Overview Demo How It Works States Features Trust FAQ Install
// HERO · 01 / 09 — INTERCEPT LAYER SEC // ZAFU.SHIELD.OBSERVER
v1.1.9 · CWS prep · recipient memory · Transfer Check

Send the right stablecoin to the right
person, on the right network.

From any wallet or exchange, ZAFU remembers who you've actually paid and on what network, preserves source evidence, reviews warning signals, and runs Transfer Check before the field accepts your paste.

ZAFU is not only looking for scams. It helps you use trusted address memory before every send.
Install free Try the live demo
Watch 30-Second Demo →
· no wallet access · optional anonymous counts · trusted contacts · protected wallets · Telegram Web evidence · TRON history review · extension source public · 3 permissions · Audit Source ↗
FIG.01 — VERDICT.OVERLAY
200ms · 9 CHECKS · LOCAL
app.uniswap.org/swap
ZAFU · ON
Send ETHEREUM · MAINNET
amount
2,400.00 USDC
recipient scanning…
0x71C7 656E C7ab 88b0 98de fB09 a29c 3a0f 1
scanning running 9 checks
Comparing clipboard, trusted history, and threat signals…
02 Recipient memory MEMORY · SOURCE · REVIEW · CHECK

Address book, source evidence, then final Transfer Check.

The extension's final check is powered by local trusted contacts, protected wallets, browser source evidence, and full-address review.

01 · Trusted Address Book

Repeat recipients become easier to recognize.

Save trusted contacts and use history-backed context for EVM, Solana, and TRON stablecoin routes when you choose to scan or review history.

02 · Protected Wallets

Keep your own wallets out of the confusion.

Mark wallets you control so ZAFU can distinguish your protected addresses from external recipients.

03 · Secure Copy Evidence

See whether the paste still matches the copy.

Telegram Web source evidence is address-only and local, with no chat text, sender, group, or message IDs stored.

04 · Transfer Check

One last review in the send flow.

Review copied-address match, warning signals, field context, and segmented full address before the field accepts it.

Known recipient Needs test Checked route Review Saved instruction Unknown Every saved recipient carries a confidence state backed by evidence — “Known recipient — Sent 14× USDT on TRON” — never a bare checkmark.
// 30-sec demo

Watch ZAFU review the transfer before paste.

See the exact moment ZAFU shows address, source, route, warning, and not-checked evidence before the wallet field accepts a paste.

route review · source mismatch · trusted contact
Video not loading? Open the MP4 directly.
03 The threat is real EVIDENCE / Q1 2026

The attack happens
in half a second.
You'll never see it.

Attackers don't need your seed phrase. They send a $0 transaction from a lookalike address — same first 4, same last 4 — and wait for you to copy it from your history.

↑ trending
0.0M
Address poisoning attempts on Ethereum — January 2026
Source - Blockaid via imToken
↑ trending
$0M
Lost to phishing attacks in January 2026 alone
Source - PeckShield / CertiK coverage
↑ 2025
$0M
Drained via clipboard-hijacking browser extensions
Source - ScamSniffer · 2025 cumulative
// what your wallet shows you
Trusted → 0x71C7…a0f1
Pasted  → 0x71C7…02e4
You can't see the difference. Zafu can.
poisoned FIRST-4 LAST-4 COLLISION
04 How it works PASTE-INTERCEPT PIPELINE

Zafu intercepts
the paste.
Not the wallet.

ZAFU runs address, source, route, and warning checks between your clipboard and the input field. No keys. No signing. Local-first storage. Evidence before the address reaches your wallet.

Step 01 / 03

Copy

You copy a crypto address from a browser workflow. When it comes from Telegram Web, ZAFU stores recent address-only source evidence locally for Transfer Check.

Step 02 / 03

Paste

You paste on a wallet, exchange, dapp, or Telegram Web address field. ZAFU checks before the address reaches the input field.

Step 03 / 03

Verdict

Clear evidence. You decide. Known recipients can move with less friction; warnings pause the paste for review.

