Why checking the first and last four characters is not enough
2026-09-25
This post contains affiliate links. As an Amazon Associate, ZAGO.TO earns from qualifying purchases.
Open almost any exchange help page and you will find the same instruction. Before you send, check the first four and last four characters of the address.
It is the most repeated piece of crypto safety advice there is. It is also, on its own, a check that a specific and very common attack was designed to walk straight through.
Where the advice came from
The advice makes sense if you know what it was originally protecting against.
Addresses are long. People used to retype them, or copy them badly, or truncate them. A checksum catches most of those errors, but not all formats have strong ones, and a wrong address means money gone with no way back. So a habit developed: glance at the ends, confirm they match, send.
For accidental errors, this works reasonably well. A slip of the finger does not usually preserve both ends of a 42-character string.
The problem is that the threat changed and the advice did not.
Address poisoning
Here is the attack that defeats it.
An attacker watches the chain for addresses that receive funds. They then generate a new address whose first few and last few characters match one you have used, which is cheap to do because they only need to brute-force the visible parts, not the whole thing. They send you a transaction worth almost nothing from that address.
Now their lookalike sits in your transaction history, one line away from the real one, with the same familiar ends.
Later you go to send funds. You scroll your history to find the address, because that is faster than digging out where you saved it. You see the right-looking prefix and suffix. You copy it. You check the ends, as instructed. They match, because that is the entire point. You send.
The check did not fail. It passed. It just was not checking the thing that mattered.
Clipboard swapping
The second attack ignores your eyes completely.
Clipper malware sits on a machine and watches the clipboard. When something that looks like a wallet address appears, it silently replaces it with the attacker's. You copy the correct address, you paste, and what lands is not what you copied. Security vendors have tracked this family since around 2017 and it keeps working, because nobody reads a 42-character string after pasting it.
If you check the ends after pasting, you might catch this one, since a random attacker address will not match. That is worth doing. But the same attacker can combine the two ideas and make the swapped address match the ends too, at which point you are back to the first problem.
What actually helps
None of the following is exotic. They are just less convenient than a glance, which is why people skip them.
Check the middle, not only the ends. Pick a few characters from the centre of the string and compare those as well. An attacker matching the ends has not matched the middle, because matching the whole thing is computationally out of reach.
Do not source addresses from transaction history. This is the single most effective change. Address poisoning only works because people reuse what is in their history. Use a saved address book entry in your wallet instead, and add entries deliberately rather than by tapping a past transaction.
Send a test amount first. For anything large enough to hurt, send a small amount, confirm it arrived where you meant, then send the rest. It costs a fee and a few minutes and it makes the entire class of attacks survivable.
Scan a code rather than move characters. If the two devices are in the same room, a QR code shown on one screen and scanned by the other removes the human from the loop entirely.
Reduce how many times the address is handled. Every copy, paste, retype and forward is another chance for something to go wrong. Fewer hops is a real security property, not just convenience.
Where we fit, and where we do not
That last point is the one our own service touches, so treat this paragraph accordingly.
ZAGO.TO moves text between devices using four digits instead of a link, and deletes it about a minute after it is opened. For an address, the effect is that the other person does not retype it and it does not stay behind in a chat thread afterwards.
That reduces the number of hops and it removes the transcription step. It does not verify anything. It will move a poisoned address exactly as faithfully as a correct one, and if the receiving machine has a clipper on it, the paste can still be swapped after our part is over.
So this belongs in the "fewer hops" line above and nowhere else in the list. Verification is still your job, and the test transaction is still the thing that saves you.
The short version
Checking the first and last four characters is a check against accident, not against a person who wants your money. The attack that matters was built to satisfy it.
Check the middle, stop pulling addresses out of your transaction history, and send a test amount when the number is big. Those three habits cover almost everything, and none of them depend on how you moved the address around.