How to withdraw crypto safely: addresses, networks and test amounts

A crypto withdrawal is final in a way a bank or card payment is not: once a transaction is confirmed on the blockchain, nobody can pull it back, not the platform that sent it, not the network and not a support agent. That makes the few seconds before you press confirm the only point where you can prevent a mistake. Here is what to check.

Why a sent transaction stays sent

Ethereum's own security guide puts it bluntly: a transaction sent on Ethereum is irreversible, and unless you know the owner of the receiving address and can persuade them to return the funds, you will not get them back. Tron works the same way. Its documentation describes a block as final once enough block producers have built on it, typically within about a minute, after which it cannot be replaced.

Tether's FAQ notes that Tether may seize and destroy tokens in response to demands from governments, law enforcement or other authorities. That power is described as an enforcement tool, not as a way to undo an ordinary transfer to the wrong address. Plan as if every withdrawal is permanent, because it is.

Get the address from the source, every time

The safest address is one you copy fresh from the receiving wallet's or service's own receive screen. Avoid copying it from your transaction history, for a specific reason: address poisoning.

In an address poisoning attack, a scammer generates an address whose first and last characters match one you have used before, then makes it appear in your history with a tiny transfer, a zero-value transfer or a fake token that mimics USDT. If you later copy the "recent" address, the money goes to the scammer. A 2025 USENIX Security study measured more than 270 million such attempts on Ethereum and BNB Smart Chain between July 2022 and June 2024, with 6,633 successful thefts causing at least $83.8 million in losses. The authors note similar attacks on Tron.

Your own computer can also be the problem. In June 2026, Microsoft described clipboard malware active since February of that year that watches what you copy and swaps wallet addresses for the attacker's. For Tron addresses, it substituted one matching the first two characters of the original, so a quick glance at the start would not catch it.

The habit that defeats both: after pasting, compare the whole address with the receive screen, including several groups of characters in the middle, not just the first and last few. If your wallet or the receiving service offers an address book, save a verified address once and reuse it from there.

Check twice, send once: there is no chargeback on a blockchain

Checksums catch typos, not swaps

Both networks build error detection into their addresses:

Tron addresses are Base58Check: the last four bytes are a checksum calculated from the rest, so a mistyped character almost always produces an address that wallets reject as invalid.
Ethereum addresses can carry a checksum in the pattern of upper- and lower-case letters, defined in EIP-55. A mistyped checksummed address has about a 0.0247% chance of slipping through. An address written in all lower case carries no checksum at all.

Checksums are a safety net for fat fingers. A poisoned or swapped address is a perfectly valid address, so it passes every checksum. Only comparing against the source protects you there.

Match the network

Tether's FAQ warns that because its tokens exist on several blockchains, people sending them need to check the destination address and make sure they are selecting the correct network. For USDT that usually means choosing between Tron (TRC-20, addresses starting with T) and Ethereum (ERC-20, addresses starting with 0x). Remember that 0x addresses are also valid on other Ethereum-compatible chains, so a 0x address alone does not prove the receiver expects Ethereum. The guide to USDT on TRC-20 vs ERC-20 covers the differences in detail.

CS2Sell withdrawals are paid in USDT on TRC-20 or ERC-20 only, so confirm that the address you enter is one your wallet or receiving service lists for USDT on that exact network. A Tron address entered for an ERC-20 withdrawal, or the reverse, is exactly the kind of mismatch to catch before you confirm.

Send a test amount first

For a new destination or a large amount, send a small test first. Wait until it shows up on the receiving side on the right network, not just on a block explorer, and only then send the rest. Yes, you pay the network fee twice. On a large withdrawal that is cheap insurance against a wrong network, a wrong address or a receiving service that does not support the token.

A test only proves something if nothing changes between the two sends. Use the same saved or freshly copied address for the second transfer and check it again before confirming.

Protect the account you withdraw from

Many losses do not start on the blockchain at all; they start with a stolen login. A few basics from Ethereum's security guide apply to any platform holding your balance:

Use an authenticator app for two-factor authentication rather than SMS, which is vulnerable to SIM-swap attacks. CS2Sell offers authenticator-app two-factor authentication in your account security settings.
Never share a seed phrase or private key. No genuine support agent will ask for one.
Check the domain before you sign in, especially after following a link.
Remove browser extensions you do not need, since many can read and change what is on the page.

If something goes wrong

Look up the transaction hash on a block explorer for the network you actually used, and confirm the recipient and status. That tells you which of the situations below you are in.

If you sent to your own 0x address on the wrong Ethereum-compatible chain, the same key controls that address there, so the funds are usually reachable by switching your wallet to that network. If you sent to a service on a network it does not support, contact its official support with the hash; whether it can help is up to them.

If the address itself was wrong, only its owner can send the money back. Unsolicited offers to "recover" lost crypto, especially ones that ask for your keys or an upfront payment, are a known scam pattern.