Theft & hacks

Theft by address substitution: when the money went to the wrong wallet

You copied an address, checked the first and last characters, sent the payment — and it arrived somewhere else. This is not clumsiness. It is a deliberate attack with four known variants, and in some of them the money is still recoverable because it landed on an account that belongs to a company rather than on an anonymous address. The first hour decides which case you are in.

Updated 16 October 2026 · about 10 minutes to read

The four ways an address gets substituted

• 1. Address poisoning. The attacker generates an address whose first and last characters match one you have used, then sends you a transaction worth nothing — a zero-value transfer, a dust amount, or a fake token with a real token’s name. The point is only to put their lookalike address into your transaction history. Later you copy “the address you used last time” from that history, and you copy theirs. Everything matches except the middle.
• 2. Clipboard hijacking. Malware on the device watches the clipboard and replaces any copied crypto address with its own. You paste what you believe you copied. This variant also hits the hardware-wallet users who verify on a laptop screen instead of on the device screen.
• 3. A substituted invoice. A compromised mailbox, a hacked website or a group chat where someone replaces payment details: the counterparty’s email thread continues normally and only the wallet address changes, sometimes with a message saying “we have updated our payment details”. This is the crypto version of invoice fraud and the amounts are usually the largest of the four.
• 4. A fake interface. A phishing copy of a site, a malicious browser extension, or a modified wallet app that shows you one recipient and signs another. The signature you approved and the screen you read were not the same thing.

The first hour

• Do not send anything else, including to the “correct” address, until you know whether your device or your mailbox is compromised. Repeat payments into the same trap are common.
• Save the facts in plain text: the transaction hash, your address, the address that received the money, the correct address you intended, the amount, the asset, the network, and the date and time with the time zone.
• Put both addresses side by side in full and keep that comparison — it is the single clearest piece of evidence that substitution happened, and it is what a compliance officer looks at first.
• Open the receiving address in a blockchain explorer and look at what it does next. Does the money stay, or move on within minutes? Where to?
• Check whether the receiving address belongs to a service. Explorers label many exchange deposit and hot wallets. If a label appears, say so in every message you send today — it changes what is possible.
• Send the freeze request immediately to the exchange or the stablecoin issuer involved, with the hashes and the full address comparison. Our free freeze request template is written for this.
• Check your device and mailbox: for the clipboard variant, treat the machine as infected and rebuild it; for the invoice variant, warn the counterparty through a channel other than the compromised thread and check mail-forwarding rules on both sides.
• If an invoice was substituted, tell your bank as well when any part of the payment chain was fiat, and file a police report with a reference number: how to report it.

Who received it, and does that help?

This is the whole question, and the answer is usually visible within minutes:

• An exchange deposit address. The best case. Behind it is an identified account at a company with a compliance function. A fast, well-documented request — hashes, both addresses in full, the amount, a police reference if you have one — sometimes results in a hold. Nothing is guaranteed, and the platform will not tell you who the account holder is, but this is the scenario where money does come back, and it is decided by how fast and how precisely you write.
• A stablecoin on an unlabelled address. Issuers of USDT and USDC can block addresses, and they do so at the request of authorities. Report it to the issuer and in your police report; the route exists, but it runs through officials rather than through you.
• An address that immediately splits and moves on. Typical of organised operations. Realistically you are then documenting for a case rather than retrieving today, and the value is in tracing to the eventual cash-out point — see the first 48 hours.
• A mixer or a cross-chain hop. Be honest with yourself here: a tracing report that ends in a mixer is a document, not a remedy. An adviser who tells you this before taking a fee is being straight with you; one who promises a return is not — run the free seven-question check.

The other case: your own mistake

Not every misdirected payment is theft, and the non-theft cases are the most recoverable ones:

• Right address, wrong network. Tokens sent to your own address on another chain are usually still yours: the same seed phrase controls that address on the other network, and you may only need to add the network and the token contract in your wallet.
• Sent to an exchange on an unsupported network, or a token the platform does not list. Many exchanges have a recovery procedure, sometimes with a fee. It is slow but it works far more often than people expect. Write to support with the hash and ask specifically for the “wrong network deposit recovery” process.
• Sent to a smart contract address. Usually unrecoverable unless the contract has a rescue function and an operator willing to use it.
• Sent to a stranger’s personal wallet. Nothing technical can be done. Occasionally a polite message attached to a small transaction gets a response; expect nothing.
• Missing or wrong memo or tag on a deposit to an exchange: this is a standard support case with a standard fix. Keep the hash and the exact time.

How to make it impossible next time

• Never copy an address from your transaction history. That is exactly what poisoning is built to exploit. Copy from the source: the counterparty’s current message, the exchange’s deposit page, your own saved address book.
• Use the address book. Save verified addresses with names in your wallet, and on exchanges enable the withdrawal address whitelist together with a delay for adding new entries.
• Check the whole address, not the ends. Four characters at each end is precisely the pattern attackers generate. Compare the middle, or better, compare it character by character on the device that signs.
• Verify on the hardware wallet’s own screen. That screen is the only one malware on the computer cannot rewrite.
• Send a small test payment first for any large or first-time transfer, and confirm receipt through a second channel before sending the rest.
• Confirm changed payment details by voice, on a number you already had, never by replying to the email that announced the change.
• Hide dust and unknown tokens in your wallet so poisoning entries stop appearing next to real ones, and never interact with an unexpected token.
• Keep signing devices boring: no cracked software, no browser extensions you cannot name, and a separate wallet for interacting with new sites — more on that in the wallet drainer guide.

If the money reached a platform you can name, speed is worth more than anything else today — describe the situation and we will tell you plainly whether there is leverage and what to send, free of charge.