Address Poisoning and Clipboard Attacks: How They Work and How to Avoid Them
Address poisoning and clipboard hijacking both attack the same habit, which is copying a destination address from somewhere convenient instead of from the recipient, and both are defeated by verifying the full address at the moment you send rather than recognizing the first and last few characters.
Updated · By RampAtlas Research
Key takeaways
- Address poisoning and clipboard hijacking both exploit the habit of copying a destination address from somewhere convenient rather than from the recipient.
- Address poisoning plants a lookalike address in your transaction history so you copy it from there on your next send.
- Clipboard hijacking is malware that swaps a copied address for the attacker's between the copy and the paste.
- Checking only the first and last few characters is exactly the check both attacks are designed to pass.
- A hardware wallet helps because it displays the destination on its own screen, which malware on the computer cannot rewrite.
In this guide
Address poisoning and clipboard hijacking both attack the same habit, which is copying a destination address from somewhere convenient instead of from the recipient, and both are defeated by verifying the full address at the moment you send rather than recognizing the first and last few characters.
Neither attack breaks any cryptography. They work because a blockchain address is a long string nobody reads, everybody abbreviates, and most software displays as a truncated middle. The attacker's whole job is to produce something that survives the abbreviated check.
How address poisoning works
The attacker generates an address that closely resembles one already in your transaction history, usually matching the first several characters and the last several characters. Generating such a lookalike is a matter of computing candidate addresses until one matches the pattern, which is cheap for a short prefix and suffix and expensive for the full string.
They then get that address into your history. The common route is a dust transfer: a payment of a negligible amount, or a zero-value token transfer, sent from the lookalike address to yours. Some variants use a token contract that emits a transfer event without moving anything, so the entry appears in your wallet's activity feed without the attacker paying to send you anything at all.
Nothing has been stolen at this point. The attack is waiting. The next time you pay the same recipient, you scroll your history, find what looks like the right entry, copy the address from it, and send. The funds go to the attacker, the transaction is final, and the recipient never receives anything.
Two details make this effective. Wallets sort activity by time, so the poisoned entry often sits directly next to the real one. And most interfaces display an address as a first fragment, an ellipsis, and a last fragment, which is precisely the check the lookalike is built to pass.
How clipboard hijacking works
Clipboard hijacking is simpler and older. Malware on your computer or phone watches the clipboard for anything shaped like a crypto address and replaces it with the attacker's before you paste.
The substitution is invisible in the flow most people follow. You copy the correct address from your wallet or from an email, you switch windows, you paste, the field fills with something that looks like an address, and you send. Some versions maintain a set of attacker addresses per chain and swap in one matching the format you copied, so even the address type looks right.
This is why every serious withdrawal instruction tells you to compare after pasting rather than before. The check has to happen in the destination field, against the source, at the moment of sending.
| Address poisoning | Clipboard hijacking | |
|---|---|---|
| Where it operates | Your transaction history | Your device's clipboard |
| What the attacker plants | A lookalike address matching the first and last several characters | The attacker's own address, swapped in between the copy and the paste |
| How it arrives | A dust transfer or a zero-value token transfer into your wallet | Malware already running on your computer or phone |
| When it costs you | The next time you copy an address out of your own history | The next time you paste an address you copied from anywhere |
| What defeats it | Copying from the recipient, never from your history | Comparing the pasted string against the source after pasting |
The verification that actually works
Verify against the source, not against your memory. Open the recipient's own wallet screen, their invoice, or the exchange deposit page you copied from, and compare the pasted string to it directly. Never compare against a previous transaction in your own history, because that is exactly what poisoning contaminates.
Check the middle of the string, not only the ends. If you are going to spot-check rather than read the whole thing, choose characters from the interior at random, since those are the parts an attacker has no cheap way to control.
Use the mechanisms that skip the clipboard. A QR code scanned directly from the recipient's screen removes clipboard malware from the path. So does an address book entry you saved and verified once, and a whitelist on the sending platform.
On chains that support it, let the format check work for you. Ethereum addresses use a mixed-case checksum defined in EIP-55, under which the net probability that a randomly generated address, if mistyped, accidentally passes the check is 0.0247% (source: EIP-55, Mixed-case checksum address encoding). That guards against typing errors. It does nothing against a deliberately generated lookalike, which is a valid address with a valid checksum.
Why a hardware wallet helps here
A hardware wallet displays the destination on its own screen, built from the transaction that is actually about to be signed. Malware that rewrote the address on your computer cannot rewrite what the device shows, so reading the device screen rather than the browser is a genuine independent check. That advantage only exists if you read it. Approving on the device without looking reproduces the risk you paid to remove. Setting one up is covered in Hardware wallet setup.
Related traps in the same family
A block explorer search for a poisoned address will show you an address with a plausible history, because the attacker's dusting created one. History on-chain is not identity.
And the ordinary rule still applies underneath all of this: nobody legitimate ever needs your recovery phrase. That guidance also states plainly that you should never, for any reason, share your recovery phrase or private keys (source: ethereum.org, Ethereum security and scam prevention). The broader set of tactics is covered in Spot a crypto scam.
A short routine for sending
- Copy the address from the recipient's own screen.
- Paste it into the send field.
- Compare the whole string, or at minimum a random interior segment, against the source.
- Confirm the network matches, since a correct address on the wrong chain fails in a different way, covered in Sending crypto across chains.
- Send a small test.
- Confirm receipt with the recipient.
- Then send the rest.
That routine takes a minute and it is the entire defense. If you are withdrawing from a trading account, the platform's own controls add to it: exchange pages on this site link to each operator's withdrawal documentation, including Coinbase and Kraken, and the full withdrawal process is in Move crypto off exchange. If you are choosing what to hold in the first place, the asset pages start at Ethereum and Buy Bitcoin.
Frequently Asked Questions
Can I get my funds back if I sent to a poisoned address?
No. A confirmed transfer is final and the recipient is an anonymous address under someone else's control. Report it to your national fraud reporting body and to the exchange you withdrew from, which may be able to flag the destination if the funds move to a regulated platform, but treat recovery as unlikely.
Is the dust someone sent me dangerous to hold?
Holding it is harmless. Interacting with it is the risk, because an unknown token can route you into a contract approval. Hide or ignore the entry rather than trying to move or sell it.
Does address poisoning affect Bitcoin as well as Ethereum?
Yes. The technique needs only a chain where addresses are long, displayed truncated, and reused, which describes almost all of them. The zero-value token variant is specific to chains with token contracts, but dust transfers work anywhere.
How do I know if my computer has clipboard malware?
You often cannot tell by inspection, which is why the defense is procedural rather than diagnostic. Verify after pasting on every send, use a hardware wallet for anything substantial, and treat an unexplained address mismatch as a compromised machine rather than a display glitch.
Are exchange deposit addresses safe from this?
The same rules apply. Copy the deposit address from the exchange's own page each time, verify it after pasting, and send a test first. Some assets also require a memo or destination tag, and a deposit sent without one may not credit.