Address poisoning does not break any cryptography or exploit any contract. It exploits the habit of copying an address from a recent transaction list.
Addresses are long and get abbreviated
A blockchain address is a long string that nobody reads in full. Interfaces display the first few and last few characters with the middle omitted.
Users verify by checking those visible characters, which is an entirely reasonable behavior given that reading forty hexadecimal digits is impractical.
The abbreviation is the weakness. Two completely different addresses can share their visible portions while differing everywhere in between.
Matching addresses can be generated
Attackers run software that generates addresses repeatedly until one matches the leading and trailing characters of a target address. This is computationally cheap for short prefixes.
The generated address is a normal address whose private key the attacker holds. It has no relationship to the original beyond visual similarity.
Because the middle is never shown, the two look identical in any interface that abbreviates. The deception requires no technical exploit.
The poisoning step plants the entry
The attacker sends a transaction from the lookalike address to the victim, typically transferring zero or a negligible amount of a token.
The transaction is valid, so it appears in the victim's history alongside genuine activity. Nothing distinguishes it visually from a real interaction.
Some variants use token transfer events that let the attacker make the transaction appear to come from the victim's own frequent counterparty.
The loss happens later
When the victim next sends funds to that counterparty, they scroll their history, recognize the familiar-looking address and copy it.
The funds go to the attacker, and the transaction is final. Blockchain transfers cannot be reversed by any party once confirmed.
The delay between poisoning and loss is what makes the attack effective. By the time the transfer happens, the planted entry looks like ordinary history.
Defenses are procedural rather than technical
The reliable habit is never copying an address from transaction history, and instead using a saved address book entry created when the address was first verified.
Verifying more characters helps, and verifying through a second channel helps more. Sending a small test transfer before a large one confirms the destination.
Wallet software increasingly flags zero-value transfers and warns about lookalike addresses, but the discipline of using a saved contact remains the actual protection.