How to stop spyware from changing crypto addresses

Clipboard-monitoring spyware can quietly watch copied text and replace a cryptocurrency wallet address before it reaches an exchange or payment field. The altered string may look genuine at a glance, especially when only the first and last characters are visible.

When spyware monitors your clipboard and replaces copied cryptocurrency addresses, a transfer can be sent to an attacker-controlled wallet within seconds. Blockchain payments are usually irreversible, so the safest response is to stop using the affected computer before attempting another transaction.

This risk applies to Bitcoin, Ethereum, stablecoins and other digital assets. It can affect Windows PCs and Macs in Sydney, Melbourne, Brisbane or anywhere else, including devices used on home NBN connections, at university networks or on public Wi-Fi in cafés.

How clipboard hijacking works

A clipboard stealer, sometimes called a crypto clipper, runs in the background and checks copied data for wallet-address patterns. When it detects one, it substitutes a different address. The malware does not need to break into your exchange account; it interferes with the information moving between your browser, wallet and payment screen.

Some variants target several networks and identify Bitcoin, Ethereum, Solana or exchange-specific formats. Others wait until an address is copied, then alter it almost instantly. A QR code is not automatically safe either, since malicious browser extensions or compromised wallet software may display a changed destination.

Spyware often arrives through cracked applications, fake browser updates, malicious email attachments or bundled installers. Pc Malware Expert’s worm removal guides explain why self-spreading malware and suspicious attachments deserve attention even when the visible symptom appears to be a cryptocurrency problem.

Warning signs before sending funds

The clearest warning is a mismatch between the address copied from the trusted source and the address pasted into the exchange or wallet. Always compare the complete string where possible, rather than relying only on the first and last few characters. If the destination changes after pasting, cancel the transaction immediately.

Other clues include clipboard contents changing without explanation, unexpected browser extensions, a sudden rise in CPU usage, fake security alerts and wallet software that behaves differently after an update. A computer may also become unusually slow or show unknown processes after login.

Australian users should be particularly cautious when moving funds between an exchange, a self-custody wallet and a local bank-linked service. A transaction that appears to match a familiar contact or trading routine still needs manual verification. Treat an address received through social media, Telegram or an unsolicited email as untrusted until checked independently.

Contain the infected device

Stop copying wallet addresses and disconnect the computer from Wi-Fi or Ethernet. Do not log in to banking, email or exchange accounts from that device while the infection is active. If a transfer is pending, contact the exchange or wallet provider through its official app or website, although blockchain transactions that have already confirmed may not be reversible.

Use a separate, clean phone or computer to change passwords and revoke active sessions. Reset email credentials first because email access can be used to take over exchange accounts. Enable an authenticator app or hardware security key where available, and avoid receiving security codes on a potentially compromised phone.

If funds have already been sent, preserve wallet addresses, transaction IDs, timestamps, screenshots and relevant messages. Contact the receiving exchange quickly if the destination is identifiable. In Australia, suspicious losses can also be reported through ReportCyber and Scamwatch, while larger incidents may require advice from the Australian Securities and Investments Commission or local police.

Inspect Windows and macOS safely

On Windows, boot into Safe Mode if normal startup repeatedly launches suspicious software. Review installed applications, browser extensions, Startup settings, Task Scheduler entries and recently downloaded files. Run Microsoft Defender or another reputable scanner, including an offline scan where available. Do not install several unknown “cleaner” programs, as fake removal tools can create another infection.

On macOS, inspect Login Items, browser extensions, Applications, Activity Monitor and unfamiliar configuration profiles. Suspicious LaunchAgents and LaunchDaemons can cause malware to return after a restart. Remove only items you can identify confidently, and record filenames and locations before deleting anything in case professional analysis becomes necessary.

A detailed cleanup process is useful when the clipboard issue is part of a broader infection. The email worm cleanup guide provides relevant background on isolating and checking malware that arrives through attachments and attempts to persist.

Recover accounts and verify transactions

After cleaning or replacing the device, update the operating system, browsers, wallet applications and security software. Download programs only from official vendor sites or recognised app stores. Restore wallet access using the original recovery phrase, never a phrase supplied by someone claiming to offer support.

Review exchange login history, API keys, withdrawal addresses, forwarding rules and connected applications. Delete unknown API keys and revoke third-party permissions. If a seed phrase was ever entered on the infected computer, consider the wallet permanently exposed and move remaining assets to a newly created wallet using a clean device.

Use a small test transfer before sending a larger amount. Confirm the network, destination address, amount and any memo or tag. Keep evidence of the original address and the pasted address, since this can help an exchange, incident responder or law-enforcement agency understand what happened.

Build safer transfer habits

Security works best when verification becomes routine rather than an occasional reaction. A hardware wallet can reduce exposure to desktop malware, but its screen should still be checked before approving a transaction. Clipboard protection alone does not replace address verification or secure account access.

The following habits reduce the chance of losing funds through address substitution:

• Compare the full destination address on the wallet or hardware device before approval.
• Send a small test amount when using a new address or network.
• Keep cryptocurrency applications and operating systems updated.
• Avoid cracked software, unofficial wallet downloads and unexpected browser extensions.
• Use a clean device for recovery phrases, password changes and major transfers.
• Store transaction IDs, screenshots and support correspondence after significant payments.

Security check	Windows	macOS
Startup review	Startup apps, Task Scheduler and installed programs	Login Items, LaunchAgents and LaunchDaemons
Malware scan	Microsoft Defender, including Offline scan	Reputable macOS scanner and manual profile review
Browser check	Remove unknown extensions and reset altered settings	Check extensions, notifications and proxy settings
Recovery step	Use Safe Mode when persistent malware returns	Inspect Activity Monitor and configuration profiles
Transfer safety	Verify on the wallet screen before sending	Verify on the wallet screen before sending

Further device-hardening and prevention advice is available in these security tips, including safer browsing, software updates and account-protection practices.