Wallet safety
How to check a wallet before you send USDC
Sending USDC is irreversible by design. Almost every loss comes from one of three mistakes: the wrong address, the wrong network, or a contract address pasted instead of a wallet. All three are catchable before you sign.
Updated 11 November 2026.
1. Confirm the address came from the owner
Copy the address from a source the recipient controls — their message, their site, their invoice — and confirm it through a second channel if the amount is not small. Address poisoning works by putting a lookalike address in your history: same first and last characters, different middle. Never pick an address out of your recent transactions without comparing the full string.
2. Compare the whole string, not the ends
Wallets shorten addresses to 0x1234…abcd for a reason, and that reason is space, not safety. Open the full address, check the checksum capitalisation, and compare character by character. If your wallet warns that the checksum is invalid, the address was mistyped — do not send.
3. Make sure it is a wallet, not a contract
A token contract, a router or a pool address will accept the transfer and the funds will be stuck. On BaseScan, a wallet shows a balance and a transaction list; a contract shows Contract next to the address and verified source code. If the address has code, it is not somebody’s account.
4. Check the network before the amount
USDC exists on many chains. Base USDC sent to an Ethereum deposit address is a different asset on a different network, and recovering it is a support ticket at best. Confirm the recipient accepts USDC on Base, and that the address they gave you is for that network.
5. Send a test amount first
Send the smallest amount that still proves the route — a dollar, or a few cents — and wait for the recipient to confirm they see it. Only then send the rest. The fee for the test is the cheapest insurance in the whole process.
6. Check what the recipient will do with it
If you are sending to a contract you do not control, the question changes: what can that contract do with the funds, who can upgrade it, and can you withdraw. That is a different check from “is this a wallet”, and it deserves its own reading before a large transfer.
What can go wrong
- Copying from transaction history — That is exactly where a poisoned lookalike lives. Compare the full address, or re-request it.
- Trusting a screenshot of an address — Images are trivially edited and easy to misread. Ask for the string.
- Assuming the exchange will recover it — Cross-chain and contract deposits are often unrecoverable, and support is not a guarantee.
What this does not tell you
These checks reduce the chance of a misdirected transfer. They cannot tell you whether the person behind the address is honest, and they cannot verify a claim about what happens after the funds arrive. For that, the counterparty and the contract matter more than the address format.
Questions
Can a wallet address be spoofed?
The address itself cannot be forged — the keys define it. What is spoofed is the display: a lookalike with matching first and last characters, placed where you will copy it. Compare the full string.
What happens if I send USDC on the wrong network?
Usually the funds arrive at an address the recipient does not control on that chain and are effectively lost. Some bridges and exchanges can recover specific cases; assume they cannot.
Is a test transfer really necessary?
For a new address, yes. It costs a few cents and it is the only check that proves the whole route end to end.