How Clipboard Hijacking Works in Crypto

Clipboard hijacking malware monitors your clipboard and silently swaps any cryptocurrency address you copy with an attacker's address — before you paste. The replacement is invisible. The loss is permanent. Here's exactly how it works and how to stop it.

The direct answer

When you copy a crypto address, that address lives in your operating system's clipboard until you paste it. Clipboard hijacking malware sits in the background, watching. The moment it sees a crypto address pattern (42 hex characters for EVM, base58 for Solana), it replaces it with the attacker's address — instantly, silently. You paste, the wallet auto-fills, and you send funds to the attacker's wallet.

By the time you notice, the transaction is confirmed and irreversible.

Step-by-step: what happens during an attack

• 1
  Malware installs a clipboard monitor. Usually delivered via a malicious browser extension, pirated software, fake wallet app, or trojanized download. The monitor runs silently in the background with no visible UI.
• 2
  You copy a crypto address. From a friend's message, a DeFi interface, an exchange deposit page — anywhere. The address enters your clipboard normally.
• 3
  The monitor detects the address pattern. EVM addresses match /0x[a-fA-F0-9]{40}/. Solana matches base58 strings of 32–44 characters. Both are trivial regex patterns.
• 4
  The clipboard contents are replaced. The monitor writes the attacker's address over your address. This takes microseconds. No notification. No visible change.
• 5
  You paste into your wallet. The wallet field fills with the attacker's address. It looks like a valid address — correct length, correct format. Nothing appears wrong.
• 6
  You confirm and send. The blockchain confirms in seconds. Funds are gone. No chargeback, no recovery, no recourse.

Why it's impossible to detect visually

Here's what a clipboard hijack looks like on screen:

The addresses are the same length. Both start with 0x71C7. Both pass checksum validation. A human glancing at the paste field has zero chance of catching the replacement. Even if you check the first and last few characters — the standard "quick check" — a targeted hijacker can generate a replacement address that matches your intended recipient's prefix and suffix.

How attackers build clipboard hijackers

Clipboard monitoring is a standard OS feature — SetClipboardViewer on Windows, NSPasteboard callbacks on macOS. Any program can register as a clipboard listener. Crypto-targeting hijackers add a regex filter and a wallet address lookup table. The total code is under 100 lines in most malware families.

More sophisticated variants pre-generate vanity addresses that share the first 6 and last 4 characters with popular exchange deposit addresses — so even a careful user who does a partial check gets fooled.

Common delivery vectors

• →
  Malicious browser extensions — most common vector; extensions run in the browser process with clipboard access
• →
  Pirated software — game cracks, productivity app keygens with bundled clipper malware
• →
  Fake wallet apps — lookalike MetaMask, Phantom, Rabby installs from unofficial sources
• →
  Trojanized crypto tools — address converters, gas calculators, portfolio trackers
• →
  npm / PyPI packages — supply chain attacks targeting developer tools

How Zafu detects clipboard hijacking

This works because Zafu operates at the paste event — the exact moment the hijacked address would enter your wallet. The comparison is deterministic: if copied !== pasted (same chain family), the HIJACKED state fires unconditionally.

Unlike antivirus software that tries to detect malware at install time, Zafu catches the hijack at the point of harm — regardless of which malware family performed the replacement, when it was installed, or whether any scanner has seen it before.

Frequently asked questions