Crypto clipboard hijacker and address poisoning: stay safe

A pasted wallet address is the weakest moment in any crypto payment. Everything before it is careful. Then you press paste, glance at a string of 42 characters, and send.

Two different attacks aim at that glance. One happens on your computer: the crypto clipboard hijacker (also called a clipper) changes the address between copy and paste. The other happens on the blockchain: address poisoning puts an address that looks almost like your contact's into the list you copy from.

This guide shows both as you would see them, how to check an address properly, and what to do if money already left. It also says plainly what the antitheft app does not stop here. It cannot, and the habit is what protects you.

What is a crypto clipboard hijacker?

A crypto clipboard hijacker is malware that watches your clipboard and replaces any wallet address you copy with one the attacker owns. It changes text only. It does not need your wallet, your password or your seed phrase to steal a payment.

You copy an address from a message, an invoice or an exchange page. Within a fraction of a second, the program sees something shaped like an address and overwrites it. You paste the attacker's address and nothing on screen tells you.

Microsoft documented a Windows clipper in June 2026 that checks the clipboard roughly every 500 milliseconds and has been active since February 2026. Its replacement addresses keep the first characters of the real one, so the start still looks right. Check Point found another in June 2026 carrying more than 15,500 attacker addresses in one program.

1. 1You copy a friend's address from their messageMara sends it in a chat, you copy it, nothing looks different.
   MMaraonline

   MHere is my wallet address for the payment10:41

   M0x7a3F9c2e51B8d40E6a1c93D7b2f08E45aC1d9B6210:41

   Write a message
2. 2A program on your computer changes it before you pasteThis step is invisible. The screen below is only here to show what happened behind the scenes.
   Your clipboard, one moment after you copied

   FileEditView

   10x7a3F9c2e51B8d40E6a1c93D7b2f08E45aC1d9B62

   20x7a3F9e04D18c7A5b3f6290eC1d84b7a3F05e9B621

   1. 1Same start, same end, different middle
3. 3You paste it into your wallet and sendThe start and the end look right, so the eye says yes. The middle is where the difference is.
   Send

   To0x7a3F9e04D18c7A5b3f6290eC1d84b7a3F05e9B621

   Amount0.50

   Send
   1. 1Not Mara's address
4. safeYou paste into a plain note first and compare it with the messageRead it in blocks of four or five characters against the original. The mismatch shows at the first block that differs.WindowsmacOSLinux
   Scratch note

   FileEditView

   1Ctrl+V

   20x7a3F 9e04 D18c 7A5b 3f62 90eC ...1

   1. 1Mara's message says 0x7a3F 9c2e 51B8 ...
   Scratch note

   FileEditView

   1Cmd+V

   20x7a3F 9e04 D18c 7A5b 3f62 90eC ...1

   1. 1Mara's message says 0x7a3F 9c2e 51B8 ...
   Scratch note

   FileEditView

   1Ctrl+V

   20x7a3F 9e04 D18c 7A5b 3f62 90eC ...1

   1. 1Mara's message says 0x7a3F 9c2e 51B8 ...

How does a clipboard hijacker get onto my computer?

Clippers arrive the way other stealers do: as a program you chose to run, or from a stick someone plugged in. They are rarely the only thing a bad program does.

Check Point's June 2026 report found one hidden inside tools that promise an unfair edge: Solana and Pump.fun "sniper" bots and "Aviator Predictor" style game predictors. They were pushed through GitHub, SourceForge, YouTube and a WordPress site, all propped up with faked stars, downloads and views. Its advice: "Don't trust engagement metrics as a proxy for safety."

Microsoft's clipper spread through shortcut files on USB drives, and it did more than swap addresses. It also reads the clipboard for anything shaped like a seed phrase or private key, and it takes screenshots of your wallet and balances.

This is why the swap is only one symptom. A machine with a clipper on it should be treated as an infected machine, not just a wrong address. The same routes in (cracked tools, fake ads, tools that promise sure profits) are covered in is cracked software safe and fake ads for real apps.

