DEV Community: cryptostrapon

Address poisoning: the scam that never hacks you (plus a 15 line check for your own app)

cryptostrapon — Thu, 29 Oct 2026 14:00:00 +0000

In December 2025 a trader withdrew almost 50 million USDT from Binance to move it to their own wallet. They did the careful thing first: a 50 USDT test transfer to the right address. It arrived.

Twenty six minutes later the full 49,999,950 USDT went to a different address. That address matched the real one in its first five and last four characters. The attacker swapped the funds to DAI, then ETH, and most of it went into Tornado Cash (The Block).

Nothing was hacked. No key leaked, no contract was approved. And on 28 October Scam Sniffer flagged another user who lost about $50,000 the same way. The attack is called address poisoning, and it works because of how our interfaces show addresses.

How it works

A bot watches the chain for transfers, including small test sends.
It generates a vanity address whose start and end match the address you just paid. This is cheap: matching a few characters at each end takes minutes on a single GPU.
It sends you a zero value or dust transfer from that look-alike. Now it sits in your history, right next to the real entry.
You come back to finish the payment, open your history, copy what looks like the same address, and send.

The test transfer did not protect the trader. It was the signal the bot needed: it told the attacker which address to imitate.

Why the UI makes it easy

Wallets and explorers shorten addresses to 0x1234...abcd. People check the start, maybe the end, and stop. So "the start and end match" proves nothing. The only part an attacker cannot cheaply copy is the middle, and that is the part we hide.

A check you can add in 15 lines

If you build a wallet, a payment form, a treasury tool or an internal payout script, you can warn before the user signs:

// Warn when a recipient looks like a known address but is not the same one.
function normalize(addr) {
  return addr.trim().toLowerCase().replace(/^0x/, "");
}

export function lookalikeOf(recipient, knownAddresses, edge = 4) {
  const r = normalize(recipient);
  if (knownAddresses.some(k => normalize(k) === r)) return null; // exact match: fine
  for (const known of knownAddresses) {
    const k = normalize(known);
    const sameStart = r.slice(0, edge) === k.slice(0, edge);
    const sameEnd = r.slice(-edge) === k.slice(-edge);
    if (sameStart && sameEnd) return known;         // looks the same, is not
  }
  return null;
}

Use it with the addresses the user really trusts: their address book, saved withdrawal addresses, and addresses they sent real value to before.

const twin = lookalikeOf(recipient, addressBook);
if (twin) {
  showWarning(
    `This address looks like ${twin} from your contacts, but it is a different address. ` +
    `Copy the recipient from the original source, not from history.`
  );
}

Three cheap upgrades make it much stronger:

Show the middle. Before signing, display the full address and highlight the characters between the first and last four. That is where the difference is.
Distrust dust senders. If the recipient only ever appeared in history through a zero value or tiny incoming transfer, say so. Real counterparties rarely introduce themselves that way.
Hide or mark zero value transfers in the history view, so poisoned entries are not one click away.

The check is deliberately simple. It does not decide who is honest. It only catches the one moment the attack depends on: copying something that looks familiar.

What users can do today

Never copy a recipient from transaction history. Take it from the original source: the invoice, the exchange deposit page, the person.
Save trusted addresses once, after checking them in full, and send only from the address book or a withdrawal whitelist.
After a test transfer, copy the address again from the same original source, not from the history that now shows two similar entries.
Compare the middle of the address, not just the ends.

We keep a short practical guide on this: how to check an address before you send.

Question for you: if you build wallets or payment tools, do you hide zero value transfers in history, or show them with a warning? I am curious which one users actually understand.

If this was useful, a star on crypto-scam-glossary, our open glossary of scam patterns, helps other developers find it.

Written with AI assistance and fact checked by the CryptoStrapon team.

Git hooks in a zip: the attack that never touches npm install

cryptostrapon — Mon, 26 Oct 2026 14:00:00 +0000

Last week we covered the npm side: install hooks that run on the first npm install. This post is about the part we did not cover, git itself.

A write-up published last week by Wisnu Rasyidin Azhari shows a variant that skips npm completely: a "recruitment documents" repo, sent as a zip, with 22 identical hooks in .git/hooks. Each one downloaded a script for your OS and piped it into a shell, quietly, in the background.

The trigger was not a build. It was git pull, git checkout or git commit. The things you do without thinking.

