For crypto
Every serious attack on a crypto transfer exploits the same habit: nobody reads forty-two characters, so we glance at the start, glance at the end, and hit send. Both clipboard hijacking and address poisoning are engineered precisely around that glance.
The root cause
Generating an address whose first and last characters match a target is a brute-force search anyone can run on a laptop — it's the same technique behind "vanity" addresses. Matching the whole address is computationally impossible. So attackers buy the ends and gamble that you never look further in.
What your eye compares
Both addresses start bc1q and end xe8s. One of them is yours. DoublyCheck compares position by position, so the six characters in the middle are not something you have to notice — they're something the app reports.
Threat model
A clipboard stealer sits quietly on the machine, watches for anything shaped like a wallet address, and substitutes its own the instant you paste. You never typed a wrong character — the string simply changed in transit between copy and paste.
The check: scan the address now sitting in the recipient field, and compare it against your saved entry or a scan of the original source. If the clipboard lied, the diff shows it.
An attacker sends you a dust or zero-value transaction from an address generated to share the first and last characters of one you really use. It lands in your wallet's history. Next time you reach for a recent address, you copy theirs.
The check: never source an address from transaction history. Keep the real one saved and labelled, and let the comparison — not your memory of the last four characters — decide.
Malware or a tampered page can render a different address than the one your transaction will actually carry. This is exactly why hardware wallets show the address on their own trusted screen — and why comparing the two screens is the standard advice.
The check: scan the address on your computer, scan the one on the hardware wallet's screen, and let the app confirm they're identical instead of squinting between two displays.
The mundane one, and probably the most common: the right address for the wrong destination. An exchange deposit address pasted into a self-custody send. Last month's deposit address for an exchange that has since rotated it.
The check: a labelled address book. Scanning tells you not just "this is a valid address" but "this is Kraken withdrawal, which you've used sixteen times."
In practice
Everyone is told to verify the address on the device screen. Almost nobody reads all forty-two characters twice. This is that check, done properly, in about ten seconds.
Scan the recipient field on your computer — the address your wallet software says it will send to.
Scan the second source — your hardware wallet's own screen, a paper backup, or the entry you saved and labelled the first time round.
Read the verdict. Identical, or a highlighted list of the characters that aren't. Then confirm on the device — or don't.
Free to use, no account, and nothing about your addresses ever leaves the device.
Paying suppliers rather than wallets? See the invoice-fraud use case.