Sending crypto to the wrong address is irreversible. Address verification is the most important step before any transaction.
Why Verification Matters
| Risk | How It Happens |
|---|---|
| Clipboard hijacking | Malware replaces copied address |
| Wrong address | You paste an old or incorrect address |
| Phishing site | Fake site shows scammer’s address |
| Typo | Manually typed address has an error |
| Address poisoning | Scammer sends dust to trick your history |
Verification Methods
| Method | Security |
|---|---|
| Check first 3 + last 3 characters | Low |
| Read address aloud | Low |
| Verify on hardware wallet screen | High |
| Use address book (whitelist) | High |
| Send small test transaction | Very high |
| QR code scan | Moderate |
| ENS/domain name | Moderate |
Hardware Wallet Verification
| Step | Action |
|---|---|
| 1 | Generate receive address on the device |
| 2 | Check the address on the device screen |
| 3 | Compare with what’s on your computer screen |
| 4 | Only confirm if they match exactly |
Never trust the address displayed on your computer alone. Malware can alter it.
The Test Transaction Method
| Step | Action |
|---|---|
| 1 | Send a small amount (1-5% of total) |
| 2 | Wait for confirmations |
| 3 | Verify the test arrived correctly |
| 4 | Send the remaining amount |
Test transactions add time but prevent catastrophic errors.
Address Whitelisting
| Feature | How It Works |
|---|---|
| Withdrawal address whitelisting | Only send to pre-approved addresses |
| 24-hour delay | New addresses take 24 hours to activate |
| Multi-factor confirmation | Requires 2FA for new addresses |
Most exchanges offer whitelisting — enable it.
Address Poisoning
| Attack | How It Works |
|---|---|
| Scammer sends tiny amount (dust) to your wallet | Your address book shows their address |
| Your transaction history shows their address | You might copy it by mistake |
| They use a vanity address similar to yours | First/last characters match |
Best Practices
| Practice | Why |
|---|---|
| Verify on hardware wallet screen | Malware can’t alter the device display |
| Use whitelisting on exchanges | Adds a delay for new addresses |
| Send test transactions for large amounts | Confirms the destination |
| Check the full address (not just first/last) | Avoids address poisoning |
| Use a fresh address for each transaction | Privacy and verification |
| Never copy and paste without checking | Clipboard hijacking is common |
ENS and Domain Names
| Service | How It Works |
|---|---|
| ENS (Ethereum Name Service) | vitalik.eth instead of 0x123… |
| Unstoppable Domains | Similar to ENS |
| DNS for crypto | Not standardised |
Domain names reduce errors but add a trust risk (the domain controller could change the address).
Bottom Line
Always verify a crypto address before sending. Use a hardware wallet screen to confirm the address. Send a test transaction for large amounts. Enable withdrawal whitelisting on exchanges. Check the full address, not just the first and last characters. Clipboard hijacking and address poisoning are real threats. A few extra seconds of verification can save you from losing your entire transaction.
What matters most
The few extra seconds you spend verifying an address are cheap insurance against a permanent loss. The core rule is simple: never trust the destination address you see on your computer, because the risk is not normally a typo you made yourself — it is malware or a phishing site actively replacing the address you copied with one the attacker controls. Clipboard hijackers sit in the background and swap a copied address for a scammer’s address the moment you paste it. Phishing sites show a fake address alongside a convincing page. This is why hardware wallet verification is the gold standard: the address is generated on the device itself, malware cannot alter the device’s display, and you confirm a transaction only after the two screens match exactly.
Verification is not a single skill but a layered habit. Use a fresh, correctly generated receive address for each transaction rather than reusing an old one. When you paste an address, do not glance at it — read it in full, or better, compare it against the hardware wallet screen. If you are moving a large sum, do not rely on a single check: combine a test transaction with whitelisting so that even a mistake is caught by a mandatory delay. The goal is not to be paranoid but to make the high-cost failure modes impossible by forcing more than one thing to go wrong before your funds leave.
A practical verification routine
Building this into an automatic routine removes the stress of doing it under time pressure. Start by deciding, before you transact, which method fits the amount involved. For small everyday transfers, confirming the full address on your hardware wallet screen and a quick glance at the first and last characters is usually enough. For anything large, add a test transaction of roughly 1-5% of the total, wait for it to confirm, and only then send the remainder. On exchanges, set up withdrawal address whitelisting so new addresses take effect only after a delay such as 24 hours, and require 2FA when adding them. Keep a private address book or a hardware wallet’s stored contacts for addresses you use often, so you are always sending to a known entry rather than relying on memory or a fresh paste. Finally, treat your browser and clipboard with suspicion: keep a trusted wallet extension, avoid copying addresses on public machines, and refresh your check process whenever you change devices or browsers.
What to avoid
The most damaging mistakes come from trusting the wrong signals. Relying on the first three and last three characters alone is the classic trap, because address poisoning is designed to beat exactly that shortcut — the scammer’s vanity address matches both ends of yours. Copying and pasting without any confirmation at all is how clipboard hijackers cash in. Scanning a QR code handed to you on a screen you cannot inspect, or one pasted into a chat, imports whatever address it encodes without you reading it. Reusing a single address repeatedly makes you a long-lived target and muddies your privacy. And skipping the test transaction on a large withdrawal because it feels slow is precisely the moment people lose everything. The common thread is replacing verification with convenience — and on an irreversible transaction, that is the wrong trade. If you are ever in doubt about the address shown, stop, go back to the hardware wallet, and confirm before proceeding.
Building habits that last
Address verification becomes second nature the same way locking a door does. Fold it into the ritual you already use for any wallet transaction: look at the screen, look at the device, make them match, then sign. Review your withdrawal whitelist entries and address book periodically so only current, trusted addresses remain, and remove anything you no longer use. When a new chain or new wallet enters your routine, practise with a tiny amount before committing real value, since each platform’s verification flow differs slightly. Over time this is simply part of being a careful crypto user, alongside seed phrase hygiene and avoiding phishing. For more context on the surrounding dangers, the safe-crypto guides on phishing attacks and on how to create a strong security plan cover the broader threats that make careful address checking so important.