Clipper Malware Swaps Wallet Addresses at Lightning Speed

A malicious program known as a clipper monitors the contents of your clipboard and replaces any recognized cryptocurrency address with one controlled by the attacker. This type of attack, also known as a clipboard attack, is an old but evolving threat that has changed in three ways over the summer of 2026: the route onto the machine, the operating system, and how much is taken.

The clipper reads the clipboard approximately every 500 milliseconds, making it nearly impossible to avoid. It not only swaps addresses but also harvests seed phrases and private keys when they appear in the clipboard. This means that even if you copy your recovery words correctly, an infected machine can still expose them.

One variant of the clipper recognizes six address formats by their beginning and length: Bitcoin legacy addresses, P2SH addresses, Taproot addresses, Bech32 addresses, Tron addresses, and Monero addresses. If a pattern matches, the swap happens. The checksum on your Bitcoin address does not help in this case, as it only detects corrupted addresses, not swapped ones.

The Windows variant of the clipper arrives via prepared shortcut files on USB storage and sets up scheduled tasks to nest permanently on infected machines. It also uses a portable Tor client and routes traffic through a local SOCKS5 proxy to remain inconspicuous.