How can I check if a swap deposit address is real and not a phishing copy

05 September 2026

You check by comparing the deposit address you see on the exchange interface against the address you manually retrieve from a trusted source - ideally the exchange's official website or app. If they match exactly, the address is real. If they differ by even one character, do not send funds.

Phishing attacks work because they create urgency or distraction. A fake site, browser extension, or pop-up window shows you a deposit address that belongs to an attacker. You copy it, paste it into your wallet, and the money goes to them. The exchange never sees it.

Here is the specific process.

Step one: open the exchange interface yourself. Navigate to the deposit page for the asset you want to swap. Do this by typing the exchange's URL directly into your browser bar. Do not click a link from an email, a social media post, or a search result. Bookmark the correct URL after you confirm it once.

Step two: read the deposit address on screen. Most exchanges display it as a long string of letters and numbers, often with a QR code. Do not copy it yet.

Step three: retrieve the same address from a second, independent source. The best method is to open a new browser tab, type the exchange's URL by hand again, log in separately, and navigate to the same deposit page. Compare the two addresses character by character. They should be identical. Some exchanges let you view your deposit address in your account settings or transaction history - that is another valid second source.

Why two sources? A phishing page can show you a fake address inside a fake version of the exchange site. If you check a second copy from a fresh login, you break the illusion. The attacker cannot control both sessions unless you are fully compromised (which is rare if you use a clean browser and no suspicious extensions).

What if the addresses match? You can safely send funds to that address - for that specific swap, at that moment. Some exchanges rotate deposit addresses after each transaction. Check fresh every time.

What if they do not match? Stop. Close all browser tabs. Clear your browser cache and cookies. Run a malware scan on your device. Then start again from a clean browser. If the mismatch persists, contact the exchange's official support through its verified support channel - never through a chat widget on a page you are unsure about.

Additional checks worth making before any swap:

• Verify the domain name in the address bar. Common tricks: using "exchаnge.com" with a Cyrillic "а" instead of Latin "a", or "exchage.com" missing one letter. Read the URL character by character.
• Check your browser extensions. Malicious extensions can rewrite deposit addresses on legitimate sites. Disable any extension you do not explicitly trust before swapping.
• Use a hardware wallet where possible. It signs transactions on the device, so even if your computer shows a fake address, the hardware wallet will display the real destination before you confirm.
• Send a small test amount first. If the swap site is real, the test transaction will confirm normally. If it is a phishing site, the test amount vanishes - and you lose only that small sum instead of your whole balance.

When something goes wrong: If you send funds to a phishing address, recovery is almost never possible. The attacker controls that address, not the exchange. Report the incident to the exchange and to local law enforcement, but set expectations low. Crypto transactions are irreversible.

For the full context of deposit security, see the hub page "Swapping crypto safely". It covers the broader workflow: choosing a swap method, verifying the exchange, and handling failed or stuck swaps. The address check described here is one step in that process - the step that stops most phishing losses before they happen.

Back to nft markets