The USDT address someone sends you in a chat is just a string. Zafu remembers who you've actually paid — which address, on which network — and runs one final Transfer Check before the funds move.
Stablecoin losses rarely start with a hacked wallet. They start at the paste: a poisoned history entry, a swapped clipboard, or the right person on the wrong network.
The attacker planted a lookalike address in the sender's history and waited. The withdrawal looked routine — same first characters, same last characters. The middle belonged to the attacker. $50M in USDT, gone at the paste.
How poisoning works →Infostealer malware replaces the address between copy and paste. Same font, same field, different recipient — invisible unless something compares the paste against its source.
How hijacking works →USDT moves on TRON, Ethereum, and more. The right person on the wrong network can still mean lost funds — and the withdrawal form will not stop you.
USDT TRC-20 checks →ZAFU is a recipient-memory layer for the browser: it learns who you pay, recognizes every paste against that memory, and puts the evidence in front of you before funds move.
Import recipients from your wallet history or save them as you send. ZAFU keeps the address and the network per recipient, locally on your device.
A pasted address resolves to a confidence state backed by evidence — “Known recipient — Sent 14× USDT on TRON” — never a bare green checkmark.
Before funds move, ZAFU shows what was observed, checked, and warned — and says “Not checked” for everything it could not see.
Transaction simulators do good work at signing time. But the largest stablecoin losses happen where there is no transaction to simulate.
A simulator inspects the transaction your wallet is about to sign and previews the outcome. That is good work — keep running one.
But the biggest stablecoin losses never reach a wallet signature. They happen in venues where the paste is the only checkpoint. ZAFU works there — one step earlier, alongside signing-time tools, not instead of them.
How the two layers fit together →You paste into a withdrawal form and the exchange sends from its own wallet. There is no transaction for a simulator to inspect.
The address arrives in a chat and the deal settles account to account. Signing-time tools never see it. ZAFU reads the paste and the source it came from.
USDT on TRON moves through exchanges and custodial apps, not connected wallets. ZAFU validates and remembers TRON routes locally, at paste time.
ZAFU is bigger than one tool: the same recipient memory backs everything we ship. Every surface below is live today — nothing here is a promise.
Recipient memory and Transfer Check at the paste moment, in Chrome — today's tool, in full detail.
Public warning lookups for any EVM, Solana, or TRON address. Works without installing anything.
Public source, release fingerprints, and permission boundaries — inspect what we ship.
Evidence before action — never a promise of safety. ZAFU keeps the boundary around keys, signing, and browsing explicit, and every release is publicly verifiable.
ZAFU cannot read private keys, seed phrases, wallet passwords, or signing credentials.
ZAFU cannot approve, initiate, broadcast, or reverse transactions.
Network Mode is optional and shares anonymous aggregate counts only, never addresses or chat text.
storage, alarms, identity — and the full extension source is public for inspection.
Contacts, protected wallets, labels, and repeat destinations for transfer review.
Source comparison, full-address display, chain context, and public warning signals.
Public source, release fingerprints, permissions, and privacy boundaries.
ZAFU is not a wallet, signer, transaction broadcaster, or approval layer.
It shows evidence and limits so you can review, not a promise that every address has no risk.
Protection is scoped to crypto-address workflows and disclosed optional signals.
If USDT or USDC is how money reaches you — invoices, desk trades, family transfers — the paste moment is your workday. ZAFU keeps your recipients straight.
Invoice in USDT, get paid to the same address every time, and catch the one that is different.
High-frequency counterparties in Telegram and exchanges, each remembered with address and network.
The same family recipient, the same TRON route, every week — recognized on every paste.
Shared address books and audit trails are on the research track. See the roadmap →
Short answers here — the full FAQ covers threats, wallets, chains, and community reports in depth.
No. ZAFU never holds funds, keys, or seed phrases, and cannot sign or send. It is a Chrome extension that checks the recipient at the moment you paste an address — alongside your wallet or exchange, not in place of it.
Recipient memory is local-first. Optional Google sync backs up the contacts you choose. Threat lookups query public sources, and optional Network Mode shares anonymous aggregate counts only. Details are in the privacy policy.
Simulators check the transaction at signing time. ZAFU checks the recipient at paste time — including exchange withdrawals and Telegram deals, where there is no transaction to simulate. They complement each other; run both.
Each result states what was observed, checked, or warned — and says “Not checked” for anything it could not see. Evidence you can read, not a promise you have to trust.
Free Chrome extension. Two minutes to import the people you already pay.