Insights on Crypto Payments, Infrastructure, and Operations

Crypto Payment Clipboard Hijacking

Crypto Payments

Pronunciation: KRIP-toh PAY-muhnt KLIP-bord HY-jak-ing

Also known as: Crypto Address Clipboard Hijacking

Definition

Crypto Payment Clipboard Hijacking is malware or malicious software behavior that replaces a copied crypto payment address with an attacker-controlled address before the user pastes it. It attacks the user interface and clipboard path, so the transaction can be validly signed while paying the wrong recipient. In practice, malware monitors clipboard content, recognizes address patterns, substitutes an attacker address, and relies on the user signing without independently verifying the destination.

Overview

Mechanism and important distinctions

Clipboard hijacking exploits the brief moment between copying payment instructions and pasting them into a wallet. The malware does not need to compromise blockchain cryptography or reverse a confirmed payment. It only needs the user to authorize a perfectly valid transfer to the wrong recipient. Some attackers generate similar-looking addresses to defeat casual visual checks; others rely on the user never examining the destination at all.

Checking the address only inside a compromised browser is a weak independent control. For larger transfers, compare the full destination through a trusted secondary channel or on a hardware wallet's secure display. A beneficiary allowlist with a cooling-off period can reduce exposure in corporate treasury flows. QR scanning bypasses clipboard substitution, but it introduces its own QR-replacement risk; the two attacks demand different verification points.

Crypto Payment QR Replacement; Crypto Payment Link Hijacking; Cross-Network Payment

Example

A user copies a Bitcoin address from an invoice. Malware watches the clipboard and replaces the value with an attacker's address. If the user checks only the first and last few characters, an attacker using a lookalike address may pass that superficial inspection; a valid checksum does not identify the intended recipient.

Comparison

Treat copied addresses as untrusted until compared with a separate authenticated source. Wallet address books, verified contacts and hardware-wallet screen verification can reduce the risk. Do not assume antivirus alone prevents clipboard substitution. Support should not confirm payment simply because the customer shows a successful transaction to a different address.

Key Takeaway

Independently verify pasted payout destinations; valid-looking addresses can belong to attackers.

Sources

  1. Address Poisoning Scams — MetaMask Help Center (2026-08-02)
  2. Clipboard Data, Technique T1115 — MITRE ATT&CK (2026-08-02)
  3. Webhook — OxaPay (2026-08-02)