Address Manipulation
Address manipulation is any attack that secretly replaces the address you intend to send crypto to with one controlled by the attacker. Because crypto transfers cannot be reversed, a swapped address usually means the funds are gone.
Why addresses are an easy target
Crypto addresses are long strings of letters and numbers that nobody memorises. Most people copy and paste them and glance only at the first and last few characters. Attackers exploit exactly that habit. They do not need to break any cryptography; they only need you to paste or pick the wrong address.
The main forms
Clipboard hijacking is malware on your computer or phone that watches what you copy. When it sees something that looks like a crypto address, it silently swaps in the attacker's address. You copy the right address and paste the wrong one.
Address poisoning works without malware. The attacker generates an address whose first and last characters match one you often use, then sends a zero-value or tiny transfer from it, so the lookalike appears in your transaction history. Next time you copy an address from that history, you may grab the fake one. In May 2024 one victim lost 1,155 WBTC this way; the attacker later returned most of it, which is rare.
Other forms include tampered QR codes, edited payment details in hacked emails or invoices, and compromised websites that display a wrong deposit address.
An example
Say you regularly send USDT to your exchange deposit address, which starts 0x7a3F and ends 9c21. After your last transfer, a 0 USDT transaction appears from an address that also starts 0x7a3F and ends 9c21, though the middle is different. A week later you copy the address from your history to send 8,000 USDT. If you picked the poisoned entry, the 8,000 USDT goes to the attacker.
How to protect yourself
Never copy addresses from your transaction history. Save trusted addresses in your wallet's address book or copy them fresh from the source, such as your exchange's deposit page. Compare the full address, or at least long chunks at the start, middle and end, after pasting. On a hardware wallet, verify the address on the device screen, not just on your computer. Send a small test transaction before a large one, and keep your devices free of pirated software and unknown browser extensions, which are common ways clipboard malware arrives.
Ask Coach about it
Coach is the AI on AtenaCrypto. It explains crypto with live market data, in plain words.
How can I set up my wallet so that address poisoning and clipboard swaps cannot catch me?Ask Coach →
Frequently asked questions
Can a transfer to a manipulated address be reversed?
Generally no. Blockchain transfers are final. Only the owner of the receiving address can send funds back, which attackers almost never do.
What should I do if poisoned transactions appear in my history?
Nothing needs to be done on-chain, and your funds are not at risk from the transfer itself. Just never copy addresses from that history, and hide the spam entries if your wallet allows it.
Is checking the first and last characters enough?
No. Address poisoning generates addresses that match exactly those characters. Check the middle part too, or rely on a saved address book entry.
Related terms
Learn it step by step
AC Learning explains these ideas in interactive lessons — the first eight sections are free.
Open AC Learning → Create a free accountAll glossary terms · Educational reference only — not investment, legal, tax or financial advice.