What is clipboard hijacking?
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 4 min
In short
Clipboard hijacking is malware on your device silently swapping a copied wallet address for one the attacker controls. You copy the right address, but what lands in the field is a different one. Checking the pasted string in full, every time, is the single most effective defence.
Key points
- The address you copy is not the address you paste
- The cause is malware already running on the device
- Comparing the full pasted string catches it
- Re-read the destination on the signing screen too
Definition
Malware that watches the clipboard, recognises text shaped like a crypto address, and substitutes an attacker-controlled address so that the victim pastes the wrong destination.
Crypto addresses are long, so everyone copies and pastes them. The attack rides on that. The malware watches clipboard contents and, the instant something address-shaped appears, replaces it with a similar-looking one. Nothing about the user's actions changes, so nothing feels wrong.
Infections typically arrive through a fake wallet app found via a search advert, pirated software, a compromised browser extension or an email attachment. Malware that arrived for unrelated reasons may gain crypto-stealing behaviour later, which is why general device hygiene is part of protecting funds.
Defend on two levels. First, read the whole pasted address back before sending. Second, use a hardware wallet and confirm the destination on the device's own screen rather than the computer's — a compromised machine cannot alter what the hardware displays.
Watch out for
- · Read the pasted address in full — not just the ends — before you send
- · Install wallets and extensions only from the official site or store listing
- · For large transfers use a hardware wallet and verify the destination on the device screen