For power usersWhy the first characters often match

A clipper does not have to match the whole address, because you will not read the whole address. Microsoft's report describes replacement addresses that keep the first characters of the original, and Check Point's carries a big list of ready-made attacker addresses to pick from. For the attacker, a close start is cheap. For you, it is enough to pass a glance.

What is address poisoning?

Address poisoning is a scam where an attacker plants an address that looks like one you use into your transaction history, so you copy the wrong one later. Nothing is installed on your computer, and your wallet is not touched.

Chainalysis describes the pattern: the scammer studies the addresses you use often, generates new addresses until one resembles yours, then sends a small, harmless-looking transaction from it. That puts the look-alike next to the real one in your history.

The look-alike matches the ends because those are the parts wallets show. Many wallets shorten an address to a few characters at each end with an ellipsis in between. Carnegie Mellon researchers found that victims tend to pick addresses that sit near the top of a recent list and look most like the right one, and that showing more of the address makes the attack work less well.

1. 1You pay a contact as usualYour history now shows a payment to Mara's address, shortened the way wallets show it.
   Activity

   FileEditView

   1Sent 50 USDT

2. 2An attacker's tool sends you a worthless transfer from a look-alikeIt costs the attacker almost nothing and it puts a second, similar line in your history.
   Activity

   FileEditView

   1Received 0 USDT1

   2Sent 50 USDT

   1. 1Not Mara. Same ends, different middle
3. 3Next time you copy the address from your historyThe newest line is the look-alike, and it reads exactly like the real one.
   Send

   To (copied from Activity)0x7a3F…9B621

   Amount2,000

   Send
   1. 1You cannot tell which of the two this is
4. safeYou pay from a contact you saved yourselfAn attacker can add lines to your history. They cannot add them to a contact you saved after checking the full address.
   Address book

   Mara0x7a3F9c2e51B8d40E6a1c93D7b2f08E45aC1d9B62 · saved after checking in full

   Send

In December 2025 one person lost almost $50 million this way. CoinDesk and The Block report that after withdrawing the funds, the victim sent a test of 50 USDT, and 26 minutes later sent 49,999,950 USDT to an address that matched the first five and last four characters of the real one. The test did not save them: the test itself put a fresh line in the history for the attacker to copy.

The planted transfer can even be for zero, so it costs the attacker almost nothing. Whatever the amount, the rule is the same: your history is not a trusted source.

How do I check a crypto address before I send?

To check a crypto address, compare the whole of it, from a source you trust, against what is about to be sent, and use a saved contact when you can. The first and last characters alone are not enough, because both attacks above are built to match exactly those.

Do these steps in this order every time you pay someone new, and for any amount you would miss:

1. Get the address from the right place. The person's own message, the exchange's deposit page, or your wallet's own receive screen. Never from your history or from a search result.
2. Paste, then read every character. Compare it in blocks of four or five against the original, from the first to the last. Where your wallet shortens the address, open the full view.
3. Confirm it a second way for a first payment. Ask the person to read you the first and last few characters by phone, or message them on a different app. A clipper on your computer cannot change what they say.
4. Save the address as a contact once it is checked, and pay that contact from then on. Do not save an address you copied from your history.
5. Send a small amount first, wait until the person confirms they got it, then send the rest to the same saved contact. Do not copy the address again from the history that the small payment just filled.
6. On a hardware wallet, read the address on its own screen. Trezor's guidance is "Copy, paste, then verify on your Trezor before you confirm": a computer can be made to lie, the device's screen is the part that cannot.

• I copied the address from the person's own message or the exchange page, not from my history
• I compared the whole address in blocks, not only the start and the end
• For a first payment, the person confirmed the ends by a second channel
• The address is saved as a contact I checked, and I paid that contact
• On a hardware wallet, the device screen shows the same address

For power usersWhy the plain note and the device screen help

Most wallets abbreviate addresses in lists, which is exactly the view poisoning is built for. Open the full address wherever you can. Pasting into a plain text field first shows you the real clipboard contents at full length, not a shortened preview, so a swapped address stands out when you compare it with the source. For a large amount, the hardware wallet's own screen is the strongest check, because it does not run on your computer and malware cannot redraw it.

How do I protect myself from a clipboard hijacker?

