HexFence Try HexFence

Address poisoning · Account enforcement

A familiar address.
A different recipient.

Address poisoning puts lookalike addresses into your transaction history. A tiny or zero-value transfer can make the wrong recipient look familiar when you copy an address for your next payment.

HexFence finds poisoning on Ethereum, warns you before you sign, and refuses the lookalike on-chain.

Check a paymentBrowse the evidence
Watch one lookalike payment fail: the guided demo

What the evidence shows

Published Arkiv records. Every record is labelled suspected.

How it works

A warning can be clicked through. The Guard can’t. Open evidence powers the warning; an on-chain rule makes the final call.

  1. 01 Observe

    Detector

    Reads Ethereum mainnet USDT and USDC transfer logs for address-poisoning patterns.

  2. 02 Publish

    Arkiv evidence

    Publishes open records anyone can re-check against Ethereum, each labelled suspected.

  3. 03 Explore

    Evidence explorer

    Browse suspected records and inspect their linked Ethereum receipts.

  4. 04 Compare

    Address X-Ray

    Read the full recipient in groups of four, with matching and different groups highlighted.

  5. 05 Check

    HexFence Pay verdict

    Checks every recipient in your browser against your approved payees and the public evidence, before you sign.

  6. 06 Enforce

    HexFenceGuard

    Refuses a payment to any different address that shares an approved payee’s fingerprint, directly on your Safe.

One suspected case, end to end

A single documented case: Ethereum mainnet, 6 Nov 2026, times in UTC. It is not part of the counts above.
Suspected. An investigative lead, not a confirmed loss.

  1. 02:02

    The account pays a recipient

    117.34 USDT, its second payment to this address that morning.

    View on Etherscan 0x28fdf0f9…811d84
  2. 02:17

    A different sender adds a lookalike

    Its transaction records a 0 USDT transfer from the account to an address with the same first 4 and last 4 characters.

    View on Etherscan 0x9e9c9d9b…7f4e63
  3. 04:14

    The account pays the lookalike

    303.635007 USDT is sent to the lookalike.

    View on Etherscan 0x6fe839c1…606bac
  4. 04:16

    The lookalike forwards it on

    All of it moves to another address.

    View on Etherscan 0x7b4d3a68…d0a48e

Try it

See the evidence. Inspect a payment.

Payment client · Sepolia

Check before you sign.

HexFence Pay brings approved payees, suspected evidence and the Guard’s resemblance rule into the payment flow.

Open HexFence Pay

Try it right now: open the live preview on our demo Safe: real verdicts in your browser, no wallet needed. Ready to send? Connect a Sepolia wallet and a Safe with HexFenceGuard enabled.

Public evidence · Ethereum mainnet

Inspect the suspected patterns.

Browse records from the Arkiv publisher, search addresses and inspect the linked Ethereum transactions.

Open evidence explorer

Nothing to install: no wallet, no account, no backend. Your browser loads the published records. Check any address privately: the check runs on your own machine.

Built to stop the wrong payment.

  • Every common payment, checked twice. ETH payments and token transfer / transferFrom calls are checked before you sign and again at execution.
  • Hidden calls stopped. The Guard refuses delegatecall, so a payment can’t be tucked inside a batch.
  • Lookalikes refused on-chain. Same first 4 and last 4 characters as an approved payee, different address: the Guard reverts the payment.
  • Other calls are not checked. HexFence checks only ETH and ERC-20 transfers; anything else shows “cannot verify”.
  • Private by design. Recipients are compared in your browser, never looked up on a server, and Safe reads go through the Nox mixnet by default.

Inspect the work yourself.

Each link below is a public record, including the Guard refusing a test payment to an address that resembles your approved payee.

Guard on Sepolia Blockscout 0xA061fB511D69e5c92E50E3BE5c789472d6f19748 Guard refusal on Sepolia 0xa43b0eeef7253281a741deca144e5ddf0c465da9cc6f48d54673a9aa9c0f6d8f Arkiv publisher · Rabdi testnet 0x36141ba063390f0d91Af7a5a9dF8dc1d80D699ecInspect this publisher’s suspected records in the explorer. GitHub repository Source, run instructions and recorded test results.