Address mistakes

Nobody types an address wrongly. They copy the right-looking one — from their own history, from a page that was rewritten, from a message. The result is identical and final.

Addresses are long strings nobody reads. Everybody copies and pastes, and every attack in this family exploits the same thing: the moment between the copy and the paste, and the fact that people verify by glancing at the ends.

Address poisoning

You receive a tiny, worthless transfer from an address that begins and ends with the same characters as one you use regularly. It costs the sender almost nothing to generate — addresses with a chosen prefix and suffix can be brute-forced cheaply.

The transfer is not the attack. Its purpose is to sit in your transaction history, so that the next time you send to that familiar counterparty and copy the address out of your own history, you copy theirs. The middle characters differ; nobody looks at the middle.

Clipboard swapping

Malware that watches the clipboard for something shaped like an address and replaces it with the attacker's, in the instant between copy and paste. It has existed for over a decade, it is trivial to write, and it is one of the standard payloads in cracked software and pirated installers.

The defence is mechanical rather than clever: after pasting, compare the pasted string against the source. Not the ends — the whole thing, or at minimum a run of characters from the middle as well as both ends.

The wrong network

A different failure with the same feeling. The address format is valid on several networks, so the transfer succeeds — on a chain the recipient does not watch. What happens next depends entirely on who controls the destination, and it is covered fully in what happens if you send to the wrong network and in networks and addresses.

The short version: funds sent to an address you control on an unexpected chain are usually retrievable with effort; funds sent to an exchange's address on a network it does not support are a support ticket with an uncertain answer; funds sent to a contract that cannot move them are gone.

Habits that make this nearly impossible

1. Send a test amount firstFor anything meaningful, and for every new destination. The fee is the cheapest insurance available anywhere in this subject.
2. Use whitelists and saved contactsMost exchanges let you name and lock withdrawal addresses, often with a delay before a new one becomes usable. That delay is the feature.
3. Verify on the device that signsA hardware wallet shows the destination on its own screen. It is the one display an infected computer cannot rewrite — which is the whole point of what "offline" really means.
4. Check the middle, not just the endsOr paste it into the address checker to see which network the format belongs to and whether its checksum holds. Or better still: paste it into the search field of a block explorer and confirm it is the account you expect before sending anything to it.
5. Never take an address from a chatMessages get edited, accounts get impersonated, and a pinned deposit address is a classic. Get it from the source you logged into.

If it already went to the wrong place

There is no cancel and no reversal, but there is a difference between "wrong chain" and "wrong owner", and the first is often fixable. Work through it here before doing anything else — and treat any offer of help that arrives afterwards as the second scam, because it is.