Check a Transfer Before You Send

A transfer check is a sequence, not a quick glance at the ticker. The same symbol can refer to different tokens, and a familiar address format can appear on different networks. We will build a transfer worksheet that makes those differences visible before any signing. The practice stays fictional, so a wrong answer costs time rather than money.

Education only. Crypto assets can lose substantial value or become worthless. No lesson requires buying an asset, depositing money or sharing real passwords, private keys or recovery words.

Begin with the intended asset and network. For a token, check the contract identity using independently verified project and recipient information. Symbols and logos can be copied. Two tokens called USDX may have unrelated issuers, contracts and redemption rights. Decimal settings affect how raw units are displayed, but do not prove that the asset is genuine.

Distinguish a native asset from a wrapped or bridged representation. Sending a representation when the recipient supports only the native version may not produce the expected credit. Read the receiving service's current deposit instructions for the exact asset and route. An explorer showing that a token exists is not sufficient proof that a provider accepts it. Record the asset identity and the source used to verify it.

Think about posting a letter through a postbox slot. Until it leaves your hand, you can still fix the address. Once it drops, you cannot reach in to get it back.

Imagine paying a builder by bank transfer and checking only the first two and last two digits of the account number. A fraudster with a fake invoice needs to match only those four.

Catch clipboard hijackers before you paste

Picture a postal worker who quietly rewrites the delivery address on every envelope you hand over. Your letter is sent, but not to the person you meant.

A clipboard hijacker, or clipper, does this to crypto addresses. Addresses are long, so almost everyone copies and pastes them. The malware watches your clipboard, recognises an address and swaps it for the attacker's own between copy and paste.

In March 2023, the security firm Kaspersky reported a clipper hidden inside fake Tor Browser installers downloaded from unofficial sites. It had affected more than 15,000 users in 52 countries, and Kaspersky estimated about US$400,000 had been stolen. The researchers noted that such malware can stay silent for years, with no network activity, until an address appears on the clipboard.

The defence is to compare the full pasted address with the original, and the transfer checking lesson in Level 2 turns that into a routine. Clippers need malware on your device. The next trick needs only a public blockchain.

See how address poisoning plants a look alike

Imagine someone slips a fake card into your contacts book. It names your plumber, and its number starts and ends with the same digits as the real one. Next time you call in a hurry, you may dial the wrong one.

Address poisoning works the same way. Attackers watch the blockchain for wallets that often send to the same address. They generate new addresses by computer until one starts and ends with the same characters as the real one. Then they send your wallet a tiny or zero-value transfer from that look-alike; Ledger Academy notes that a zero-value transfer leaves a record without moving real tokens. Next time you copy "the usual address" from your history, you may copy the attacker's.

Chainalysis studied one campaign that ran from 28 February to 4 May 2024. It seeded about 82,031 look-alike addresses, and 2,774 victim addresses sent a combined total of about US$69.7 million to them. One victim alone sent about US$68 million, which was later returned. The real and fake addresses in that case shared the same first six characters, "0xd9A1", and differed further along.

Why match only the start and end? Because each extra matching character multiplies the computing work.

Address poisoning plays on habit. The next danger lives inside your browser.

Open diagram at original size ↗

Read diagram as text

Usual address: 0xd9A1b3F720c85e9D41aA7c06e2B893F51D4c7e3C. Look-alike: 0xd9A109aE6f1B3d85C2e47a90bF16d38Ec5A27e3C.

The shortened transaction history displays both as 0xd9A1…7e3C. A zero-value attacker transfer places the look-alike in the history.

Compare every character against an independently verified destination. These invented strings are not receiving instructions.

Picture a parcel addressed correctly to "12 King Street", but sent to the King Street in the wrong city. The house number is fine; the city is wrong, and the parcel never arrives.

In crypto, the "city" is the network, or chain. The wallet and custody lesson in Level 2 explained that the same token can exist on several networks, as separate balances. When you send, you choose which network carries the transfer, and the receiver must support that same network for that token. Kraken's deposit guide warns that some cryptocurrencies can be sent on several networks, and that using one it does not support can mean lost funds.

