Clipboard Attack: How Malware Swaps the Wallet Address You Copied

You copy the receiving address from your wallet, switch to your exchange window, paste it and confirm the withdrawal. If what is known as a clipper is running on your computer, the address you pasted is no longer the one you copied. It belongs to the attacker, it is technically entirely valid, and your wallet has no reason to reject it. The money is gone as soon as the transaction is confirmed.

This type of attack is old, but over the summer of 2026 it changed in three ways that concern you directly as a holder: the route onto the machine, the operating system, and the question of how much is taken from you at all. This piece explains each of the three using the publications in which they were described, and ends by saying which check actually works.

Clipboard attacks explained: how malware swaps the wallet address you copied

A clipper is a malicious program that monitors the contents of the clipboard and replaces any crypto address it recognises with an address controlled by the attacker. That is the whole idea. Nothing is decrypted, no wallet file is opened, no password is guessed. The attack exploits the one moment in which an address leaves the secure area of your wallet and travels through the operating system as plain text.

What sets it apart from almost every other attack on crypto assets is that you do everything right and still lose. You copied the address correctly. Your wallet is not compromised. Your seed phrase sits untouched in the safe. The transaction you sign is exactly the transaction you see, only to a different recipient. That is why none of the precautions that protect against forged approvals or against key theft apply here.

Bitcoin is only one of the targets. If you are interested in the price of the largest crypto asset, you will find our current assessment in our bitcoin price prediction. For this piece, only one thing about Bitcoin matters: the address formats are publicly documented and easy to detect by machine, and that is precisely what makes them convenient for a clipper.

ClickFix: why you paste and run the malicious code yourself

ClickFix describes a deception in which a website places a command in your clipboard and then gets you to paste and run it yourself in your computer's command line. The name comes from the fact that the page acts out a problem for you and immediately offers the matching repair.

That is why this type of attack works so well. There is no email attachment for a virus scanner to check, and no download for your browser to flag as suspicious. The malicious code arrives as text in the clipboard, and the user carries out the execution with their own hand. From the operating system's point of view, the logged-in user entered a command. Which is exactly what they did.

The sequence in detail: what the Federal Office for Cybersecurity described

The Swiss Federal Office for Cybersecurity broke the sequence down into six steps in its weekly review of February 24, 2026. First the attackers manipulate a website or place an advertisement with a convincingly realistic window. Merely opening the page already copies the malicious code into the clipboard automatically, without anything having to be clicked. The window then claims a technical problem, usually a failed browser update or a CAPTCHA still to be solved.

The user is then instructed to enter innocuous-looking key combinations. These open the console, paste the prepared code and run it. At the end comes the download of a program that harvests login credentials and wallet data. The agency puts its most important recommendation unambiguously: be suspicious as soon as a website claims the browser needs updating, and never copy code from an unknown source directly into the command line. The notice deliberately names no specific command lines, because the attackers keep swapping them out anyway.

For you, that yields a rule of thumb that requires no technical knowledge. No reputable software anywhere has you paste a command from the clipboard into a black window in order to fix a browser problem or to prove that you are human. Anyone who asks you to do that is attacking you.

Every 500 milliseconds: how often a clipper reads the clipboard

On June 17, 2026, Microsoft described a Windows campaign that, by its own account, has been running since February 2026. The malware polls its command server and reads the clipboard roughly every 500 milliseconds. In doing so it looks not only for addresses but also harvests seed phrases and private keys as soon as they appear there.

Twice a second means, in practice: there is no window of time short enough. Between copying and pasting, a withdrawal rarely involves more than a few seconds, and that is orders of magnitude more than enough. The second part of the finding is at least as unpleasant. Anyone who ever copies their recovery words to the clipboard, for instance when moving to different wallet software, exposes them on an infected machine.

Bitcoin, Tron and Monero: which address formats the malware recognises

The variant documented by Microsoft recognises six address formats by their beginning and their length. For Bitcoin these are the legacy addresses beginning with a one and 32 to 36 characters long, the P2SH addresses starting with a three and of the same length, the Taproot addresses beginning bc1p with 40 to 64 characters, and the Bech32 addresses beginning bc1q in the same range. Added to these are Tron addresses, which begin with a capital T and count exactly 34 characters, and Monero addresses with a four or an eight at the start and exactly 95 characters.