✓ trusted
lower-friction review
⚠ danger
cancel is the only default
05 Detection states PASTE STATES · ONE PIPELINE

Paste states.
Clear evidence
before action.

Every checked paste gets a clear state. The color marks severity, and the text shows the evidence and limits behind the review.

POSSIBLE MISMATCH01 / 06
trigger

Pasted address differs from the recent same-chain address ZAFU saw copied in the browser.

user experience

Warning review. Address diff highlighted so you can cancel before the field accepts it.

POISONED02 / 06
trigger

Pasted address looks identical to a trusted contact — same start and end, different middle.

user experience

Both addresses shown in 4-char segments. Differing chunks flash red. No quick confirm.

SCAM03 / 06
trigger

Matches GoPlus Security real-time database or ScamSniffer bundled blocklist.

user experience

Red modal. Cannot be overridden. Address is blocked.

SUSPICIOUS04 / 06
trigger

Address appears in your history but you've never sent value to it — likely airdrop or dust.

user experience

Confirm modal with review checkbox. You must explicitly continue.

KNOWN05 / 06
trigger

Exact match in your trusted contact history — you've sent value to this address before.

user experience

Low-friction banner for a known saved or history-backed contact.

UNKNOWN06 / 06
trigger

Address has never appeared in your transaction history.

user experience

Confirm modal. Full address shown in 4-character segments so you can review it manually.

06 Core product surfaces POWER FEATURES · SAME SHIELD

Recipient memory in practice.

The live workflow pieces behind the final check: trusted address memory, secure copy evidence, and full transfer review.

A · Trusted Address Book

Your trusted contacts. Auto-built.

Add a wallet, and ZAFU can show outgoing EVM, Solana, and TRON counterparties for review before you save them as trusted contacts.

  • Auto-discovered from EVM and Solana history
  • TRON history import with recipient review
  • Starred favorites float to the top
Address Book · 2,148 entries
auto · synced
addressnamelast seenstate
0x71C7…a0f1 Cold Storage 2 days ago KNOWN
0xe592…1564 Uniswap V3 Router 5 days ago KNOWN
0x71C7…02e4 — Planted 9d POISONED
0xa0b8…4b48 airdrop · dust 12 days ago SUSPICIOUS
B · Transfer Check

One final full-address review.

Transfer Check shows a final review before crypto-address pastes: copied-address match, Telegram Web source evidence when available, warning signals, route context, what was not checked, and the full address.

  • Copied-vs-pasted address match
  • Telegram Web match or mismatch evidence
  • Threat and lookalike checks complete
transfer check
final address review checked
0xd8dA 6BF2 6964 aF9D
7eEd 9e03 E53A 1351 1BbA 6E4c
KNOWN · sent 4× since 2024
transfer check is on · turn off in settings
C · Secure Copy Evidence

Source context for stablecoin workflows.

v1.1.8 keeps Telegram Web source matching address-only, keeps paste-time TRON checks local-first, and adds TRON history review for USDT/USDC transfer flows. No chat text, sender, group, or message IDs are stored.

  • Copied from Telegram Web 18s ago
  • Pasted address matches or differs from source
  • TRON paste-time validation runs locally
Source Evidence · local
telegram_web
signalevidencestate
source copied 18s ago MATCH
chain TRON local VALID
privacy address only LOCAL
07 Trust model BUILT TO BE AUDITED · NOT TRUSTED

Built to be audited.
Not trusted.

Three browser permissions. Local-first data. No advertising telemetry. The Chrome extension source is public and auditable, with a fingerprint you can verify yourself.

No wallet access

Cannot read keys, seed phrases or signing credentials. Cannot sign or initiate transfers. By architecture — not policy.

No advertising telemetry

Optional Network Mode shares anonymous aggregate counts only. Pasted EVM addresses can go to GoPlus for threat checks — never your wallet address, never your history.

