A clean wallet address is not necessarily a safe transaction – Lessons from a sophisticated crypto fraud attempt

A company was preparing to transfer an amount of CHF 850’000 in USDT. The counterparty information had been reviewed and the receiving wallet address showed no identifiable adverse risk exposure in blockchain forensic tools. Yet the subsequent transaction instructions revealed a sophisticated fraud attempt involving two different forms of wallet address manipulation. The case is a useful reminder that wallet address screening is important – but it is only one element of transaction security.

KEY TAKEAWAY A “clean” wallet address screening result means that no relevant adverse history was identified at the time of screening. It is not a general assurance that the transaction, the counterparty or later payment instructions are safe.

1. What happened?

The client was considering a material payment ofapprox. 850’000 USDT in connection with a commercial transaction. As part of the preparation, information on the intended recipient and the proposed receiving wallet address was reviewed. The blockchain forensic screening showed that the wallet address was new and did not have identifiable risk exposure. In other words, the screening result itself did not indicate that the wallet address was connected to illicit activity.

The engagement with the alleged broker appeared straightforward and low-risk. The proposed arrangement did not involve any upfront retainer or other advance payment. Rather, the broker’s compensation was structured solely as a success fee, payable in cryptocurrency, and conditional upon introducing investors and the successful completion of the financing round. At first glance, this seemed to pose no direct risk or exposure to the company.

However, the risk became apparent only later. The alleged broker introduced additional “verification” steps and instructed the client to carry out specific wallet address operations. Rather than treating those instructions as purely technical implementation details, the client asked for further advice. A closer review of the entire transaction flow showed that the proposed steps could have redirected the client’s funds to wallet addresses controlled by third parties.

This sophisticated fraud attempt unfolded in two stages, utilizing distinct manipulation techniques to exploit different vulnerabilities, which are described in detail below.

2. First attempt: weaponising a human-readable ENS name

The client was asked to create a second account in its hardware wallet and to use a specific .eth name in connection with an internal transfer. In parallel, that same Ethereum Name Service (ENS) name had been registered and configured to link to an externally controlled wallet.

ENS is designed to make blockchain interactions easier: instead of entering a long hexadecimal Ethereum wallet address, a user can enter a human-readable name, which is then resolved to the underlying address. That convenience can become a risk if the name has not been independently verified. Had the client entered the instructed ENS name as the recipient in an interface resolving ENS names, the payment could have been routed to the address associated with that name rather than to the client’s own second wallet address.

The lesson is not that ENS is unsafe. The lesson is that a human-readable name must be treated as an address-routing instruction. For material transactions, the name and the full underlying address should be independently verified before execution.

3. Second attempt: address poisoning

After the first approach did not succeed, a second technique appeared. Externally controlled wallet addresses were generated to look very similar to addresses legitimately used by the client. The first and last characters were deliberately close to those of the genuine wallet addresses. Small inbound transfers were then sent from the lookalike wallet addresses so that they appeared in the client’s transaction history.

This technique is commonly referred to as “address poisoning”. It exploits the fact that wallet interfaces often abbreviate wallet addresses and that users may recognise an address mainly by its first and last characters. The attacker’s objective is to make the lookalike wallet address appear familiar enough that it is later copied from the transaction history and used for a material transfer.

In this case, the pattern was particularly striking because multiple micro-transfers were used to place several lookalike wallet addresses into the relevant transaction history.

4. Why the initial wallet screening was not enough

Blockchain analytics and wallet screening remain essential tools. They can identify links to known illicit activity, sanctions exposure, fraud typologies and other risk indicators. But they answer a specific question: what can be learned from the history and exposure of the wallet address being screened?

They do not, by themselves, establish that every later wallet address or name presented during the payment process is controlled by the intended recipient. Nor do they validate the integrity of a changing transaction flow. This case illustrates the distinction between wallet risk and transaction integrity.

The initial forensic result was therefore not “wrong”. A newly created wallet address can genuinely have no adverse transaction history. The critical mistake would be to convert that limited finding into a broader assumption that all subsequent steps proposed by the counterparty are safe.

5. Practical safeguards for material crypto transactions

For companies, founders, CFOs and boards handling significant crypto transfers, the case suggests a number of practical safeguards:

• Treat a wallet screening result as a point-in-time risk assessment, not as a blanket approval of the transaction.

• Verify the full destination wallet address independently and through a trusted channel before every material transfer. Do not rely only on the first and last characters displayed by a wallet interface.

• Do not copy wallet addresses from the transaction history. Only use a previously verified wallet address or another controlled source.

• When an ENS or other human-readable name is used, verify the full wallet address linked to the name and ensure that the intended recipient really controls that wallet address.

• Apply a four-eyes principle to the final recipient, network, token and full wallet address immediately before execution.

• Use test transactions only after the destination wallet address has been independently verified. If the recipient wallet address or the payment instructions change, treat this as a new verification event.

• Escalate unusual “verification” requests. A last-minute change in process, an instruction to create new wallet addresses, or a request to use a particular wallet address or naming convention should trigger renewed scrutiny.

• Preserve the relevant communications and on-chain evidence if fraud is suspected and obtain specialised support promptly.

6. A broader lesson for start-ups and growth companies

Fast-moving companies often have to execute financing, commercial and treasury transactions under significant time pressure. Fraudsters can exploit exactly this combination of urgency, unfamiliar technical processes and seemingly professional counterparties. The relevant risk is therefore not confined to “crypto companies”. Any business that holds or transfers digital assets may be exposed.

This is also why crypto transaction security benefits from an interdisciplinary approach. Corporate and transaction counsel understand the commercial context and the counterparties; financial regulatory and crypto specialists understand the legal and compliance framework; and blockchain forensic expertise helps assess on-chain activity. In a sophisticated case, no single perspective is sufficient on its own.

7. How Kellerhals Carrard supports clients

Kellerhals Carrard combines its Startup & Venture Capital Desk with specialist expertise in Banking, Finance and Fintech, Crypto Compliance and Blockchain Analytics. This allows us to support clients not only with the legal structuring of transactions, but also with counterparty due diligence, wallet and transaction-risk assessments, regulatory questions, and the practical handling of suspected fraud situations.

The present case is an example of that collaboration: an existing venture client was able to draw on specialised crypto expertise when an apparently routine payment process developed into a technically sophisticated fraud scenario.

Note: The client facts have been anonymised. It provides general information and does not constitute legal advice.