Why this works

Git hooks are scripts in .git/hooks that git runs on its own at certain moments. Two facts make them a good trap:

They run without asking. No prompt, no output if the script sends it to /dev/null.
They never travel through git clone. Hooks are not part of the repository history. So the attacker cannot put them on GitHub. They have to send you the whole folder: a zip, a cloud drive link, "the project archive".

That second fact is your best signal. A recruiter who sends a zip that still contains the .git folder, instead of a link to clone, is a red flag on its own.

The same delivery trick works for a few neighbours of hooks:

Where	What runs	When
`.git/hooks/*` (no `.sample`)	any script	commit, checkout, pull, merge, push
`.git/config` `core.hooksPath`	hooks from another folder	same as above
`.git/config` `core.fsmonitor`	any program	even `git status`
`.git/config` aliases with `!`	shell command	when you use the alias
`.vscode/tasks.json` with `"runOn": "folderOpen"`	any task	when you open the folder in VS Code

The last one is different: .vscode can be committed, so it also arrives through a normal clone. VS Code asks whether you trust the folder first. Say no.

The 5 second check

Before any git command in a folder someone sent you:

# real hooks are anything that is not a .sample file
find .git/hooks -type f ! -name "*.sample"

# config entries that make git run programs
grep -nE "hooksPath|fsmonitor|sshCommand|pager|editor|= *!" .git/config

# VS Code tasks that start on open
grep -n "folderOpen" .vscode/tasks.json 2>/dev/null

On a fresh repo the first two print nothing interesting. If you need to run git anyway, switch hooks off for that command:

git -c core.hooksPath=/dev/null status

We added this to npm-install-audit

npm-install-audit is our small read-only Node script for unknown repos. Version 1.1 now checks .git/hooks, risky .git/config entries and VS Code folderOpen tasks, next to the npm install hooks it already flagged:

$ node audit.js ./take-home
! .git/hooks/post-checkout: active git hook, runs automatically on git commands, downloads and runs code
! .git/config: core.hooksPath points git hooks to another folder: hooksPath = .githooks
! .vscode/tasks.json: VS Code task runs when the folder is opened

3 finding(s). Read them before you run npm install or any git command.
Tip: git -c core.hooksPath=/dev/null <command> runs git without repo hooks.

One file, no dependencies, no network. It ignores .sample hooks, so a normal clone stays clean. It will flag husky, because husky sets core.hooksPath too. Read the finding and decide.

A clean result is not proof of safety. The payload in these attacks lives on the attacker's server and can change any time, so the throwaway VM habit from last week's post applies here too.

If you already ran git in that folder

Treat the machine as compromised. From a clean device, change passwords, revoke tokens and SSH keys, and move any crypto to a new wallet created on that clean device. Then wipe and reinstall. The full list, plus the indicators from the original case, is in Wisnu's write-up.

Question for you: which of these did you already know about: core.fsmonitor running a program on a plain git status, or VS Code tasks that start when a folder opens? And do you check .git/hooks before running git in a folder you did not clone yourself?

If npm-install-audit is useful, a star on GitHub helps other developers find it: https://github.com/cryptostrapon/npm-install-audit

More scam breakdowns and free tools: https://cryptostrapon.com?utm_source=devto&utm_medium=article&utm_campaign=git_hooks

Read what you sign: 5 function selectors that should make you stop (with a small decoder)

cryptostrapon — Thu, 22 Oct 2026 11:12:28 +0000

When a dapp asks you to confirm a transaction, the wallet shows a summary. The raw data field is where the truth is, and its first four bytes (the function selector) say what is being called.

Here are selectors worth recognising on the Ethereum virtual machine:

Selector	Function	Why it matters
`0x095ea7b3`	`approve(address,uint256)`	Lets a spender move your token. "Unlimited" amounts are the risky part
`0xa22cb465`	`setApprovalForAll(address,bool)`	Lets an operator move all your NFTs of a collection
`0x39509351`	`increaseAllowance(address,uint256)`	Same idea as approve, added on top of an existing allowance
`0x23b872dd`	`transferFrom(address,address,uint256)`	Moves tokens using an allowance. Normal for swaps, a red flag if you did not start a swap
`0xa9059cbb`	`transfer(address,uint256)`	A plain send. Check the recipient

