What Is a Man-in-the-Middle Attack on a Public Wi-Fi Crypto Transaction?

28 October 2026

A man-in-the-middle (MITM) attack on a public Wi-Fi network intercepts the data sent between your device and the cryptocurrency service you are using, allowing the attacker to alter transaction details - such as the recipient address or amount - before the data reaches its destination. You see a legitimate transaction on your screen, but the blockchain records a different one. The attacker profits; you lose your funds.

How the attack works

The core mechanism is simple: the attacker places themselves between your device and the internet, typically by exploiting an unsecured public Wi-Fi network. Every piece of data you send - including login credentials, API requests, and transaction confirmations - passes through the attacker's system before reaching the actual server.

Step-by-Step in a Public Wi-Fi Scenario

1. Attacker sets up a rogue access point. In a coffee shop, airport, or hotel, the attacker creates a Wi-Fi network with a name similar to the legitimate one (e.g., "Starbucks_Free_WiFi" instead of "Starbucks_Guest"). Your device connects to it automatically if it has connected to a similar network before, or you choose it manually because it looks trustworthy.

2. Your device connects to the attacker's network. The attacker's access point forwards your internet traffic to the real network, but it also copies and inspects everything. You can browse normally; there is no obvious sign that anything is wrong.

3. You visit your cryptocurrency exchange or wallet site. The attacker sees the request. If the site uses HTTPS (which most reputable crypto platforms do), the connection is encrypted. However, the attacker can still see which domain you are visiting, and they may attempt a downgrade attack to force the connection to HTTP, or use a forged SSL certificate if your device does not properly validate it.

4. You initiate a transaction. You enter the recipient's wallet address and the amount, then click "Send" or "Confirm." The transaction data is sent from your device.

5. The attacker intercepts and modifies the data. Before the transaction reaches the exchange's server, the attacker replaces the recipient address with one they control. The amount may also be changed, though the attacker typically keeps the same amount to avoid suspicion.

6. The server processes the modified transaction. The exchange or wallet service sees the attacker's address as the destination. It signs and broadcasts the transaction to the blockchain. The funds are transferred to the attacker.

7. You see a confirmation - but for the wrong address. The transaction hash and block confirmation appear on the blockchain explorer. The address shown is not the one you intended. By the time you notice, the attacker has already moved the funds.

Why public wi-fi is particularly dangerous

Public Wi-Fi networks lack the security controls of a private home or office network. Encryption is often weak or absent. Other users on the same network can see traffic that is not encrypted, and even encrypted traffic can be intercepted and analysed. The attacker does not need physical access to your device - only to the network you are using.

Common Variants

• Rogue access point. The attacker sets up their own Wi-Fi hotspot. This is the most common method.
• ARP spoofing. The attacker sends fake Address Resolution Protocol messages to associate their MAC address with the IP address of the network gateway. Your device sends traffic to the attacker instead of the router.
• DNS spoofing. The attacker redirects your DNS requests to a fake site that looks identical to the real exchange or wallet service. You enter your credentials and transaction details on the fake site.

How to protect yourself

No single measure is foolproof, but combining several makes an attack far harder.

Before using public wi-fi

• Use a VPN. A reputable VPN encrypts all traffic from your device to the VPN server. Even if an attacker intercepts your data on the public Wi-Fi, they see only encrypted gibberish. The VPN server then sends the request to the destination. This breaks the man-in-the-middle chain.
• Disable automatic Wi-Fi connections. Turn off the setting that lets your device connect to open networks automatically. Choose networks manually and verify the name with staff if possible.
• Use your mobile data instead. Cellular networks are generally more secure than public Wi-Fi. If you need to make a crypto transaction, tethering from your phone is safer than connecting to an unknown hotspot.

During the Transaction

• Verify the website's certificate. In most browsers, click the padlock icon next to the URL. Check that the certificate is issued to the correct domain and is not expired. A valid HTTPS certificate does not guarantee safety, but a missing or invalid one is a red flag.
• Copy and paste addresses from a trusted source. Do not type addresses manually. Use the clipboard, but be aware of clipboard hijacking (already covered on this site). Double-check the pasted address character by character before confirming.
• Use a hardware wallet. A hardware wallet signs transactions on the device itself. The attacker cannot modify the transaction data after it leaves your computer if the hardware wallet displays the correct address for you to verify.
• Check the transaction on a block explorer before sending. Some wallets allow you to review the raw transaction data before broadcasting. If the address looks wrong, cancel.

After the Transaction

• Monitor the blockchain. Check the transaction hash on a block explorer within minutes of sending. If the destination address is not what you intended, contact the exchange or wallet support immediately. There is no guarantee of recovery, but prompt action may help.
• Revoke permissions. If you used a DApp or smart contract, revoke any token approvals that might have been exposed (covered elsewhere on this site).

What to Do If You Are a Victim

If you realise that a transaction was intercepted, time is critical. The attacker will move the funds as quickly as possible. Report the incident to the exchange or wallet service you used. File a report with local law enforcement and with the relevant cybercrime unit. Provide the transaction hash and any network details you can recall. Recovery is unlikely but not impossible if the funds are frozen at an exchange.

The most effective defence is prevention. Treat every public Wi-Fi network as potentially hostile. Use a VPN, verify every address before confirming, and never assume that a transaction shown on your screen is the one being broadcast to the blockchain.

Back to crypto scams