Crypto scams generated approximately $17 billion in losses in 2025, with cross-chain swappers among the most targeted victims. Fake swap sites, address poisoning, and clipboard malware exploit the speed at which users send funds across chains. This guide covers the most common attack vectors and gives you a step-by-step routine to verify every swap before you send.
The Scams Targeting Cross-Chain Swappers
Lookalike swap domains and malicious ads
Scammers register domains that look nearly identical to legitimate swap interfaces. A single swapped letter or a hyphen is enough to fool users who click quickly. These fake sites often appear as sponsored search results or social media ads.
Once you connect your wallet to a malicious site, you may sign a transaction that drains your tokens. Signature phishing attacks alone stole $6.27 million from 4,741 victims in January 2026, a 207% increase from December 2025.
Address poisoning attacks
Address poisoning exploits a common shortcut: copying a recent address from your transaction history. Attackers send zero-value or dust transactions from addresses that share the same first and last characters as your real destination. When you copy from history without checking the full string, you paste the attacker's address instead.
Two victims lost a combined $62 million to address poisoning in late 2025 and early 2026. One lost $50 million in December 2025; another lost $12.2 million in January 2026. These are not edge cases.
Fake support DMs
After posting about a swap issue on Discord, Telegram, or X, you may receive a direct message from someone posing as "support." They'll ask you to connect your wallet to a "verification tool" or share your seed phrase. Impersonation scams grew more than 1,400% year-over-year in 2025, powered in part by AI-generated personas that look convincing.
No legitimate protocol will ever DM you first or ask for your seed phrase. Treat every unsolicited message as hostile.
Clipboard malware
Malware running in the background can detect when you copy a crypto address and silently replace it with an attacker-controlled address. You paste what you think is your own wallet and unknowingly send funds to a thief.
This attack is especially dangerous because everything looks normal until you check the address character by character after pasting.
Supply-Chain Risk: Hardware Wallet Tampering
On October 29, 2026, Singapore police warned that some Ledger hardware wallets sold through local stores had been tampered with. Two cases resulted in losses of approximately S$3.5 million ($2.7 million USD) since September 10, 2026. The devices came with pre-set seed phrases controlled by attackers.
Buy hardware wallets only from the manufacturer's official site or authorized resellers. When the device arrives, verify the packaging shows no signs of tampering. Most importantly, your hardware wallet should generate a fresh seed phrase during setup. If a device comes with a seed already written down, stop immediately.
A Verification Routine Before Every Swap
Understanding what a cross-chain swap really costs matters, but none of it helps if you send funds to a scammer. Use this checklist before every swap.
1. Verify the domain
Type the URL manually or use a bookmark you created yourself. Never click swap links from ads, DMs, or search results without inspecting the full domain. Check for subtle misspellings: swapped letters, extra characters, or suspicious subdomains.
2. Compare the full address
Do not rely on just the first and last four characters. Expand the address and verify the entire string. For high-value transfers, cross-check the address against multiple sources, such as a previous confirmed transaction on a block explorer.
3. Paste, then inspect
After pasting an address, compare what appears in the input field against your original source character by character. Clipboard malware depends on you not looking twice.
4. Send a test amount
For any significant transfer, send a small test transaction first. Wait for it to confirm, verify you can access the funds at the destination, and only then send the full amount. The extra network fee is cheap insurance.
5. Track your swap on an explorer
Use a block explorer to confirm the transaction reached the correct address. For cross-chain swaps, protocol-specific explorers show the full swap lifecycle. For example, Chainflip Scan lets you track a swap from deposit to final settlement, including the exact output address and amount received.
Staying Safe as Cross-Chain Activity Grows
The cross-chain swap market continues to expand, which means attackers will keep refining their methods. Speed is not your friend when verifying a transaction. Taking 30 extra seconds to confirm a domain, inspect an address, or send a test amount can save you from losing everything.
Scammers count on urgency and habit. Build a verification routine that slows you down just enough to catch the obvious traps before you hit send.
Resources
Swap - Start swapping native assets
Lending - Borrow against native Bitcoin
Blog - Product updates and announcements
Chainflip Scan - Track swaps and network activity
Website - Explore Chainflip
Earn with Chainflip:
Boost - Earn fees by providing single-sided liquidity with no IL risk
Stablecoin Strategies - Deposit stablecoins and earn optimized yields
Provide Liquidity - Supply assets to Chainflip's liquidity pools
Stake FLIP - Delegate FLIP and earn staking rewards
Find us:
What is address poisoning in crypto?
Address poisoning is an attack where scammers send dust transactions from addresses that look similar to your real wallet addresses. When you copy an address from your transaction history without verifying the full string, you may accidentally paste the attacker's address instead of your intended destination.
How can I spot a fake crypto swap site?
Check the URL carefully for misspellings, extra characters, or unusual subdomains. Type the address manually or use a saved bookmark rather than clicking links from ads or search results. Legitimate protocols also display consistent branding and will never ask you to share your seed phrase.
Why should I send a test transaction before swapping?
A small test transaction confirms that your destination address is correct and that you can access funds at the receiving wallet. This extra step catches address poisoning, clipboard malware, and simple copy-paste errors before you commit a larger amount.
How do I verify a cross-chain swap completed correctly?
Use a block explorer to track your transaction. Protocol-specific explorers like Chainflip Scan show the full swap lifecycle, including the deposit, execution, and final settlement address. Confirm the output address and amount match what you expected.
Is it safe to buy a hardware wallet from a third-party retailer?
Buying from unauthorized sellers introduces supply-chain risk. Tampered devices may come with pre-set seed phrases controlled by attackers. Purchase hardware wallets only from the manufacturer or official resellers, and always let the device generate a fresh seed phrase during setup.
