Address poisoning.

A blockchain address is a long string no one memorizes. To send funds, people copy an address, often from an earlier transaction in their history. Wallets show only the first and last few characters, so an address is recognized by its ends.

Address poisoning turns that habit into the attack. The attacker sends a tiny transfer from an address whose first and last characters match one you use often. It lands in your history looking like a familiar contact, and next time you copy that poisoned entry after glancing at the ends.

The signature is valid and the network does exactly what it is told. The mistake happens before signing, when a person reads a shortened string and treats it as the full address.

Funds sent on-chain cannot be reversed, so an address confirmed only by its ends trusts the very part an attacker can reproduce.