How a link is recycled
This is the most dangerous state an address can be in, and the one that looks most like everything being fine.
What a retired address is worth
Consider what an address that served for two years has that a new phishing domain does not. It is in old forum posts, archived pages, directories nobody maintains, browser bookmarks and screenshots. People recognise it. Some recognise it well enough to skip checking, because it looks like the one they have always used.
Whoever answers at that address inherits every bit of that for free. No ranking to build, no credibility to establish, no need to convince anyone of anything. They wait for traffic that was already heading there, and the traffic that arrives is disproportionately people who trust the address because they remember it.
Being precise about the mechanism
Two different things get called recycling and only one of them is actually possible.
- Taking over the exact address. Requires the private key, since the address is derived from it. This does not happen absent a key compromise, and a key compromise is a much larger event than a phishing page.
- Standing up a near miss. Generating an address matching the first several characters, which costs almost nothing, and letting the middle differ. This is what you will actually encounter.
The second is what people mean when they say an old address came back. It did not come back. Something that resembles it enough to pass a glance is now answering, and the resemblance was manufactured cheaply and deliberately.
Why it defeats experienced users
Because every heuristic short of a signature check returns a positive result. The address is recognised. The page loads, usually faster than the real platform, since a clone carries no load and runs no defences. The interface matches, because it was copied. Nothing about the experience feels wrong.
And the people it reaches are the ones who have used the platform longest without incident, because those are the ones with old addresses saved and the strongest sense that they know what they are doing. Familiarity is doing all the work, and familiarity has never been evidence of anything.
The defence
- Delete retired addresses rather than archiving them. An address kept for sentimental reasons is one you might paste on a distracted evening.
- Never treat an address answering again as recovery. That event does not occur in the legitimate direction.
- Check the middle of any address you did not paste from a current roster, since that is where a near miss differs.
- Verify the signature on arrival, which is the only step that catches this regardless of how convincing everything looks.
The last one is the only one that works alone. Everything above reduces how often you land somewhere wrong. The signature is what tells you when you have.