Insights on Crypto Payments, Infrastructure, and Operations

Crypto Payment QR Replacement

Crypto Payments

Pronunciation: KRIP-toh PAY-muhnt KYOO-AR rih-PLAYS-munt

Also known as: Payment QR Code Replacement

Definition

Crypto Payment QR Replacement is the substitution of a legitimate crypto payment QR code with one that encodes an attacker-controlled address, link, amount, network, or payment request. It exploits the fact that users usually cannot visually inspect encoded data before scanning. In practice, the attacker replaces a printed, displayed, embedded, or dynamically generated QR code so the scanning wallet receives fraudulent payment data.

Overview

Mechanism and important distinctions

QR payment payloads are convenient because long addresses are error-prone to type. They may encode an address alone or contain extra fields such as chain, amount, memo or URI scheme. A scanner should parse these fields using the intended protocol, then display them in a human-readable confirmation view. A malicious replacement can alter a single field without making the QR unreadable.

The safest control is not a particular QR graphic style. It is a trustworthy route from the merchant's order record to the displayed destination, plus independent confirmation of what the wallet is about to sign. Static printed codes need physical tamper checks; web-generated codes need secure page delivery and defenses against browser compromise. If the destination changes during an active invoice, the merchant should invalidate or explicitly version the instructions rather than silently swapping them.

Cross-Network Payment; Crypto Payment Clipboard Hijacking; Crypto Payment Link Hijacking

Example

A café displays a checkout QR code containing an amount, network and payment address. An attacker places a sticker with a different QR code over the display; the customer's wallet scans a valid-looking destination that belongs to the attacker. The transfer can confirm normally while the merchant receives nothing.

Comparison

A scannable QR code proves only that data can be read, not that the destination is authentic. Merchants should render codes from a trusted checkout session, use tamper-resistant displays and include a visible recipient fingerprint where practical. Customers should compare the destination with the merchant's trusted invoice before sending, especially for unusually large transfers.

Key Takeaway

A readable QR code authenticates neither the merchant nor the receiving address.

Sources

  1. Address Poisoning Scams — MetaMask Help Center (2026-08-02)
  2. Clipboard Data, Technique T1115 — MITRE ATT&CK (2026-08-02)
  3. Webhook — OxaPay (2026-08-02)