$68 Million Gone in One Copy-Paste: What Happens If You Send Crypto to the Wrong Address
Have you ever stared at a 42-character wallet address, hit send, and felt your stomach drop a second later?
In most cases, crypto sent to the wrong address is gone for good — but "most cases" hides four very different outcomes, and which one you're in decides everything.
On May 3, 2024, one trader sent 1,155 wrapped bitcoin — about $68 million — to an address that looked right and wasn't. The ending was almost unheard of: the attacker sent nearly all of it back. Almost nobody gets that ending. This post maps the four cases, what recovery actually costs, and the habits that make the mistake nearly impossible.
Why a Confirmed Transfer Can't Be Undone
There is no bank to call. Once a transaction is confirmed, only the person holding the private key for the receiving address can move the funds.
A blockchain is a shared ledger with no central operator. No company, exchange, or developer can rewrite an entry after the network has confirmed it. Coinbase states it plainly: crypto transactions are final and cannot be canceled or reversed. MetaMask's support pages say the same — once final, a transaction is not reversible.
That finality has one safety net built in. Ethereum and Bitcoin addresses carry checksums, so a mistyped address is usually rejected by your wallet before anything is sent. The real danger is not a typo. It is a valid address that belongs to someone else — and your wallet has no way to know that.
The scale of permanent loss is hard to grasp. Chainalysis estimated in 2017 that between 2.78 and 3.79 million bitcoin — 17% to 23% of the supply mined at the time — were already lost forever, including the roughly 1.1 million coins mined by Bitcoin's creator, which the study classed as lost. It is an estimate, not a count: a coin that hasn't moved in years looks identical on-chain to a coin whose key is gone. But the direction is clear — every year, more coins join the pile nobody can spend.
If you want the mechanics behind that finality, our step-by-step guide to what happens after you hit send on a Bitcoin transaction walks through each stage, from signing to the six confirmations after which a payment is generally treated as irreversible.
Four Cases: What Actually Happens to Your Money
The outcome depends on one question: who holds the private key for the address your coins landed on?
1. The address is invalid: nothing leaves your wallet
This is the best mistake to make. If the address fails its checksum — the built-in error check in the address format — most wallets refuse to send at all. The transaction is never broadcast, and your funds never move. If your wallet warns you about an address, stop. The warning is the system working.
2. The address is yours, on the wrong network: usually recoverable
Ethereum and the chains built to work like it — Polygon, Arbitrum, Optimism, BNB Smart Chain — derive addresses the same way. The same private key controls the same 0x address on every one of them. So if you sent tokens to your own address on the wrong EVM network, the funds are usually still sitting at your address on that network. Switch your wallet to the correct network, add the token contract if needed, and the balance appears. From there you can bridge it back.
The exception is a jump between networks with different address formats — Bitcoin to an Ethereum address, for example. Those coins are usually unrecoverable, because the address doesn't exist in the same form on the other chain.
3. The address belongs to a stranger: the money is theirs now
A valid address with a real owner is the worst case. The coins now sit in a wallet only that person can open, and the blockchain will not take them back. Your only path is the owner's cooperation — and wallet addresses aren't registered to names, so you often can't even find them. Some victims have sent on-chain messages offering a bounty, which is how the $68 million case ended. That is the exception, not the plan.
Two sub-cases are worse still. A burn address — an address like 0x0000…dead that nobody generated a key for — can never send anything out, so coins sent there are permanently out of circulation. And a smart contract address that wasn't designed to receive your token may hold the funds with no withdrawal function at all. In both cases, nobody can act, and no recovery service can help.
4. The address belongs to an exchange: the exchange decides
When the destination is an exchange deposit address, only the exchange holds the key — so only the exchange can move what arrived. The large exchanges have turned the most common mistakes into a written process, and every one of them says recovery is not guaranteed.
- Coinbase: A self-service asset recovery tool covers certain unsupported tokens sent to a Coinbase address. Recoveries above $100 carry a 5% fee on the amount over $100, plus network fees paid in ETH, and the recovered funds go to a self-custodial wallet you connect. Coinbase also states it cannot recover funds sent on the wrong network in general.
- Kraken: A published recovery table runs from free for a deposit that simply wasn't credited up to $500 for the hardest cases, such as an unlisted asset on an unsupported network. Kraken asks for the transaction ID, the coin and amount, the deposit address used, and the date and time — and states plainly that successful recovery is not guaranteed.
- Binance: A self-service recovery form handles crypto deposited to your own account whose transaction is confirmed on-chain. Its published table lists fees up to 20 USDT with waits of 5 to 30 working days, and the fee is charged only after a successful retrieval.
None of these processes reverses the transaction. They move funds the exchange already controls, case by case, for a fee — and a deposit on a network the exchange doesn't support at all is the hardest case, or impossible.
The $68 Million Copy-Paste: How Address Poisoning Works
Nobody hacked the wallet. The owner copied the wrong address from their own transaction history.
Address poisoning is a scam built around a normal habit. An attacker generates an address that starts and ends with the same characters as one you already use, then sends a tiny or zero-value transfer from it — so the lookalike appears in your transaction history. The next time you reach for a recent address instead of typing it fresh, you copy the attacker's.
Researchers at Carnegie Mellon University, in a study presented at the USENIX Security Symposium in 2025, counted about 270 million poisoning attempts aimed at roughly 17 million victim addresses on Ethereum and BNB Smart Chain between July 2022 and June 2024 — with at least $83.8 million in confirmed stablecoin losses across 6,633 incidents. And that figure is a lower bound: it covers stablecoins only, and many victims never report.
