Clipboard hijacker (clipper malware)

Crypto addresses are long and hard to read, so almost everyone copies and pastes them. Clipper malware exploits that habit. Running quietly on a computer or phone, it monitors the clipboard, recognises strings that look like Bitcoin, Ethereum, Tron or other addresses, and replaces them with an attacker-controlled address. More advanced variants pick a replacement that shares the first and last characters with the original.

Clippers usually arrive bundled with pirated software, fake utilities, cracked games or malicious browser extensions, and some have appeared in fake apps on official stores. Because the transaction itself is signed willingly by the victim, nothing looks wrong until the payment fails to arrive.

The defence is to verify the full address after pasting, ideally on a hardware wallet screen, which malware on the computer cannot alter. Saved address books and whitelists help, as do small test transactions for new recipients. Clippers are often confused with address poisoning, which plants lookalike addresses in your transaction history; the result is similar, but no malware is involved there.