Insights on Crypto Payments, Infrastructure, and Operations

Crypto Payment Link Hijacking

Crypto Payments

Pronunciation: KRIP-toh PAY-muhnt LINK HY-jak-ing

Also known as: Payment Link Substitution

Definition

Crypto Payment Link Hijacking is the unauthorized replacement, redirection, or takeover of a crypto payment link so that a payer receives attacker-controlled instructions or destination data. The visible merchant context may remain convincing even though the underlying URL, page, QR code, or wallet parameters were changed. In practice, the attacker changes a URL, redirect, hosted page, message, domain, or embedded parameters so that the victim reaches fraudulent payment instructions.

Overview

Mechanism and important distinctions

A payment link is a pointer to payment instructions, not the payment instruction's proof of authenticity. Attackers may replace the URL in a social-media message, redirect traffic through a lookalike domain, take over an account that shares invoices, or manipulate a compromised merchant website. The resulting fake checkout can copy logos, invoice totals and even support language while replacing the recipient.

A strong design binds the link to an authenticated order, shows the merchant identity clearly and separates payment-instruction edits from ordinary support messages. Sensitive updates should notify the customer through a trusted channel. Merchants should keep an immutable record of the original URL and recipient, plus the time any authorized change occurred. If a buyer paid a malicious link, evidence gathering and dispute handling are more realistic than promising that an on-chain transfer can simply be cancelled.

Crypto Payment Clipboard Hijacking; Crypto Payment Address Poisoning; Crypto Payment QR Replacement

Example

A seller shares an invoice link in a chat. A compromised social account edits the message to a phishing checkout under a nearly identical domain. The fake page presents an attacker-controlled address and the correct order amount, so the customer may believe the payment instructions are genuine.

Comparison

Protect links at the communication and website levels: authenticated merchant profiles, short-lived signed order tokens where suitable, TLS, domain checks and change-of-address warnings. A correct amount or a familiar logo does not authenticate the receiver. If payment instructions change after issuance, require an independent confirmation path and retain previous link versions for investigation.

Key Takeaway

Trust the authenticated merchant instructions, not the appearance of a shared payment URL.

Sources

  1. Address Poisoning Scams — MetaMask Help Center (2026-08-02)
  2. Clipboard Data, Technique T1115 — MITRE ATT&CK (2026-08-02)
  3. Webhook — OxaPay (2026-08-02)