QR code swap attacks: the crypto scam hiding in plain sight

Most crypto scams live online. Phishing emails arrive in your inbox. Malicious links circulate on Discord. Fake websites appear in search results. The attack surface, in most people’s mental model, is somewhere on the internet.

QR code swap attacks are different. They happen in the physical world, in places you trust, at moments when your guard is completely down. They have hit conference venues, restaurants, charitable donation points, and retail merchants. They require almost no technical skill to execute. And they are almost impossible to detect once they are in place.

How the attack works

A QR code is a visual encoding of a string of data. In a crypto payment context, that string is typically a wallet address, sometimes with an amount and network specified. When you scan the code with your phone, your wallet app decodes the string and populates the send field with whatever address the QR encoded.

The attack is straightforward. An attacker prints a sticker containing their own QR code, encoding their own wallet address. They find a legitimate payment QR code in a physical location, such as a donation box at a conference, a payment display at a merchant, an invoice taped to a wall, or a poster at a community event. They place their sticker precisely over the legitimate code.

You walk up, scan the code, see the send confirmation screen in your wallet, and pay. Your wallet decoded the address correctly. The transaction goes through without error. The funds go to the attacker.

The legitimate QR code underneath the sticker is irrelevant. The original merchant or charity receives nothing. Nobody knows the swap happened until the expected funds fail to arrive, which may not be noticed for hours or days.

Why it is so difficult to detect

A sticker placed over a QR code is visually indistinguishable from the original if the attacker takes modest care. The attacker can print a sticker on glossy paper in the same general style as the original, size it precisely to cover only the code area, and apply it cleanly. Unless you are actively looking for a sticker edge or examining the code at close range with suspicion, you will not notice.

The decoded address gives you no help. A 42-character hex string tells you nothing about whether it is the right address. You would need to independently source and verify the intended wallet address before scanning, compare the full decoded string character by character against it, and do this every time you make a payment. Nobody does this.

The transaction itself is clean. No fraud flag is triggered. No payment processor intervenes. The blockchain records a valid transaction from your wallet to an address. The fact that the address was not the intended recipient is not visible in the transaction data.

Detection typically happens only when the legitimate recipient checks their incoming transactions and finds an expected payment missing. By then the trail is cold. The attacker’s wallet may have already forwarded the funds through a mixer or a chain of subsequent wallets. Recovery is effectively impossible.

Where these attacks have occurred

QR code swap attacks have been documented at crypto conference payment terminals, where attendees paying for merchandise or services in crypto sent funds directly to attackers. The physical nature of conference payments and the general assumption of legitimacy in those environments made detection slow.

Charitable fundraising is a notable target. Donation stations at events and physical collection points have been compromised. Donors believing they were supporting a cause sent funds to an attacker instead. The reputational damage to the fundraising organisation, when eventually discovered, compounds the financial loss.

Retail merchants accepting crypto payments at point-of-sale have been hit. In some cases, the merchant continued displaying the compromised QR code for days before noticing that their incoming crypto payments had stopped while customer payment confirmations continued.

Peer-to-peer payments in physical settings, where one party displays a QR code on their phone or a printed invoice, are also vulnerable if the QR code itself was generated by a compromised application or if the printed version has been interfered with.

The habit defences

For paying: ask the recipient to confirm the first and last several characters of their wallet address verbally or in a text message before you scan and pay. Compare those characters against the decoded address your wallet shows after scanning. If they do not match, do not pay.

For displaying your payment code: generate your QR code fresh at the point of payment from a trusted application rather than using a pre-printed or pre-displayed version that could have been compromised. If you use printed QR codes, examine them for sticker overlays before each payment session and replace them regularly.

For high-value payments: avoid QR codes entirely. Have the recipient send you their address through a verified channel you trust, such as a direct message on a platform with a confirmed identity, and copy it from there.

Why readable wallet domains change the risk profile

The QR code swap attack works because QR codes encode hex addresses that cannot be human-verified. The decoded string your wallet shows after scanning is the same incomprehensible character sequence that makes every address-based attack possible. You have no way to know, at a glance, whether 0x71C7…976F is the address you expected.

A QR code can also encode a domain name. When a payment QR code encodes benson.erc instead of a hex address, the decoded string your wallet shows after scanning is a readable name. You know what name you expected. You can see immediately whether the decoded name matches it.

An attacker executing a QR code swap against a domain-based payment code has a harder problem. They cannot generate a lookalike domain name that your eye will accept the way it accepts a lookalike hex string. The first four and last four characters of benson.erc are b, e, n, s and e, r, c. A convincing lookalike would need to be visually indistinguishable at a glance, and readable names simply do not offer the same spoofing surface as hex strings do.

The attack is not impossible against domain-based payments. But it is significantly harder to execute invisibly, because the decoded output is something a human can actually read and verify in the moment.

permanentwallet.xyz offers .erc and .erc20 domain registration for exactly this reason. A payment identity built on a readable name rather than a hex string raises the bar for every category of address-based attack, including the ones that happen in the physical world.

The pattern across all seven attacks

Address poisoning, blockchain domain confusion, poor wallet hygiene, seed phrase gaps, clipboard hijacking, wrong-network sends, QR code swaps. These are seven distinct attacks with seven distinct mechanisms. They share one root cause: crypto addresses are not designed for human use.

Every one of these attacks exploits the gap between what a computer can process and what a human can verify. Every one of them becomes harder to execute when the human-facing identifier in the transaction is a readable name rather than a hex string.

The technology to close that gap exists. The habit change to use it is small. The losses it prevents are not.