This list is no secret knowledge, and it shows how mechanically the attack works. A pattern matches or it does not. Once it matches, the swap happens. Anyone who moves value between networks more often should keep in mind that detection can be extended to further formats with a few lines of code; the six above are the state of a single documented campaign, not an exhaustive list of what is possible.

Why the checksum of your bitcoin address is no help here

This is where the most dangerous misunderstanding lies. Crypto addresses carry a checksum, a few additional characters from which it can be computed whether the rest is unaltered. Many holders conclude from this that their wallet would inevitably reject a manipulated address.

That is a fallacy, and the reason is simple. The checksum detects a corrupted address. But the clipper does not deliver a corrupted address; it delivers the perfectly sound address of a different recipient. It is correctly constructed, its checksum is right, its network is right, and the wallet therefore confirms it without objection. A checksum protects against typing errors and transmission errors. Against a swap it does not, because from the point of view of the mathematics a swap is not an error at all.

USB sticks and scheduled tasks: how the clipper digs in and spreads

The Windows variant described by Microsoft arrives via prepared shortcut files on USB storage. After execution it searches the drive for ordinary documents, hides the originals and puts shortcuts with the same file names in their place. Anyone who opens the stick afterwards appears to see their files and in truth starts the malware.

To nest permanently, the software sets up two scheduled tasks with no end date. One ensures that every freshly inserted, still clean USB device is prepared as well, the other runs the actual harvesting. That explains why such infections return in households and small offices after they seemed already cleared: the next stick brings them back.

Tor and a local proxy: why the traffic stays inconspicuous

The campaign brings along a portable Tor client and routes its traffic through a local SOCKS5 proxy on port 9050. In practice that means there is no conspicuous connection to a suspicious server visible on the network for a firewall or a router to act against. Anyone relying on their home network to block malicious destinations has nothing to work with here.

A contract on BNB Smart Chain: why blocklists achieve little against ClickFix

On August 6, 2026, Microsoft Threat Intelligence described a group of compromised websites that serve ClickFix lures. The injected, Base64-encoded JavaScript code connects to an access node of BNB Smart Chain and queries a smart contract there for its instructions. What gets delivered includes Lumma Stealer, the remote control tools Xworm and AsyncRAT, and a downloader called MintsLoader. Microsoft speaks of campaigns that target thousands of devices daily in businesses and households worldwide.

The trick lies in where the instructions are stored. A domain can be taken down, a server seized. An entry in a public contract on a blockchain cannot be removed from outside, and it can only be changed by whoever holds the corresponding key. Defence thereby loses its most effective lever, and protection shifts from the network to the device and to the habits of its user. That a public blockchain of all things takes on this role is the uncomfortable punchline: the very property that makes it valuable as a ledger turns it here into an unreachable letterbox.

macOS is no safe harbour any more: the finding from early August

On August 7, 2026, The Hacker News reported on macOS malware written in Go and distributed via ClickFix lures. The analysis comes from the security researchers at the vendor Huntress. Affected, in their account, are Bitcoin, Litecoin, Dogecoin, Monero, Ethereum and XRP.

With that, an assumption falls that persists stubbornly among holders. The claim that a Mac is the safer choice for crypto custody was already more habit than finding, and the attack route via a pasted terminal command works under macOS for the same reason as under Windows: it rests on the user executing it themselves. The agency notice from February, too, names Windows and macOS explicitly side by side.

Partial draining instead of total loss: why a small shortfall can be more dangerous

One detail of the August 7 finding deserves particular attention. The malware contains a routine that first queries a wallet's balance and can then also withdraw a partial amount instead of the entire holding. The researcher quoted describes this as the first malware known to him with that capability.

Why that is worse than it sounds: an emptied wallet is noticed immediately. A shortfall that stays small enough may go unnoticed by anyone for months, and during that time the infection persists, keeps collecting credentials and travels onward via the next USB device. Anyone who only knows their holdings roughly will not notice such an outflow. A properly kept record of holdings is therefore also a security measure and not merely an obligation towards the tax office.

Address poisoning and clippers: two routes to the wrong address

On August 22, 2026, we described in detail a case of address poisoning in which around $2 million went to a lookalike address. The difference from today's subject matters, because it determines the right defence.