A small decoder (17 lines)

const WATCH = {
  "0x095ea7b3": "approve: gives a spender permission to move your tokens",
  "0xa22cb465": "setApprovalForAll: gives an operator access to ALL your NFTs in a collection",
  "0x39509351": "increaseAllowance: raises a spender's permission",
};

function explain(data) {
  const selector = data.slice(0, 10).toLowerCase();
  if (!WATCH[selector]) return null;
  const MAX = (1n << 256n) - 1n;
  let note = WATCH[selector];
  if (selector === "0x095ea7b3") {
    const amount = BigInt("0x" + data.slice(74, 138));
    if (amount === MAX) note += " (UNLIMITED amount)";
  }
  return note;
}

It reads the first four bytes and, for approve, checks if the amount is the maximum possible value (all bits set). Use it in a wallet UI, a browser tool or an internal review step.

What to do as a user

An approval is not a payment. Ask: why does this site need permission to move my tokens?
Prefer exact amounts over "unlimited" when the interface lets you choose.
Revoke approvals you no longer use. Open source tools and block explorers can list them.
If you did not start a swap, mint or claim, any transferFrom or approval request is suspicious.
A hardware wallet shows less detail on small screens, so read carefully and never approve something you cannot explain.

Follow for more plain-language scam breakdowns and open tools from CryptoStrapon. Everything we publish is free and open (MIT code, CC BY 4.0 content).

Not sure about a message, link or token? Free checker, no sign-up: https://cryptostrapon.com/scam-detector?utm_source=devto&utm_medium=article&utm_campaign=selectors

Test yourself with the open quiz (50 core scenarios here, 104 on cryptostrapon.com/scam-quiz): https://cryptostrapon.github.io/crypto-scam-quiz/

If the quiz or this decoder is useful, a star on GitHub helps other people find it: https://github.com/cryptostrapon/crypto-scam-quiz

You got a take-home test from a recruiter. You have 5 minutes before npm install

cryptostrapon — Tue, 20 Oct 2026 07:30:00 +0000

A recruiter likes your GitHub. The pay is 20 to 40 percent above market, the call goes well, and then comes the take-home: clone the repo, run npm install, finish it in 48 hours.

That last step is the whole attack. Nobody hacked you. You ran the malware yourself.

This is a real campaign

Researchers call it Contagious Interview and link it to North Korea. Socket counted 338 malicious npm packages and about 50,000 downloads as of October 2025. A newer wave, PolinRider, covers 108 malicious packages and extensions, and 1,951 public GitHub repositories were compromised as of April 2026.

What they take

Not your project files. Your wallet data, browser sessions and saved logins, SSH keys and cloud credentials, and tokens from .env files. One take-home can become a company breach.

How it works

npm install runs a postinstall hook with your permissions before you have read anything. A hidden payload decodes itself, searches browser profiles and config folders, and sends what it finds to the attacker. You see no error, and the project may even run.

The tells, before you clone anything

The message: pay far above market, your own GitHub quoted back to you, a recruiter with few connections, a quick move to Telegram or Discord.
The call: the camera is "broken", the face looks off, or you are asked to run the project live on screen share.
The task: a deadline built to stop you reading, a private repo from an organization with no history, "just run npm install", a request to turn off antivirus.

One tell alone proves nothing. Several together are a pattern, so slow down.

Check the message, then the repo

Paste the recruiter's message into our free AI scam detector (our project, disclosed because it is ours) and it lists the red flags it finds. It reads text for patterns and cannot confirm who is behind an account.

Then check the repo. This script only reads files: it lists install hooks and flags shell commands, hidden base64, long encoded strings and paths to wallet, browser and key data. It never runs the project and never touches the network. It is also in a small MIT repo with a self test: github.com/cryptostrapon/npm-install-audit.

#!/usr/bin/env node
// npm-install-audit: look before you run.
// Usage: node audit.js ./some-repo
// Read only, no network, no dependencies. A clean result is not proof of safety.
const fs = require("fs");
const path = require("path");

const target = process.argv[2] || ".";
let root;
try {
  root = path.resolve(target);
  if (!fs.statSync(root).isDirectory()) throw new Error("not a directory");
} catch (e) {
  console.error("Cannot read directory: " + target);
  process.exit(2);
}

