Clipper Malware
Malicious software that monitors a device's clipboard and silently swaps a copied crypto address for an attacker's address before the victim pastes it.
Clipper malware is a type of malicious software that runs in the background on an infected device, continuously monitoring the clipboard for anything resembling a cryptocurrency address, and silently replacing it with an address controlled by the attacker the moment it's copied. Because crypto addresses are long strings most users don't check character-by-character before pasting, a victim who copies a legitimate recipient's address and pastes it into a send transaction may unknowingly send funds to the attacker's substituted address instead.
This attack relies entirely on exploiting the common habit of copying and pasting addresses without carefully verifying every character after pasting, making the most effective defense simply double-checking the full pasted address — or at minimum its first and last several characters — against the intended recipient's address before confirming any transaction. Clipper malware is typically bundled with other malicious software or distributed through compromised downloads, and its presence is often only discovered after funds have already been misdirected.
Examples
- A user infected with clipper malware might copy a friend's correct wallet address, only to have the malware silently replace it with the attacker's address before they paste it into their wallet.
- Carefully verifying a pasted address's full character string against the intended recipient before confirming a transaction is one of the few reliable defenses against clipper malware.