Wallet security involves two different questions: who can authorise access to your assets, and where a transfer will send them. Protecting a recovery phrase helps with the first. Checking the full destination address helps with the second.
Scammers can target either point. They may imitate a wallet provider to obtain secrets or make an incorrect destination look like an address you have used before. This guide explains the differences and the checks to make before acting.
Key takeaways
Keep seed phrases and private keys private; they are different from public wallet addresses.
Verify an address from its original trusted source, not just from transaction history.
Check the complete destination after pasting and again before confirming a transfer.
Exchange accounts and self-custody wallets
A custodial exchange account and a self-custody wallet do not use the same access model. With a custodial service, the provider manages the relevant private keys and you access your account through its login process. With self-custody, you are responsible for the credentials that control the wallet.
This distinction is explained in MetaMask's wallet overview. It matters because a wallet recovery instruction is not a general method for recovering an exchange account.
For CoinByte account questions, use CoinByte's published account and support guidance. Do not follow a stranger's instructions to create or import a self-custody wallet as a supposed requirement for verifying an exchange account.
Seed phrases, private keys and public addresses
A seed phrase, also called a recovery phrase, is a wallet backup made of a sequence of words. In common wallet systems it can restore the keys used to control multiple accounts. A private key authorises control of assets associated with the relevant account.
A public wallet address is a destination identifier that may be shared to receive funds. It does not provide the same access as a private key or recovery phrase. Read Ledger's seed phrase explanation for the underlying distinction.
Anyone obtaining sufficient wallet secrets may be able to move your assets. Do not send them in a support message, include them in screenshots or enter them into an unexpected online form.
There are legitimate wallet restoration processes, but they must follow the actual provider's instructions using verified software or hardware. A stranger offering to restore a wallet is not a substitute for those checks.
Fake wallet apps and fake support
A malicious app or browser extension may copy the name and appearance of a real wallet. After installation, it may invite you to import a recovery phrase. Entering that phrase can expose the wallet even if the app then shows a familiar balance.
Obtain software through the wallet provider's independently verified website and its official store links. Check the publisher and permissions. A polished logo or large number of positive reviews does not independently establish authenticity.
Fake support often appears after you post a question online. Someone may send a private message claiming you must validate, synchronise or repair a wallet. They may direct you to a form asking for secrets. Use the provider's published support channel yourself.
Trezor's wallet backup guidance illustrates why backup words must remain private and why the device's official recovery process matters. Follow the guidance specific to your own wallet.
Address poisoning
Address poisoning attempts to make the wrong destination look familiar. An attacker may cause a lookalike address to appear in your transaction history, for example through a small incoming transaction. You later copy that entry, assuming it belongs to a known recipient.
The attacker does not need your private key if you authorise a transfer to the wrong address yourself. Recognising the first and last characters is insufficient when the middle characters differ.
Clipboard malware
Clipboard malware targets copy and paste. You copy the correct address, but malicious software replaces the clipboard contents with another address before you paste it.
Unlike address poisoning, the error may appear even when you started with a correct trusted source. Always compare the pasted result with the original. Binance's official explanation of address poisoning also covers the risk of altered clipboard contents.
Unexpected mismatches are a reason to stop, not to keep trying until the screen looks right. Do not authorise a payment from a device you suspect is compromised.
A fictional example
This scenario is invented and does not describe a CoinByte customer.
Noah previously sent crypto to his own wallet. Before a later withdrawal, he copies an address from a recent transaction entry. Its beginning and ending look familiar, so he initially assumes it is correct.
Noah compares the entire address with the receiving address displayed in his verified wallet. The middle characters differ. He stops the withdrawal and checks the source of the unfamiliar entry.
The important step was comparison with the intended recipient's trusted source. Familiarity in the history was not enough. If the pasted address had changed instead, the same comparison would also have revealed a problem.
Before withdrawing from CoinByte
Use a deliberate final check:
Obtain the receiving address from the verified wallet or recipient through a trusted channel.
Confirm that the asset and selected network match what the destination supports.
Compare the complete pasted address with the original, including the middle characters.
Include any memo or destination tag required by the recipient.
Review the final confirmation details before approving the transfer.
A correct-looking address does not validate an investment or prove a recipient is honest. These checks reduce transfer mistakes; they do not replace verifying the purpose of the payment.
CoinByte's crypto withdrawal guide provides its published transfer instructions. Check that guide for the current supported process before withdrawing.
If wallet information may be exposed
Contact the relevant wallet provider through independently verified support. If a seed phrase or private key has been disclosed, changing the wallet app's password alone does not replace the exposed keys. Follow official compromise guidance; do not import the same exposed phrase into another app and assume the risk is gone.
MetaMask provides guidance for recognising its real wallet and handling exposed recovery phrases. Different wallet designs require their own official instructions.
Tell CoinByte if a transfer from its platform was involved and preserve the destination address and TXID. Recovery cannot be assumed for a confirmed transfer. For suspicious wallet permissions or tokens, see Fake Tokens, Airdrops and Crypto Giveaway Scams.
防诈骗What to Do If You Think You've Been ScammedIf you think you may have been caught in a crypto scam, act quickly. You do not need to be certain before asking for help. The immediate priority is to prevent further payments and protect any affected accounts or devices. Take these steps firstStop sending money or cryptocurrency and stop following
防诈骗How to Verify a Crypto Platform, App or Investment OpportunityBefore sending money, check the business, the person contacting you and the particular offer. They are separate questions. A real company can be impersonated, and a genuine app can be used to buy crypto that is then sent to a scammer. This checklist helps you identify gaps before making a payment. It
防诈骗Recovery Scams: When Getting Your Money Back Becomes Another ScamAfter losing money, an offer to retrieve it can be difficult to ignore. Someone may say they traced your crypto, found it in a frozen wallet or can recover it using specialist tools. The apparent solution can be another attempt to obtain money or account access. You can seek help without accepting an