Address Poisoning and Clipboard Malware
Reviewed and updated September 14, 2026 by the SmartCryptoEarnings editorial team · editorial policy
Both of these attacks exploit the same human shortcut: nobody reads a full crypto address. They do not steal your keys — they change the destination.
Address poisoning
An attacker sends a tiny or zero-value transfer from an address engineered to begin and end with the same characters as an address you really use. Their entry then sits in your wallet history looking familiar.
Later, when you copy a destination from your own transaction history rather than from the source, you copy theirs.
Clipboard malware
Clipboard hijacking malware watches for something that looks like a crypto address and silently substitutes the attacker's. You paste what you believe you copied, and the characters at the start still match closely enough to pass a glance.
- It is device malware, so it affects every wallet and site used on that machine.
- It commonly arrives via pirated software, fake installers and browser extensions.
- A hardware wallet still protects your key, but the device will faithfully sign the substituted address if you approve it.
The verification habit that defeats both
- Always copy the destination address from the recipient's own deposit screen, never from your transaction history.
- After pasting, compare the first six and last six characters — and at least one group in the middle — against the source.
- Verify the address on your hardware wallet's own screen, not only in the browser.
- Send a small test amount for any new destination and confirm it arrives before sending the rest.
- Use your wallet's address book or whitelist feature so routine destinations are saved once and verified once.
Middle characters matter. Poisoned addresses are generated to match the beginning and end, which is exactly what a quick check looks at.
If you suspect an infected device
- Stop making transfers from that device immediately.
- Move funds using a different, clean device.
- Assume any recovery phrase ever typed or stored on the machine is compromised and migrate to a new wallet.
- Rebuild the device from a clean installation rather than trusting a cleanup.
Frequently Asked Questions
Is a tiny unexpected deposit dangerous on its own?
Receiving it does not put your funds at risk. The risk appears only if you later reuse that address from your history as a destination.
Do address checksums prevent this?
No. Checksums catch typos, not deliberately valid attacker addresses. Only comparing against the true source helps.
Sources
Spotted something out of date? See our corrections policy and fact-checking policy.
Continue reading
Educational information only. Nothing here is financial, legal or tax advice.