Clipboard Hijacker Scam: How It Works, Warning Signs & What To Do
Malware that swaps the wallet address you copied for the attacker's address.
A clipboard hijacker watches what you copy. When you copy a cryptocurrency address, it replaces the clipboard with a look-alike address, often one that starts and ends with the same few characters. You paste it and send funds to the attacker. This page is general safety guidance. It does not describe a specific case.
What to do if targeted
- 1Compare the full pasted address with the original before you send. Check the middle, not only the start and the end
- 2If the address changed, do not send. Disconnect that device from further transfers
- 3Remove recently installed extensions and run a malware scan from a source you already trust
- 4Move remaining funds using a clean device
- 5Report to FBI IC3 at https://www.ic3.gov
- 6Report to FTC at https://reportfraud.ftc.gov
Questions
Is checking the first and last characters enough?
No. Look-alike addresses are built to match those characters. Compare the entire address, or send a small test only when you can confirm the whole string on a second screen you trust.
I already sent funds to the swapped address. Can I undo it?
A cryptocurrency transfer is not reversible from your side. Contact the exchange if the address belongs to one, and report it to the FBI IC3. Do not pay a recovery service that contacts you afterward.
Where should I get wallet software?
Use the publisher's own site or an official app store listing you reached yourself. Do not install it from an ad, a search ad, or a link in a message.