How to read a blockchain explorer — hashes, lookalikes and fake sites

An explorer is a camera pointed at a public ledger. It is indispensable. It is also one of the easiest places in this industry to be lied to, because the interface looks like customer service and behaves like a search engine. A reader in Singapore who has just tapped send wants a green tick and a human. What they get is a hash, a block number, and — if they arrived via a chat link — sometimes a stage set.

This briefing is a reading lesson, not a recommendation to use any network or any website. For what happens before the row appears, see how on-chain transactions actually move. For the crime that loves a panicked search, see phishing, seed phrases and account takeover. Both belong, with this page, in the security hub.

The hash is the name of the message

A transaction hash (txid) is a fingerprint of the signed message your wallet broadcast. It is long, ugly, and the only object worth pasting into an explorer when someone asks “did you send it?”

Until a hash exists, you have pressed a button. A platform’s “withdrawal processing” spinner is not a hash. The firm may still be in an internal queue, a compliance hold, or a batch. Those delays are company behaviour. They are not “the blockchain being slow”, although they get described that way in group chats.

Once a hash exists, the explorer can usually tell you four useful things:

• Whether the network has seen the message (pending, in a mempool).
• Whether a block producer has included it (a block number appears).
• How many confirmations have stacked on top of that block.
• Which addresses, amounts and — on contract-capable chains — which token contracts were involved.

It cannot tell you that the recipient is the person who texted you. It cannot tell you that the token is the one you meant. It cannot tell you that the sender was you rather than someone who had your key. Those are human facts. The camera records the message.

If a platform’s support desk asks for the hash, that is legitimate. If anyone asks for the seed phrase “so we can find the transaction”, that is a script. No explorer, no licensed desk, and no officer of MAS needs the words.

Addresses are destinations, not names

An address is a string the network treats as a destination. Some look like they start with a 1 or a 3 or bc1. Some look like 0x followed by forty hexadecimal characters. Some look like something else again. The shape is a hint about the network. It is not a guarantee.

Three educational habits:

• Checksums help, they do not save you. Some encodings detect a typo. They do not detect a correct address that belongs to someone else, or to a contract you did not intend.
• The same human can have many addresses. A new address per receipt is ordinary. “I don’t recognise this destination” is not, by itself, evidence of theft; it is a reason to slow down.
• A labelled name on an explorer is a volunteer annotation. “Binance 7”, “Hot wallet”, “Mr Lee” — those tags are crowdsourced or editorial. They can be wrong, stale, or planted. Treat them as a hint you still have to verify.

Singapore readers sometimes treat an address the way they treat a PayNow proxy: a stable handle for a person. A PayNow proxy is tied into a bank scheme. An address is a public string. Anyone who can sign for it owns the practical rights. Anyone who cannot, does not.

Tokens are contracts; tickers are costumes

On chains that run programs, most of the assets people talk about are not the native unit. They are token contracts: programs that keep a list of balances and a name the author chose. The explorer will show that name in large, friendly type. The name is advertising.

This is the lookalike problem, and it is older than the current wave of screenshots.

Anyone who can deploy a contract can call it USDT, BTC, S$, or the name of a licensed platform. They can copy the logo. They can airdrop a balance into your address so that, when you open the explorer, a line says you “received” 10,000 of a famous ticker. You did not receive the famous ticker. You received a guest entry on a contract you never asked to meet.

How to tell a costume from the thing you meant

The durable identifier is the contract address, not the ticker. The habit is:

• Know, from a source you already trust, the contract you intended — a licensed platform’s own withdrawal screen, the issuer’s site you typed yourself, a document you saved last month. Not a pinned tweet. Not a Telegram admin.
• Compare that string, character by character, with the contract the explorer is showing.
• Ignore the icon. Ignore the “official” badge if you did not understand who issued the badge.

