§ Guide · Foundation

Clipboard malware swapped my Bitcoin address — now what

Pasted a Bitcoin address and the coins went somewhere else? How to confirm a clipboard hijack, contain the infected machine, and the habit that beats it.

By dont-trust-verify Published July 19, 2026

You copied a receive address, pasted it, checked it looked right, hit send. Now the transaction is on the explorer and the destination is an address you have never seen. You didn’t fat-finger anything — you pasted. Which is exactly the problem: on your machine, paste is no longer yours.

Here’s the honest frame before anything else: if that transaction has confirmed, the coins are gone, and nothing on this page brings them back. What this page can do: prove what actually happened, win the race in the rare case it’s still winnable, stop the same machine from taking the rest, and make this the last time paste costs you money.

TL;DR. First: prove the swap — pull the intended address from its source again on a different device and compare it, full string, against the output of the sent transaction on a public explorer. Second: if the transaction is unconfirmed and replaceable, you can try to double-spend the coins back to yourself at a higher fee — a race measured in minutes; never hit “speed up” on the swapped transaction, that just pays the thief faster. Third: the machine is compromised — stop all wallet activity on it, rescue remaining funds from a clean device, and plan an OS reinstall, not a scan. Fourth: clipboard swapping is the one attack a hardware wallet screen fully defeats — the fix is a verification habit, not better luck.

First — prove the swap actually happened

Panic wants to skip this step. Don’t. A surprising share of “my address was swapped” cases turn out to be something else, and the something else has a different playbook.

  1. Get the transaction ID. Open the send in your wallet’s history and copy the txid — it’s public information; pasting it anywhere reveals nothing an explorer doesn’t already show.
  2. Open it on a public explorer. Paste the txid into mempool.space and read the output side: that’s where your coins actually went, as recorded on the chain. Your wallet’s display could lie; the chain can’t.
  3. Fetch the intended address again — on a different device. Go back to the source of truth (the exchange’s deposit page, the invoice, the person you were paying) on your phone or another computer. You need a copy of the correct address the malware never touched.
  4. Compare the full strings — not just the first and last four characters. Good clippers substitute an address chosen to match yours at both ends, so check generous chunks from the middle too. If the address looks mangled or truncated rather than different, run it through our address validator to check it’s even well-formed.

Three outcomes. The addresses match: no swap — you’re probably dealing with a stuck or delayed transaction, a much happier problem. They differ because the source changed — exchanges rotate deposit addresses, so compare against the address you were shown at the time if you still have it. They genuinely differ: the clipboard was hijacked. Keep reading in order.

The unconfirmed window — what can and cannot be undone

Check the transaction’s status on the explorer. This one field decides everything.

Confirmed — even once. It’s over, and I won’t pretend otherwise. The transaction your wallet signed pays the attacker’s output, and no wallet, exchange, government, or developer can claw it back. Don’t go looking for someone who says they can: the “recovery services” that reply to victims are a second scam layered on the first — I’ve covered how they work, and which reports are actually worth filing (police for the case number, chainabuse.com to tag the attacker’s address, exchange abuse desks), in my Bitcoin was stolen — what now. File them for the paper trail, then put your energy into containment below, because the machine that did this is still on.

Still unconfirmed. There is a real but narrow option, and I want to be precise about it. You cannot “edit” the transaction — it’s validly signed and the destination is fixed. What Bitcoin allows is replacement: broadcasting a new transaction that spends the same coins, pays them back to an address you control, and attaches a higher fee so miners prefer it. If the original was flagged replaceable (RBF — most modern wallets do this by default), your wallet’s cancel/replace function does exactly this. Paste the txid into our tx stuck checker to see its status and whether it signals RBF; the stuck transaction guide covers replacement mechanics.

Two honest warnings before you try. First, never press “speed up” or “bump fee” on the swapped transaction itself — that re-broadcasts the payment to the attacker at a higher fee. You want cancel-and-return, not acceleration. Second, remember where you’re typing: the replacement is built on a wallet that holds your keys, and if that’s the infected machine, the malware can swap the return address too — verify it on a hardware wallet screen against a copy from a clean device, or character by character against that clean copy. And set expectations: confirmation takes one block, about ten minutes on average, so unless you caught the swap almost immediately the race was probably over before you knew it started. Losing is the normal outcome — which is why the rest of this page matters more.

