Ilia Zavialov

How crypto works

Ilia Zavialov walks through how a crypto transfer actually works, from signature to finality

English version for the United States.

A cryptocurrency transfer looks like a single action: type an address, type an amount, press send. Underneath that single action sits a sequence of separate steps, and each step carries a different relationship to reversibility. Some can be stopped a second after they start, quietly and at no cost. Others cannot be undone by anyone, on any platform, for any reason, once a specific point in the sequence has passed. This article follows one transfer through that sequence and names exactly where the point of no return sits.

·14 min read·Ilia Zavialov

Cover illustration for the Ilia Zavialov guide to how a crypto transfer actually works, from signature to finality

01What a wallet actually stores

A cryptocurrency wallet holds a private key, a piece of data that can produce a signature nobody else can forge. The balance associated with an address lives on the network itself, recorded as a running total that anyone can look up. The key is the only thing capable of authorising a change to that total.

This is why a wallet can be recreated on a new phone from nothing but a recovery phrase, and why nobody else can recreate it without one. The phrase is a human readable form of the same key, written as ordinary words so it can be copied by hand and stored somewhere durable. It carries the same authority as the key, so anyone who reads it can move the funds it protects.

The phrase functions less like a password and more like the asset itself in transferable form. A bank can freeze an account, reissue a card and reset a login when something goes wrong, because it ultimately controls the ledger. A cryptocurrency network has no equivalent party. Whoever produces a valid signature is treated as the owner, without any check on identity or intention, and that assumption is what every later stage builds on.

02From a private key to a public address

An address is produced from the private key by a mathematical process that only works in one direction, so an address can be worked out from a key but never the reverse. That one-way relationship is what makes it safe to publish an address anywhere, on a receipt, a profile or an invoice, without exposing anything that could spend the funds it receives. The key stays private no matter how widely the address travels.

Most address formats include a short built-in check, extra characters that let a wallet catch an obvious typing mistake before it reaches the network. That check is useful, and it is also narrow: it confirms that an address is well formed. Whether an address belongs to the person the sender has in mind is a separate question, one the check was never built to answer.

The network itself never asks that second question. It validates a transaction against the mathematics of signatures and addresses alone, with no field for a name, a company or an intention. A payment to a stranger's address and a payment to the intended recipient's address look, to the network, exactly the same, provided both are correctly formed.

Where a crypto transfer stands at each stage, and what can still be done
Stage of the transferCan it still be stoppedWhat decides the outcome
Address and amount typedYesWhether the address was copied from a system of record
Signed but not yet broadcastYesThe signature can simply be discarded
Broadcast, waiting in the queueSometimesWhether the wallet can replace it with a higher fee
Included in one blockNoOne block can still be displaced by a competing version
Several confirmations oldNoDisplacing it now costs more than anyone gains by trying
Credited to an exchange balanceNoThe exchange has already waited out its own threshold
Sent on the wrong networkNoThe destination may belong to no one who is watching for it

03Why an address is trusted on faith

Because the network cannot tell an intended recipient from a stranger controlling a similar looking address, the entire burden of getting the address right falls on the sender, before anything is signed. A bank transfer at least routes through an institution that can sometimes flag a mismatch between an account number and a name. A cryptocurrency address carries no name at all.

This is the gap that address substitution is built to exploit. Malware on a device can watch the clipboard and swap a copied address for one the attacker controls the moment it is pasted. Tools exist that generate addresses sharing the first and last characters of a genuine one, defeating the habit of checking only the ends. A support chat message can supply a corrected address at the moment a payment is prepared, timed for the sender's least attentive moment.

None of this requires breaking any cryptography. It only requires the sender to trust an address that arrived through a message instead of one copied directly from a system of record, such as an exchange's own withdrawal page or a recipient's previously verified details. Reading the full address, character by character, is the one habit that generated lookalikes cannot defeat.

04Assembling and signing the transaction

Before anything leaves a device, a transaction exists only as a small record made up of the recipient's address, the amount, a reference to the sender's current balance and a fee. This record is assembled entirely on the sender's own device, by software that has not yet spoken to the wider network. Nothing about it is final yet, because nothing about it has been shown to anyone else.

