Clipboard Hijacking

How It Works

Clipboard hijacking malware (also called a clipper or clipboard replacer) runs silently in the background on an infected device. It monitors the system clipboard using OS APIs and uses pattern matching — typically regex — to detect when a cryptocurrency address is copied. Crypto addresses have distinctive formats: Ethereum addresses start with 0x followed by 40 hex characters, Bitcoin addresses start with 1, 3, or bc1, and Solana addresses are 32-44 base58 characters.

When the malware detects a copied crypto address, it instantly replaces it with a pre-configured attacker address. The replacement happens in milliseconds, and the user sees no visual indication that the clipboard content has changed. When they paste the address into a send transaction, they unwittingly paste the attacker's address instead of the intended recipient.

Advanced clipper malware maintains a database of attacker addresses that visually resemble common address prefixes or suffixes, making the substitution harder to detect even if the user partially verifies the pasted address. Some variants specifically target exchanges and wallet applications, activating only when these programs are in the foreground.

Why It Matters

Clipboard hijacking is especially dangerous because it exploits a behavior that every crypto user performs regularly — copying and pasting addresses. The attack requires no interaction with smart contracts, no phishing site, and no social engineering. Once the malware is installed, every address the user copies is a potential theft opportunity.

Prevention includes always verifying the full pasted address against the original before confirming a send transaction, using hardware wallets that display the recipient address on a trusted screen, using address book features in wallets to avoid manual copying, and maintaining strong device security with updated antivirus software. QR code scanning instead of copy-paste also bypasses clipboard attacks.

Real-World Example

A user downloads a seemingly legitimate crypto trading tool from an unofficial source. The installer bundles clipboard hijacking malware. Later, the user copies their Binance deposit address to transfer ETH from MetaMask. The malware swaps the address in the clipboard. The user pastes the address, glances at the first few characters (which match), and confirms the transaction. The ETH is sent to the attacker's wallet instead of Binance. The loss is only discovered when the deposit never arrives.