Chapter 6 of 6 / it already went wrong
I sent a payment to the wrong place
The honest answer first: it is not coming back. There is no process, no support ticket and nobody to appeal to. What is worth your time is working out how the destination got changed, because that part repeats.
How the destination usually got changed
| Cause | How often | What it means for you |
|---|---|---|
| Software on your machine swapping it between copy and paste | Common enough to assume it | Treat the machine as the problem |
| An expired or reused deposit address | Common | Its own page |
| Copying from an old tab or a screenshot | Common | A habit rather than an attack |
| Typing it by hand | Uncommon | Never do this. Ever |
| A destination given to you by somebody | Uncommon | Different problem, same outcome |
Why a signature check does not catch it
Everything else on this site assumes your machine reports honestly what it received and what it sent. Signature checks, address comparisons and careful reading all run on that machine and are only as reliable as it is.
If the machine is the thing doing the swapping, the checks return whatever it wants them to. That is a real gap rather than an oversight, and the only thing that closes it is comparing the ends of what actually landed in the field against what you meant to send.
The check that would have caught it
Three seconds, every time, including on the small payments where it feels excessive. Compare the first and last several characters after pasting. This is the one check in the whole subject that catches a compromised machine, and it works because a swap replaces the entire string rather than resembling it.
What to do with the machine
- Do not repeat the payment from the same system. Whatever changed it once will change it again.
- Treat saved wallet files on it as suspect. Move funds from a machine you trust more, if you have one.
- Look at what was installed recently, particularly anything obtained outside official channels or anything promising to make Tor faster.
- Reduce how many things are installed on it. Every install is a decision to trust somebody, and the useful question is how many of those you are carrying.
What not to bother with
- Recovery services. There are none. Everything advertising itself that way is a second loss aimed at the first.
- Tracing where it went. You can often see it. That is not the same as getting it back.
- Messaging the market. The payment never touched them.
- Sending again to prove the first one was a fluke. This happens, and it doubles the number.