Clipboard address swapping: how not to lose your USDT

Clipboard malware watches what you copy. When you copy a wallet address, it quietly replaces it with a similar-looking scammer address. You paste "your" address, but the field already holds someone else's.

A blockchain transfer cannot be reversed, so the only protection is checking before you send. Compare not just the first and last 4 characters but several in the middle too. Do not copy addresses from your transaction history. Send a small amount to a new address first.

How the swap works

Clipboard malware

The program gets onto a computer or phone with "cracked" software, a browser extension or a file from a chat. It waits for a string that looks like an address to appear in the clipboard. A TRON address is easy to recognize: it starts with the letter T and has 34 characters.

The malware substitutes the scammer's address. Often it is chosen in advance to have the same first and last characters.

Address history poisoning

The second method needs no malware. The scammer creates an address similar to one you often send to, and sends you a tiny transfer. That address now appears in your history. If you later copy the "recipient" from your history, you may pick the fake one.

Checklist before every transfer

1. Copy the address from the original source: the recipient's message or the exchange deposit page. Not from your transaction history.
2. Paste and compare the first 4, the last 4 and 4–6 characters in the middle.
3. Check the length and format: starts with T, 34 characters.
4. Use the wallet's address book for frequent recipients. Save the address once, after checking it in full.
5. Send a test amount to a new address. Wait for the recipient to confirm, and only then send the rest.
6. Check the address again on the confirmation screen. The malware can act at any moment between copying and sending.

What a test transfer costs

A test transfer is one more transaction, and it needs Energy too. But it is a small price for peace of mind.

Scenario	Energy needed	TRX burned	Instant purchase
Test transfer to a new address	~131,000	~13.35 TRX	5 TRX
Main transfer (recipient already holds USDT)	~65,000	~6.85 TRX	2.5 TRX
Both transfers in a row	~196,000	~20.2 TRX	7.5 TRX (3 transfers)

Through the instant purchase, you can get Energy for three transfers at once for 7.5 TRX. It lasts 1 hour, enough for both the test and the main transfer. The transfer amount does not affect Energy use.

Signs your device is infected

• The pasted address differs from the one you copied.
• The address changes if you copy it again.
• You recently installed software or extensions from unverified sources.

If you notice even one of these, do not send anything from this device. Scan it with antivirus software. Use another, clean device for the transfer.

If the transfer already went to the wrong address

To be honest: blockchain transactions are irreversible. Neither the wallet, nor the network, nor an Energy service can cancel a transfer.

What you can do:

1. Save the TxID and open it in TronScan. Confirm where the funds went. How to do this is in how to check a transaction in TronScan.
2. If the address belongs to an exchange, contact its support with the TxID.
3. Report it to law enforcement in your country.
4. Switch devices or reinstall the system before working with crypto again.

Scammers posing as support

Another common scheme is "help" with a transfer. Someone messages you offering help with Energy and asks for your seed phrase or private key.

An Energy service needs only your public address. No honest service asks for a seed phrase, a private key or for you to sign unclear transactions. More on the safety page.

FAQ

Is checking the first and last 4 characters enough? Not always. Scammers generate addresses with matching ends. So also check several characters in the middle.

Does a hardware wallet protect me? It protects your keys, but not the recipient address. Check the address on the device screen before confirming.

Can the malware steal USDT without me sending anything? A clipboard swapper cannot; it only acts when you send. But if a device has this malware, it may have other malicious software too. Do not store your seed phrase in notes, screenshots or the cloud.

In short

• Check the whole address, not just the ends.
• Do not copy the recipient from your transaction history.
• Send a test amount to a new address first.
• Before the transfer, check your address to see how much Energy both transfers need.