A transfer of a lookalike token is not “your bitcoin”. It is not “your USDT”. It is a row about a different object. People lose money when they then try to “sell” the lookalike through a helpful website that asks for a wallet connection, or when they approve a contract that promises to “unwrap” it. The airdrop was the bait. The approval is the hook.

Native units — bitcoin on Bitcoin, ether on Ethereum, and their cousins — do not have a token-contract field in the same way. A lookalike problem still exists across networks: a token on one chain that borrows the name of a unit on another. Sending the right name on the wrong rail is a standing way to lose the asset. The explorer will show a success. The success is the wrong success.

An explorer reports that a message was included. It does not certify that the asset in the message is the asset you have in mind, or that the site you are reading is the camera you think it is.

Status words that do not mean what the app implied

Pending means the message is eligible and waiting, or that the explorer has not yet seen an inclusion. It does not mean “the bank is processing”. A low fee in a busy hour can sit here until you replace it, if the network allows that, or until you give up.

Success / confirmed means a block included a valid message. It does not mean the recipient’s platform has credited them. Custodial firms wait for a house number of confirmations, then run their own compliance. A merchant who ships at one confirmation on a fast chain is taking a reorganisation risk.

Failed on a contract chain often means the message was included and the program reverted. You still paid a fee. The tokens you hoped to move may still be where they were. “Failed” is not “never broadcast”.

Internal transactions and token transfers are tabs that confuse everyone. A single hash can contain a native-unit movement, several token movements, and a trail of program-to-program hops. The tab you are looking at may not be the tab that answers your question. If you sent a stablecoin, look at the token-transfer list and the contract address, not only the native-unit amount, which may be a fee.

From / to can be a contract. Sending to a contract that is not expecting your token is a frequent irreversible event. The explorer will still say success if the message was valid.

Phishing explorers, and the search that happens after a mistake

The honest explorer problem is already hard. The dishonest one is simpler. Someone buys a domain that looks like a well-known explorer — a transposed letter, an extra dash, a different top-level domain — and waits for traffic from people who typed in a hurry or clicked a chat link.

What the fake site wants:

• A seed phrase, requested as “decode”, “claim”, “unlock” or “support verification”.
• A wallet connection that then asks for a signature you did not read.
• A download. A browser extension. A “faster” app.

What it will also do, to look real: display an actual hash you pasted, pulled from the public network, so the first screen is correct. The lie is the button that appears next to the row.

Defensive habits, stated as household procedure rather than as a product pitch:

• Type the explorer hostname yourself, or use a bookmark made on a calm day.
• Do not arrive via a search advert if you can avoid it. Ads have pointed at costumes.
• Never enter a seed phrase into an explorer. An indexer does not need it. A thief does.
• If a page asks you to “speed up”, “cancel”, or “refund” a transaction by connecting a wallet, pause. Some legitimate wallets have replace-by-fee tools. Random websites do not need your key to show you a pending row.
• If you are already shaky because a transfer is late, you are the person the fake site was built for. Walk to the kettle. Then type the address.

Licensed platforms in Singapore will ask for a hash. They will not ask you to authenticate to a block explorer they do not operate. Anyone claiming to be MAS “on the explorer” is not MAS.

A method for the next time someone says “check the chain”

A short sequence that keeps the camera in its place:

1. Get the hash from the sending wallet or platform, not from the person who is in a hurry to be paid.
2. Open the explorer from a bookmark.
3. Confirm the network in the page header matches the network you intended.
4. Read status, confirmations, from, to, amount, fee.
5. If a token is involved, read the contract address before you read the ticker.
6. If the recipient is a platform, wait for their credit, not only for the chain’s tick.
7. Stop. Do not download anything. Do not “verify” the transaction with a stranger.

An explorer is how you stop arguing from a spinner. It is how you notice a lookalike before you try to sell it. It is how you see that a payment is pending because the fee was a hope. It is not customer service, not a court, and not a place to type twelve words. The rest of the beat — movement, phishing, licensed desks — is what you do with the facts the camera actually shows.