Its close cousin, address poisoning, works by polluting your transaction history while your device stays clean. This one is the reverse: your history is fine, but your machine is infected, and the substitution happens in the half-second between Ctrl+C and Ctrl+V. The distinction matters because the standard defense against one does nothing against the other. Part of Know the Scam by SimpleSwap.

You copy a wallet address. You paste it. You send.

Somewhere in between, a process running on your computer noticed that what you copied matched the shape of a crypto address and replaced it with a different one. The paste looked normal. The field is filled. Nothing on screen suggested anything had happened, because from the operating system’s point of view, nothing unusual did.

This is clipper malware, and it is one of the oldest tricks in crypto for a reason: it is cheap, it requires no interaction with any blockchain, and it exploits the one step nobody reads carefully.

How it works, mechanically

Three stages, and none of them are clever.

Infection. The clipper arrives inside something you installed. Cracked software, fake tools, unofficial app stores, malicious browser extensions. A Rust-based clipper, documented by Check Point Research in June 2026, was hidden inside Solana and Pump.fun sniper bots, an “Aviator Predictor,” and assorted crash-game forecasters. That is a precise portrait of the target: people hunting an edge.

Listening. Once resident, it registers a clipboard handler and maintains a list of regular expressions that match address formats for Bitcoin, Ethereum, Tron, XRP, and others. Every copy event gets tested against them. Copy a recipe and nothing happens. Copy an address, and it fires.

Substitution. The clipboard contents are swapped for an attacker’s address before you paste. That is the whole attack.

Check Point’s own conclusion is worth quoting in spirit: the malware is not the interesting part, because clippers are old news. The interesting part is that the attacker behaved less like a hacker than like a marketer. The campaign ran a WordPress hub feeding downloads on GitHub, SourceForge and YouTube, propped up by networks of fake accounts: repositories padded with fake stars and forks, a SourceForge counter showing 44,485 downloads mostly from Android devices despite no Android build existing, tutorial videos with AI narrators and coordinated positive comments, and manufactured upvotes on security platforms.

Which means every check a careful person performs before downloading, the star count, the reviews, the community sentiment, the low detection rate, has been bought in advance.

Microsoft Threat Intelligence documented a Windows clipper that has been active since February 2026, runs without a traditional installer, uses Windows Script Host and ActiveX to launch a bundled Tor proxy, and communicates with a hidden-service command server. Alongside clipboard theft, it takes screenshots and spreads through USB shortcut files. The Check Point payloads targeted both Windows and macOS, with the macOS build shipping a script that walks the victim through stripping Apple’s quarantine flag to bypass Gatekeeper. That instruction is the attack.

Why blocklists do not help

The scale of these operations is what surprises people.

CyberArk’s analysis of the MassJacker campaign, distributed via a pirated software site, found 778,531 unique attacker addresses. Only 423 of them held funds at the time of analysis, totaling around $95,300, with roughly $336,700 having passed through in total.

That ratio is the design, not a failure. Hundreds of thousands of addresses exist so that no two victims ever pay the same one. There is no single address to report, blocklist, or track. The Check Point sample contained more than 15,500 addresses in a single binary, most of them Bitcoin addresses, and rotated them as they were used.

The advice that does not transfer

Here is why this deserves its own entry rather than a paragraph in the address poisoning one.

Against poisoning, the standard defense is to keep a saved address book and select from it rather than copying from your transaction history. That works because poisoning depends on you picking a bad address that arrived legitimately in your history.

Against a clipper, the address book does not help. You can select a perfectly correct address from your own saved contacts. The substitution happens after the copy and before the paste, in transit, on your machine. The source you copied from was clean. What arrived in the field was not.

The second habitual defense also has a hole. Checking the first and last few characters catches a random substitution, so clipper authors adapted. The Laplas family introduced a method for generating addresses that closely resemble the one the victim copied, and researchers testing it produced a convincing lookalike in about five seconds. A glance at the ends now passes.

And one more, which catches people who believe they have already solved this: a hardware wallet does not protect you. It protects your keys and your seed phrase, neither of which is under attack here. It cannot know that the destination you approved is not the destination you intended. You will confirm the swapped address on the device screen yourself.

What actually works

Because the malware operates at the operating system level, defenses fall into two groups: catching a substitution in the moment and preventing infection in the first place.

Verify the address after pasting it into the field, not before. This is the single most important habit, and it inverts the usual advice. It does not matter what you copied. What matters is what is sitting in the recipient box at the moment you confirm. Read it there, against a trusted source, comparing the middle of the string rather than just the ends.

Check it on the signing device. If you use a hardware wallet, the address shown on its screen is the one the transaction will actually use. That display is beyond the reach of clipboard malware on your computer, making it the most trustworthy surface you have.

Send a small test first for large transfers, and re-verify the field contents before the main send rather than reusing anything.

If something tells you to bypass a security warning, stop. The macOS variant needed victims to disable Gatekeeper themselves. Any instruction to strip a quarantine flag, ignore a signature warning, or disable protection is not a workaround. It is the payload’s install step.

Treat cracked software as a wallet risk, not a legal one. Every major clipper campaign in the past two years has been distributed this way. Pirated applications, cracked wallet tools, sniper bots, game cheats, and “unlockers” are the primary delivery vehicles, and the calculation is straightforward: the software you did not pay for is being paid for another way.

Install mobile apps only from official stores and only via links published on the official site. Copy-paste is even harder to avoid on a phone than on a desktop.

Audit browser extensions. They can read clipboard contents in some contexts and are a common delivery route. Remove anything you do not actively use.

Keep a clean device for significant holdings. The most effective structural answer is separation: one machine for downloads, games, and experiments, another for anything involving real money.

If you suspect an infection, do not just change addresses. Scan with reputable security software, and treat any large transfer as unsafe until the device is verified clean. A clipper that is still resident will simply swap the next one too.

Where this meets your swap

Every exchange asks for a receiving address, and this crypto scam targets the exact moment you provide it, thereby putting it into our flow whether we like it or not.

There are two paste operations in a standard SimpleSwap exchange, and both are exposed on an infected machine. The receiving address you paste into the form and the deposit address you copy from us into your own wallet. A clipper can substitute either one.

Nothing on our side can detect that. The address that arrives in the field is the address we will use, because it is indistinguishable from one you typed deliberately, and a confirmed transfer cannot be reversed by anyone. So the verification is genuinely yours: after pasting, read what is actually in the box, and when copying our deposit address, check the value that landed in your wallet against the one shown on the order page.

Anyone asking whether SimpleSwap is safe should understand this honestly. The service can be operating perfectly, and your funds can still end up somewhere else because the failure occurred on your device before the transaction was created. Our only official domain is simpleswap.io.

What comes next

Each entry above gets its own breakdown in “Know the Scam by SimpleSwap.“ Next up: honeypot tokens, rug pulls, fake support, fake airdrops, drainer dApps, and recovery scams.

This article is for educational purposes only and is not financial or security advice. SimpleSwap’s only official domain is simpleswap.io.