With address poisoning there is no malware on your computer. The attacker places a deceptively similar address in your transaction history, and later you reach for the wrong line yourself. What helps against that is an address book, a whitelist and a deliberate refusal to copy from the history. You will find exactly those steps in our guide to checking a receiving address, and we deliberately do not repeat them here.

With a clipper the malware sits on the device. It intervenes between copying and pasting, which is to say after every choice you make. An address book in wallet software helps only as far as the address does not travel via the clipboard. That is the core of the difference, and it explains why a holder should know both attacks even though the outcome looks the same in either case. Related, but again differently arranged, are forged approvals, which we covered under wallet drainers and signature approvals, as well as malicious browser extensions.

The hardware wallet display: the screen the clipper cannot reach

Against an address swap on the computer there is a defence that works regardless of how good the malware is. A hardware wallet shows the receiving address of an outgoing transaction on its own small screen before you confirm it. That device has no operating system for a clipper to nest in, and it shows what is actually being signed.

The benefit only materialises through reading it, however. Anyone who merely presses the confirm button on the device without comparing the characters against the intended destination has given the advantage away. It makes sense to compare the first five and the last five characters plus a group from the middle, because attackers deliberately generate their addresses so that the beginning and the end look similar. Which devices display the address in full and at a sufficient size differs noticeably; a look at our overview of hardware wallets is worth it before buying for precisely that reason.

Withdrawal whitelists at exchanges: what they achieve and what they do not

Most larger trading venues allow you to register withdrawal addresses once and to block withdrawals to all other addresses. The protection here is greater than it first appears: even if a clipper inserts a foreign address at the moment of withdrawal, the payment goes nowhere, because the destination is not approved.

The limit of this protection lies in creating the entry itself. If the address is pasted from the clipboard when it is first registered, it may have been swapped at exactly that moment, and from then on the wrong address is the approved one. That is why the comparison on the wallet display belongs at this point, not at the later withdrawal. It also makes sense to use the change period that many providers impose after a new address is added.

What is established and what remains assessment

Established are the technical details, because they come from the publications named and are dated there: the sequence of the ClickFix deception per the agency notice of February 24, 2026, the polling interval of around 500 milliseconds, the six address formats, the spread via USB storage, the two scheduled tasks and the Tor route per the Microsoft analysis of June 17, 2026, the querying of a contract on BNB Smart Chain per the Microsoft observation of August 6, 2026, and the macOS variant including partial withdrawal per the report of August 7, 2026.

Assessment, and labelled as such, is the reading of these points as one connected development. That an attack route spreads to a second operating system within a few weeks and moves its command channel onto a blockchain points to growing effort. How many devices are actually affected and how high the damage in Germany turns out to be is not known, and we deliberately give no figure for it. Nor does this text make any statement about who is behind the campaigns.

An assessment of how to handle the residual risk belongs here too. No procedure makes an infected computer trustworthy again. Anyone with well-founded suspicion that a clipper is running on their device should enter no further address from that device and type no further recovery words on it, but move their holdings from another, clean machine.

Defending against clipboard attacks: what to take away

1. Never paste a command into a command line or terminal that a website has placed in your clipboard. That is the only step that prevents the infection at all; everything else merely limits the damage. No browser update and no human verification asks for anything of the sort. If you keep assets on a device that is also used for browsing, move custody to a device with its own screen; the differences are shown in our overview of hardware wallets.
2. Read the receiving address on the display of the signing device, not on the computer screen. Compare the first five characters, the last five and a group from the middle. If you use a pure software solution, the limits of this approach are greater, because display and clipboard sit on the same system; how much the individual programs catch is set out in our overview of software wallets.
3. Register a withdrawal whitelist at your trading venue and check the address especially carefully when creating it. After that, a later address swap goes nowhere. Which providers offer this lock and how long their change periods run is in our rundown of crypto exchanges.
4. Keep a traceable record of your holdings. A partial withdrawal is only noticed if you know what should be there. That holds regardless of whether a tax return is due at the end of the year.

The two publications on which this text principally rests are ones you can read yourself: the technical analysis of the Windows campaign at Microsoft Security and the German-language description of the ClickFix sequence at the Federal Office for Cybersecurity.

(As of September 1, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)