Security Alert: Users Should Beware of “Address Poisoning” Attacks During Periods of Concentrated Withdrawals

At 14:00 (Beijing Time) on November 1, 2026, Binance officially initiated the phased restoration of its withdrawal service—marking the first such step since suffering the largest theft in cryptocurrency history. The rollout began gradually for users starting November 2. Following the reactivation of withdrawal channels, some users swiftly moved their assets from the platform to personal cold wallets to strengthen control and custody autonomy.

However, the initial phase after withdrawal functionality resumes has historically been a peak period for “address poisoning” attacks. Attackers precisely target publicly visible on-chain addresses—or addresses that recently conducted transactions—and flood them with high-frequency “poisoning transactions.” In these transactions, the fake recipient addresses are carefully crafted so that their first and last four hexadecimal characters match the user’s real address exactly, making the entire address appear nearly identical at a glance. This deception is designed to trick users—especially under time pressure—into copying the wrong address from their wallet’s transaction history, or into having the middle portion of the address silently altered by clipboard-hijacking malware already installed on their device.

Reminder: When initiating withdrawals from an exchange, users must manually verify *all 42 hexadecimal characters* of the destination address—character by character—and perform this full verification independently at least two to three times. Do *not* rely on auto-fill from transaction history, recent-address lists, or any pre-stored content in your system clipboard.