How do I confirm a swap deposit address belongs to the real exchange and not a fake

05 September 2026

You confirm a deposit address by copying it directly from the exchange's authenticated interface and cross-checking the first few and last few characters against any independently verified source you trust. This is not something you can do by looking at the address alone, because a fake address looks exactly like a real one - that is the point of the attack.

Here is why it is not enough to "just look" at the address in your browser or in a chat message, and what steps actually limit your exposure.

The problem: identical appearance

A fake deposit address is not a mistyped address. It is a real, valid address that the attacker controls. The attacker generates addresses from the same cryptocurrency protocol as the exchange, so both addresses begin with the same prefix (for example, "1" for Bitcoin, "0x" for Ethereum) and conform to the same checksum rules. Visually, they are indistinguishable. The attack works by replacing the exchange's address with the attacker's address at some point between the exchange's server and your eyes.

Common replacement vectors include clipboard hijackers (malware that swaps the address when you paste it), compromised browser extensions that rewrite the page, phishing sites that mimic the exchange's interface exactly, and social engineering where someone sends you a fake address via direct message or email.

How to verify: the two-channel confirmation

The most reliable method is to obtain the address from the exchange's own authenticated interface - log in yourself, navigate to the deposit page, copy the address from there - and then confirm that address through a separate, independent channel. You might compare it against a previously saved list, or send a tiny test transaction to the address you copied and verify receipt on the exchange's deposit history before sending the full amount.

Do not rely on a single browser window. If you are on a compromised machine or a phishing site, both the address on screen and any address you paste into your wallet can be altered. Use a second device, if possible, or at least a second browser that is not logged into the exchange, to pull the address from a trusted source such as the exchange's official API documentation, a long-known bookmark, or a verified social media account.

What phishing sites specifically do

A phishing site replicates the exchange’s login page and deposit interface. When you enter your credentials, the attacker captures them and either shows you a fake deposit screen with their own address or proxies your session to the real exchange and replaces the address in the returned HTML. In either case, looking at the URL bar is not enough: many phishing domains use addresses that differ by one character (for example, "exchonge.com" instead of "exchange.com") or use subdomains like "secure-exchange.com". Always type the exchange's URL yourself from memory or use a bookmark you created on a trusted device.

The role of the exchange's own warnings

Reputable exchanges display deposit addresses that change after each transaction or remain static only for a specific memo/tag combination. Some also generate QR codes you can scan. These features are not security measures per se, but they make it harder for an attacker to reuse a stolen address. Some exchanges publish a cryptographic signature of their deposit addresses or a list of authorized addresses via a secondary channel. Check if yours does - but only if you can verify that secondary channel independently.

What to do if you suspect you have a fake address

Stop. Do not send any funds. Close the browser, clear the cache, run a security scan on your device, and log in again using a clean browser or another device. If the address still looks unusual compared to what you previously recorded, contact the exchange's support through its official site - not through links in an email or a chat message you received. The hub page under which this information sits, "Swapping crypto safely," explains the broader checks worth making before any transaction and what steps to take when something does go wrong.

Back to exchange fees