Crypto Clipper: malware that silently swaps a wallet address
Crypto Clipper monitors your device’s clipboard and may replace a copied cryptocurrency address with the attacker’s address. If you miss the change before sending, funds go to the wrong destination and recovery is often extremely difficult.
What happened in your case?
The response depends on whether you only copied an address, already approved a transaction or suspect malware on the device.
I copied an address but sent nothing
The funds have not left. Check the address and the device before doing anything else.
See the steps →I use a Trezor or another hardware wallet
Protection helps only if you actually verify the recipient on the device’s own screen.
See recommendations →I suspect malware on my computer
The device behaves suspiciously, or you installed an unfamiliar program, crack or wallet tool.
See urgent steps →I already approved the transaction
Keep evidence, verify the transaction ID and stop using the same device for further transfers.
See the steps →How Crypto Clipper works
The clipboard is manipulated silently. You believe you are sending cryptocurrency to the intended recipient, but malware may substitute another address before you paste or approve it.
You copy an address
You copy the recipient address from an exchange, wallet, email or chat. Verify the source independently too.
Malware watches the clipboard
The clipper looks for clipboard values resembling cryptocurrency addresses.
The address is replaced
The original is replaced with an attacker-controlled address, sometimes a visually similar one.
You paste it into the wallet
A different address appears from the one you intended to use.
The check is too quick
You check just a few characters or trust the computer and miss the substitution.
The transaction goes elsewhere
Once confirmed on the blockchain, recovery is usually very difficult.
Clippers are part of a broader threat known as cryware
Cryptocurrency attacks may combine clipboard substitution with credential theft, screenshots and other harmful functions.
An attack can have several functions
The clipper may be one component of malware that also steals other sensitive information.
It is not limited to “crypto software”
Cracks, fake utilities, dubious attachments and tampered installers can also deliver it.
Communication may be concealed
Some campaigns use proxies or other infrastructure to make their communication harder to trace.
More than addresses
Cryptocurrency malware may seek recovery phrases, private keys, credentials or screenshots.
Common infection routes
This threat concerns the device and environment used for the transaction, rather than the cryptocurrency alone.
Fake wallet tools
Supposed crypto helpers, address generators, trading utilities or fake updates.
Pirated software and cracks
Unverified installations may contain malware that steals passwords, cryptocurrency or other data.
Infostealers and ClickFix
A deceptive website or email may first deliver other malware, with the clipper just one of its functions.
Unknown USB devices and attachments
Shortcuts, archives, macros and executable attachments from unverified sources can be risky.
How to protect against address substitution
Combine a trusted device, careful full-address verification and caution about unverified software.
Safer practice
- Verify the full recipient address against an independently trusted source before approval.
- With a hardware wallet, check the address on its own screen against the intended recipient.
- Compare the entire address, not just its beginning and end, regardless of the amount.
- Make transfers only from a trusted, updated device.
- A small test transfer can reveal some mistakes, but is not proof that a later transfer will be safe.
Common mistakes
- Assuming that copy and paste is always safe.
- Checking only a few address characters in a hurry.
- Transferring from a device full of cracks, unfamiliar extensions or experimental software.
- Keeping a recovery phrase in ordinary computer files, cloud storage or screenshots.
- Sending without checking the recipient, network, asset and any required memo or destination tag.
Check the destination address
Compare the whole address with a trusted source; check the hardware wallet’s own screen if used.
Use a hardware wallet properly
The device helps only if you verify the details shown on its own display before signing.
Update the system and software
Keep your operating system, browser, wallet app and security software current.
Avoid dubious tools
Avoid cracks, unofficial wallet helpers and dubious trading utilities.
Separate everyday activity from crypto
A dedicated trusted device can reduce exposure. A separate browser profile alone does not isolate you from system malware.
Consider a test transfer
A small trial can expose an error, but verify the entire address and transaction details again for every later transfer.
What to do if you suspect Crypto Clipper
Acting early can prevent further loss. The next steps depend mainly on whether the transaction has already been confirmed.
