An address swapped on your own machine
The only entry here that is inside rather than outside, and the only one the main defence on this site does nothing about.
- How often
- Uncommon
- Typical size
- One payment, in full
- Recoverable
- Never
- Cost to prevent
- Three seconds
What is happening
Something running locally watches for anything address shaped and replaces it between the copy and the paste. It costs nothing to run against many machines at once, so a low success rate is still worth somebody's while, which is why this has existed unchanged for years and will continue to.
The check that catches it
Compare the first and last several characters of what actually landed in the field against the source. The ends, not the middle, because a substitution replaces the whole string rather than resembling it.
| Situation | Which part to compare |
|---|---|
| An address from a page or a message | The middle. A forgery resembles the original and differs where reading stops. |
| What appeared after you pasted | The ends. A substitution replaces everything. |
| Either, done properly | Paste both strings somewhere that reports an exact match. |
This is the only place on the site where checking the ends is the right check, and it applies to payment destinations as much as to addresses in a browser bar.
Where it comes from
- Anything promising faster Tor. There is no such product and the category is largely this.
- Repackaged browser bundles. Software named similarly, from anywhere other than the project.
- Convenience wallets and helpers. Tools offering to simplify the awkward parts, which is where the awkwardness was doing work.
- Ordinary unrelated software. It does not have to arrive through this activity at all, which is why it reaches people careful about everything else.
If a payment already went
It is not recoverable, and the machine is the problem rather than the platform. Treat anything else on that machine as suspect, including saved wallet files, and do not repeat the payment from the same system. This is one of the few entries where the honest answer is that the loss is final and the useful action is preventing the next one.
Why this one breaks the site's own model
Everything else here assumes your machine reports honestly what it received and what it sent. Signature checks, address comparisons and careful reading all run on that machine and are only as reliable as it is. If the machine is lying, the checks return whatever it wants them to return.
That is a genuine hole rather than an oversight, and it is why the habits page states plainly that nothing in it closes this entry. Advice that claimed otherwise would be selling comfort.
What raises the odds
| Situation | Why it matters |
|---|---|
| Software installed for this activity specifically | A category with a strong incentive to be malicious and a weak norm of verification |
| Anything obtained outside official channels | Including repacks, mirrors and helpful reuploads |
| A machine shared with other people | Their installs are your exposure |
| A machine used for years without a rebuild | Accumulation, rather than any single decision |
The two habits that reduce it
Check the ends of every destination after pasting, every time, including the small payments where it feels excessive. And keep the number of things installed on the machine used for this small, because every install is a decision to trust somebody, and the useful question is not whether a given piece of software is malicious but how many such decisions you are currently carrying.