You copy a wallet address from an exchange, a friend's message, or your own records. You paste it into your wallet, check that a swap or transfer looks right, and send. Except in a small but real number of cases, the address that landed in the paste field was never the one you copied. Something on the computer swapped it in between.
That something is a category of malware known as a clipper, short for clipboard hijacker. It has existed for years across different kinds of digital theft, and it has become one of the more persistent threats to self custody wallets because it does not need to trick you into clicking a bad link or approving a strange transaction. It just needs to sit quietly on your device and wait for you to copy something that looks like a wallet address.
What a clipper actually does
Your operating system's clipboard is a simple, shared piece of memory. Any program running on your computer can, in principle, read what is on it and write something new to it. Most of the time nothing abuses that. A clipper is malware built specifically to abuse it.
Once installed, a clipper monitors the clipboard in the background. When it detects text that matches the pattern of a cryptocurrency address, a long string starting with 0x for Base and other EVM networks, or the different formats used by Bitcoin and other chains, it quietly replaces that text with an address the attacker controls. The swap happens in a fraction of a second, well before you paste. If you do not check the pasted address against the one you meant to use, the funds go to the attacker instead of the intended recipient.
This is different from address poisoning, which plants a lookalike address in your transaction history so you copy the wrong one by mistake. A clipper does not rely on you making that kind of error. It intercepts a copy of an address you got right and corrupts it before you ever see the destination.
How it tends to spread
Security researchers have documented several clipper campaigns over the years, and reporting from Microsoft in mid-2026 described one such family spreading through infected USB drives and malicious shortcut files, then persisting on the system and communicating with attacker infrastructure in the background. Other researchers have separately documented clippers distributed as fake browser extensions posing as note-taking or productivity tools.
The distribution methods vary and change over time, but the pattern is consistent: the malware arrives disguised as something else, whether a USB drive shared at an office, a cracked piece of software, a fake browser extension, or an attachment in an unsolicited message, and once it is running, it works silently until you copy an address.
Why it is easy to miss
A clipper does not ask for permission, does not pop up a warning, and does not change how your wallet behaves. The wallet software itself is not compromised. It faithfully sends a transaction to whatever address is in the paste field, because as far as the wallet knows, that is the address you chose.
The only symptom is the address itself, and most people do not re-read a 42-character string character by character before confirming a transaction. That is exactly the gap a clipper is built to exploit.
How to protect yourself
A few habits close most of the gap:
Check the pasted address, not just the copied one. After pasting, glance at the first and last several characters and compare them to the source you copied from. This will not catch every clever lookalike, but it catches a wholesale swap to an unrelated address, which is what most clippers do.
Confirm on a hardware wallet's own screen if you use one. A hardware wallet shows the destination address on its own separate display, not on the potentially infected computer. If that address does not match what you intended to send to, decline the transaction there, regardless of what your computer screen shows.
Keep your operating system and browser extensions minimal and updated. Clippers are malware, and standard malware hygiene reduces the risk of picking one up in the first place: avoid unfamiliar USB drives, avoid pirated software, and periodically review which browser extensions you actually have installed. An extension you do not remember installing, or one that asks for broad permissions it does not need, is worth removing.
Use antivirus or endpoint protection that is kept current. Clipper families are known malware and get added to detection signatures over time. This is not a complete defense on its own, since new variants appear, but it catches a meaningful share of known threats.
Treat a freshly reinstalled or reset device as a fresh start. If you ever suspect your device is compromised, generating a new wallet on a clean device and moving funds there is safer than continuing to use a machine you are not sure about. Our guide on keeping your recovery phrase safe covers how to do that without creating new risks in the process.
None of this requires special tools beyond attention and basic device hygiene. The defense against a clipper is the same defense that works against most wallet threats: verify what is actually on the screen in front of you before you approve anything, rather than trusting that what you copied is what arrived.
This is general security information, not a guarantee against any specific threat.