Zero dependencies

The Chrome extension is pure vanilla JavaScript: no npm packages, no bundler, no CDN scripts. Nothing hidden in a dependency tree.

Verifiable install

Every release ships a 16-character fingerprint derived from the security-critical extension files and bundled risk data. Compare against the public release. Verify yourself.

Cross-platform

Works across EVM, Solana, and local TRON transfer workflows on wallet, exchange, dapp, and Telegram Web address fields.

Shared reports

Manual reports and opt-in automatic threat signals feed a shared warning list that protects other users. Anonymous by default. Threshold-reviewed before it affects blocking decisions.

real product proof

This is what stops a poisoned paste.

The extension shows the actual pasted address against the trusted address, segment by segment, before the address reaches the wallet field. The design goal is clarity under pressure, not decoration.

ZAFU possible address poisoning warning showing segmented address differences
permissions audit
3 permissions total. Average extension requests 17.
current
storage Saves your wallet list and address index locally on device. Never synced.
alarms Schedules 24h auto-refresh of wallet history and community report data.
identity Optional Google Sign-In only. Never used unless you sign in.

Chrome may say Zafu can "read and change all your data on all websites" because Zafu has to see crypto-address paste events before the destination field accepts them. Zafu does not request tab history, does not run advertising analytics, and only activates address-checking logic when a crypto address is pasted in a relevant context.

/ works across major chains · wallet and exchange websites
ETH
Ethereum
POL
Polygon
ARB
Arbitrum
BASE
Base
OP
Optimism
BNB
BNB Chain
SOL
Solana
TRX
TRON local
MetaMask Rabby Coinbase Wallet Phantom Binance Kraken Uniswap 1inch Aave Compound Etherscan OpenSea + 30 more →
08 Frequently asked OBJECTIONS · HANDLED

Common questions.

01Does Zafu need my private key or seed phrase?
No. Impossible by architecture. Zafu only needs your public wallet address — the same one you share when receiving funds. It cannot access, request, or store private keys or seed phrases.
02Does Zafu send my addresses to any server?
Your wallet address is sent to Etherscan or Solscan only when you explicitly click "Fetch History." Pasted addresses are sent to GoPlus Security for real-time scam detection — only on paste events, never in the background. Flagged attacker addresses (not your wallet) are submitted to the community pool if you report them or opt in to automatic threat signals. Full details in the Privacy Policy.
03Why does Chrome say Zafu can read and change data on websites?
Chrome shows that warning because Zafu's content script can run on websites where you might paste a crypto address. That access lets Zafu stop address poisoning and clipboard hijacking before the pasted address reaches a wallet or exchange field. Zafu does not request tab history, does not use tabs or activeTab, does not run advertising analytics, and gates checks to crypto-address paste events in relevant contexts.
04What's the difference between POISONED and HIJACKED?
POISONED means the pasted address looks nearly identical to one you trust — an attacker may have planted a lookalike in transaction history. POSSIBLE MISMATCH means the pasted address differs from the recent same-chain address ZAFU saw copied in the browser. Both get their own distinct review.
05Which chains does the extension support?
ZAFU supports EVM and Solana workflows with history-backed address intelligence, plus TRON address validation, copy-vs-paste comparison, and TRON history import/review in v1.1.8. Paste-time TRON checks are local-first; Tronscan is used only for public history review flows.
06What is Transfer Check?
An optional setting that shows a final address check before crypto-address pastes. It summarizes copied-address match, threat signals, field context, and the full segmented address so you can review before the address reaches the field.
#StayZafu
— verify the address before you trust the send —

Check the address.
Then send.

ZAFU gives every crypto transfer a final address check before it reaches your wallet. Free. Local-first. Never touches your keys. Public extension source. Three permissions.

Install free Audit Extension Source

Running a crypto team, OTC desk, or stablecoin operation? ZAFU is researching shared address-book and transfer-review workflows. Contact Us. Paid products are not live yet.

v1.1.9 · MIT license · github.com/jimozo/zafu-extension