const HOOKS = ["preinstall", "install", "postinstall", "prepare"];
const SKIP_DIRS = new Set([".git", "node_modules"]);
const RISKY = [
  [/child_process|execSync|execFileSync|spawnSync|\bspawn\(/, "runs shell commands"],
  [/\beval\(|new Function\(/, "evaluates code at runtime"],
  [/\batob\(|Buffer\.from\([^)]*base64/, "decodes base64 at runtime"],
  [/(curl|wget)\s[^\n]*\|\s*(sh|bash)/, "pipes a download into a shell"],
  [/Login Data|keystore|wallet\.dat|\.ssh[\/\\]|id_rsa|\.aws[\/\\]credentials|Local Storage[\/\\]leveldb/i, "touches key, wallet or browser data paths"],
];

let findings = 0;
const flag = (file, msg) => {
  findings++;
  console.log("! " + path.relative(root, file) + ": " + msg);
};

function checkPackage(file) {
  let pkg;
  try { pkg = JSON.parse(fs.readFileSync(file, "utf8")); }
  catch { flag(file, "package.json could not be parsed, read it by hand"); return; }
  for (const h of HOOKS) {
    if (pkg.scripts && pkg.scripts[h]) flag(file, h + " hook runs: " + pkg.scripts[h]);
  }
}

function checkSource(file) {
  let text;
  try { text = fs.readFileSync(file, "utf8"); } catch { return; }
  for (const [re, why] of RISKY) if (re.test(text)) flag(file, why);
  if (!/\.min\.js$/.test(file)) {
    const blob = text.match(/[A-Za-z0-9+\/=]{300,}/);
    if (blob) flag(file, "long encoded string (" + blob[0].length + " chars)");
  }
}

function walk(dir, depth) {
  if (depth > 8) return;
  let entries;
  try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
  for (const e of entries) {
    if (SKIP_DIRS.has(e.name)) continue;
    const p = path.join(dir, e.name);
    if (e.isSymbolicLink()) continue;
    if (e.isDirectory()) { walk(p, depth + 1); continue; }
    if (!e.isFile()) continue;
    if (e.name === "package.json") { checkPackage(p); continue; }
    if (/\.(js|cjs|mjs|sh)$/.test(e.name)) {
      let size = 0;
      try { size = fs.statSync(p).size; } catch { continue; }
      if (size < 2e6) checkSource(p);
    }
  }
}

walk(root, 0);
if (findings) {
  console.log("\n" + findings + " finding(s). Read them before you run npm install.");
  process.exit(1);
}
console.log("No obvious install hooks or risky patterns found. Still read the code.");

Run it on the cloned folder:

git clone <repo> task && node audit.js ./task

On a repo with a postinstall that decodes base64 and reads ~/.ssh/id_rsa, it prints:

! package.json: postinstall hook runs: node ./scripts/setup.js
! scripts/setup.js: runs shell commands
! scripts/setup.js: decodes base64 at runtime
! scripts/setup.js: touches key, wallet or browser data paths
! scripts/setup.js: long encoded string (380 chars)

5 finding(s). Read them before you run npm install.

It is a first filter, not a verdict. It cannot see code fetched after install, obfuscation it does not recognize, or VS Code task files (.vscode/tasks.json) that run code the moment you open a folder.

A safer habit

Run npm install --ignore-scripts first and read before you enable anything.
Open unknown folders in VS Code in Restricted Mode and do not click Trust.
Use a throwaway VM or container, never the machine with your wallets and browser sessions.
Verify the job on the company's own careers page.

If you already ran it, treat the machine as compromised. From a clean device, move your funds first, then rotate passwords and keys and revoke sessions.

Full write up: fake test project investigation.

Question for the comments: has a recruiter ever sent you a take-home that made you stop? What was the tell?

How "approval phishing" drains wallets without stealing a key (and how to check it in 10 lines)

cryptostrapon — Wed, 14 Oct 2026 12:10:03 +0000

Most people picture a crypto theft as "someone got my seed phrase". A large share of wallet drains we see in scam reports works differently: the victim signs one innocent-looking message, and the attacker never touches the key.

This post explains the mechanism and shows a short script that checks whether a token approval is unlimited.

What an approval is

ERC-20 tokens let you give another address (a "spender") the right to move your tokens, up to some amount. Exchanges, DEXs and games use this all the time:

You call approve(spender, amount) on the token contract.
The spender can later call transferFrom(you, anywhere, amount) without asking you again.

The risk: many dapps ask for MaxUint256 (unlimited) so you don't have to approve again. If that spender is a scam contract, or a legitimate one that later gets compromised, it can empty that token from your wallet at any time. The approval stays valid until you revoke it.

