← Back to Blog

Web3 Security · 9 min read · October 28, 2026

Are QR Codes Safe for Crypto Payments? How Quishing Drains Wallets in 2026

A QR code is the only payment instruction that hides itself until the moment you act on it. In crypto, where transfers are final and an approval can be unlimited, that gap is now a production line for drainers — here is how the 2026 QR attacks work and how to verify a code before it costs you a wallet.

Are QR codes safe for crypto payments?

A QR code is a container, not a security control. It holds a string of text — usually a URL or a wallet address — encoded in a pattern no human can read. Scanning one means trusting a destination that was deliberately hidden until after you committed to opening it.

That matters most in crypto, where a transfer cannot be reversed and an approval can be unlimited. Keepnet Labs found roughly 2% of all scanned QR codes are malicious, and KnowBe4 and NordVPN found 73% of people scan without verifying where a code goes. Two risks hide here: a payment code pointing at the wrong address, and a connection code that pairs your wallet to a malicious app.

Why quishing defeats the filters you already trust

Quishing is phishing where the link lives inside a QR image instead of the email text. Secure email gateways parse headers, body text and hyperlinks; an image of pixels has no URL to extract, so the message arrives with nothing to flag.

The trend is steep. The Anti-Phishing Working Group tracked a 400% increase in image-based phishing heading into 2025, Microsoft reported that QR codes embedded in email bodies surged 336% in March 2026, and Keepnet and Supercode put image-encoded payloads at 12–12.4% of all phishing incidents. ZenSec counted 1.7 million unique malicious QR codes in attachments during 2025.

The second half of the trick is the device swap: you scan with a personal phone, moving the attack past the proxy, the DNS filter and the endpoint agent, onto the one device nobody is watching.

The four QR attack paths that target crypto

1. Physical sticker swaps

In September 2026 the FTC warned that scammers were covering legitimate QR codes on parking meters with their own stickers. Ann Arbor police found fakes labelled “Scan to Park!” in October, and Redondo Beach previously found them on roughly 150 meters. Replace the meter with a merchant counter, invoice or donation box and you have the crypto version: a sticker over the receiving code, pointing at someone else’s address.

2. Quishing attachments posing as account notices

The familiar lure, re-delivered: “unusual withdrawal detected”, “re-verify your identity”, “complete your payout setup”. The instruction is always to scan with your phone and finish on mobile — exactly where the link cannot be previewed.

3. Wallet deep-link abuse

This is the path that turned a scan into a drain. CYFIRMA documented a campaign in April 2026 in which codes distributed through Telegram were wrapped in a wallet’s own deep-link handler — link.trustwallet.com/open_url?url=... — so the redirect appeared to come from a trusted intermediary. The destination was a lookalike “Send USDT” page that never sent anything: it requested an ERC-20 approve() granting an unlimited allowance to an attacker contract on BNB Smart Chain, dressed up as a one-dollar transfer. Researchers logged 52 exfiltration notifications and affiliate tracking parameters — the signature of drainer-as-a-service.

4. Scan-to-connect pairing codes

A session QR does not authorise anything by itself; it pairs your wallet to an application. The danger is the next prompt. Pairing is not permission, but it is the doorway permission walks through.

What the code actually asks you to sign

There are only two shapes that matter. A transfer moves a specific amount to a specific address, once. An approval grants a contract permission to move your tokens later, up to a limit — and attackers ask for the maximum, 2²⁵⁶−1, which wallets display as “unlimited”.

An unlimited approval carries no token value and costs only gas, which is why it slides past anyone watching their balance. It also covers future deposits: once granted, the attacker can call transferFrom() whenever they like, without another signature, until you revoke it.

The rule is narrow and it works: a payment should produce a transfer of a stated amount to a stated address. Anything that says connect, enable, unlock or verify is not a payment.

How to verify a QR code before you act

• Never scan a code from an unsolicited message. A DM, comment or email that opens with “scan this” is the attack.
• Decode before you open. Most camera apps show the URL first. Read the hostname, not the page title — a lookalike with the right logo still lives on a domain you have never heard of.
• Type the address instead. For a payment you already expect, use a saved contact, an ENS name or your address book.
• Receiving never needs a scan. To get paid you display your address; a flow that asks you to scan in order to receive or verify is asking for something else.
• Check the full string on the device that signs. Confirm the first and last eight characters on the hardware-wallet screen, not on the phone that read the sticker.
• Refuse unlimited approvals. Set an exact amount where the wallet allows it, and revoke what you no longer use.
• Inspect physical codes. A raised sticker edge, mismatched branding or a code placed beside the signage is a tell.

If you already scanned and approved

Speed matters more than tidiness. Disconnect the session, then revoke the approval at the token contract through a tool such as revoke.cash. Check for an EIP-7702 delegation as well: a delegation is code, not an allowance, and revoking approvals will not remove it. Move whatever remains to a freshly generated wallet and treat the old address as burned. Report the loss to the exchange’s fraud team and your national fraud line within hours — and expect a wave of “recovery” offers, which are their own scam.