Most losses we see involve an address that the sender believed was correct. The attacks that produce this are cheap, automated and effective, and they are all beaten by the same routine.
The three attacks worth knowing
Address poisoning. An attacker sends you a zero-value or dust transaction from an address engineered to share the first and last characters of one you use regularly. Later you copy an address from your transaction history, glance at the ends, and send to theirs. This works because wallets abbreviate addresses in the middle, and because the ends are the only part anyone reads.
Clipboard hijacking. Malware watches for something address-shaped on the clipboard and swaps it for the attacker's at paste time. You copied the right address; you pasted a different one.
Lookalike substitution. A support impersonator, a compromised group chat, or an edited message replaces a legitimate address with one that reads similarly at a glance.
The routine
1. Check the middle, not the ends. Compare at least six characters from the middle of the address as well as the first and last four. Poisoned addresses are generated to match the ends because that is what wallets display. Matching the middle costs an attacker orders of magnitude more work.
2. Never copy from transaction history. Take the address from its source every time: the invoice, the exchange withdrawal page, the person, verified through a channel you initiated. Transaction history is exactly where poisoned entries are waiting.
3. Verify the checksum. Most address formats carry one, which is the whole point of them. Bitcoin's Base58Check and bech32 formats and Ethereum's mixed-case EIP-55 encoding all detect single-character alterations. A validator that actually checks these will reject a tampered address rather than shrug. Note the exceptions: an all-lowercase Ethereum address carries no checksum information at all, and Solana addresses have no checksum, so structural validity proves less there.
4. Send a test transaction. For any meaningful amount, send a small amount first and confirm receipt with the counterparty before sending the rest. The fee is the cheapest insurance available in this field.
5. Check the address against a risk dataset. Reported addresses are worth screening against before you transact. Treat a hit as decisive and a miss as meaning nothing much: absence from any dataset is not evidence of safety, only of absence.
On hardware wallets
If a hardware wallet is in use, confirm the address on the device screen rather than in the software. The device screen is the one surface malware on the host machine cannot rewrite. Skipping that confirmation removes most of the reason to own the device.
If you have already sent to the wrong address
Act immediately, because the window is short. Capture the transaction hash. If the destination looks like an exchange deposit address, contact that exchange's compliance team with the hash. File a report with your national fraud body and keep the reference. Then get an assessment of where the funds went before spending anything on recovery, and read our advisory on recovery scams first, because the offers will start arriving quickly.