Clipboard malware and look-alike addresses

Two attacks, one trick

Clipboard malware watches the clipboard and swaps a copied address for the attacker's. Address poisoning sends tiny or zero-value transfers from an address that looks like one in the victim's history, hoping it gets copied from there later.

Both rely on people checking only the first and last few characters. Look-alike addresses are generated until the start and end match.

A checksum does not help here

The replacement is a real, valid address with a correct checksum. The checker will call it valid. Only comparing the whole address with a trusted source shows the difference.

What does help

• Compare the full address, not the ends — the compare tool marks every differing character.
• Copy addresses from the recipient's own source, not from the transaction history.
• Confirm the address on a hardware wallet's screen where one is used.
• Send a small test amount first and have the recipient confirm it.