The best fraud response is the transfer that never happens. Address-poisoning and look-alike drainer attacks seed a victim's history with a wallet that copies a trusted counterparty, matching its first and last characters, so the next copy-paste sends funds to the attacker. Our verify-recipient API catches it at the send screen.
Before a transaction is signed, send the payer and the destination. We compare the recipient against the payer's real transaction history and its on-chain activity, then return a verdict your app can act on.
POST /api/pre-send/verify-recipient { "payer": "0x9c4f…a71b", "recipient": "0x441c…9c7e", "chain": "ethereum" } // response { "verdict": "block", "reason": "lookalike-of-trusted", "lookalikeOf": "0x441c…3fdf", "recipient": { "txCount": 2, "fresh": true }, "paidBefore": false }
No score to interpret. Allow lets the payment through, warn shows a confirmation, block stops it. You decide how each maps to your UX.
The recipient is a wallet the payer has paid before, or an established counterparty with real history. Let it through.
The recipient resembles a trusted address but has real activity of its own. Show a confirmation before the send.
A fresh wallet that copies a trusted counterparty's first and last characters and was never paid before. Stop the send.
The detector follows the payoff-confirmation model from peer-reviewed on-chain phishing research (arXiv:2501.16681): a wallet is only a confirmed threat when the same look-alike first baited the victim and then received a payment, not merely when two addresses share a prefix.
Flags addresses that copy a counterparty's leading and trailing characters, the copy-paste trap.
Catches fake tokens that borrow a real symbol from a contract that is not the legitimate one.
Weighs the recipient's real activity, so an established vendor is never mistaken for a drainer.
Apply for the pilot cohort. One endpoint, one verdict, no drainers. We respond within 48 hours.