Why Did the Bitcoin Address I Pasted Change? Clipboard-Hijacking Malware, Explained

Bottom line

If the destination bitcoin address you copied changes into something else the instant you paste it, that's not a typo on your part — it's the classic signature of "clipboard hijacking" (also called a "clipper") malware. This malware continuously monitors your clipboard (the temporary storage that holds what you've copied), and the moment it detects a string that looks like a crypto address, it silently swaps in the attacker's own address. Because blockchain transactions cannot be reversed, sending funds without noticing this means the money is almost certainly unrecoverable. The core defense is to verify every single character of the pasted address on-screen before sending, and to treat the infected device itself as compromised.

What clipboard hijacking is — a quiet thief targeting copy-paste

Because crypto addresses are long and unwieldy, most people copy and paste them rather than typing them manually. Clipper-type malware exploits that habit. According to analyses from security firms and Microsoft, this kind of malware checks the clipboard's contents roughly every 500 milliseconds (0.5 seconds), and the instant it detects a string matching a Bitcoin, Ethereum, or other crypto address format, it swaps in an address the attacker controls.

Nothing appears wrong on screen — no error, no unusual behavior from your wallet, no noticeable slowdown. It's deliberately designed to stay hidden, since the longer it lurks undetected, the more it profits the attacker. "CryptoShuffler," reported by Kaspersky in 2017, stole roughly 23 BTC (about $140,000 at the time) using exactly this technique. Because the mechanism is so simple, new variants keep appearing to this day.

This is also a subset of scams more broadly — see our overview of bitcoin scams and how to avoid them for the bigger picture.

Why checking "just the ends" doesn't catch it

Most people verify an address by glancing at just the first few and last few characters. That's exactly what attackers exploit. Fortinet's analysis found that one clipper kept a library of 10,000 attacker-controlled addresses ready, choosing whichever one most closely matched the beginning and end of the address that had actually been copied.

That means even if you think you checked bc1qxy...k4h9, dozens of characters in the middle may have been swapped entirely. That's why verification only works if it's a full-string comparison.

Layered defense — don't rely on any single measure

Rely on multiple defenses together rather than any single one.

For the basic mechanics of sending, see how to send bitcoin. Using QR codes or a saved address book avoids the clipboard entirely, substantially reducing the chance for a swap to occur.

What "final verification" on a hardware wallet screen actually means

Even if you use a hardware wallet, you typically enter the destination address through a companion app on your PC or phone. If that companion device is infected with a clipper, the destination can be swapped at that point.

This is where the hardware wallet's own physical screen matters. Right before you sign, the address shown on the device's own screen is a value processed inside the secure device itself — not the (possibly compromised) PC. Compare the address on your PC screen against the address on the device screen, character by character, and only approve with the physical button once they match. Getting into the habit of pressing the button without actually reading the device screen throws away the entire point of using a hardware wallet.

Signs of infection and how to clean up

Clippers are designed to be inconspicuous, but watch for signs like:

• A copied crypto address comes out slightly (or significantly) different after pasting
• Behavior turns odd after plugging in an unfamiliar USB drive (some variants spread via USB)
• You recall opening a shortcut (.lnk) file or executable from an unknown source

Basic response steps:

1. Stop sending immediately. Don't send any crypto while there's a suspicion of infection.
2. Run a full scan with trusted security software (e.g. Windows Defender) and quarantine anything found.
3. If you can't fully clean the infection or remain unsure, reinstall the OS (a full reset).
4. Change passwords for any exchange accounts you accessed on that device, and reset two-factor authentication. Because some variants also steal seed phrases, move funds to a new wallet if there's any chance you typed your seed on that device.

Beyond malware infections, many attacks also steal addresses or keys via fake websites — see also how to spot fake exchanges and phishing.

Frequently asked questions

Q. Does this happen on phones too? Yes. Similar clipper apps have been documented on Android and other mobile platforms. Avoid installing apps outside official app stores, and always verify the full address string before sending, on mobile too.

Q. Is it safe if I paste right after copying? Not necessarily. Monitoring intervals are reportedly around 0.5 seconds, so the swap can happen in the instant between copy and paste. Speed isn't your defense — checking the full string after pasting is.

Q. I already sent to the attacker's address. Can I get it back? As a rule, no. Blockchain transactions can't be reversed, and identifying the owner of the attacker's address is generally not feasible. If it went through an exchange, contacting them immediately leaves a small chance of a freeze (see what to do if you sent to the wrong address).

Q. Which address formats are targeted? Some variants target older formats (starting with "1"); others support multiple coins and formats. Make full-string verification a habit regardless of address format.

Sources

• CryptoShuffler Trojan has quietly stolen $140,000 worth of Bitcoin — Kaspersky
• Copy-Pasting Thief: clipboard clipper analysis — Fortinet Threat Research
• Microsoft warns new crypto clipper malware can steal seed phrases and hijack wallet transfers — AMBCrypto
• Sure, I'll take that! New ComboJack Malware Alters Clipboards to Steal Cryptocurrency — Palo Alto Unit 42