Address Poisoning on TON: RedotPay Users Targeted

If you top up a crypto card such as RedotPay with USDT on the TON network, you may have noticed something odd: minutes after a real deposit, a tiny "dust" transfer shows up in your history from an address that looks almost exactly like the one you just used. That is not a coincidence. It is address poisoning, and it is aimed at the single habit almost everyone has: copying a recipient from recent transactions.

What address poisoning is

Address poisoning does not hack your wallet or steal your keys. Instead, the attacker plants a lookalike address in your transaction history and waits for you to make a mistake. The next time you need to send to the same place, you open your history, see an entry that looks right, copy it — and send your funds to the attacker.

It works because wallets shorten long addresses to fit on screen. A TON address is 48 characters long, so wallet apps typically show only the first and last few characters, like UQCh…t9K. If two addresses share the same beginning and end, they look identical at a glance.

A real example: RedotPay deposits on TON

RedotPay is a crypto card and payments app that gives every user a personal TON deposit address for USDT. Our team saw the same pattern repeatedly on one of these RedotPay deposit addresses: every time USDT was deposited, a wallet with a lookalike address sent a dust transfer within minutes. Here is the real RedotPay deposit address next to two of the poisoning addresses (middle characters masked for privacy):

	Address (shortened)
Real RedotPay deposit address	UQCh…EWEZpt9K
Poisoning address #1	UQDa…mTIQit9K
Poisoning address #2	UQBu…ds5Vot9K

All three start with UQ and end with t9K. In a wallet that shows "UQ…t9K", they are indistinguishable.

The UQ prefix is free for the attacker: every non-bounceable TON wallet address starts with it. The real work is the tail. Attackers generate huge numbers of key pairs until one produces an address ending in the same characters as yours, then send a near-zero transfer so it lands in your history right next to the genuine deposit. Because the dust arrives minutes after a real deposit, this is automated — bots watch the chain for transfers to busy deposit addresses and poison every sender they see.

To be clear, this does not mean RedotPay was hacked or that its systems are compromised. Address poisoning targets the users of any popular service whose deposit addresses are visible on-chain. RedotPay users are a natural target simply because many of them deposit on TON regularly, and a single copied address is enough to lose a deposit.

How to protect yourself today

• Never copy a recipient from transaction history. Always take the deposit address from the official app or website of the service you are paying.
• Compare the middle of the address, not just the start and end. Poisoned addresses almost never match in the middle.
• Save trusted recipients in your wallet's address book or contacts, and send from there.
• Ignore unexpected tiny transfers. They are bait, not payments.
• For large amounts, send a small test transaction first and confirm it was credited.

These habits help, but they all depend on people being careful every single time. The real fix is to stop asking people to handle 48-character addresses at all.

The structural fix: send to a name, not an address

On TON, a .ton domain is a readable name such as alice.ton whose wallet record points to an address. When you type the name into a wallet that supports TON DNS, such as Tonkeeper, the wallet looks up the current wallet record on-chain and sends there.

This defeats address poisoning for a simple reason: an attacker cannot create a lookalike of a name you type yourself. They can grind an address that ends in "t9K", but they cannot make alice.ton resolve to their wallet — only the owner of the domain can change its records, by signing a transaction. And there is nothing to copy from history: you type the name every time.

What payment apps can do: a .ton deposit gateway

Services like RedotPay can go further and give all their users one name to pay. The idea is to point a single brand domain — for example redotpay.ton — at a gateway smart contract, then route each incoming deposit to the right customer account. Two routing options cover most cases:

1. Registered sender address. A user registers their sending wallet once in the app. Every later deposit from that wallet to the brand name is credited to their account automatically.
2. Memo or comment. The user adds their account ID (or, later, a username) as the transaction comment, and the gateway routes the deposit to that account — the same pattern many exchanges already use with memos.

Mistakes still need a safety net. If a deposit arrives with a wrong ID or from an unregistered wallet, the gateway can hold the funds and ask the user to send a signed message from the same wallet referencing that transaction. The service matches the proof and credits the correct account, so nobody is left stranded and nothing is sent back to a guessed address.

The result is a deposit flow with no long address to copy, nothing in history for an attacker to imitate, and a brand name users can recognise.

We have notified RedotPay

We have reported this attack pattern to RedotPay, including the example addresses above, and shared the gateway design as a possible fix. As a courtesy, Namespace registered redotpay.ton and has offered to transfer it to RedotPay at no cost, so the name is ready if they choose to use it — and stays out of the hands of anyone who might abuse it in the meantime.

Until a name-based deposit flow is in place, RedotPay users should follow the habits above: always take the deposit address from the RedotPay app, never from transaction history, and check the middle characters before sending.

Set up your own .ton name

You do not need to be an exchange to benefit. If people pay you in gram or USDT on TON, give them a name instead of an address:

1. Search for your name on Namespace and check it on .ton, .eth, .sol and Telegram usernames at once.
2. Register it, or bid on it in a live TON domain auction.
3. Open the domain page, connect your wallet and set the wallet record to the address you want to receive funds at.
4. Share the name — and tell the people who pay you to type it, not copy an old transaction.

A .ton domain has no yearly fee; updating any record once a year keeps it active. To learn more about how TON names resolve, see Learn TON DNS.