A Man-in-the-Middle (MitM) attack occurs when an attacker positions themselves between two communicating parties and attempts to read, modify, or replace the data being exchanged.

In cryptocurrency infrastructure, MitM attacks can target exchange websites, wallet connections, application interfaces, network connections, or communications between infrastructure components. The objective may include stealing credentials, replacing a destination address, or altering information presented to a user.

One major protection mechanism is encryption of the communication channel combined with proper authentication of the remote party. Encryption alone is not sufficient if a user accepts a fraudulent certificate, installs malicious software, or ignores security warnings.

Address replacement is particularly dangerous in cryptocurrency transactions. An attacker may attempt to replace a wallet address before the user signs a transaction. Critical transaction details should therefore be verified on a trusted device whenever possible.

A MitM attack differs from phishing. Phishing often tricks the user into voluntarily providing information to the attacker, while a MitM attack attempts to interfere directly with the communication channel.