Attacks
Malware that swaps the address you copied for one belonging to somebody else. A clipper is malware that watches the clipboard for anything shaped like a crypto address and silently replaces it with the attacker’s. You copy your own address, you paste it, and the characters are different. Because nobody reads a 42 character string, the transaction goes out to a stranger.
What it is
A clipper is malware that watches the clipboard for anything shaped like a crypto address and silently replaces it with the attacker’s. You copy your own address, you paste it, and the characters are different. Because nobody reads a 42 character string, the transaction goes out to a stranger.
How it plays out
It arrives with something else
A pirated program, a fake wallet installer, a browser extension, or a file from a chat.
It watches quietly
Doing nothing visible until an address hits the clipboard.
It substitutes
Sometimes matching the first and last characters of the real address, which is exactly the part people check.
The transaction confirms
And it is final.
What gives it away
- A pasted address that does not match what you copied.
- Software installed from anywhere other than the official source.
- Browser extensions you do not remember adding.
How to not be caught by it
- Check the full address after pasting, not just the ends. Middle characters too.
- Send a small test transaction first for anything that matters.
- Use a name service so you send to a readable name instead of a string.
- Confirm the address on the hardware wallet screen, which malware cannot alter.
- Install software only from official sources, and audit your browser extensions.
If it already happened
- If a transaction already went out, it cannot be reversed.
- Treat the machine as compromised and rebuild it.
- Move funds from any wallet whose keys were on that machine, from a clean device.
- Check every saved address in your wallet, since some clippers rewrite the address book.
Where to go next
Check your setup before you need to
An hour on a screen share, going through your wallets, your approvals, your backups and your recovery plan. You click everything and we never ask for keys.