Crypto wallet address swaps: the scam with no chargeback

In a crypto wallet address swap, the payer believes they are sending funds to the merchant, but the address they copy, paste or scan has already been replaced with a criminal's. Because blockchain transactions cannot be reversed, money sent to the wrong address is almost always gone. That is why the only protection that really works is stopping the swap before the payment is sent.

Where the swap happens

The scam relies on one simple fact: nobody checks a 40-plus character address one character at a time. It can be carried out at three different points between the payment request and the payment itself.

On the payer's device. Malware known as clippers watches the clipboard and, when it spots a copied wallet address, pastes a different one instead. In February 2019, ESET found an app of this kind on Google Play that impersonated MetaMask and targeted Bitcoin and Ethereum. In March 2025, CyberArk described the MassJacker campaign, which drew on a list of at least 778,531 addresses to make its swaps.

On the payment page itself. Here the problem stops being the customer's and becomes the merchant's. On September 8, 2025, Aikido Security found malicious code in 18 widely used programming libraries with more than 2 billion combined weekly downloads. When that code reached a website, it ran in the visitor's browser, looked for wallet addresses and replaced them with others chosen to resemble the originals, on networks such as Ethereum, Bitcoin, Solana and Tron. In December 2023, Ledger reported a similar case: a tampered version of its wallet-connection library was live for about five hours and diverted users' funds to a wallet controlled by the attacker.

In the QR code on screen. A QR code is just another way of delivering the same address. If the script that builds the page is compromised, the image can be swapped without anything looking different to the person scanning it.

Why there is no chargeback

With cards, the issuing bank can dispute a purchase. With crypto there is no intermediary with that power: once the network confirms a transaction, it is not undone. The US Federal Trade Commission puts it plainly: in general, you only get your money back if the recipient chooses to send it back.

For merchants, this creates a double problem. The customer paid the right amount, saw the transaction confirmed and expects the product. The store received nothing. The conversation that follows is draining for both sides, and the customer tends to conclude the store is to blame. After all, the address was on its page.

Checklist for merchants accepting crypto at checkout

1. Generate one address per payment request, from your server or payment provider, instead of a fixed address pasted on the page. This makes reconciliation easier and helps you spot payments that never arrive.
2. Show the network and amount explicitly. The same token can exist on different networks, and a transfer on the wrong one may also be unrecoverable.
3. Cut third-party scripts on the checkout and pin the versions of the libraries the page loads. The September 2025 case showed that a single automatic update is enough to bring malicious code to your page.
4. Monitor the live payment page. What matters is the address the customer sees and copies, not only what sits in your repository.
5. Verify, in the customer's browser, that the displayed address, the copied address and the QR code match what you issued, and block any mismatch before the payment is sent.
6. Offer a clear channel for “I paid but it never arrived.” It is the first sign that something is swapping addresses along the way.

What payers can check

It also helps to guide customers, for example with a short note next to the address:

• Compare the whole address, including the middle, not just the first and last characters: recent attacks generate lookalike addresses precisely to defeat that quick check.
• After pasting, check again against the source; on hardware wallets, confirm the address on the device's own screen.
• Be suspicious if the network or amount in the wallet does not match what the store showed.
• For large amounts, confirm the address with the store through another channel before sending.

These steps lower the risk on the customer's device. Against a tampered script on the page, however, the customer has no way to know the address changed: the wrong content comes from the store itself.

How Proteside protects this moment

Proteside runs on your payment page and checks, in the buyer's browser, that the address, network and amount displayed or copied are exactly what you issued, blocking any swap before the funds are sent (in crypto, the only moment when the loss can still be prevented). See how crypto payment protection works and try it free for 14 days.