Why does my phone clipboard change the address when I paste it into a swap

21 September 2026

Your phone clipboard is not changing the address. A malicious app or browser script is intercepting your clipboard, reading the crypto address you copied, and replacing it with a different address before you paste. This is called clipboard hijacking.

The mechanism is straightforward. When you copy a wallet address, that data sits in your phone's shared clipboard - accessible by any app running in the foreground or background, depending on your operating system. On many mobile browsers, JavaScript code running on the page you are using can read the clipboard without your permission. A piece of malware or a compromised app can do the same. The attacker's script or app then swaps the genuine address for one they control, and you paste the replacement without noticing the change.

Why does this happen specifically during a swap? Because that is the moment when you are most likely to copy and paste an address. Scammers target that exact step. They know you are focused on the token amounts, the exchange rate, or the confirmation screen. You are not double-checking every character of a long alphanumeric string. They rely on that.

The replacement address often looks similar to the original - same first few and last few characters. Some attackers use "vanity" addresses that begin with the same letters as the real contract address for a token. If you glance only at the start and end of the pasted string, you see what you expect.

Phone operating systems handle clipboard permissions differently. Apple's iOS shows a prompt when an app reads the clipboard, but that prompt appears after the read, and many users dismiss it without reading. Android versions from 10 onward restrict background clipboard access, but malicious apps can still read it if they are in the foreground or if they exploit accessibility service permissions. On both platforms, browser-based clipboard reading via JavaScript is possible on some sites that request explicit permission - or that rely on older browser APIs that do not require it.

You can stop this attack. The only reliable check is to verify every character of the address after pasting. Compare the pasted address against the one you copied - character by character. Do not rely on the first and last four characters. Read the middle.

A better habit is to avoid copying addresses at all. If you are swapping from a mobile wallet, many wallets let you paste directly into the exchange interface without touching an external clipboard. Some swap interfaces let you scan a QR code from your wallet instead of pasting. Use those methods when they are available.

If you must copy, clear your clipboard immediately after pasting. That limits the window for any background reader. Some security apps can alert you when an app reads your clipboard, but those alerts are not foolproof.

The underlying problem is deeper than any single fix. On mobile devices, the clipboard is a shared resource with weak permission controls. Until operating systems lock it down further - requiring explicit user confirmation for every read - you are the last line of defense.

For a broader look at the ways mobile swaps can go wrong, including with carbon credit tokens, read the hub page titled "Mobile wallet swap mistakes with carbon credit tokens." That page covers the full set of pitfalls that arise from the mismatch between mobile wallet interfaces and the precision required for token swaps.

Back to carbon credits