You protect yourself by keeping the program off your computer and by checking every pasted address anyway. A checking habit catches a hijacker that gets through.

• Do not run tools that promise an edge. Sniper bots, game predictors and anything that promises sure crypto profits are, in Check Point's words, "classic bait". Cracked software and fake ads for real apps are the other usual way in.
• Do not plug in a USB stick you were handed, and do not open shortcut files from one. That is how Microsoft's clipper spread.
• Never copy a seed phrase or private key to the clipboard at all. Microsoft's clipper reads the clipboard for exactly those. See seed phrase safety and how to protect a crypto wallet from malware.
• Keep your system's own scanner on. It catches clippers it already knows. Treat a clean scan as good news, not proof, and keep checking addresses anyway.
• If one address ever pastes differently than it copied, stop. Do not send anything from that computer.

Does antitheft stop clipboard hijackers and address poisoning?

No. The antitheft app does not stop a program from changing an address you copy, and it does not stop address poisoning. Both are decided by what you paste, and only your check protects you.

What the antitheft app does is different. On Linux only the app that owns your wallet files, browser passwords, logins and cookies may open them, so a stealer that arrives alongside a clipper cannot read them; on Windows and macOS that stealer is stopped the moment it touches them. A clipper can still change a payment address. Think of the app as keeping your wallet and passwords closed, and of the habit above as keeping your payments honest.

On Linux, antitheft's Activity view also lists what is set to start with your computer and marks entries that changed for a look. A clipper has to start somewhere, so a changed entry there is your cue to check.

What to do if I already sent crypto to the wrong address

Act within minutes, because the only chance of getting anything back is a company that can still freeze the money. Most of the time it cannot be recovered, and that is worth knowing before you start.

1. Stop sending anything, and do not retry the payment from the same computer.
2. Write down the transaction ID, the destination address, the amount and the time. Copy them from your wallet or a block explorer, not from memory.
3. Find out where the money went. If the address belongs to an exchange or another company, contact their support at once with the transaction ID and ask them to freeze it. If it is a private wallet, a company cannot help and the chance of getting the money back is small.
4. Contact your bank or the service you paid from, if you sent through one, and ask for a recall. The FBI's guidance in its 2025 report is that "time is of the essence" and to "request a recall of the funds".
5. File a report at ic3.gov if you are in the US, or with your local police, whatever the amount. The FBI asks for the full transaction details, and says IC3 may be able to assist financial institutions and law enforcement in freezing funds.
6. If a clipper did it, move everything else. From a clean device (your phone is fine), create a new wallet with a new seed phrase and move the rest of your funds there. Treat any seed phrase you ever copied on that computer as read. Then reinstall the system before you use it for money again.
7. Ignore anyone offering to get it back. Someone who writes to you after a loss, a "recovery firm", a "lawyer", a "hacker for hire", is almost always a second scam.

$1.4Breported lost in recovery scams in 202510,516 complaints. People already robbed, chased again. May include the loss from the first scam.

$11.4Breported lost in complaints that involved crypto in 2025181,565 complaints. Mostly investment fraud: wrong-address sends have no line of their own.

Source: FBI IC3, 2025 Internet Crime Report, Apr 2026

The FBI's report names the pattern: more complaints about scammers impersonating government officials and recovery firms, and fictitious law firms targeting crypto victims. No one can reverse a blockchain payment for a fee, and no real helper needs your seed phrase.

For power usersIf the funds are a stablecoin or went to an exchange

The only parties that may be able to act on a completed transfer are the ones that run the destination: an exchange that holds the receiving account, or the company that issues a stablecoin. Give them the transaction ID and, once you have it, your police or IC3 report number. Speed matters because the money moves on: The Block reports that in the December 2025 case the attacker swapped the stolen USDT into another asset within 30 minutes. That is why the first call matters more than the second.

Which is worse, a clipboard hijacker or address poisoning?

Neither is worse in the outcome: both send your money to a stranger, and neither can be undone. They differ in what they say about your computer.

A clipboard hijacker means a program is running on your computer, and it probably does more than swap addresses. Address poisoning says nothing bad about your computer at all: it is a trap on a public ledger, and only your habit defeats it.