I copied an address but have not approved the transaction
- Stop the transaction and approve nothing.
- Compare the recipient with an independently verified source, without relying on the same clipboard.
- Stop wallet activity and have the device checked with trusted security tools; a clean scan alone is not proof of safety.
- Review recently installed programs, browser extensions and downloaded files.
- Make no further transfers from the device until its safety has been established.
I approved the transaction and the funds left
- Keep the transaction ID, actual destination, intended destination and exact time, plus the network and asset.
- If an exchange or other service was involved, contact its genuine support promptly with those details. Recovery is not guaranteed.
- Stop using the same device for wallet operations.
- Arrange a thorough system assessment; confirmed compromise may require a clean reinstall and careful restoration.
- Report suspected crime to the police or relevant reporting service in your country and preserve technical records.
I suspect malware on the device
- Stop financial and cryptocurrency activity on it; disconnect it from networks if compromise is suspected.
- Arrange a full scan and trusted technical assessment. A clean scan alone cannot exclude compromise.
- Review new programs, browser extensions and suspicious system changes.
- Never enter recovery phrases, private keys or important credentials on that device.
- Change sensitive passwords from another trusted device.
I kept a recovery phrase or private key on the computer
- With credible compromise, treat the exposed recovery phrase or key as compromised too.
- Use a clean trusted device and official wallet instructions to create a new wallet with a new recovery phrase.
- If funds remain, get trusted help planning a safe move. With an active sweeper, adding funds for fees may lead to further theft; do not experiment or share the phrase with anyone.
- Do not reuse the compromised phrase or key; changing an app password does not replace them.
- Keep evidence and have the affected device assessed safely.
Funds already sent to another address?
Do not wait for an automatic return. Keep the transaction ID and technical details, stop transfers from the device and follow the incident-response steps. Beware of paid “recovery” promises and never share your recovery phrase.
What to save and report
Transaction records help explain where the funds went and what happened on the device.
Transaction ID and addresses
Keep the transaction hash, intended address and actual destination.
Screenshots
Preserve already available wallet screens, transaction history, suspicious behaviour and error messages; do not perform new transfers for evidence.
Suspicious files and links
Record installer names, URLs, attachments and archive names. Do not reopen suspicious files or expose recovery phrases in screenshots.
Incident timeline
Record what you installed, when you copied the address and when you approved the transaction.
Crypto Clipper – FAQ
Answers about malicious wallet-address substitution.
Does a hardware wallet always protect me?
It helps when you verify the full destination against a trusted recipient on the device’s own screen before signing. Owning the device alone is not enough; approving a wrong address still sends to that address.
Is checking the first and last characters enough?
No. An attacker may choose an address with similar beginning and ending characters. Compare the entire address with an independently trusted source before every approval.
Can malware also steal recovery phrases and private keys?
Yes. Cryptocurrency malware may target recovery phrases, private keys and other sensitive data as well as swapping addresses.
Did I lose money if I only copied an address but sent nothing?
Not necessarily. Without an approved transfer, the funds may not have left. Still investigate the device because malware may remain and other data could be exposed.
Can a sent blockchain transaction be reversed?
A confirmed blockchain transfer generally has no ordinary cancellation option. Preserve the transaction ID and contact any involved service promptly; tracing or reporting does not guarantee recovery.
Where should I report the incident?
Contact the genuine support of any involved exchange or service. Report suspected fraud or loss to local police or the relevant reporting service with transaction IDs, addresses, network and times. Never share private keys or recovery phrases.
Remember one rule
Crypto Clipper can remain unnoticed until funds have already left.
Verify the full recipient address immediately before every transaction approval.
Also check the address source
Address poisoning is different: a lookalike address is planted in transaction history, so you may copy the wrong recipient without clipboard malware. Never use history alone as the source; verify the full address independently.
Ledger: address poisoning (English) · MetaMask: clipboard hacking (English)