Clipboard hijackers
Malware on your computer or phone watches the clipboard and swaps any wallet address you copy for the attacker's.
How it works
Clipboard malware comes bundled with cracked software, fake game mods, fake 'AI tools' and some fake extensions.
When it sees something shaped like a wallet address, it replaces it, often with a look-alike that shares the first and last characters.
The swap happens in the background, so it only shows up when you check the pasted address carefully.
Red flags
- A pasted address that differs from what you copied
- Cracked or pirated software on the same machine you use for crypto
Protect yourself
- Compare the full pasted address with the original, character by character
- Verify the address on a hardware wallet screen before you confirm
- Keep a clean device for crypto and avoid pirated software on it
If you already signed
- Scan or wipe the device before using it again
- Move funds to a wallet created on a clean device
Incidents using it 2
-
Medium✕Still active
'Silent Swap' clipper hides in a fake Google Notes browser extension to swap wallet addresses
McAfee researchers found unsigned .NET and Go installers, linked to the CountLoader malware loader, that force-install a fake 'Google Notes' extension into Chromium browsers. The extension reads the clipboard and replaces copied Bitcoin, Ethereum, Bitcoin Cash, XRP, Dash and Solana addresses with attacker addresses; it finds its control server through a smart contract. Anyone who finds an unknown 'Google Notes' extension should remove it and treat anything copied while it was installed as exposed. No loss total was published.
Chromium browser users infected via unsigned installers (fake 'Google Notes' extension)·Bitcoin, Ethereum, Solana·Since Jun 30, 2026·
-
High✕Still active
Microsoft: USB-spread 'CryptoBandits' clipper swaps wallet addresses and steals seed phrases over Tor
Microsoft reported a Windows crypto clipper, detected as Trojan:Win32/CryptoBandits, active since February 2026 and spreading through malicious shortcut (.lnk) files on USB drives. It checks the clipboard every half second, replaces copied Bitcoin, Tron and Monero addresses with lookalikes that share the first characters, grabs copied 12/24-word seed phrases and private keys, takes screenshots, and talks to its servers over Tor. Always check the whole address on your wallet or device screen before sending. No loss total was published.
Windows users who open shortcut files from USB drives·Bitcoin, Ethereum, Tron·Since Jun 17, 2026·