Signing applies the private key to this record and produces a signature, data that anyone can check against the sender's public key without ever seeing the private one. The signature proves that whoever holds the key approved exactly this record, this recipient and this amount, and no other. It reveals nothing about the key, which lets it sit publicly on the network forever without weakening the account it belongs to.

A transaction that has been signed but not yet sent anywhere has done nothing at all. It exists only on the device that created it and can simply be deleted or replaced at no cost. This is the last moment in the entire sequence where a mistake is free, and it ends the instant the transaction is broadcast to the network.

05The queue, and the price of a place in it

Broadcasting sends the signed transaction out to the network, where it joins a queue of other transactions waiting for a place in the next block. Nothing about broadcasting itself moves any funds. It only makes the request public and available to whoever assembles the next block.

The fee attached to a transaction works as a bid for a place in that block, paid to whoever assembles it. That builder has an incentive to include the transactions paying the most relative to their size. A low fee simply leaves a transaction waiting, sometimes for minutes and sometimes for much longer, behind every other transaction willing to pay more.

Some wallets allow a transaction still waiting in the queue to be replaced by a new one offering a higher fee, moving it to the front or superseding it entirely. This is the one point after broadcasting where a change of mind can still work. It closes the moment the original transaction is picked up and included in a block, after which the replacement has nothing left to replace.

06The network has to match too

Many cryptocurrency assets exist in more than one version, issued on different networks or under standards that are not interchangeable with each other. An address that is perfectly valid in form can exist on several of these networks at once, controlled by different people, or by no one at all. Nothing about the address itself reveals which network the sender meant to use.

Choosing the wrong network sends a genuine, correctly signed transfer to a place nobody involved was expecting. Every earlier step can be done correctly, the address checked in full, the amount confirmed, the signature valid, and the transfer still lands somewhere unintended, because the destination was read on the wrong network. Mechanically this is a separate failure from address substitution, even though the outcome looks similar.

Recovering from this depends on whether a single operator happens to control both the network the sender used and the one the recipient expected. Crediting a deposit requires recognising it on the specific network being watched, and a deposit on a different network sits outside that entirely. No complaint changes what a ledger nobody is watching contains.

07What a block confirms, and why one block is not enough

Inclusion in a block bundles a transaction with others and links that block to the one before it, extending a chain every participant treats as shared history. Being included in the newest block is a real milestone, though not yet the same as safety, since that block can, in rare cases, be displaced by a competing version that briefly gains more support. This is why services built on these networks measure safety in confirmations.

A confirmation is simply another block built on top of the one containing the transfer. Each additional block makes displacing the earlier one more expensive than the last. The certainty that a transfer will stand accumulates gradually, block by block, until reversing it would cost far more than anyone stands to gain by trying.

This is also why an exchange can show a deposit as pending on the public record while the same funds are absent from the customer's balance. The exchange has set its own confirmation threshold before crediting an account, waiting out the risk described above rather than trusting a single block. The gap reflects two different questions asked of the same chain, one about what has been broadcast and one about what has been confirmed enough to trust.

08Why there is no reversal mechanism

A card payment can be reversed because a bank or card network recorded it centrally and retains the authority to unwind it, a process most people know as a chargeback. That authority is precisely what a network built on distributed agreement is designed never to hand to any single party, including the platforms built on top of it. Keeping that authority away from any single party is the design choice the whole system is built around.

Final, for a transfer of this kind, means no institution holds a button that undoes it, however cooperative it wants to be. A support team can escalate a case and investigate thoroughly, and still be unable to move the funds back, because that needs a new transfer out of the receiving address, one only its controller can sign. Sympathy and effort do not substitute for a signature the receiving party has no reason to provide.

This property, more than any interface detail, separates a finished cryptocurrency transfer from a card payment or a bank transfer sitting inside a dispute window. It is also the reason every check described earlier, the address, the network, the amount, belongs before the transaction is signed and broadcast. Once broadcasting happens the review has already ended, whether or not the sender realized it.

