Clipboard Hijacking Attacks: When Copy and Paste Can Cost You Crypto
Clipboard hijacking attacks happen when malware or a malicious browser extension changes what you copied before you paste or approve a crypto transaction. For Bitcoin and crypto users, the practical rule is simple: your clipboard is only a convenience; the final send screen is where the real check has to happen.
If you have ever copied a Bitcoin address, pasted it into a wallet, glanced at the first few and last few characters, and clicked send, you have used the habit these attacks are built around. With crypto, one wrong pasted address can send money to someone else. That is why the final screen matters so much.
What are clipboard hijacking attacks?
A clipboard hijacking attack is a device-side attack where software watches your clipboard and replaces copied information with something chosen by the attacker. In crypto, that usually means wallet address swapping.
The normal flow is supposed to be boring. You copy the correct Bitcoin, Ethereum, or exchange deposit address. You paste it into your wallet. You review the transaction. Then you send.
With a clipboard hijacker, the middle step changes. The malware recognizes that the copied text looks like a wallet address, then swaps it for an attacker-controlled address. Your wallet may still accept the pasted address because the new address can be valid. It is just valid for the attacker.
Microsoft has described “clipping and switching” as a cryware technique where malware monitors clipboard content and replaces wallet addresses. In 2026, Microsoft and McAfee both reported clipper campaigns that watched copy/paste activity and swapped crypto addresses before confirmation.
Address format checks have limits. They can reject broken addresses. They cannot protect you when the attacker gives your wallet a different valid address.
Why crypto users are good targets
Crypto addresses are long enough that most people stop reading them closely. After a while, people start checking only the beginning and end.
Attackers know this. BleepingComputer reported on Laplas Clipper in 2022, which replaced copied crypto wallet addresses with lookalike attacker addresses aimed at people who compare only a few starting and ending characters. The uncomfortable part is that you may have copied the right address from the right place. The mistake happens after that, inside your own browser, operating system, clipboard manager, or infected computer.
Clipboard hijacking vs address poisoning
Clipboard hijacking and address poisoning both exploit copy/paste trust, but they hit at different moments.
With clipboard hijacking, you copy the correct destination, then malware swaps the destination before it reaches the send screen or before you confirm it.
With address poisoning, the attacker poisons your wallet history first. They may send tiny, zero-value, dust-value, or fake-token transactions involving a lookalike address, hoping you later copy the wrong history entry yourself. MetaMask warns users against trusting shortened address views or copying blindly from history. A 2025 USENIX Security paper measured address poisoning activity on Ethereum and BNB Smart Chain from July 2022 through June 2024 and found 270 million attack attempts, 17 million targeted victims, 6,633 successful incidents, and at least $83.8 million in losses.
The plain-English difference is timing. Clipboard hijacking swaps the address after you copy. Address poisoning tricks you into copying the wrong address before the clipboard ever gets involved.
Related reading: this attack pairs with address poisoning attacks, another copy-and-paste trap that hits before the clipboard ever gets involved.
The dangerous habit is checking too little
A lot of wallet interfaces shorten addresses because full addresses are ugly to read. That makes the screen cleaner, but it can train bad habits. Checking only the first four and last four characters is thin protection for larger transfers.
The better habit is to compare more of the address, including middle characters, on the final screen where the transaction will actually be signed or submitted. Ledger’s support guidance says to verify the entire destination address on the Ledger device and abort if the device address does not match the intended destination.
A hardware wallet helps only when you use the hardware wallet screen as the source of truth. Blind-confirming defeats the point.
What should you do before pressing send?
Use a boring checklist. Boring is good when money is moving.
- Copy the address from a trusted source.
- Paste it into the wallet or exchange withdrawal page.
- Compare the pasted address with the intended address, including middle characters.
- If you use a hardware wallet, compare the address on the device screen.
- For new addresses, large transfers, or anything under pressure, send a small test transaction first.
- After the test succeeds, send the larger transaction to the same verified destination.
Withdrawal whitelists can help, but be careful when creating the whitelist. If the address was added through an infected clipboard, you may have whitelisted the attacker’s address from day one.
Warning signs you should not ignore
Stop if the pasted address changes after you copy it. Stop if your hardware wallet or wallet software shows an address mismatch. Stop if a recent browser extension asks for strange permissions, or if you downloaded cracked software or fake tools.
Check Point has reported crypto clipboard hijackers being distributed through fake popularity signals across GitHub, SourceForge, YouTube, forums, and VirusTotal comments. McAfee’s 2026 extension report described a malicious extension campaign disguised as “Google Notes.”
If you suspect infection, do not keep transacting from that machine. Disconnect, scan with trusted security tools, remove suspicious extensions, and consider a clean reinstall if the compromise looks serious. Move funds only from a clean device if seed phrases or private keys touched the suspect machine.
The practical rule
Treat copy and paste as untrusted until the final send screen proves otherwise.
That one habit covers clipboard hijacking, address poisoning, wrong exchange deposit addresses, old saved contacts, and rushed transfers. If you use a hardware wallet, the device screen matters even more than the computer screen.
Crypto gives you direct control, and direct control has sharp edges. Slow down for the last 30 seconds. Read the address. Check the middle. Use a test transaction when the amount matters. If anything looks wrong, abort.
A missed send is inconvenient. A wrong send may be permanent.
Source list
- Microsoft Security Blog: cryware clipping and switching (2022); Windows crypto clipper campaign (2026).
- McAfee Labs: “Silent Swap: A Crypto Clipper Extension Campaign” (2026).
- BleepingComputer: Laplas Clipper lookalike address reporting (2022).
- Ledger Support: Clipboard Highjack guidance, last updated May 13, 2026.
- MetaMask Help Center: address poisoning scams.
- USENIX Security 2025: “Blockchain Address Poisoning.”
- Check Point Research: fake reputation economy behind crypto clipboard hijackers.
Disclaimer: This article is for general informational and educational purposes only and does not constitute financial, investment, legal, or tax advice. Cryptocurrency and Bitcoin involve risk. Always conduct your own research before making financial decisions.
Related reading
Continue with these related Proof of Tech guides: