Copy-Paste Crypto Addresses Safely Before a Swap: 6 Checks Against Clipboard Malware (2026)

By Swappr Editorial (GSPTeck) · Published 2026-10-16 · Last verified 2026-10-16

Every instant crypto swap depends on two addresses you never type by hand: the receiving address you paste into the swap form and the deposit address you copy into your wallet. Copy and paste is what makes crypto usable, and it is also what one family of malware attacks. A “clipper” watches your clipboard and silently swaps a copied address for the attacker’s; look-alike addresses do something similar by tricking your eyes instead. This guide maps where addresses move during a swap, then gives six checks that take under a minute and stop both problems. Educational only; Swappr processes swaps via FixedFloat’s public flow described in the app and on its homepage.

Swappr in one line: a free Android app for multi-coin swaps — pick the coin you have and the coin you want, check the estimate and limits, choose Fixed or Float rate, paste the receiving address, and send the deposit from your own wallet. Features that matter for address safety:

Honest comparison: converting inside an exchange avoids the deposit-address step but keeps your coins in a custodial account; a DEX swap avoids pasting a deposit address but asks you to approve contracts with your wallet. An instant swap like Swappr is flexible across chains, and in exchange it asks you to handle two addresses carefully. That is what the checks below are for. Details are on the Swappr app page.

Where addresses move during a swap

Four-step flow of address moments in a swap: receiving address from wallet to form, refund address, deposit address from swap screen to wallet, send once
Three address moments.

There are three address moments in a typical swap. First, you copy your receiving address for the coin you want from your wallet and paste it into Swappr. Second, if the form asks for one, you paste a refund address on the deposit coin’s network. Third, Swappr shows a deposit address, which you copy or scan into your wallet to send the coins. Our guide to refund addresses vs receiving addresses explains what each field is for. Each moment is a chance for the wrong address to slip in.

How clipboard malware and look-alikes work

A clipper is malware that scans your clipboard for anything shaped like a crypto address and replaces it with one the attacker controls. ESET researchers reported the first clipper found on Google Play in February 2019: an app impersonating MetaMask that could replace copied Bitcoin and Ethereum addresses. It was removed after being reported, but the technique remains common on every platform. The MetaMask Help Center on clipboard hacking describes the same mechanism and recommends double-checking every pasted address.

A look-alike attack needs no malware. Someone generates an address that starts and ends with the same characters as one you use, then sends you a tiny transaction so it appears in your history. If you copy from history instead of from the source, you copy theirs.

One detail matters for swaps: address validation does not help here. FixedFloat’s FAQ explains that an address is rejected as invalid when its network does not match the selected currency. A clipper inserts a perfectly valid address on the right network, so the form accepts it.

Check 1: copy from the source, never from history or chats

Two columns comparing risky sources for copying addresses, such as history and chats, with safe sources, such as the wallet Receive screen and the current order
Where to copy from.

Copy your receiving address from your wallet’s own “Receive” screen, for the exact coin and network you selected in Swappr. Do not copy it from your transaction history, an old chat, a note saved from an earlier swap or a screenshot. History is where look-alike addresses live, and chats are where people paste “corrected” addresses. Our guide to choosing the USDT network for a swap shows why the coin and network on the Receive screen must match the swap form.

Check 2: compare the start, the middle and the end

After pasting, compare the pasted address with the source in three places: the first six characters, six characters from the middle, and the last six. Look-alike addresses are built to match the start and end, so the middle is the part that catches them. Saying the characters out loud in groups of three or four makes differences easier to spot.

Check 3: scan the QR code instead of copying when you can

For the deposit step, scanning Swappr’s deposit QR code with your wallet’s camera skips the clipboard entirely. If your wallet runs on the same phone, use the copy button, then run check 2 on the wallet’s send screen before you confirm. Never paste a deposit address that came from anywhere except the deposit screen of your current order.

Check 4: notice what Android tells you about the clipboard

Recent Android versions make clipboard activity more visible. According to the Android developer documentation on copy and paste, Android 13 and higher show a confirmation with a preview when content is copied, and Android 12 and higher usually show a message when an app reads data that another app put on the clipboard. If you see an unexpected app reading your clipboard while you handle addresses, stop and investigate before sending.

Check 5: re-check on the final confirmation screen

Grid of address comparison checks: first six characters, six from the middle, last six, memo if needed, final confirmation screen, stop on mismatch
Compare in three places.

The last screen before you send is the one that counts. Read the address there, not just in the field where you pasted it. If you use a hardware wallet, compare against the address on the device’s screen. For coins that need a memo or destination tag, confirm that too; our memos and destination tags guide lists the networks where a missing memo matters.

Check 6: keep the phone clean

Install apps only from Google Play or the developer’s official site link, keep Play Protect on, and remove apps you do not recognize, especially “wallet helpers,” keyboards and clipboard managers you did not install deliberately. If a pasted address ever differs from the source, do not send anything: scan the device, remove the suspect app, and consider moving funds from a clean device.

A 60-second routine for every swap

Four-step 60-second routine: copy from the Receive screen, paste and compare, scan the deposit QR code, send once and save the transaction ID
60-second routine.
  1. Copy the receiving address from your wallet’s Receive screen for the right network.
  2. Paste into Swappr and compare start, middle and end.
  3. Add a refund address the same way, if requested.
  4. Scan the deposit QR code, or copy it and compare in your wallet.
  5. Read the address and amount on the final confirmation screen, then send once.
  6. Save the deposit transaction ID for tracking.

If something looks wrong after sending, the Swappr blog collects our tracking and refund guides. A transaction sent to the wrong address on-chain generally cannot be reversed, so the checks before sending are the only real protection.

Vertical Pinterest graphic listing six checks for copying and pasting crypto addresses safely before a swap
Pinterest pin: address checks.

FAQ

Can a swap app detect a replaced address?

Usually not. A replaced address is still a valid address on the right network, so validation passes. Only your comparison catches it.

Is copying the deposit address safe?

Yes, if you compare it on the send screen. Scanning the QR code avoids the clipboard altogether.

What if my pasted address does not match?

Do not send. Check the device for malware, remove unknown apps, and start a new order from a clean device if needed.

Does Swappr ever ask for my seed phrase?

No. You send from your own wallet; Swappr never needs a recovery phrase.

Sources