Crypto Address Changes When You Paste It? Check for Clipboard Malware

If a crypto wallet address changes when you paste it, stop the transfer. Clipboard malware can replace the destination with an attacker’s address, but a change limited to one website or browser needs a different check from a change across Windows. Do not send a small payment to test the problem. First compare the same public address outside the payment form, then scan the affected PC if substitution is confirmed or other compromise signs are present. A wallet generating a new receiving address is a separate, potentially normal event.

This guide focuses on Windows. Keep wallet recovery phrases, private keys and account passwords out of every clipboard test below.

Normal address rotation does not rewrite the text you copied

Some services deliberately display a new receiving address. Coinbase Exchange, for example, documents address generation after transactions or movements between its wallet and storage systems. That is a change at the source before you copy anything. Follow your own service’s current deposit instructions; do not assume every exchange preserves old addresses in the same way. [2]

Clipboard substitution is different: the source shows one address, but the pasted destination contains another. Address poisoning is different again: a lookalike entry in transaction history tricks you into copying the wrong address in the first place. For recipient, network and transaction-history checks, use our crypto wallet verification guide.

Compare the entire address, including the middle. A familiar beginning and ending are insufficient. Truncated displays, line wrapping or a different selected account can also make a comparison misleading, so expand the full text and verify that you are comparing the same source.

Check where the address changes—without sending funds

Cancel the pending transaction and close any signature request. If you already know the device is infected, skip testing: disconnect it and begin cleanup. Otherwise, this brief check can help describe the symptom:

1. Use a public receiving address you already have. Confirm its full value against the recipient’s trusted source on a separate device. Do not sign in to another account or import a wallet just to obtain test material.
2. Check ordinary text in Notepad. Type a harmless sentence, copy it and paste it into the same document. If ordinary text is wrong too, check whether you selected the right text or pasted an older clipboard-history item.
3. Copy the public address and paste into Notepad. Compare every character against the trusted original. Do not paste into a terminal, online comparison tool or payment form. MetaMask also recommends a local text-editor check, while warning that selective malware may evade it. [1]
4. If the mismatch is limited to a page, distinguish the source from the destination. A page’s Copy button and manually selected visible text may produce different results. A difference points toward the page or browser context, but does not identify the cause by itself. Stop once you have a reproducible mismatch; repeated tests cannot make that device safe.

Record the source app or page, destination app, whether ordinary text changes, and whether the address changes immediately or after a delay. A screenshot of public address text can preserve the mismatch for support; crop account balances and personal information before sharing it.

• The receiving page itself now shows a different address; copying preserves it. Confirm normal address rotation, selected account and network through the service’s official help. This observation alone is not clipboard malware.
• The address differs when pasted into Notepad. The copying path or device is untrustworthy. Stop wallet activity and follow the Windows cleanup steps below.
• Notepad matches, but a browser field changes the address. Investigate that page, browser extensions and userscripts. A correct Notepad result does not exclude selective malware.
• The address was already wrong in the message or transaction history. Reconfirm the recipient independently. Local malware removal cannot authenticate a payment request.

These observations narrow the investigation; they are not a malware-family detector. In particular, one website’s Copy button can supply different text without a system-wide clipboard infection.

Remove clipboard malware from Windows

Once substitution is confirmed, stop using the PC for wallet or exchange activity. Disconnect it from the network while you arrange cleanup, and use a separate trusted device for urgent account or wallet decisions. Clearing clipboard history only clears stored text; it does not remove the component that can change the next address.

Use Gridinsoft Anti-Malware as the main Windows cleanup path:

1. Download the installer from the official Gridinsoft website. If necessary, obtain it on a clean computer. Reconnect the affected PC only as needed to install and update the scanner, without opening wallet accounts.
2. Install Gridinsoft Anti-Malware, update its detection database and run a Full Scan.
3. Review the detections and apply the recommended cleanup. Keep suspicious items quarantined rather than restoring them to see whether an app still works.
4. Restart Windows. Repeat the public-address comparison and scan again if detections or substitution return.

A recurring swap can involve more than the visible download. A background component, startup mechanism or browser modification may remain. Microsoft’s CryptoBandits investigation documents one campaign that combined address replacement with scheduled tasks, clipboard-secret theft and remote execution; that does not mean every mismatch is CryptoBandits. [3] A full scan helps check for malicious components, but it cannot return funds already sent or make exposed wallet secrets private again.

If the installer or scanner cannot run, do not disable security controls or download a “clipboard repair” executable from a forum. Use the recovery steps for blocked antivirus access, then return to the full scan when access is restored.

If it happens only in the browser—or returns after cleanup

Close the affected page. Review recently installed extensions and userscripts, especially tools advertised as wallet helpers, exchange bonuses, download assistants or unofficial updates. Remove an untrusted add-on and restart the browser. The Silent Swap case shows why a harmless-looking extension name is not enough to trust it.

Before deleting a legitimate wallet extension, make sure its recovery method is safely available. Do not enter the recovery phrase into a page claiming to “repair” or “validate” the wallet. If you suspect the phrase was exposed, use the separate recovery branch below.

A fresh browser profile with no imported extensions can help isolate a browser-specific symptom. Keep this comparison limited to public text: do not import wallet secrets or sign in merely to test it. If a suspicious extension reappears, follow the extension persistence guide rather than repeatedly removing the same entry.

If substitution persists across local apps after cleanup and restart, leave financial activity on the trusted device. Preserve scan results and seek support for the unresolved compromise; a clean Windows reinstall may be appropriate when trust cannot be restored. Do not manually delete arbitrary system files or registry entries based only on a familiar malware name.

Handle wallet and account exposure separately

• You caught the mismatch before signing or sending. The changed text alone does not show that funds moved. Cancel the transaction, clean the device and verify the destination again before any later payment.
• You already sent to the substituted address. Save the transaction hash, asset, network, destination and relevant messages. Contact your exchange or wallet service through its official support channel promptly. Confirmed blockchain transfers generally cannot be reversed by a scanner or wallet support team; reject unsolicited recovery offers requesting fees or a recovery phrase.
• A seed phrase or private key was copied, displayed or entered while the device may have been compromised. Treat it as potentially exposed. From a trusted device, follow the wallet provider’s recovery guidance for a new wallet with a new phrase. Reinstalling an app or changing its unlock password does not replace the underlying secret.
• You used exchange or email accounts on the affected PC. From a clean device, review account activity, revoke unfamiliar sessions and change exposed passwords. Keep this account recovery separate from the malware scan.

Resume transfers only after the mismatch is resolved and the source, full destination and network have been independently verified. Where available, compare the destination on the hardware wallet’s trusted display before approving. A successful copy-and-paste check is useful evidence that the symptom has stopped—not proof that a previously exposed wallet is secure.

References

1. MetaMask. “Clipboard hacking.” MetaMask Help Center, accessed September 30, 2026. Clipboard checks and their limitations.
2. Coinbase. “Why did my crypto address change?” Coinbase Exchange Help, accessed September 30, 2026. Receiving-address generation.
3. Microsoft Defender Security Research Team and Microsoft Defender Experts. “Crypto Clipper uses Tor and worm-like propagation for persistence and control.” Microsoft Security Blog, June 17, 2026; accessed September 30, 2026. CryptoBandits campaign analysis.