How to verify a crypto address before you hit send

Verify a receiving address by checking it at the source, comparing the full string rather than the first and last characters, and sending a small test transaction before a large one. Crypto transfers are final: there is no bank to call, no chargeback, and no support desk that can reverse a payment to the wrong address. Verification is the only line of defence, and it has to happen before you sign.

Why is a wrong address unrecoverable?

A blockchain transaction is an instruction signed by your key and settled by the network. Once it is included in a block, no operator can rewrite it — that immutability is the point of the system. If the address you signed belongs to a stranger, the funds are theirs. If it belongs to nobody, the funds are stranded.

Exchanges are a partial exception: a deposit sent to the right exchange but the wrong network, or without a required memo, can sometimes be recovered manually by their support team, often for a fee and never with a guarantee. That is a rescue, not a right.

What is address poisoning?

An attacker generates an address whose first and last characters match one you have used before, then sends your wallet a worthless dust transaction from it. Their address now sits in your transaction history looking exactly like the one you recognise. The next time you pay that counterparty, you copy from history instead of from the source — and pay the attacker. It is the same playbook as the impersonation tricks in our guide to avoiding crypto scams, applied to your clipboard instead of your inbox.

The attack costs almost nothing to run at scale, and it targets a habit rather than a vulnerability. Nothing in your wallet has been compromised. You simply copied the wrong row.

What is clipboard hijacking?

Malware on a compromised computer or phone watches the clipboard for anything shaped like a crypto address and replaces it with the attacker's. You copy the correct address, paste it, and the field silently contains a different one. This is why the check that matters happens in the destination field, after pasting, and again on the hardware wallet screen if you use one.

What does a solid verification routine look like?

• Get the address from the source: the exchange's deposit page, the recipient's own message on a channel you trust, or a saved contact you created yourself.
• Paste it, then compare the pasted string against the source in three places — the first characters, a chunk from the middle, and the last characters.
• If you sign on a hardware wallet, read the address on the device screen. That display is not controlled by the computer, so it defeats clipboard malware.
• Confirm the network. The same string can be valid on several chains, and sending on the wrong one is a common way to lose funds.
• For exchange deposits, check whether a memo or destination tag is required. Omitting it usually means a manual recovery request at best.
• Send a small test transaction to a new destination, wait for it to arrive, then send the rest.

Once an address is verified, save it. Wallet address books and exchange withdrawal whitelists let you reuse a checked destination instead of re-verifying under time pressure — and a whitelist with a time delay on new entries means an attacker who reaches your account still cannot move funds to a fresh address immediately. Whichever wallet holds the keys, the seed phrase and recovery guide covers what happens if the device itself is lost.

Do human-readable names help?

Naming services map a readable name to an address, which removes the character-comparison problem and replaces it with a different one: you now have to trust that the name resolves to the address you expect, and that you typed the name correctly. Lookalike names, expired registrations and homoglyph characters are all used in practice. Treat a name as a convenience, verify the resolved address the first time you use it, and save the result.

How do withdrawal whitelists and QR codes change the risk?

An address whitelist on an exchange turns verification into a one-time job. You add a destination once, confirm it through email and two-factor, and from then on withdrawals can only go to addresses on that list. Platforms that pair this with a waiting period before a newly added address becomes usable give you a window in which an attacker who has taken over the account still cannot move funds anywhere useful.

QR codes remove typing errors but not substitution. A code is just an encoding of a string, and a screenshot posted in a chat, a printed code in a public place or an image rendered by a compromised page can encode anything. Scan it, then read the decoded address in your wallet and check it against the source exactly as you would a pasted one — the scan replaced your keyboard, not your judgement.

• Add the addresses you use repeatedly to a whitelist or wallet address book once, carefully.
• Enable the delay on newly whitelisted addresses if the platform offers it.
• After scanning a QR code, verify the decoded string; never assume the image is the address.
• Re-verify whenever a counterparty says their address has changed — that message is a classic invoice-fraud pattern.