Clipboard hijacking is malware that monitors your clipboard and automatically replaces crypto addresses when you copy-paste them. You copy a legitimate address from an exchange or friend, but when you paste it into your wallet send field, the malware has silently swapped it for the attacker address. You send funds to the wrong destination without realizing. It is one of the simplest and most effective crypto theft methods.
What Is Clipboard Hijacking?
3 min read
The short version
You copy your friend address to send them crypto. Between the copy and the paste (milliseconds), a hidden program on your computer swaps that address for the attacker address. You paste, glance at it (maybe check the first few characters), hit send, and your crypto goes to a thief. The attack is invisible unless you verify the full address character by character before confirming.
How It Works
How it works technically: the malware (often bundled with pirated software, fake wallet apps, or browser extensions) runs in the background monitoring your clipboard. When it detects a crypto address pattern (starts with bc1, 0x, or other blockchain-specific prefixes), it instantly replaces the clipboard content with an attacker-controlled address. Many clipboard hijackers use vanity addresses that match the first and last few characters of the original (making quick visual checks unreliable). The swap happens in milliseconds. Your paste result looks almost right at a glance but sends funds to the attacker. Prevention: (1) Always verify the FULL pasted address against the original (compare all 42 characters for Ethereum, all 62 for Bitcoin bech32). (2) Use QR codes when possible (bypasses clipboard entirely). (3) Send a tiny test transaction first for any new address. (4) Keep your system clean: do not install pirated software, suspicious browser extensions, or apps from unofficial sources. (5) Use a hardware wallet (displays the destination address on its own trusted screen for verification). (6) Some wallets (Rabby, MetaMask) show a warning if a pasted address differs from what you copied.
Losing $8,000 to a clipboard swap
A user installs a free crypto portfolio tracker they found on a forum. It contains clipboard hijacking malware. Two weeks later: they copy their Coinbase deposit address (0x742d35Cc6634C0532925a3b844Bc9e7595f2bD3a) to transfer 2.5 ETH from MetaMask. They paste into MetaMask send field. The malware replaced it with 0x742d35Cc6634C0532925a3b844Bc9e7595f28b7F (different last 4 characters). They glance at it, see it starts with 0x742d35... and ends with a similar pattern. Looks right. They confirm the $8,000 transaction. ETH goes to the attacker. Irreversible. If they had: (1) verified all 42 characters, or (2) used a QR code, or (3) sent a $1 test first, the theft would have been prevented.
What People Get Wrong
My antivirus would catch clipboard malware
Clipboard hijackers are often new variants not yet in antivirus signature databases. They use minimal system resources, do not trigger behavioral alerts (monitoring the clipboard is a normal operation many apps do), and can hide in seemingly legitimate software. Antivirus reduces risk but does not eliminate it.
Checking the first and last few characters is enough
Sophisticated clipboard hijackers generate vanity addresses matching both the prefix and suffix of common address patterns. An address matching the first 6 and last 4 characters appears correct at a glance but routes to the attacker. Only full character-by-character verification catches this.
This only happens on Windows
Clipboard hijacking malware exists for Windows, macOS, Linux, Android, and iOS (though rarer on mobile). Browser extensions can also perform clipboard manipulation on any OS. No platform is immune if you install unverified software.
Keep Reading
Sources & Further Reading
- Malwarebytes
Anti-malware tool that can detect clipboard hijacking malware
Questions People Also Ask
- How do I check if I have clipboard malware?
- Test: copy a crypto address, open a text editor, paste it. Compare what you pasted to what you copied. Do this several times. If the pasted text ever differs from what you copied, you have clipboard malware. Run a full system scan with Malwarebytes (free version works). Remove suspicious browser extensions. Consider reformatting your system if confirmed.
- Do hardware wallets protect against this?
- Partially. When you send from a hardware wallet, the destination address is displayed on the device trusted screen (which malware cannot alter). If you verify the address shown on your Ledger/Trezor screen matches the intended recipient, the clipboard swap is caught before confirmation. This is why hardware wallets show the full address on their own display.
- How common is this attack?
- More common than most people realize. In 2022-2023, multiple clipboard hijacking campaigns were identified distributing through: fake wallet apps on unofficial app stores, pirated software with bundled malware, malicious browser extensions, and compromised npm packages targeting developers. The simplicity of the attack (one function monitoring clipboard) makes it easy to implement and hard to detect.