How scams use it

The pattern is simple and repeated across fake airdrop sites, fake "claim" pages and cloned mint pages:

A page tells you to "verify your wallet" or "claim your reward".
Your wallet pops up a signature or approval request. The text looks harmless, or is hard to read.
You sign. The scammer's contract now has an allowance.
Funds move later, sometimes days after, so the link to that page is easy to miss.

Off-chain signatures such as permit / Permit2 can do the same job without you paying gas for an approval transaction, which is why "it was free" is not a safety signal.

Check an allowance yourself

With ethers v6:

import { ethers } from "ethers";

const ERC20 = ["function allowance(address owner, address spender) view returns (uint256)"];

const provider = new ethers.JsonRpcProvider(process.env.RPC_URL);
const token = new ethers.Contract(process.env.TOKEN, ERC20, provider);

const allowance = await token.allowance(process.env.OWNER, process.env.SPENDER);
console.log(allowance === ethers.MaxUint256 ? "UNLIMITED allowance" : allowance.toString());

Run it with your own wallet address, the token address and the spender you want to check. An unlimited allowance to an address you don't recognise is the red flag.

What to do

Revoke approvals you don't use. Block-explorer "token approvals" pages and revoke tools let you set the allowance back to zero.
Prefer exact amounts over "unlimited" when your wallet offers the choice.
Read what you sign. If the request mentions approve, setApprovalForAll, permit or a long hex blob you can't parse, stop.
Use a separate wallet with little in it for new or unfamiliar sites.

Practice it

We turned these patterns into a free quiz: 50 core scenarios in one HTML file, no tracking (the version on cryptostrapon.com has 104). Try a few and see which ones you would have signed:

Quiz: https://cryptostrapon.github.io/crypto-scam-quiz/
Glossary of scam vectors (including approval phishing): https://cryptostrapon.github.io/crypto-scam-glossary/

Both are open (code under MIT, content under CC BY 4.0), so you can reuse or translate them. If you want a quick sanity check on a suspicious site or token, our free AI scam detector (our project) is at https://cryptostrapon.com/scam-detector?utm_source=devto&utm_medium=post&utm_campaign=approval_phishing.

An open crypto-scam quiz in one HTML file: no build step, MIT code, CC BY 4.0 content

cryptostrapon — Mon, 12 Oct 2026 21:43:21 +0000

Most scam-awareness content is a list of "red flags". It does not test whether you can apply them under pressure, so we built a quiz that does.

What it is

50 core scenarios (the version on cryptostrapon.com has 104) based on scam patterns we see in investigations: wallet drainers, approval phishing, fake airdrops, honeypot tokens, bridge exploits, AI-impersonation scams.
Four answers each, one correct, plus an explanation and a severity label.
A companion glossary of 11 scam vectors with mechanics, red flags and what to do if you were hit (the full glossary on cryptostrapon.com has 301 terms).

Live quiz: https://cryptostrapon.github.io/crypto-scam-quiz/
Glossary: https://cryptostrapon.github.io/crypto-scam-glossary/

How it is built

The whole thing is one index.html plus a questions.json. Vanilla JS, no framework, no build step, no dependencies, no tracking. It is hosted on GitHub Pages, so a fork is live in a minute.

A few small decisions that turned out to matter:

Shuffled answer positions. Our first draft had the right answer in the same slot far too often. We shuffled with a fixed seed so the distribution across the four slots is roughly even and the result is reproducible.
Generalised details. The scenarios describe the pattern, not a named victim or exact figures, so they stay accurate and do not point at specific people.
Open licensing. Code is MIT, content is CC BY 4.0, with a LICENSE-CONTENT.md so reuse terms are unambiguous for schools, wallets and newsrooms.
Citable. Each repo has a CITATION.cff and a Zenodo DOI, plus schema.org Dataset markup so it can appear in dataset search.

Reuse it

Take the JSON, translate it, embed it in a training portal, or open a PR with a new scenario. Contributions and corrections are welcome.

Source: https://github.com/cryptostrapon/crypto-scam-quiz
Maintained by CryptoStrapon, a free AI crypto-scam detector: https://cryptostrapon.com/scam-detector?utm_source=devto&utm_medium=post&utm_campaign=open_quiz

Educational resource only, not financial or legal advice.