Clipboard address malware changes a copied destination before a transaction is signed. It exploits a habit: copying an address once and assuming the wallet will preserve it. A safe response combines device hygiene, full address comparison, small tests, and a clear incident path. The workflow applies to Bitcoin, Ethereum, and other networks where a wrong destination can be irreversible.
Recognize the warning pattern
Compare the address copied from the recipient with the address displayed by the signing wallet or hardware device. A changed first or last character is obvious, but a sophisticated substitute can look plausible. Unexpected clipboard history, security software alerts, or a new browser extension are additional clues. Do not paste a suspected address into another online “checker” that asks for a private key.
Stop the transaction safely
If the signing screen differs, reject it and disconnect the device. Do not repeatedly copy until the values happen to match; that can hide the source. Write down the intended recipient through a trusted channel and obtain a fresh address if needed. For a transaction already broadcast, save the hash immediately and contact the recipient and official platform support without promising recovery.
Verify the endpoint
Run a reputable malware scan, inspect startup items and browser extensions, and update the operating system and wallet software through official channels. A clean scan is not proof of a clean device, so use a separate trusted device for high-value transfers. Hardware verification helps only when the hardware screen is read and the address is compared in full.
Reduce copy reliance
Use address books only after independently verifying the address, and label network and purpose. For important payments, read the full address on the device or use a QR code from a trusted source, then compare several segments. A QR code can also be replaced, so the final device display remains the control. Keep the address and network in a transaction record.
Use a bounded test
Send a small test amount to a newly verified address and wait for the recipient to confirm it. A test reduces but does not eliminate malware risk; the infection could alter a later transfer. Do not reuse a successful test as a reason to skip verification on a larger amount or a different network.
Contain an affected device
Assume credentials typed on an infected device may be exposed. Change passwords and rotate API keys from a clean device, review sessions, and move funds only through a verified process. If a seed phrase was entered or photographed, treat it as compromised and follow the wallet recovery plan. Preserve samples, timestamps, and software versions for a professional incident response.
Teach the habit
A team card can say: paste, pause, compare full address, compare network, confirm amount, then sign. It should not include actual addresses or secrets. Make the device screen the final authority, and escalate any mismatch. This simple pause is more reliable than trusting a familiar logo or a green browser lock.
Worked example: a changed first character
A Bitcoin address copied from a family message starts with the expected prefix, but the hardware screen shows a different first and last segment. Reject the transaction and do not keep copying until the values match. Use a clean device to verify the recipient’s address, then scan for unknown extensions and malware. If a transaction was already broadcast, save the hash and tell the intended recipient immediately. The response record should include device, wallet version, network, and time, while excluding the seed phrase and full private data.
Operational handoff
Do not assume that only a Windows clipboard is affected; browser extensions, mobile keyboards, remote desktop software, and QR handlers can also alter an address. A high-value policy can require two independent people to compare the signing-device display. If a recipient address is reused, explain the privacy cost separately from the malware response. The incident report should preserve the original intended address in a protected record and never publish it with a person’s name.
Frequently asked question
Can a QR code eliminate address malware?
No. Malware can replace QR images or alter the device environment. QR codes reduce typing errors, but the final wallet or hardware display still must match the intended address and network.