Glossary / Privacy & security
Clipboard malware
Also known as Clipper malware.
- Definition
- Clipboard malware sits on an infected computer or phone and silently replaces any bitcoin address you copy with one belonging to the attacker, moments before you paste it.
This is the laziest profitable malware ever written: it does not need your password, your seed, or even administrator rights. Kaspersky's write-up of the CryptoShuffler trojan in November 2017 put its haul at roughly 23 bitcoin, and a 2018 family carried a hardcoded list of 2.3 million addresses to swap in. Nothing on screen changes when the substitution happens, so the only reliable defense is checking the address after you paste.
How it works
The clipboard is a shared scratchpad, and on most desktop systems any running program can read and write it without asking permission.
A clipper is a small background process that polls that scratchpad, usually a few times per second. When the contents match a pattern it recognizes, it overwrites them. The pattern matching is trivial, because cryptocurrency addresses advertise themselves: a bitcoin legacy address starts with 1, a script address with 3, native SegWit with bc1q, Taproot with bc1p, an Ethereum address with 0x followed by 40 hexadecimal characters. The malware keeps one attacker address per format so the replacement always looks plausible, and better-built versions pick the substitute that shares the most leading characters with what you copied, borrowing the trick that makes lookalike addresses work.
Infection routes are ordinary rather than exotic. Cracked software and game cheats, fake wallet or trading app downloads served through search ads, malicious browser extensions with clipboard permissions, and poisoned packages published to software registries under names close to popular libraries. On mobile, apps could once read the clipboard in the background unnoticed; Android 12 in 2021 began showing a notification whenever an app does it, and Apple added a comparable paste banner in iOS 14. Those warnings are why mobile clippers now tend to arrive inside a full fake wallet app instead.
The failure mode is total. Once the payment confirms, roughly ten minutes later, there is no mechanism anywhere in bitcoin to claw it back, and the attacker's address is fresh and unlinked to anything.
Where you see it
Clipboard malware only earns its keep at the handful of moments when you copy an address, and those moments are predictable.
Withdrawing from an exchange to your own wallet is the big one, and it is also the easiest to defend. Register the destination in the exchange's withdrawal whitelist while you are calm, and a swapped address will simply be refused later. Kraken, Coinbase, and Binance all support this.
Paying an invoice or a merchant is the second. Scan the QR code rather than copying text where you can, since a code rendered by the recipient never touches your clipboard. Be aware that a compromised browser can also redraw a QR code on a web page, so treat the two paths as equally suspect on a machine you do not trust.
Sending from a hardware wallet is where the attack breaks down, and it is the reason to own one. Trezor and Ledger devices display the destination address on their own small screen and require a physical button press to approve. That screen is driven by the device, not by the infected computer, so a clipper can change what the desktop app shows and still cannot change what you are asked to confirm. Read the device, not the monitor.
Two habits close the remaining gap. Compare characters from the middle of the address as well as the first and last four, because attackers optimize for the ends. And if a paste ever produces an address you did not expect, stop and treat the machine as compromised rather than pasting again, since a clipper that failed once will happily try on the next attempt.