What is clipper malware and how it steals crypto
Clipper malware monitors the clipboard and replaces a copied crypto address with the attacker’s address.
A clipper is a type of malware that watches the clipboard on a computer or phone. When it detects something that looks like a crypto address, it silently replaces it with an address controlled by the attacker. The victim copies the correct address, pastes, and sends funds to the thief without noticing. Such malware is often bundled with pirated software, fake wallet apps and cracked games.
Clippers are effective because people rarely compare long addresses character by character. Advanced variants even pick replacement addresses that start and end with the same characters as the original, so a quick glance at the first and last few symbols is not enough. Checksums like EIP-55 do not help, because the substituted address is valid.
A related attack is address poisoning. The attacker sends a tiny or zero-value transfer to the victim from an address that looks almost identical to one the victim often uses. Later, the victim copies an address from their transaction history and picks the fake one. This is common with USDT on TRON and EVM networks.
For merchants the result is a customer who swears they paid, a TXID that shows a transfer to an unknown address, and no way to recover the funds. Payment pages can reduce the risk by offering QR codes, reminding customers to check the pasted address, and showing addresses in a way that makes the middle part visible too. Customers should only install software from official sources and never copy addresses from transaction history.
The Moonvex payment page offers a QR code next to the address, so customers can scan instead of copying, and each payment has its own address, which makes it easy to compare the pasted address with the one on the page.
How to protect yourself
- scan the QR code instead of copying when possible
- compare the pasted address with the original, including the middle
- never copy an address from your transaction history
- install wallets and software only from official sources
- send a small test amount for large transfers