Clipboard Hijacking: The Malware That Swaps Your Address

This is one of the oldest attacks in crypto and it still works, because the defence requires a habit almost nobody has.

How it works

Malware on the machine monitors the clipboard. When it detects a string matching the pattern of a crypto address, it replaces it with an address controlled by the attacker.

You copy the correct address. You paste. The field now contains a different address. You send.

Sophisticated versions maintain a table of attacker addresses with matching first and last characters for each major address format, so the truncated version you glance at looks right.

Why it survives

Addresses are unreadable. Nobody verifies forty characters. Wallets show you the ends, so the ends are what attackers match.

The paste feels safe. You copied it yourself, from the right place. The trust comes from your own action rather than from any external source.

It is silent. No prompt, no warning, no visible change unless you look carefully at the middle of the string.

How the malware arrives

The usual routes. Pirated software. A browser extension that requested more permissions than it needed. A cracked application. An installer downloaded from a search advertisement rather than from the vendor’s site.

Browser extensions deserve emphasis. An extension with permission to read and modify page content can do this and considerably more, and permissions are routinely granted without reading.

The defences, in order of effectiveness

Verify on a hardware wallet screen. The device displays the destination address independently of the computer. If the machine is compromised, the device still shows the truth. This defeats the attack completely and is the main practical argument for hardware wallets beyond key storage.

Send a test transaction. Small amount, confirm arrival with the recipient, then send the rest. Catches this and several other attacks.

Check the middle of the address. Four or five characters from the centre, not the ends.

Use address book entries. A saved entry is not pasted and cannot be swapped.

Audit browser extensions. Remove anything you do not actively use. Check what permissions the remainder hold.

What this shares with address poisoning

Both attacks exploit the same weakness: humans verify the first and last few characters of a string that is forty characters long.

Address poisoning puts the wrong address in your history. Clipboard hijacking puts it in your clipboard. The defence is identical, which is that the destination must be confirmed somewhere the compromised machine does not control, or a small amount must be sent first.

For the working balance

Funds held at a regulated venue are not exposed to this, because withdrawals go to addresses you have saved and, on platforms that support it, to an allowlist with a delay on additions.

That is a genuine argument for keeping the portion you actively move through a platform such as Collect & Exchange rather than shuttling funds between hot wallets on a machine whose cleanliness you cannot verify.

If a transaction has already gone to the wrong address

It is gone. Look the address up on a block explorer: if it is labelled as an exchange deposit address, contact that exchange immediately with the hash. Otherwise there is no mechanism.

Then treat the machine as compromised. Move funds from any wallet whose keys have been on it, using a different device.