What is clipper malware in crypto?

Clipper malware is a type of malicious software that targets copy and paste. Crypto addresses are long strings that few people type by hand, so most users copy them. A clipper sits on a phone or computer, waits for something that looks like a wallet address to land on the clipboard, and quietly swaps it for one belonging to the attacker. If the user does not compare the pasted address, the funds go to the thief.

How does clipboard hijacking work?

The malware scans the clipboard for text that matches address formats, such as an Ethereum address starting with "0x" or a bitcoin address of typical length, Merkle Science explains. When it finds one, it replaces it instantly. Some versions also try to grab private keys or recovery phrases if those are ever copied. Microsoft groups this kind of threat under the name "cryware", The Hacker News noted. Because a confirmed blockchain payment cannot be pulled back, as covered in can you reverse a crypto transaction, the loss is usually permanent.

How does clipper malware get on a device?

Merkle Science says clippers first appeared around 2017, and in 2019 one was found in a fake MetaMask app on Google Play. Others have been bundled into trojanized copies of the Tor browser on unofficial sites and spread through phishing emails and compromised websites.

In September 2024 Binance warned of an "ongoing" global clipper threat, saying activity spiked on August 27 and caused significant losses for affected users. It said the malware was often spread through unofficial apps and plugins, especially on Android and web apps, sometimes installed by people looking for software in their own language. The Electrum wallet's own documentation lists clipboard hijackers among the main ways users lose coins, alongside malicious clones of the wallet.

How do you protect against clipper malware?

The basic defense is to check the whole pasted address, not just the first and last few characters, against the original before confirming. That habit also helps against address poisoning, a separate trick that relies on look-alike addresses in your history. Installing wallet apps only from the official website or app store listing linked by the developer, and avoiding cracked software and unknown plugins, reduces the chance of infection. Some hardware wallets show the receiving address on their own screen, which gives a second place to compare it, as described in what a hardware wallet is.

If a pasted address ever differs from the one you copied, the device may be infected and should be checked before it is used for crypto again.