Your computer is now the enemy — containment

A confirmed clipboard swap is proof of code execution on your machine — someone else’s software is running with enough access to rewrite everything you copy. Not “maybe infected”; proven. From this moment, treat everything that computer shows you as potentially false.

  1. Stop all wallet activity on that machine. No sends, no address generation, no “just checking the balance”, no downloading a cleanup tool it suggested. Every address it displays and every string you paste on it is suspect.
  2. Inventory what the machine could reach. This decides how bad your week is. If a software (hot) wallet lived on that computer, assume the seed is compromised — clippers ride in on the same loaders as infostealers, and you can’t audit which passengers arrived. Move what’s left to a brand-new seed from a clean device, following the triage in is your seed phrase compromised. If your keys are on a hardware wallet, breathe: the seed never touched the infected host. The device just can’t trust that computer as a display anymore — which, as we’ll see, it never needed to.
  3. Move remaining funds from a clean device. A different computer, a phone, a fresh wallet — anything the infection never touched. If you must install a wallet in a hurry, verify the installer’s checksum against the vendor’s published hash with our wallet verifier first; people urgently downloading wallets are exactly who fake-installer campaigns target.
  4. Rotate credentials from the clean device too. Exchange logins, email, password-manager master password. I can’t know what else was bundled with your particular clipper — neither can you, and that’s the point. Assume text that passed through that machine was readable.
  5. Plan the reinstall. A clean antivirus scan tells you your scanner found nothing — the swapped transaction already out-voted it. The honest fix is the boring one: back up personal files (documents and photos, never applications or installers), wipe the disk, reinstall the OS from official media. Anything less is choosing “probably fine” as the foundation under your money.

How the swap works — and the habit that defeats it

Knowing the mechanism makes the defense obvious. A clipper does three small things: it watches the clipboard, it pattern-matches anything that looks like a cryptocurrency address — Bitcoin’s formats are easy to spot, strings starting with 1, 3, or bc1 — and it swaps in an attacker address before you paste. This malware family is old and boring — documented clippers go back to at least 2017 — and it persists because it keeps working.

The uncomfortable part is how well it beats the standard advice. “Check the first and last few characters” is the habit most of us were taught, and attackers know it: better kits carry pools of pre-generated addresses and substitute the one that best matches yours at both ends. Generating an address with a chosen prefix is cheap — our vanity address generator demonstrates the technique in your browser — and bech32 stacks the deck further: every mainnet SegWit address starts with bc1q or bc1p. The characters your eyes rest on are exactly the ones the attacker gets for free.

So the habit that actually works has two tiers:

Making the next paste boring — the prevention stack

Once the machine is rebuilt and the funds are on a fresh setup, three habits keep this attack retired:

FAQ

Can I reverse a Bitcoin transaction that went to the wrong address?

No — a confirmed transaction is final, by design, for everyone. The narrow exception is an unconfirmed replaceable transaction, which you can attempt to double-spend back to yourself at a higher fee; that race lasts minutes and is usually already lost. Anyone offering to reverse a confirmed transaction for a fee is a recovery scammer.

How did malware change the address I copied?

A clipper watches the clipboard, pattern-matches Bitcoin address formats, and swaps in an attacker address before you paste — often one pre-selected to resemble yours at the start and end. It needs no passwords and no keys; it just needs you to trust paste.

Will antivirus catch clipboard hijackers?

Not reliably. Clippers are small, endlessly recompiled, and typically arrive inside software the user chose to run. A clean scan proves your scanner found nothing — the swapped transaction already proved the machine is compromised. Believe the transaction.

Is my seed phrase stolen too?

If a hot wallet lived on the infected machine: assume yes and move to a fresh seed from a clean device. If your keys are on a hardware wallet: the seed never touched that computer — the malware could only lie about addresses, which the device screen catches.

How do I safely use this computer again?

Back up personal files only, wipe the disk, reinstall the OS from official media, then reinstall applications from official sources and verify their checksums. Scans and removal tools can’t prove a negative; a rebuild doesn’t have to.

Why does a hardware wallet screen stop this attack?

The device shows the destination it is actually about to sign, computed internally — the compromised computer has no way to alter it. Read the screen and a clipboard swap has nowhere to hide, because the source you copied from still shows the real address. (If the source display itself could be compromised, compare the screen against a copy fetched on a clean device.) It’s the attack a hardware wallet defeats completely.