Typosquatting

What Is Typosquatting?

Typosquatting is a cyberattack technique where an adversary registers a domain name, software package name, or token name that is nearly identical to a legitimate one, differing by only a small typo, character substitution, or added character. The goal is to intercept users who make minor typing errors and redirect them to malicious resources: fake websites that harvest credentials, compromised code libraries that steal data, or fraudulent tokens designed to drain wallets.

The technique is also known as URL hijacking or domain mimicry when applied to web addresses. It is a subset of cybersquatting, the broader practice of registering domains in bad faith to profit from someone else's trademark or brand recognition. What makes typosquatting particularly effective is that it exploits muscle memory and the speed at which people type URLs, run install commands, or search for tokens. A single wrong keystroke is all it takes.

In cryptocurrency, the consequences are amplified because transactions are irreversible. A user who enters a seed phrase on a typosquatted phishing site or a developer who installs a malicious package cannot undo the resulting theft. This makes typosquatting one of the most cost-effective attack vectors in the crypto ecosystem.

How It Works

Typosquatting attacks follow a common pattern regardless of the specific attack surface. The attacker identifies a high-value target (a popular website, package, or token), registers a look-alike name, and waits for victims to arrive through ordinary mistakes.

Common Typo Strategies

Attackers use predictable variations of legitimate names to maximize the chance of catching errors:

• Character omission: dropping a letter, such as "trustwalet.com" instead of "trustwallet.com"
• Character substitution: replacing visually similar characters, such as using a zero for the letter "o" ("micr0soft.com") or "rn" for "m"
• Adjacent key errors: swapping letters based on keyboard proximity, such as "gooogle.com" or "amzon.com"
• Character transposition: reversing two adjacent letters, such as "crytpo.com" instead of "crypto.com"
• TLD variation: using a different top-level domain, such as ".co" instead of ".com" or ".io" instead of ".org"
• Homograph attacks: using Unicode characters from other scripts that look identical to Latin letters (e.g., Cyrillic "а" in place of Latin "a")

The Attack Chain

Once a victim reaches the typosquatted resource, the attack follows a predictable sequence:

1. The attacker registers the look-alike domain, publishes the malicious package, or deploys the fraudulent token contract
2. The victim makes a typing error and lands on the attacker's resource, often without noticing the difference
3. The malicious resource mimics the legitimate one: a cloned website asks for credentials or seed phrases, a package executes hidden code during installation, or a token drains funds on approval
4. The attacker extracts value: stolen credentials are used immediately, exfiltrated keys drain wallets, or liquidity is pulled from the fraudulent token

Attack Surfaces

Web Domain Typosquatting

The most established form of typosquatting targets web domains. Attackers register misspelled versions of popular cryptocurrency sites: exchanges, wallet providers, DeFi protocol frontends, and block explorers. These fake sites are designed to harvest private keys, seed phrases, or login credentials.

The attack is especially dangerous in crypto because many DeFi interactions begin with a user typing a URL and connecting their wallet. A typosquatted DeFi frontend can present a malicious transaction for signing that grants the attacker unlimited token approval, draining the wallet in a single transaction. Search engine ads have also been used to place typosquatted sites above legitimate results, catching users who search rather than type directly.

An example attack flow for a fake wallet site:

# Legitimate site
https://app.uniswap.org

# Typosquatted variants an attacker might register
https://app.uniswp.org       # missing letter
https://app.unisswap.org      # doubled letter
https://app.uniswap.co        # wrong TLD
https://app-uniswap.org       # hyphen variation
https://app.unıswap.org       # Unicode homograph (dotless i)

Package Registry Typosquatting

Software package registries like npm and PyPI are a growing target for typosquatting. An attacker publishes a malicious package with a name nearly identical to a popular library. When a developer mistypes an install command, the malicious package runs arbitrary code on their machine or in their CI/CD pipeline.

This is a form of supply chain attack because the compromised dependency can propagate through build systems and affect every user of the resulting application. In 2025, security researchers identified over 3,000 confirmed malicious packages across npm and PyPI, with cryptocurrency theft as a primary goal of many campaigns. A March 2026 campaign attributed to North Korean threat actors published 26 malicious npm packages disguised as developer tools, each delivering credential stealers and remote access trojans.

# Legitimate package install
npm install @solana/web3.js

# Typosquatted variants attackers have used
npm install @solana/web3js     # missing dot
npm install solana-web3.js     # wrong scope
npm install @solana/web3.jss   # extra character

# The malicious package may contain:
# - postinstall scripts that exfiltrate environment variables
# - code that scans for wallet key files
# - backdoors that phone home to command-and-control servers

Package lockfiles (package-lock.json, yarn.lock) help prevent this attack in production environments because they pin exact package names and versions. The risk is highest when a developer first adds a dependency by typing the name manually.