09What this mechanism hands to fraud

Because a completed transfer cannot be recalled, cryptocurrency has become a preferred settlement method for schemes whose business model depends on a payment nobody can claw back. The scale is tracked in official figures rather than estimates. The FBI's Internet Crime Complaint Center recorded 1,008,597 complaints and close to 21 billion dollars in losses for 2025, a rise of 26 per cent on the year before, with roughly half of all reported losses connected to cryptocurrency.

Investment style schemes account for the largest share on their own, 8.648 billion dollars, more than 40 per cent of everything reported. These schemes rarely touch a key or an address, because the owner authorises the transfer personally, believing it a deposit into an account with a rising balance inside the scheme's own interface. The mechanism does exactly what it is built to do, moving funds on a valid signature, with no way to check whether that balance is real.

Persuading the owner to produce that signature has become the easier route, needing no theft of a key. Voice cloning research describes a convincing clone built from about three seconds of speech, reaching roughly 85 per cent accuracy, with listeners in one study telling a real voice from a cloned one only 37.5 per cent of the time. Vishing built on cloned voices grew by 1,633 per cent in a single quarter, targeting the decision behind a signature rather than the mathematics checking it. The mechanism only checks whether a signature is valid, never why.

Most attempts against this mechanism fail before a signature is produced. Four out of five impersonation reports to the FTC involved no financial loss, so attempts heavily outnumber successes. Among older adults who lost 10,000 dollars or more to a company or government impersonation, 33 per cent paid in cryptocurrency, 20 per cent by bank transfer and 16 per cent in cash, showing where the leverage described here ends up whenever a scheme succeeds.

10The sequence, start to finish

Set out in order, the stages are typing the details, signing them, broadcasting the record, waiting in the queue, inclusion in a block, and confirmation by later blocks. Each carries a different relationship to reversibility, and none of that changes visibly on screen at the moment it does. Treating every stage as already past the point of no return is the only habit that does not depend on remembering where that point falls.

The early stages are forgiving. A typed address can be checked again, a signed transaction can be deleted, a queued one can sometimes be replaced. The later stages carry none of that room, and the transition between the two happens without any warning on screen, which is why so many losses trace back to a step that felt, at the time, like it could still be undone.

The table below sets out each stage against what can still be done at that point and why, so the boundary between the forgiving half of the sequence and the final half becomes a fact that can be checked rather than guessed under pressure. Reading it before a transfer is prepared costs a minute. Reading it after broadcast only confirms what has already happened.

11Questions and answers

How does a cryptocurrency transfer actually work?

A wallet signs a record containing the recipient's address, the amount and a fee using its private key, then broadcasts that signed record to the network. The transfer becomes final once enough blocks have been built on top of the one that includes it, after which no institution can undo it.

Can a crypto transaction be reversed once it is sent?

Once a transaction is included in a block it cannot be reversed by anyone. Before that point, while it is still waiting in the queue, some wallets allow it to be replaced by a version paying a higher fee, and that is the last moment a change of mind can still work.

Why does my deposit show on the blockchain but not in my exchange account?

The exchange has set its own number of confirmations to wait for before crediting an account, and that threshold is usually higher than one block. Until it is reached, the funds are visible on the public record and absent from the balance shown to the customer.

What happens if crypto is sent to the wrong network?

The transfer completes exactly as signed, on the network that was actually selected, and the destination address there may belong to someone else or to no one at all. Recovery only happens when a single operator controls both the network used and the one intended, and even then it is not guaranteed.

Why is a crypto transaction fee not a fixed amount?

The fee works as a bid for space in the next block, paid to whoever assembles it, and it competes against every other transaction waiting in the same queue. A low fee leaves a transfer waiting behind transactions that offered more, sometimes for a long time.

Why do scammers prefer payment in cryptocurrency?

A completed transfer cannot be recalled by any bank or platform, which suits schemes that depend on a payment nobody can later claw back. FBI data for 2025 ties roughly half of all reported fraud losses in the United States to cryptocurrency, and investment style schemes alone account for 8.648 billion dollars of that total, more than 40 per cent of everything reported.

Written by Ilia Zavialov, digital security consultant. Profile of Ilia Zavialov

12Read next

Back to the blog