Crypto addresses are long strings nobody types by hand, so they are copied and pasted. Malware that watches the clipboard and substitutes its own address exploits exactly that habit.
The attack is simple by design
A background process monitors clipboard contents and applies pattern matching to detect strings resembling wallet addresses on common networks.
On a match, it replaces the contents with an attacker-controlled address of the same format before the user pastes.
Nothing is stolen from the wallet. The user authorizes a correct transaction to the wrong recipient, and the wallet has no basis for objecting.
Visual verification fails predictably
Most people check an address by comparing the first few and last few characters, because comparing the full string is tedious and error prone.
Attackers exploit this by generating addresses whose visible ends match the intended one, a search that is computationally cheap for a small number of characters.
The substituted address then survives a casual check, and the middle section, which nobody reads, carries the difference.
Irreversibility removes the safety net
Conventional payment systems allow recall or chargeback because a bank sits in the middle and can reverse an entry.
A confirmed blockchain transaction has no such intermediary. Recovery requires the recipient to return the funds voluntarily or an exchange to freeze them if they arrive there.
This is why the technique persists despite being unsophisticated: the payoff per success is complete, and detection usually occurs after confirmation.
Defenses that actually work
Verifying an address on a hardware wallet screen is effective, because the device displays what it is about to sign using its own display rather than the compromised computer's.
Sending a small test amount confirms the path before committing a larger sum, at the cost of an extra fee and some delay.
Address books and naming services reduce exposure by removing the copy step, though the entry has to be verified once when it is first saved.
The pattern extends beyond the clipboard
Address poisoning uses the same insight without malware, sending tiny transactions from lookalike addresses so a similar string appears in transaction history.
Compromised websites achieve the same result by altering a displayed deposit address, which is why payment pages are a recurring target.
All three variants rely on the recipient field being treated as a formality, so the durable defense is treating it as the part of the transaction that matters most.
The habit that helps is verifying the address on a device the attacker does not control, every time, rather than relying on the address having been correct when it was first saved.