What Is a Crypto Wallet Address? Safety Guide (2026)

Every Ethereum account you control has a public address — a string of characters that looks something like 0x71C7656EC7ab88b098defB751B7401B5f6d8976F. This is the destination you share when someone needs to send ETH or a supported token to that account. Understanding how addresses work and how to verify them is fundamental to using Ethereum safely.

What a Wallet Address Actually Is

An externally owned Ethereum address is derived from the last 20 bytes of the Keccak-256 hash of its public key, then displayed with a 0x prefix. It contains 40 hexadecimal characters after that prefix.

The address is derived mathematically from your private key using one-way cryptographic functions. You can share your public address with anyone — it is how people send you ETH. Your private key is what you must never share — it is what proves you own the address and authorizes transactions from it.

The relationship: private key generates public key, public key generates public address. You can go forward in this chain but not backward. Knowing someone's public address gives you no information about their private key.

How Ethereum Addresses Work

The hexadecimal characters are not inherently case-sensitive, but ERC-55 uses mixed uppercase and lowercase letters as a checksum that compatible wallets can use to catch many typing errors.

An account address stays the same across compatible Ethereum apps unless you switch accounts or wallets. Reusing it across DeFi, NFT platforms, and other services can make that activity easier to connect.

This has a privacy implication: balances, assets, and transaction activity tied to that address are publicly visible on the blockchain. Anyone who knows the address can inspect that public activity with a portfolio tracker.

Types of Ethereum Addresses

Externally owned accounts: standard wallet addresses controlled by a private key. These are what MetaMask, hardware wallets, and exchange accounts generate. They start with 0x and are 42 characters.

Contract addresses: addresses where smart contract code is deployed rather than a private key. DeFi protocols, NFT collections, and tokens all have contract addresses. They look identical to wallet addresses but no private key controls them — they are governed by their code.

On an Ethereum explorer, both account types can show balances and transaction activity. A contract page also exposes deployed bytecode; verified contracts may show source code and contract-specific read and write tools.

Sending ETH Safely

Before sending ETH to any address, verify the destination and network. Confirmed blockchain transfers are typically not reversible, so a copy-and-paste error can be difficult or impossible to recover.

Best practices for sending:

Copy from the recipient, receiving wallet, or exchange deposit screen—not from transaction history. Then compare the complete address before confirming.
For a new destination or high-value transfer, consider a small test first and confirm it arrives. This adds another network fee, so weigh the fee against the amount at risk.
Compare the entire address, especially the middle characters. Address-poisoning attacks place a lookalike address in transaction history and rely on people checking only a shortened prefix and suffix.
Confirm the receiving platform supports the exact network and asset. A familiar address shape alone does not prove you selected the intended chain, and recovery after a wrong-network transfer is not guaranteed.

ENS Names: Human Readable Addresses

The Ethereum Name Service allows wallet addresses to be mapped to human-readable names like vitalik.eth. If someone provides an ENS name instead of a 0x address your wallet will resolve it to the underlying address automatically.

ENS names are convenient but introduce a dependency on the ENS resolution system. Always verify the resolved address matches what you expect before confirming a large transaction.

Keeping Your Address Private

While your address is public by design, there are good reasons not to broadcast it widely. Anyone who knows the address can inspect its public balances and activity, which may create privacy and social engineering risks.

Using separate addresses for DeFi, long-term storage, and receiving payments can reduce simple address-based profiling, though transactions between them or reuse elsewhere may still reveal a connection.

Quick answer

A wallet address is public. Your signing secret is not.

An Ethereum account address is a 42-character public identifier: 0x followed by 40 hexadecimal characters. It can identify either an externally owned account or a contract account. Sharing the address does not let another person sign transactions, but activity tied to it can be visible on the public ledger.

Address, public key, and private key are different

Wallet address

A public identifier used to receive assets and identify an account on a network.

Usually safe to share, but its public activity may reveal balances and transaction patterns.

Public key

Cryptographic material derived from the private key and used to verify signatures.

Wallet software handles it. Most people share the shorter account address instead.

