🪧 Address Labeling

Make crypto wallet addresses human readable!

Product

walllet.com

Role

Product Designer

Industry

Finance, Banking

Year

2023

Why asking users to check the address does not work

An irreversible payment to an unreadable identifier is the core risk in every crypto wallet, and the standard mitigation is a request: please confirm the address is correct. The user compares a few characters against a string they copied from somewhere they have now closed, decides it looks right, and continues. Nothing about that check catches a substituted address, a lookalike, or a deposit address the sender was socially engineered into using.

The information that would actually help is available and simply never surfaced. The wallet knows whether this person has paid this address before. The chain knows whether the address has ever transacted. Third-party data can confirm that an address belongs to a named exchange, or that it has been reported. All of it was sitting one query away from a screen that instead said "double-check the details".

The problem in one sentence: the wallet knew more about the destination than the user did, and asked the user to verify it anyway.

TRADE-OFFS

Why I refused to reduce this to safe and unsafe?

The obvious design is a badge with two values. It fails on the middle: an address nobody has flagged and nobody can vouch for is not dangerous, it is simply unknown, and a binary badge has to file it under one of the two words it owns. In practice it files it under danger, so most ordinary first-time sends get a warning, and a warning attached to ordinary behaviour is a warning people stop seeing.

WHAT I CHOSE	WHAT I CUT	WHY
Six named states	A safe / unsafe badge	Uncertainty deserves its own word. Collapsing it into "unsafe" makes the alarm routine and the routine alarming.
Labels state evidence, not verdicts	A risk score	A score implies a confidence we do not have and cannot explain. "No previous transactions" is checkable; "risk 68" is not.
Inline at checkout, beside the address	A confirmation modal	A modal arrives after the decision and gets dismissed as an obstacle. Inline, the label is read in the same glance as the amount and the fee.
One red state only	Escalating everything uncertain	Red has to stay rare to stay meaningful. Reserving it for reported addresses is what buys the attention when one appears.

MY CONTRIBUTION

What I owned on address labelling

WHAT I OWNED
The taxonomy and its evidence rule, which states exist, what each is allowed to claim, and which source of knowledge it comes from. The severity ladder and the decision to keep exactly one red state. Every label and tooltip word. The placement at checkout, inline with the address rather than as an interruption. And the link back to contacts, so a saved payee or a verified exchange arrives at the checkout already labelled.

Uncertainty deserves its own word. Call it danger and people stop reading the word for danger.

DESIGN DETAIL

Three sources of knowledge, one row of interface

The six states are not a severity list with six rungs. They answer three different questions, and keeping those separate is what stopped the set from collapsing back into a score.

What the wallet knows about you and this address

You have paid it before, or you have not. This is the highest-value signal because it is personal and unfalsifiable by an attacker who can only manipulate what you paste. Its reassuring form removes hesitation from repeat sends; its neutral form marks a first send without dressing it up as a risk.

What the chain knows about the address

An address created moments ago, or one that has never received anything, is not proof of fraud, plenty of legitimate wallets are new. It is still the shape most scam destinations have, and it is exactly what a user cannot see for themselves. These two carry a caution weight without the red.

What a third party can confirm

Only here does the interface make a claim rather than report an observation, so only here does it use the strongest visual language it has. Verified names the service, the exchange, not just a checkmark, because a mark without a name asks for trust without offering a reason. Reported is the single red state in the entire set.

All of it lands in a single row of the checkout, next to the destination and above the fee, where the user is already looking.

What I'd change about the label set

What worked: separating what we know, what the chain knows, and what someone else can confirm. Three sources rather than one scale kept each label honest about its own evidence, and made it obvious which states were allowed to look alarming.

What I'd do differently: two states share the phrase "Not Safe" at different severities, amber on an address with no transaction history, red on a reported one. The amber case is common and the red case is rare, so the frequent state is the one teaching users what the phrase means, and it teaches them it means very little. I'd give the chain-history states their own words and reserve that phrase for the one state that earns it.

What this changed: I now write the copy for the state that fires most often first, because that is the one defining what the label means by the time the rare state appears.