How people send crypto to the wrong address
Short answer
Almost nobody mistypes an address — they copy the wrong one. The most common attack works by planting an address in your own transaction history that matches the first and last four characters of one you already trust. Checking "the beginning and the end" is exactly the habit it is built to defeat.
The mistake that actually happens
Crypto addresses are 42 characters long, so nobody types them. Everyone copies. That means the question is never "did I type it right" — it is "where did I copy it from".
Here are the three ways money actually leaves for good.
1. Address poisoning: the scam that beats careful people
Someone sends you a tiny, meaningless amount — a few cents, sometimes zero. It appears in your transaction history. You ignore it, because it looks like noise.
That was the whole point. The address it came from was generated to match the address of someone you actually pay: same first four characters, same last four characters, different middle.
Real: 0x1c55A3046fCcc9d49A1Cf41951Dae2328396b0fF
Fake: 0x1c557d81E0b4aA92c3F5619e0Cc7104b28Eb0fF
Both show as 0x1c55…b0fF in almost every wallet interface. Next time you pay that person, you scroll your history, see something that looks right, and copy it.
This is not a rare or theoretical attack. Blockaid, the security vendor behind MetaMask's warnings, reported flagging 65.4 million address-poisoning transactions between January 2025 and February 2026. MetaMask shipped dedicated detection for it in June 2026.
Why "check the first and last few characters" is bad advice. It is the single most repeated tip about crypto addresses, and it is precisely the check this attack is designed to pass. Following it carefully does not protect you — it is the reason the attack works.
What actually protects you
- Never copy an address out of your transaction history. That is the surface the attacker controls. Copy from the person, from a saved contact, or from a QR code.
- Compare the middle, or compare nothing. If you are going to verify by eye, check characters in the middle of the address, not the ends.
- Treat unexpected dust as a warning, not free money. A tiny incoming transfer you did not expect usually means someone is setting this up.
2. Sending to a contract address
Some addresses are not wallets — they are programs. If you send USDC to a contract that was not written to receive it, the tokens are recorded as belonging to that contract, and there is no mechanism to get them out. Not a slow process: no mechanism at all.
This happens most often when someone copies a token address instead of a recipient address. The USDC contract itself is a common destination for this mistake, and the money is gone.
The good news: this one is detectable. Any address can be checked for whether it contains program code, and a wallet can warn you before you sign.
3. The right address on the wrong network
Ethereum-style addresses look identical across Base, Arbitrum, Polygon and Ethereum itself. USDC exists on all of them. So an address can be perfectly correct and the transfer can still fail if the destination does not support the chain you sent from — most commonly when sending to an exchange deposit address.
Sometimes the exchange can recover it manually. Sometimes it cannot. Either way, it is out of your hands, and this is described as a leading cause of lost USDC.
What to do if you already sent it
The honest answer first: you almost certainly cannot get it back. Blockchain transfers are final by design. No company — not us, not the wallet you used, not the network — can reverse one. Anyone who tells you otherwise is running the second scam.
| Where it went | Realistic chance | What to do |
|---|---|---|
| A stranger's wallet (poisoned address) | None | Nothing to do. Stop paying attention to it and secure your habits |
| A contract | None | Nothing to do |
| Exchange deposit address, wrong network | Sometimes | Contact the exchange's support with the transaction hash. Only through their official app or site |
| Someone you know | Good | Ask them to send it back. This is the only case where a human decision exists |
Two things to avoid right now
- "Recovery services". Anyone offering to reverse a blockchain transaction for a fee is stealing from you a second time. There is no technical way to do it.
- Sharing your seed phrase or private key with anyone "helping". No legitimate support ever needs it.
What a wallet can check for you
We build these checks, so here is what is technically possible — and what is not.
| Check | Catches | Limits |
|---|---|---|
| Look-alike detection | Address matching the ends of one you have paid before | Only works if you have paid that person from this wallet before |
| Contract detection | Destination contains program code | Cannot tell a safe contract from an unsafe one |
| Sanctions and fraud databases | Known bad addresses | Only known ones. A fresh address has no history |
| Burn address detection | The obvious dead ends | Trivial, but people do hit them |
What none of this catches: the correct address for the wrong person. If you are tricked into paying a scammer who gave you their real address, every check above passes. Software can verify an address; it cannot verify a relationship.
Common questions
Can a crypto transaction be reversed?
No. Blockchain transfers are final once confirmed. No company, wallet or network operator can reverse one, and anyone offering to do so for a fee is a scammer.
What is address poisoning?
An attacker sends you a tiny transaction from an address generated to match the first and last four characters of an address you already use. The goal is that you later copy it out of your transaction history instead of the real one.
Why is checking the first and last characters of an address not enough?
Because that is exactly what the attack copies. A poisoned address matches the visible ends and differs only in the middle, which no wallet interface shows by default.
What happens if I send USDC to a contract address?
The tokens are credited to that contract. If it was not written to handle them, there is no mechanism to withdraw them, and the money is permanently inaccessible.
I sent crypto to the wrong network. Can I recover it?
Sometimes, if the destination was an exchange — contact their support with the transaction hash through their official channels. If it went to a personal wallet on a chain nobody controls the keys for, it is not recoverable.
Written by the team building hho.cash, a self-custodial USDC wallet. We run the checks described above before every irreversible transfer, including on transfers out. We are not a bank and we do not hold your funds.