The May 2024 case shows how a single paste can go. On May 3, a trader sent 1,155 wrapped bitcoin, worth about $68 million, to a poisoned address that shared the first characters — 0xd9A1 — with the real one. After a week of on-chain negotiation, in which the victim offered to let the attacker keep 10%, the attacker returned about 22,960 ETH, worth roughly $65.7 million — more than 96% of the value. That return is the exception. Do not plan around a thief's generosity.
The December 2025 case is the sharper warning. A trader sent a small test payment of about $50 in USDT to the correct address. Minutes later, a poisoned entry appeared in their history — and they sent 49,999,950 USDT to an address that matched only the first three and last four characters. A test transaction proves the address you tested. It says nothing about the one you paste next.
What to Do in the First Hour
Move fast, in this order — the first three steps decide whether recovery is even possible.
1. Find the transaction ID
Open a block explorer — Etherscan for Ethereum, Blockchain.com for Bitcoin — paste your wallet address, and find the transfer. Copy the transaction ID (TXID), the destination address, the amount, and the time. Every support team and every recovery form will ask for these first.
2. Work out which case you're in
Use the table above. Invalid address, your own address on another network, a stranger's wallet, or an exchange deposit — each one has a different next step, and the wrong next step wastes the hour that matters.
3. Contact the exchange — through its official app or website only
If the funds landed at an exchange, open a support ticket with the TXID and the details from step 1. If they landed in your own wallet on the wrong EVM network, switch networks in your wallet and check the balance before you contact anyone — you may already be able to fix it yourself.
4. If it was a scam, report it
File a report with the FBI's Internet Crime Complaint Center (IC3). A report creates a formal record and helps investigators track the scam — but treat it as documentation, not a recovery path. Confirmed transfers are rarely recovered through law enforcement.
5. Ignore anyone who offers to recover it for a fee
Recovery scammers monitor public complaints and contact victims promising to retrieve the funds. Real support never asks for your seed phrase or private key, and no legitimate service can reverse a confirmed transaction. Anyone who says otherwise is running a second scam on the first one.
How to Make This Mistake Nearly Impossible
The fix is boring, and it works: never copy a recipient address from your transaction history.
- Verify the whole address, not the first and last characters: Lookalike addresses match the ends by design. Check the middle characters too — that is where the fake differs.
- Use your wallet's address book and withdrawal allowlists: Save a verified address once, then select it instead of pasting it. Lock withdrawals to allowlisted addresses where your platform supports it.
- Send a test transaction — then re-check the address before the real one: A small test is still worth doing for a first-time recipient. Just remember the December 2025 lesson: re-verify the full address for the large transfer, don't paste it fresh from history.
- Use a readable name instead of a hex string: The Ethereum Name Service maps a name like alice.eth to a wallet address, so you type a name instead of copying 42 characters. It removes the copy-paste step where most of these mistakes happen. It is not a safety net: a mistyped name can point to someone else's name, and names expire if not renewed — so check the resolved address before you confirm.
- Never copy from history or a block explorer: Copy the address from the recipient's own message, a QR code, or your address book. Your transaction history is exactly where attackers plant lookalikes.
Key Takeaway
Most wrong-address transfers end the same way: the coins belong to whoever holds the key, and no one can undo a confirmed transaction. The exceptions are narrow — your own address on another EVM network, or an exchange with a recovery process — and they cost time and fees, with no promise of success.
Check the full address before you send, never copy one from your history, and let a readable name do the work a 42-character string can't.
Frequently Asked Questions
Can I cancel a crypto transaction after sending it?
Once it is confirmed in a block, no. While it is still pending, some wallets let you cancel or replace it — by sending a replacement transaction with a higher fee, known as replace-by-fee on Bitcoin, or through the cancel option in wallets like MetaMask on Ethereum. Once it is in a block, that window is closed.
What happens if I send crypto to a burn address?
It is gone permanently. A burn address has no known private key, so the coins can never move again. They join the estimated 2.78 to 3.79 million bitcoin that Chainalysis classed as lost forever — out of circulation for good.
Can an exchange tell me who owns the wrong address?
No. A wallet address isn't registered to a name, so nobody can look up its owner. If the address belongs to another exchange's customer, that exchange may be able to help — but only if you contact them with the transaction ID, and only they decide whether to act.
This article is general information, not financial advice. Crypto transactions are irreversible, and your situation may differ — consider a qualified professional before acting on a loss.
Sources
• Coinbase Help — Recover unsupported crypto: help.coinbase.com — Recover unsupported crypto
• Cointelegraph — Up to four million bitcoins gone forever (Chainalysis study, 2017): cointelegraph.com — Up to four million bitcoins gone forever
• JewelSwap — Address Poisoning: How the Crypto Scam Works and How to Stop It (USENIX Security 2025 figures): jewelswap.io — Address Poisoning
• Binance Square — Address Poisoning: The Scam That Can Empty Your Wallet: binance.com — Address Poisoning
• ChainGate — Sent Crypto to the Wrong Network? How to Recover It, Case by Case (Kraken, Binance, and Coinbase recovery tables): chaingate.dev — Sent Crypto to the Wrong Network?
• Tangem — ENS Names Explained: A Beginner's Guide to Human-Readable Crypto Addresses: tangem.com — ENS Names Explained
• What Is Crypto — Address Poisoning: The Lookalike Crypto Address Scam: whatiscrypto.info — Address Poisoning
Comments
Post a Comment