Attack demo 1 of 3. The "hacked script" below only edits this page. All demos

Classic crypto checkout

Pay with USDT

Total 16.50 USDT

Send exactly 16.50 USDT on Whitechain to:

0x5409000000000000000000000000000000005409

Demo address, not a real wallet. Do not send funds to it.

What happens

This is how most stores take stablecoins today: the checkout code holds the merchant's address and the buyer copies it.

Copy the address, then inject the script and copy again. The script swaps the address on the page and in the clipboard. A buyer who checks only the first and last few characters can miss it; address-poisoning attackers pick lookalike addresses for exactly that reason.

Log

    Next: the same script against the Sitebound checkout