The fix for both is the same two rules: read the whole address from a trusted source, and never copy one from a list a stranger can add to. That habit protects you whichever one is aimed at you.

For the program side, what an infostealer is covers what else tends to arrive with a clipper, and what a crypto drainer is covers the signature scams that no address check can catch. On Linux antitheft keeps your wallet and passwords closed to everything but their owner, and on Windows and macOS it stops anything else that touches them. The check before you press send stays with you.

Questions people ask

What is a crypto clipboard hijacker?

A program running on your computer that watches what you copy. When it sees something shaped like a wallet address, it quietly replaces it with the attacker's address, so the address you paste is not the one you copied. It changes text only: it does not need your wallet, your password or your seed phrase to do it.

What is address poisoning?

A scam on the blockchain itself, with nothing installed on your computer. An attacker makes an address that starts and ends like one you use, then sends you a tiny or zero-value transfer from it so it lands in your transaction history. If you later copy the address from your history instead of from the original source, your funds go to the attacker.

How do I know if my clipboard was hijacked?

You usually cannot see it happen, so check the pasted address against the source every time, in full, before you confirm. If you ever find the pasted address differs from the one you copied, treat the computer as infected: stop using it for crypto, move your funds from a clean device to a new wallet, and reinstall the system before you use it for money again.

Does sending a small test transaction protect me?

Only against typing or pasting a wrong address once. It does not protect you from address poisoning if you then copy the address for the big transfer from your history, because the test itself puts a new line there for the attacker to imitate. In a December 2025 case the victim sent a test of 50 USDT first, then lost almost $50 million 26 minutes later. After the test, paste the same address again from your saved contact or from the original source, and compare it in full.

Can I get crypto back if I sent it to the wrong address?

Usually not. Blockchain transfers cannot be reversed by anyone. The only chance is when the money landed at an exchange or other company that can freeze the account, so tell them within minutes and report it at ic3.gov (US) or to your local police with the full transaction details. Be careful of anyone who offers to recover it for a fee: the FBI counted 10,516 recovery-scam complaints and $1.4 billion in reported losses in 2025.

Does antivirus or antitheft stop clipboard hijackers?

A good antivirus catches clipboard hijackers it already knows, but a new one can get through, so the checking habit matters either way. antitheft is not an antivirus. Its app keeps other programs out of your wallet files, browser passwords and cookies on Linux, and on Windows and macOS stops a program that touches them, but it does not stop a program from changing an address you copy, and it does not stop address poisoning. Only your own check does.

Is it safe to copy an address from my transaction history?

No. History is the one place an attacker can add lines to. Copy an address only from the source that you trust (the person's own message, the exchange's deposit page, your wallet's own receive screen) or from a contact you saved yourself after checking it in full.

the short version

A crypto clipboard hijacker and address poisoning are the two ways a pasted wallet address ends up wrong. The hijacker is a program that swaps the address you copied for the attacker's. Address poisoning needs no program: an attacker plants a look-alike address in your transaction history and waits for you to copy it. Both send your crypto to a stranger, and nobody can undo it. The defence is a habit: read the whole address, and never copy one from your history.

sources

1. FBI Internet Crime Complaint Center: 2025 IC3 Annual Report (crypto complaints, recovery scams, reporting guidance) (Apr 2026)
2. Microsoft Security blog: Crypto Clipper uses Tor and worm-like propagation for persistence and control (Jun 2026)
3. Check Point Research: From Stars to Upvotes, fake reputation fueling a crypto clipboard hijacker (Jun 2026)
4. Check Point Blog: the fake reputation economy behind a crypto clipboard hijacker (user advice) (Jun 2026)
5. CoinDesk: crypto user loses $50 million in an address poisoning scam (Dec 2025)
6. The Block: crypto trader loses $50 million in address poisoning attack (Dec 2025)
7. Chainalysis: Anatomy of an address poisoning scam (how it works, advice) (Oct 2024)
8. Tsuchiya, Dong, Soska and Christin (Carnegie Mellon): Blockchain Address Poisoning, arXiv 2501.16681 v3 (Jul 2025)
9. Trezor: Trusted Display, verify every address on your device