Private key or recovery phrase

The secret that can authorize transactions and recover control of an account.

Never share it, paste it into a website, or send it to support.

What mixed-case checksum addresses do—and do not do

ERC-55 uses a pattern of uppercase and lowercase letters as an error-detection checksum while keeping the same 40 hexadecimal characters. Wallets that validate the checksum can catch many accidental typing errors. A valid checksum does not prove who owns an address, confirm the intended network, or protect you from a deliberately generated lookalike. Preserve the checksummed form when a wallet or trusted source provides it.

A safer five-step send checklist

1
Start from a trusted source
Get the destination from the recipient, the receiving wallet, or the exchange deposit screen. Do not use an unsolicited token transfer or a recent-history row as your source of truth.
2
Compare the complete address
Confirm more than the first and last characters. Look closely at the middle, and compare the destination shown by the wallet with the source you independently verified.
3
Confirm the network and asset
A familiar 0x-shaped address does not prove you selected the intended network. Check the receiving wallet or exchange supports the exact network and asset before sending.
4
Save verified contacts
Use an address book for destinations you use repeatedly, but only after verifying the first entry through a separate trusted channel.
5
Use a test transfer when the stakes justify it
For a new destination or a high-value transfer, send a small amount and confirm receipt before sending the remainder. A test adds another network fee, so weigh that cost against the amount at risk.

Scam pattern

How address poisoning creates a convincing lookalike

An attacker watches public transfers, generates an address that resembles a real destination, and sends a tiny or zero-value transaction so the lookalike appears in the target wallet's history. The attacker is not changing the legitimate address. The goal is simply to make the victim copy the wrong row later.

A suspicious history entry does not, by itself, reveal your private key or mean the wallet is compromised. Ignore the entry, do not interact with unfamiliar tokens, and never copy a destination from that row. Verify every character from the original source instead—especially the middle characters that shortened interfaces often hide.

If you already sent to the wrong address

Save the transaction hash and contact the recipient or receiving platform immediately. Confirm the network and asset involved before following any support instructions. Confirmed cryptocurrency transfers are typically not reversible; recovery may depend on the recipient voluntarily returning the funds or a platform being able to assist. Treat anyone promising guaranteed recovery for an upfront fee as another risk.

Continue safely

Choose an Ethereum wallet Review token approvals Compare hardware wallets Check Layer 2 network and bridge risks

Wallet address safety FAQ

Is it safe to share an Ethereum wallet address?

Sharing a public address does not reveal your private key or authorize transactions. However, activity tied to that address is public, so consider privacy and spam risks before posting it widely.

Why do some Ethereum addresses use mixed uppercase and lowercase letters?

ERC-55 uses letter casing as a checksum that can help compatible wallets detect many typing errors. It does not verify the recipient’s identity or stop a deliberately generated lookalike address.

Does a zero-value transaction mean my wallet is compromised?

Not by itself. It may be spam or part of an address-poisoning attempt designed to place a lookalike address in your history. Do not copy from the entry or interact with unfamiliar tokens; verify future destinations from a trusted source.

Should I copy a wallet address from transaction history?

No. Address-poisoning scams rely on people copying a lookalike from history. Get the destination from the recipient, the receiving platform, or a previously verified address-book entry, then compare the complete address before signing.

Do I always need to send a test transfer?

A test transfer is not a protocol requirement, but it can reduce risk for a new destination or a high-value payment. Confirm the small transfer arrived before sending the remainder, and remember that the test creates an additional network fee.

Can a cryptocurrency transfer to the wrong address be reversed?

Usually not after it is confirmed. Save the transaction hash and contact the recipient or receiving platform promptly, but recovery is not guaranteed and may depend on the recipient returning the funds.

Evidence reviewed August 11, 2026

Primary sources

Address mechanics were checked against Ethereum specifications. Safety guidance was checked against current wallet-provider documentation and the FTC's consumer guidance. Wallet interfaces and warnings can change, so recheck the documentation for the wallet you use before a high-value transfer.

What Is a Crypto Wallet Address? Safety, Checksums, and Address Poisoning