Wallet Ranking Update: Address Poisoning and AI-Assisted Reviews

Today, we’re releasing the testing results for Round 4 of Coinspect’s Wallet Security Ranking.

Wallet features differ across browser extensions, Android, and iOS, so we evaluate each platform independently. This round includes 19 browser extensions, and we will publish mobile results once their testing and review cycle is complete.

In this round, we dedicated additional time to improve our testing methodology and tools. This edition was completed with a more precise methodology and new versions of our testing software. Thanks to the improved process and the introduction of AI-assisted review, we uncovered inconsistencies in previous evaluations. Correcting them led to score and ranking changes even if the wallets themselves had not changed.

Since the previous round, we’ve:

• Redesigned the testing dApp around a guided, reproducible wizard.
• Improved address checksum checks.
• Expanded our malicious address detection checks to include address poisoning.
• Expanded token spam detection to cover both tokens and NFTs.

Our goal remains unchanged: to provide transparent, objective security benchmarks that help users choose safer wallets and encourage teams to raise Web3 security standards.

Round 4 Introduces AI-Assisted Evidence Reviews

During Testing Round 4, every completed wallet test was reviewed with the support of an AI agent built into our testing software. For each check, the agent receives the selected result, the tester’s comment, and the submitted screenshots, and compares them against the requirements defined in checks.json from our open-source WSR repository.

The agent analyzes whether the required evidence is visible in the screen captures and whether the selected result is consistent with both the comment and the screenshots. It then assigns a confidence score to the review.

This confidence score does not affect the wallet’s security score. It indicates how clearly the available evidence supports the submitted result, helping us identify checks that may require additional evidence, a clearer screenshot, or closer review.

The agent supports the review process but never makes the final decision. Every result is ultimately validated by a human reviewer.

Round 4 Adds Address Poisoning Coverage

Round 4 expands our existing malicious-address check to include address poisoning, a form of recipient manipulation that may not be detected through conventional address reputation data.

In an address-poisoning attack, an attacker creates a lookalike address that often matches the first and last characters of a legitimate recipient. The attacker then introduces it into the victim’s transaction history. The goal is for the user to copy the attacker-controlled address when making a future transaction.

Both testing scenarios involve malicious recipients, but the signal available to the wallet is different. A previously flagged address can be identified through threat-intelligence data, while a newly created poisoning address must be recognized from its transaction context and deceptive similarity to a legitimate recipient.

A wallet receives full credit if it protects users in both scenarios, partial credit if it covers only one, and no credit if it covers neither.

Methodology and Tooling Updates

The Testing Wizard

Our redesigned testing dApp now implements a guided wizard that walks testers through each check in the ranking.

Every flow is linked to its canonical criterion and displays the steps, parameters, RPC method, chain, and dApp version used during execution. The wizard automatically documents each run using the same source of truth that drives the test, keeping the displayed parameters and generated evidence aligned with the check being executed.

After each interaction, the wizard records the wallet’s response and execution context as structured evidence. This allows anyone to reproduce the flow, inspect the exact inputs, and compare the observed behavior against the published methodology.

The wizard documents what happened, but it does not replace human review or automatically assign a pass or fail result. Checks that depend on the wallet’s interface still require manual observation.

Improved Address Checksum Checks

Address checksums help detect when a recipient address may have been mistyped or manipulated before a transaction is signed. A wallet should warn the user or block the operation when the checksum is invalid, reducing the risk of funds being sent to an incorrect or attacker-controlled address.

We test checksum validation in two ways: by submitting a transaction request through the testing dApp and by entering the recipient directly in the wallet. Previously, the dApp rejected the invalid-checksum address before the request reached the wallet, while the wallet-initiated scenario could still be evaluated correctly.

The updated flow now allows both scenarios to execute end-to-end. If a wallet silently normalizes the invalid address and allows the transaction to continue, the check fails.

Malicious Address Detection

The existing malicious-address check now also covers an address-poisoning scenario, without changing its total weight.

Token and NFT Spam Detection

The previous methodology focused primarily on spam NFTs. The updated check also includes spam ERC-20 tokens.

To fully pass the check, a wallet must protect users from both spam NFTs and ERC-20 tokens. If it protects users from spam NFTs but not spam tokens, or vice versa, it no longer receives full credit.

Wallets Not Evaluated in This Testing Round

Four browser extensions from the previous testing pool were not included in this release:

• Tomo and Frame were not retested since their extension versions had not changed since the previous testing round (November 2025). Their latest available versions remain 2.0.2 and 0.6.11, respectively.
• Ctrl Wallet was removed after the team announced that the product would be permanently discontinued as of August 3, 2026.
• Elytro shifted its focus from its browser extension to an agent-oriented wallet interface, placing it outside the scope of the ranking’s current testing methodology.

Looking Ahead

Mobile wallets will complete Testing Round 4. The second release will cover Android and iOS, applying the same updated methodology, reproducible testing flows, and AI-assisted review process.

Explore the Wallet Security Ranking and review the results. Soon, you will be able to reproduce the checks using the new Wallet Security Framework testing dApp.