What it is (one-paragraph answer)
A crypto QR code is a wallet address — the 26-35 character string you'd otherwise type by hand — wrapped in a scannable image, nothing more. It's a different animal from the fiat-rail codes covered in generating a payment QR code for Apple Wallet, Venmo, or PayPal: those route through a processor that can flag or reverse a mistake, while a crypto address is the final destination. Scan it, and whatever's encoded inside is where the funds go. No bank sits in the middle to catch an error.
How it actually works
Encoding: it's just text in a container
A QR code stores data in one of four modes — numeric, alphanumeric, byte, or kanji — and a wallet address fits easily as alphanumeric or byte data, needing only about 26-35 bytes, well within even a small, low-density code. Nothing about the container is cryptographic. The security lives in the address string and the transaction signature, not the QR format itself. That's also why Reed-Solomon error correction lets a code stay scannable with up to 30% of it damaged or covered — handy for a code that's been through a wallet, and exactly the property a sticker-overlay scam relies on.
Static vs. dynamic wallet addresses
Wallet apps generate either a static code — a fixed receive address you reuse — or a dynamic one issued per transaction, sometimes with an amount baked in. See static vs. dynamic QR codes for how that tradeoff plays out generally. Crypto wallets have leaned on QR scanning for this since the first mobile Bitcoin wallet added send/receive-by-QR back in March 2011 — longer than most other QR use cases on this site.
Where you'll see it
Wallet "receive" screens, crypto ATM kiosks, exchange withdrawals, in-person transfers, and checkout displays at businesses accepting crypto directly. Two patterns show up over and over. One: a sticker placed directly over a legitimate code — at an ATM, on a poster — which scans just as cleanly as the real one underneath, the same behavior covered in sticker scams and quishing. Two: a QR code on a fake investment platform, presented as the "deposit address" for an offer promising outsized returns.
Tips, gotchas, and a quick how-to with QRDock
The risk that trips up careful users happens after the scan, not during it. Clipboard-hijacking malware watches for a copied cryptocurrency address and swaps it for an attacker-controlled one matching the same first and last characters — built to survive a quick glance. One tracked sample monitored over 2.3 million addresses to keep its lookalike database current, up from roughly 400,000-600,000 earlier. The swap produces no visible signal.
A few habits close most of the gap: compare the full decoded address, not just the endpoints; send a small test amount first on a new or high-value transfer; skip public codes at unfamiliar locations; check the destination URL before opening if the code leads to a link.
To scan one with QRDock, open the app, point it at the code, and review the decoded text before tapping through — the built-in URL safety check flags known-malicious links. It doesn't verify a wallet address belongs to who you think it does; that part's still on you. Open QRDock to scan and confirm before you send.
Frequently Asked Questions
Is scanning a crypto wallet address QR code safer than typing it?
For accuracy, yes — scanning skips the transcription errors that come with a 26-35 character string. But it doesn't verify the code is legitimate. A tampered or swapped code scans just as cleanly as a correct one, so the accuracy benefit only covers half the risk.
Can a QR code itself be hacked to steal crypto?
Not in the sense of exploiting a flaw in the format — it's a container for text, and anyone can generate one encoding any address. The attack is in what gets put into the code, or what replaces it: a sticker over a legitimate code, a fake investment site's image, or a lookalike address swapped into your clipboard.
What is a clipboard hijacker and how does it relate to QR codes?
Malware that watches your clipboard and swaps a copied cryptocurrency address for an attacker-controlled lookalike sharing the same first and last characters. It's a copy/paste risk, not a QR-scanning risk directly — but the two combine when you scan a code, copy the decoded address into a wallet app, and the hijacker swaps it in that instant.
How do I verify a wallet address after scanning its QR code?
Compare the full address against your trusted source, not just the endpoints — lookalike malware is built to fool a quick glance. Send a small test amount first on a new or high-value transfer, and check that a public code isn't a sticker over the original.
Does QRDock protect against malicious crypto QR codes?
Its URL safety check flags known-malicious links, which helps with codes leading to phishing or fake investment sites. It can't verify a decoded wallet address belongs to who you think it does — that check is best-effort for links, and address verification stays on you.
The bottom line
The QR code isn't the vulnerable part. It's a neutral container that decodes exactly what's inside it, nothing more. The risk lives in what gets encoded before you scan, or what replaces the address after you copy it. A few extra seconds comparing the full address, every time, is the entire defense.