Short answer. Almost nobody mistypes an address — they copy the wrong one. The most common attack works by planting an address in your own transaction history that matches the first and last four characters of one you already trust. Checking "the beginning and the end" is exactly the habit it is built to defeat.
Crypto addresses are 42 characters long, so nobody types them. Everyone copies. That means the question is never "did I type it right" — it is "where did I copy it from".
Here are the three ways money actually leaves for good.
Someone sends you a tiny, meaningless amount — a few cents, sometimes zero. It appears in your transaction history. You ignore it, because it looks like noise.
That was the whole point. The address it came from was generated to match the address of someone you actually pay: same first four characters, same last four characters, different middle.
Both show as 0x1c55…b0fF in almost every wallet interface. Next time you pay that
person, you scroll your history, see something that looks right, and copy it.
This is not a rare or theoretical attack. Blockaid, the security vendor behind MetaMask's warnings, reported flagging 65.4 million address-poisoning transactions between January 2025 and February 2026. MetaMask shipped dedicated detection for it in June 2026.
Why "check the first and last few characters" is bad advice. It is the single most repeated tip about crypto addresses, and it is precisely the check this attack is designed to pass. Following it carefully does not protect you — it is the reason the attack works.
Some addresses are not wallets — they are programs. If you send USDC to a contract that was not written to receive it, the tokens are recorded as belonging to that contract, and there is no mechanism to get them out. Not a slow process: no mechanism at all.
This happens most often when someone copies a token address instead of a recipient address. The USDC contract itself is a common destination for this mistake, and the money is gone.
The good news: this one is detectable. Any address can be checked for whether it contains program code, and a wallet can warn you before you sign.
Ethereum-style addresses look identical across Base, Arbitrum, Polygon and Ethereum itself. USDC exists on all of them. So an address can be perfectly correct and the transfer can still fail if the destination does not support the chain you sent from — most commonly when sending to an exchange deposit address.
Sometimes the exchange can recover it manually. Sometimes it cannot. Either way, it is out of your hands, and this is described as a leading cause of lost USDC.
If this already happened to you, we wrote a step-by-step page for the hour after: what to do now. The summary is below.
The honest answer first: you almost certainly cannot get it back. Blockchain transfers are final by design. No company — not us, not the wallet you used, not the network — can reverse one. Anyone who tells you otherwise is running the second scam.
| Where it went | Realistic chance | What to do |
|---|---|---|
| A stranger's wallet (poisoned address) | None | Nothing to do. Stop paying attention to it and secure your habits |
| A contract | None | Nothing to do |
| Exchange deposit address, wrong network | Sometimes | Contact the exchange's support with the transaction hash. Only through their official app or site |
| Someone you know | Good | Ask them to send it back. This is the only case where a human decision exists |
We build these checks, so here is what is technically possible — and what is not.
| Check | Catches | Limits |
|---|---|---|
| Look-alike detection | Address matching the ends of one you have paid before | Only works if you have paid that person from this wallet before |
| Contract detection | Destination contains program code | Cannot tell a safe contract from an unsafe one |
| Sanctions and fraud databases | Known bad addresses | Only known ones. A fresh address has no history |
| Burn address detection | The obvious dead ends | Trivial, but people do hit them |
What none of this catches: the correct address for the wrong person. If you are tricked into paying a scammer who gave you their real address, every check above passes. Software can verify an address; it cannot verify a relationship.
No. Blockchain transfers are final once confirmed. No company, wallet or network operator can reverse one, and anyone offering to do so for a fee is a scammer.
An attacker sends you a tiny transaction from an address generated to match the first and last four characters of an address you already use. The goal is that you later copy it out of your transaction history instead of the real one.
Because that is exactly what the attack copies. A poisoned address matches the visible ends and differs only in the middle, which no wallet interface shows by default.
The tokens are credited to that contract. If it was not written to handle them, there is no mechanism to withdraw them, and the money is permanently inaccessible.
Sometimes, if the destination was an exchange — contact their support with the transaction hash through their official channels. If it went to a personal wallet on a chain nobody controls the keys for, it is not recoverable.