The trap is that many networks use addresses that look alike. An address beginning "0x" can be valid on several networks that work like Ethereum, so your wallet may accept it even though the receiver will never see funds sent there. Some providers offer limited help: Coinbase's help centre describes a paid recovery service for certain assets and networks only, and accepts no liability for losses. Do not count on rescue.

Moving tokens between networks needs special tools with their own risks, covered in Level 4. Some networks also add one more field to fill in.

Similar address formats do not mean that ledgers are interchangeable. A receiving service may display an address for one supported network while not monitoring the same format on another. Do not choose a cheaper route merely because the address looks compatible. Some mistaken transfers can be recoverable under particular circumstances, but recovery may be unavailable, delayed or expensive. A beginner should not base the original decision on that possibility. The safe procedure is to establish support before sending, using current instructions rather than a screenshot from an old tutorial.

Think of an office block with one street address and hundreds of tenants. Post with only the street address reaches the building, but the mailroom cannot tell which tenant it is for.

Some exchanges work the same way on certain networks. They use one shared deposit address for many customers and tell them apart with an extra number or note, called a memo or destination tag. Kraken's XRP guide explains that the destination tag decides which account is credited, and warns that leaving it out leads to significant delays and can, in some cases, make a deposit impossible to retrieve. Its deposit guide lists other assets that need a tag or memo, such as XLM and STX, and reminds users to check that the tag or memo is included when scanning a QR code.

The analogy has a limit. A mailroom can often trace a parcel without a flat number. A missing tag may need a manual support claim, which can be slow and is not always successful.

If the receiving page asks for a memo or tag, it is mandatory; if it does not, leave the field empty. The next check costs a little money and can save a lot.

Follow the recipient's exact instructions rather than assuming every asset uses the same fields. A small test below a minimum may not be credited, which makes it a poor test of the intended process. A network fee and a minimum deposit are different constraints and should appear separately in the worksheet.

Inspect the device amount and fee

Obtain the destination through the intended recipient's verified route. Check the full address where practical, not just a few matching characters, and beware of copied addresses from unsolicited transaction history. Confirm the amount, unit, decimal point and whether the wallet displays a fee-inclusive or fee-exclusive amount. Clipboard malware can replace a copied destination, so inspect the final signing request.

Some networks require a native asset to pay transaction fees even when the transferred item is a token. Holding the token alone may be insufficient to send it. Fee estimates can change, and a failed or cancelled attempt may still incur costs depending on the network and stage. Never send extra fee funds to an address suspected of key compromise simply to make a transfer possible; the incident-response lesson addresses that special risk.

Think of a cash machine whose screen a criminal has covered with a fake overlay. You would want a second display you knew nobody could tamper with.

Think of the final screen when you book a flight. You check the total, not only the fare, because charges are added at the end.

Imagine a waiter handing you a card machine with the amount already typed in. You read the number before entering your PIN. Approving a crypto transaction is the same moment.

A valid test and a fresh check of the final transfer

A small test can help verify that the selected route is currently usable, provided it meets the recipient's rules. Wait for the expected credit and compare the asset and account. A successful test does not certify a larger transfer: the next address, network, memo or amount may differ, and a malicious interface may change details between attempts.

Before the larger action, repeat the checks from the beginning. After sending, record the transaction ID, network status and receiving-service credit status separately. Do not repeat a transfer simply because a balance display is slow. First determine whether the first transfer is pending, confirmed or awaiting provider processing. An irreversible duplicate payment can be worse than a short delay.

Send a test transaction first

A small test transfer is a check of a particular route at a particular time. It must use the intended asset, supported network, verified address and required memo, and meet any recipient minimum. Wait for the expected credit before concluding that the route worked.

The next transfer remains a new authorisation. Repeat the checks, including the complete destination and final device display. A malicious interface can behave differently for a larger amount, and fees or service limits can change. Do not describe a test as insurance.

Think of a train guard who spots an open door as the train is about to leave. The rule is to stop first, then work out why.

Open diagram at original size ↗

Read diagram as text

Check the exact asset and contract; the supported network on both sides; and the recipient address verified independently.

Check any memo or tag and minimum; amount, decimals and native fee asset; then a valid test followed by a fresh check of the actual action.

A matching format or a successful earlier transfer cannot replace the full checklist.

Everyday example

What to remember

Lesson completion check

References and further reading