How to Avoid Clipboard Hijacking Malware in Crypto

Clipboard hijacking malware, sometimes called a "clipper," is malicious software that runs quietly in the background of an infected device and monitors the system clipboard for crypto wallet addresses, automatically replacing any address you copy with one controlled by the attacker before you paste it.

Because crypto addresses are long, random-looking strings, most people don't visually verify every character after pasting — they trust that what they copied is what got pasted. Clipboard hijackers exploit that trust gap directly, sitting between the copy and paste actions without any other visible sign of interference.

How clipboard hijacking works

Once installed on a device — typically through a trojanized download, a cracked software installer, a malicious browser extension, or an infected email attachment — the malware runs silently and monitors clipboard activity. When it detects that the copied text matches the pattern of a crypto address (a recognizable format for Bitcoin, Ethereum, and other major chains), it swaps the clipboard contents for a different address chosen by the attacker, often one visually similar in length and structure to avoid immediately looking wrong.

If you then paste that clipboard content into a wallet's "send" field without checking it character by character, your funds go to the attacker's address instead of your intended recipient. Because the swap happens instantly and silently, most victims don't notice until after the transaction confirms and funds are irreversibly gone — a core property of blockchain transactions covered in our what is DeFi explainer.

Some more advanced variants target multiple cryptocurrencies simultaneously, detecting the address format for whichever chain you're using and substituting an attacker address matched to that same chain, so the swapped destination still "looks" plausible for the asset being sent.

Where this malware typically comes from

• Pirated software, keygens, or cracked applications bundled with hidden payloads
• Malicious or compromised browser extensions, including some disguised as wallet or portfolio-tracking tools
• Phishing email attachments disguised as invoices, resumes, or official documents
• Fake wallet or trading applications downloaded outside of official app stores
• Infected USB drives or files shared through unofficial channels

How to detect and prevent it

• Always verify the full pasted address against the original source, character by character, or at minimum check both the first and last several characters carefully before confirming a send
• Use a hardware wallet that displays the destination address on its own separate screen — this creates an independent verification point that a compromised computer's clipboard or display cannot fake
• Keep antivirus and anti-malware software updated, and run periodic scans, especially after installing new software
• Only download wallet software, browser extensions, and trading tools from official, verified sources — never from third-party download sites or unsolicited links
• Avoid installing cracked or pirated software on any device that also handles crypto wallets or exchange logins
• Consider using a dedicated, minimal-software device for high-value crypto transactions rather than a general-purpose daily-use computer

Clipboard hijacking vs. address poisoning

Factor	Clipboard hijacking malware	Address poisoning scam
Mechanism	Malware swaps clipboard content silently	Lookalike address planted in transaction history
Requires infected device?	Yes	No
Detectable by	Verifying pasted address matches source	Verifying full address, not just truncated display
Prevention	Anti-malware, hardware wallet address display	Saved address book, full-address verification

Both scams rely on the same underlying weakness — that people rarely verify a full crypto address before confirming a transaction — but they achieve it through very different mechanisms, one through device compromise and the other through social engineering of your own transaction history. See our companion piece on address poisoning for the comparison in more detail.

What to do if you suspect infection

If you notice a pasted address doesn't match what you copied, stop immediately and do not send the transaction. Disconnect the device from the internet, run a full anti-malware scan, and treat any wallet or exchange credentials used on that device as potentially compromised — consider moving funds to a new wallet generated on a clean device, and revoking any active token approvals using an approval checker tool. Our broader DeFi wallet security guide covers additional device-hygiene practices, and common DeFi scams surveys related attack patterns.

Bottom line

Clipboard hijacking malware turns an ordinary copy-paste action into a silent redirection of your funds, and it's effective precisely because most people don't re-verify addresses after pasting. The most reliable defenses are a hardware wallet that independently displays the destination address, disciplined manual verification of pasted addresses, and keeping your devices free of pirated software and unverified extensions that commonly carry this kind of malware.