What is clipboard malware?

Software on a compromised device that watches for a copied crypto address and silently swaps it for the attacker's before you paste.

The transfer looks normal at every step except the destination. You copy the correct address, the malware substitutes its own, you paste and glance at the first four characters, which match because the attacker generated an address with a matching prefix, and you send. Once confirmed, nothing can be reversed.

It is one of the oldest attacks against people who otherwise handle keys carefully, and it survives because it does not need your keys at all. It only needs your clipboard.

How it works

The malware runs as an ordinary background process with no special privileges. Reading and writing the clipboard is a normal thing for software to do, so it triggers little suspicion.

It matches on pattern. A string starting with the right characters and of the right length is recognized as a Bitcoin, Ethereum, or other chain address and replaced with one the attacker controls on the same chain. Some variants hold a library of thousands of attacker addresses and choose one whose leading and trailing characters match what you copied.

That prefix matching is the reason a partial check fails. Comparing the first and last few characters is exactly the check the attacker anticipated.

Two defenses actually work. Verify the entire address, ideally by having the receiving party or exchange confirm it through a second channel. And confirm the destination on a hardware wallet screen, which the malware on your computer cannot alter, since the device displays what it is actually being asked to sign.

Example

Illustrative. You copy an exchange deposit address beginning bc1qxy2 and ending 4mdq. The malware replaces it with bc1qxy2 ... 4mdq, an address it controls, chosen from a pregenerated set for the matching ends. You check the first five and last four characters, they match, and you send 0.4 BTC. On a hardware wallet the device screen would have shown the full substituted address before you approved, and the mismatch against the exchange's published address would have been visible.

Why it matters when you buy

Every purchase that ends with moving coins off an exchange involves pasting an address, which is the moment this attack targets. Sending a small test amount first costs one extra network fee and confirms the route end to end. Move crypto off an exchange walks through the process, and hardware wallet setup covers the device check.

Related terms

address poisoning — the related trick using your own transaction history; hardware wallet — the device that shows the real destination; wallet drainer — the signature-based equivalent; address book — saved addresses that avoid pasting; withdrawal whitelist — the exchange-side control.

Questions

Will a hardware wallet stop this?

It stops you sending to the wrong address, provided you read the address on the device screen rather than on your computer. The device shows what it is signing, and malware on the host cannot change that display.

Does a test transaction help?

Yes, and it is the cheapest safeguard available. Send a small amount, confirm it arrived at the intended destination, then send the rest without recopying the address.

Can this affect a phone?

Yes. Mobile malware does the same thing, and mobile clipboard managers that sync between devices widen the surface further.