Clipboard Hijacking: The Malware That Swaps the Wallet Address You Just Copied

What a clipper actually does

A clipper is malware with one narrow job: watch your clipboard and change what is in it. Microsoft's threat intelligence team, analysing a Windows clipper campaign in June 2026, described malware that checks the clipboard roughly every 500 milliseconds, looking for anything shaped like a cryptocurrency address. When it finds one, it replaces it with an address the attacker controls. You copied the right address. By the time your finger reaches paste, it is not the same string.

The reason this works is that nothing about the experience feels wrong. There is no phishing site, no link to be suspicious of, no prompt asking for your recovery phrase. You are on the exchange or wallet you meant to be on, doing the routine thing, and the transaction you sign is technically valid — it simply pays someone else. Because blockchain transfers are irreversible and there is no bank to call, a single successful swap is a complete loss. Microsoft's report on the 2026 campaign noted infections running since February of that year, and CoinDesk's coverage described the same family monitoring the clipboard for seed phrases, private keys, and recipient addresses before silently substituting the destination.

Why 'I checked the address' often is not enough

The standard habit is to glance at the first four and last four characters of the pasted address and call it verified. Clipper authors know this. Microsoft's analysis described the malware substituting addresses using pattern matching that preserves leading characters — for example, swapping a Bitcoin legacy address that begins with '1' for another beginning with the same two characters. The attacker cannot control every character of an address, but they can generate large numbers of them in advance and select one that matches your prefix, which is enough to survive a glance.

This is the same defeat-the-glance logic behind address-poisoning scams, where a lookalike address is planted in your transaction history so you copy it yourself. The mechanisms are different — one is malware on your machine, the other is a decoy on-chain — but the lesson is identical: partial visual comparison is not verification. A check that only looks at the ends of a string is a check an attacker can plan around, and if you are choosing one habit to adopt from this guide, make it the full-address check below rather than a longer glance.

It is also worth retiring the assumption that this is a Windows-only problem. The Microsoft campaign is a Windows worm, but the Check Point research published the same month described a clipper written in Rust and built to run on both Windows and macOS, distributed through the same bundle of fake trading tools. Clipboard substitution is a simple technique with no platform-specific requirement, so treat the habit as universal rather than something you can skip on a particular operating system.

How a clipper gets onto a machine

Two routes dominate, and neither requires you to be careless in an obvious way. The first is removable media. The campaign Microsoft documented spreads worm-style through USB drives: it replaces the files on a clean drive with shortcut (.lnk) files carrying the same names, so plugging that drive into the next computer and opening what looks like your own document runs the malware instead. CoinDesk's write-up described exactly this file-for-shortcut substitution as the propagation method. A shared USB stick, a printing-shop drive, or a colleague's key is enough.

The second route is the software you go looking for yourself. In the same month, Check Point Research documented a clipper campaign that hid a clipboard hijacker inside tools aimed at crypto traders — sniper bots and crash-game predictors for Solana and Pump.fun — and manufactured credibility around them with coordinated five-star reviews, AI-narrated tutorial videos on a YouTube channel with more than 91,000 subscribers, GitHub repositories with inflated stars and forks, a SourceForge download counter showing tens of thousands of downloads, and even coordinated comments on VirusTotal intended to make the files look benign. Every signal a careful person uses to judge whether an unknown tool is safe — reviews, stars, downloads, scanner comments — was purchased or faked. The takeaway is not that those signals are useless, but that for downloadable software touching your wallet, they are not sufficient on their own.

The habits that actually catch the swap

Verify on a device the malware cannot touch. A hardware wallet displays the destination address on its own screen, generated from the transaction it is being asked to sign, and requires a physical button press to approve. If a clipper altered the address on your computer, the altered address is what appears on that screen — so reading the full address there, character by character rather than at the ends, is the check that holds. This is also why a hardware wallet helps against a compromised machine in general: the keys never exist on the infected computer at all.

Then send a small test amount first. Move ten or twenty dollars, confirm it arrived at the address you intended by checking the receiving wallet or a block explorer, and only then send the rest. It costs one extra fee and it catches clipboard substitution, wrong-network mistakes, and simple typos in a single step. Two smaller habits round it out: after pasting, compare the address in full rather than the ends, and where a platform offers an address book or whitelisted withdrawal address, use it — a saved, previously verified destination is not re-copied each time, so there is nothing for a clipper to intercept.

What else a clipper takes while it is there

Address swapping is only the visible half. The same malware family harvests far more: Microsoft's analysis described it detecting 12- and 24-word BIP39 recovery phrases in the clipboard, saving them locally and exfiltrating them to a command-and-control server over the Tor network, and capturing a short burst of screenshots — five, ten seconds apart — to give the operator context on which wallets and balances the victim has. Recovery phrases and private keys were among the material CoinDesk reported it monitoring for.

That changes what an infection costs you. A swapped address loses one transaction; a captured recovery phrase loses everything that phrase controls, whenever the attacker chooses to use it. The practical rule is simple and worth keeping permanently: never put a recovery phrase on the clipboard, and never type it into a computer at all unless you are performing a genuine recovery on a device you trust. No legitimate wallet, exchange, or support agent will ever ask for it — a request for your phrase is, by itself, proof of a scam, a point the FTC makes repeatedly in its consumer guidance on crypto fraud.

If you think you are already infected

Assume the machine is untrustworthy and act in order of value. Stop making transfers from it. If any wallet's recovery phrase or private key has ever been typed, pasted, stored, or photographed on that computer, treat those funds as exposed: create a new wallet on a clean device — ideally a hardware wallet whose keys were generated on the device itself — and move the assets there. Rotating away from a possibly-captured phrase is the step people delay, and it is the one that matters, because a stolen phrase can be used weeks later with no warning.

Then clean up around it. Run a full scan with reputable, up-to-date security software, disable AutoRun for removable media, and stop using the USB drives that may have carried the infection. Change the passwords for your email and exchange accounts from a different, trusted device, and prefer a hardware security key or an authenticator app over SMS codes. Finally, if you sent funds to a substituted address, report it — to your national fraud or cybercrime reporting body and to the exchange involved if the destination is a platform address — and then be extremely wary of anyone who contacts you offering to recover the money. Recovery offers that follow a public loss are, almost without exception, the second scam.

Authority sources used

Outbound links are included for verification and entity authority, not decoration.

• Crypto Clipper uses Tor and worm-like propagation for persistence and controlMicrosoft Security Blog
• Microsoft found malware that hijacks crypto wallets and spreads through USB sticksCoinDesk
• Crypto Clipper Campaign Abuses Fake Reviews, AI Narrators, and VirusTotal CommentsThe Hacker News, reporting Check Point Research
• What To Know About Cryptocurrency and ScamsFederal Trade Commission

FAQ