Short version. Most Bitcoin losses to "wrong addresses" are not typos: the wallet's checksum rejects almost every typo before you can send. The real risk is a perfectly valid address that belongs to an attacker and looks like one you know. This is called address poisoning.
How the attack works
- The attacker watches an address you use and generates a new address that copies its first and last characters.
- They send you a tiny transaction from that lookalike address, so it appears in your transaction history.
- Later you copy "your usual address" from the history. Wallets and explorers often show only the first and last characters, so it looks right. You pay the attacker.
Reported scale
- A Carnegie Mellon (CyLab) study covering 2022 to 2024 reported more than 270 million poisoning attempts against over 17 million wallets, with confirmed losses of at least $83.8 million (as summarised by bex.co).
- One copy-paste mistake was reported to cost a trader about $50 million in December 2025 (CoinDesk).
- Chainalysis documented a victim who lost nearly $68 million in wrapped bitcoin after an operation built 82,031 lookalike addresses (Chainalysis).
These figures come from the linked reports and their summaries; check the sources for exact definitions.
Why a checksum does not help
The lookalike is a real, valid address that the attacker controls, so checksum validation passes. What gives it away is similarity to an address you already know.
How unlikely is a coincidence?
Two unrelated addresses share characters by chance with probability alphabet-n (32 symbols for bech32, 58 for Base58). Computed values:
| Matching characters (after bc1q) | Chance two unrelated bech32 addresses match this much | What the checker says |
|---|---|---|
| 4 | 1 in 1,048,576 | Suspicious (medium) |
| 6 | 1 in 1,073,741,824 | Likely lookalike (high) |
| 8 (e.g. 4 + 4, what many wallets display) | 1 in 1,099,511,627,776 | Likely lookalike (high) |
| 11 | 1 in 3.6e16 | Likely lookalike (high) |
| 8 in a legacy (Base58) address | 1 in 1.3e14 | Likely lookalike (high) |
The checker skips the fixed header (bc1q, 1, 3), counts matching characters at both ends, and raises an alert from 4 matching characters (medium) and 6 (high). Two addresses that differ in at most 3 positions are always flagged.
What to do
- Compare the whole address, not the first and last characters.
- Do not copy an address from your transaction history. Use an address book you built yourself or ask the recipient again.
- Send a small test amount first.
- Treat a tiny incoming transaction from an unknown address as a warning, not a payment.
- Check a candidate against your known addresses with the free tool below (runs in your browser).
Limits
The tool compares only with the list you provide. It cannot tell who owns an address, and "no lookalike found" is not a guarantee. Tested on synthetic lookalikes and on 2,412 independent address vectors; not investment, legal or tax advice.