Token Name Squatting on DEXes

Because anyone can deploy a token contract on permissionless blockchains, attackers create tokens with names and symbols that mimic popular assets. On decentralized exchanges like Uniswap, these fraudulent tokens appear in search results alongside the real ones.

An academic study of counterfeit tokens on Uniswap found a significant number of fraudulent tokens mimicking legitimate ones, with scammers often targeting upcoming tokens that have growth potential. The structural cause is that DEXes do not require identity verification or token approval processes: any contract address can be traded.

The key defense is to verify the token's contract address rather than trusting its name or symbol. Token names and symbols are arbitrary strings set by the deployer and carry no guarantee of authenticity:

// Token name and symbol are just strings in the contract
// Two different contracts can have identical names
contract FakeToken {
    string public name = "Uniswap";   // same name as real UNI
    string public symbol = "UNI";      // same symbol
    // But the contract address is different
    // Always verify: 0x1f9840a85d5aF5bf1D1762F925BDADdC4201F984
}

Why It Matters for Crypto

Typosquatting is particularly dangerous in the cryptocurrency ecosystem for several reasons that do not apply to traditional web services:

• Transactions are irreversible: there is no chargeback mechanism for stolen cryptocurrency, unlike credit card fraud where transactions can be disputed
• Self-custody means self-responsibility: users who lose self-custodial wallet credentials have no support team to restore access
• High-value targets are concentrated: a single seed phrase controls an entire wallet, making a successful phishing attack far more valuable than stealing a single password
• Developer tooling handles real value: a compromised npm package in a wallet SDK or smart contract deployment pipeline can affect thousands of end users
• Permissionless token listing: unlike centralized exchanges, DEXes do not vet tokens before they become tradable, making token name squatting trivially easy

Security practices like verifying URLs and auditing smart contracts before interaction are essential for anyone operating in this space. For a broader overview of how these attacks fit into the threat landscape, see the research on hardware wallet attack vectors and address poisoning attack defenses.

Countermeasures

For End Users

• Bookmark verified sites: always access exchanges, wallets, and DeFi protocols through saved bookmarks rather than typing URLs or clicking links in messages
• Verify SSL certificates: check that the site's certificate matches the expected organization before entering any credentials
• Use browser protections: modern browsers flag known phishing domains and warn about Unicode homograph attacks in the address bar
• Verify contract addresses: before trading any token, confirm its contract address through the project's official documentation or a trusted block explorer
• Be skeptical of search ads: attackers have used paid search placements to position typosquatted sites above legitimate results
• Use hardware wallets: a hardware wallet displays transaction details on its own screen, providing a second verification layer before signing

For Developers

• Use lockfiles: always commit package-lock.json or yarn.lock to pin exact dependency names and versions
• Verify packages before installing: check download counts, repository links, and publisher history on npm or PyPI before adding a new dependency
• Use security scanning tools: tools like Socket, npm audit, and Snyk detect known malicious packages and flag suspicious install scripts
• Enable two-factor authentication on registry accounts: preventing account takeover of maintainer accounts stops attackers from injecting code into legitimate packages
• Review postinstall scripts: malicious typosquatted packages often use postinstall hooks to execute their payload immediately on npm install

For Organizations

• Register defensive domains: proactively register common misspellings and alternate TLDs for your brand and redirect them to the legitimate site
• Monitor for new registrations: domain monitoring services can alert you when look-alike domains are registered
• File UDRP complaints: ICANN's Uniform Domain-Name Dispute-Resolution Policy allows trademark holders to challenge domains registered in bad faith
• Use the Anticybersquatting Consumer Protection Act (ACPA): in the United States, this law provides a legal remedy against bad-faith domain registration
• Implement DNSSEC: DNS Security Extensions help prevent DNS spoofing attacks that can redirect users even when they type the correct URL

Risks and Limitations of Current Defenses

Despite the countermeasures available, typosquatting remains a persistent threat:

• New TLDs expand the attack surface: the proliferation of top-level domains (.io, .xyz, .finance, .app) gives attackers more variations to register
• Blockchain name services lack UDRP equivalents: systems like ENS operate without centralized dispute resolution, and research has found tens of thousands of squatting registrations across ENS, Unstoppable Domains, and similar services with essentially no defenses in place
• Reactive detection is slow: malicious packages and domains often cause damage before they are identified and removed by registries and registrars
• AI-generated phishing sites are increasingly convincing: automated tools can clone legitimate sites in minutes, making visual inspection unreliable
• Package registries struggle with scale: npm alone hosts over two million packages, making proactive scanning for every possible typosquat computationally expensive

The most reliable defense remains user vigilance combined with technical safeguards: bookmarking sites, using lockfiles, and always verifying addresses and contract hashes before transacting.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.