The short version: the address you pasted is not necessarily the address you copied, and the address in your transaction history is not necessarily one you ever used. Reading it off the hardware wallet's own screen, every time, is the only check that survives a compromised computer — and it takes four seconds.

When I shake the food container, Tuga arrives at a sprint. She's responding to a sound, and the sound has been reliable for years, so she doesn't bother checking anything else.

The one time I shook it while tidying up and didn't actually feed anyone, she arrived at full speed, stopped, and looked at me with an expression of such profound betrayal that I apologised out loud to a cat.

She trusted the signal instead of the thing the signal was supposed to indicate. In Bitcoin that mistake costs rather more than dignity, because sending to the wrong address is the one error with no undo, no support desk and no appeal.

I wrote a few weeks ago about verifying the software you downloaded. This is the other half: verifying the destination, which is the attack that actually empties wallets.

1. Clipboard swapping

The oldest version and still working.

Malware sits on your computer doing nothing visible. It watches the clipboard. When something that looks like a Bitcoin address appears there, it replaces it with the attacker's address. You paste, and the field fills with a long string that begins and ends roughly the way you expect, because the malware selected one that does.

You check the first four characters. You check the last four. They match. You send.

This works because of exactly how humans verify long strings: we sample the ends. Attackers generate addresses in advance to match common prefixes and suffixes, which is cheap, and the middle — which nobody reads — is where the difference lives.

2. Address poisoning

Newer, cleverer, and it doesn't require any malware on your machine at all.

The attacker watches the chain for addresses that transact. They generate an address resembling one you've recently received from or sent to — same first characters, same last characters. Then they send you a tiny amount, or a zero-value transaction, from that lookalike.

Now their address sits in your wallet's transaction history, looking like a familiar counterparty.

Weeks later you want to send to that counterparty again. You scroll back through your history, find what looks like the right address, copy it from there, and send. The money goes to the attacker.

The elegance of it is that nothing was hacked. Your wallet is fine, your computer is clean, your seed is safe. You were handed a plausible-looking entry in your own records and you trusted your own records.

Never copy an address out of transaction history. Get it from the recipient, fresh, every time.

3. The check that actually works

Everything above is defeated by one habit:

Read the address off the hardware wallet's own screen and compare it to where you believe you're sending.

This works when nothing else does, because the hardware wallet's screen is driven by the device, not by your computer. Malware on your laptop can change what the laptop displays. It cannot change what the little screen shows. When the device asks you to confirm the destination, it is showing you what will actually be signed.

Which means:

Compare the middle, not just the ends. Pick a chunk from the centre and check it character by character. The ends are the part attackers optimise.

Confirm out-of-band for anything significant. Phone the recipient — voice, not chat — and read a section aloud. Email and messaging apps can be compromised; a phone call to a voice you recognise is harder.

Send a small test first for large or new destinations. The fee is real and it is the cheapest insurance in this entire field. Send a small amount, confirm it arrived, then send the rest.

Use the receiver's own channel. An address from a website that was fine yesterday may not be fine today; sites get compromised and addresses get swapped. For recurring payments, ask the recipient to confirm their address hasn't changed.

Don't skip the device prompt. Pressing confirm without reading is the same as not having a hardware wallet. The whole value of the device is concentrated in those four seconds, and the habit of clicking through them is the most expensive one in self-custody.

4. The uncomfortable half

This advice fights the interface. Every wallet, exchange and payment flow is designed around copy and paste, because that's what's convenient. The secure behaviour is the slow one, and the industry has spent a decade optimising away exactly the friction that was protecting people. I can tell you to verify on-device; the software will keep making it easy not to.

QR codes are better and not immune. Scanning avoids the clipboard entirely, which removes the most common attack. It does not remove a malicious QR code displayed by a compromised site, printed on a sticker over a real one, or sent to you in an image. Scanning moves the trust to whoever showed you the code.

Test transactions have a cost most people skip. Two transactions mean two fees and two entries in your records, and they link the two payments together publicly in a way one payment wouldn't. For a small transfer that's a poor trade. I'd reserve it for new destinations and meaningful amounts, which is where the loss would actually hurt.

And verifying diligently can't save you from sending to the wrong person. This whole article is about making sure the address is the one you intended. It says nothing about whether the person on the other end is who they claim, deserves the money, or will deliver anything. Most money lost in this space goes to addresses the sender checked very carefully, because the fraud was upstream of the address entirely.

She hears the container and runs, and she's right almost every time. Almost every time is a fine record for a cat and a terrible one for an irreversible payment. 🐾⚡