ZAFU checks copied vs pasted addresses, lookalikes, threat signals, and the full address before the field accepts your paste.
See the exact moment ZAFU catches a lookalike address before it reaches the wallet field, then lets a trusted contact through.
Attackers don't need your seed phrase. They send a $0 transaction from a lookalike address — same first 4, same last 4 — and wait for you to copy it from your history.
Nine checks run between your clipboard and the input field. No keys. No signing. Local-first storage. Just a verdict — before the address ever touches your wallet.
You copy a crypto address from anywhere — Etherscan, your friend, a contract page. Zafu silently records the chain, value and timestamp.
You paste on any wallet or exchange. Zafu intercepts before the address reaches the input field. In under 200ms, nine detection checks run — locally.
Clear result. You decide. Trusted addresses auto-confirm in two seconds. Anything else stops cold.
Every paste resolves to exactly one verdict. The colour is the conclusion. The text is the evidence. You're never asked to "consider" — you're shown what happened.
Pasted address differs from what you copied — clipboard malware replaced it mid-paste.
Red modal. Address diff highlighted. Cancel is the only action.
Pasted address looks identical to a trusted contact — same start and end, different middle.
Both addresses shown in 4-char segments. Differing chunks flash red. No quick confirm.
Matches GoPlus Security real-time database or ScamSniffer bundled blocklist.
Red modal. Cannot be overridden. Address is blocked.
Address appears in your history but you've never sent value to it — likely airdrop or dust.
Confirm modal with verification checkbox. You must explicitly verify.
Exact match in your trusted contact history — you've sent value to this address before.
Green banner. Auto-confirms in 2 seconds. No friction.
Address has never appeared in your transaction history.
Confirm modal. Full address shown in 4-char segments. You manually verify.
Two power features that turn Zafu from a paste-checker into a ledger of trust.
Add a wallet, and Zafu pulls every counterparty from your on-chain history. Real recipients become trusted contacts. Lookalikes get flagged on import.
Transfer Check shows a final review before crypto-address pastes: copied-address match, threat signals, field context, and the full address. Confirm to proceed.
Three browser permissions. Local-first data. No advertising telemetry. The Chrome extension source is public and auditable, with a fingerprint you can verify yourself.
Cannot read keys, seed phrases or signing credentials. Cannot sign or initiate transfers. By architecture — not policy.
No analytics, crash reporting, usage tracking or advertising. Pasted addresses go to GoPlus for threat checks — never your wallet address, never your history.
The Chrome extension is pure vanilla JavaScript: no npm packages, no bundler, no CDN scripts. Nothing hidden in a dependency tree.
Every release ships a 16-character fingerprint derived from the security-critical extension files and bundled risk data. Compare against the public release. Verify yourself.
Works on MetaMask, Rabby, Coinbase Wallet, Binance, Kraken, Uniswap and 30+ more. Not locked to any single wallet or chain.
Manual reports and opt-in automatic threat signals feed a shared signal list that protects other users. Anonymous by default. Threshold-reviewed before it affects blocking decisions.
The extension shows the actual pasted address against the trusted address, segment by segment, before the address reaches the wallet field. The design goal is clarity under pressure, not decoration.
ZAFU gives every crypto transfer a final address check before it reaches your wallet. Free. Local-first. Never touches your keys. Public extension source. Four permissions.
Running a small crypto team? ZAFU is exploring Teams / Pro beta workflows for shared address books and transfer reviews. Contact the beta list. Paid products are not live yet.