Check every address: address poisoning and test transactions

A crypto address is a long string of letters and numbers that works like an account number. When you send coins to the wrong address, there is usually no way to undo it. Blockchains do not have a cancel button. That makes careful checking one of the most important habits you can build.

Why people only check the start and end

Addresses are long, so most people glance at the first few and last few characters. Wallets often shorten them on screen, too. Attackers know this habit and exploit it.

Address poisoning

In an address poisoning attack, a scammer creates an address that starts and ends with the same characters as one you use often. They then send a tiny or zero-value transaction from that look-alike address to your wallet. Now the fake address appears in your transaction history.

Later, you want to send funds to your usual address. You open your history, copy the most recent entry and paste it. Without noticing, you copied the scammer's look-alike, and the funds go to them.

Safe address habits

• Never copy addresses from your transaction history. Use a saved address book entry, or copy directly from the official deposit page of the receiving wallet or exchange.
• Check the whole address, including the middle. Compare it in chunks of four or five characters.
• Watch for clipboard malware. Some viruses swap the address in your clipboard for the attacker's. Always compare the pasted address with the original.
• Confirm on the device. With a hardware wallet, read the address on its screen, not just on your computer.
• Check the network. The same token may exist on several blockchains. Sending on the wrong network can mean the funds never arrive.

The test transaction

Before you send a large amount to a new address, send a small test transaction first. Wait until it arrives and the receiver confirms it. Then send the rest.