Free interactive demo
Clipboard malware doesn’t hack your wallet. It edits your paste. Copy the fictional address below, flip the clearly labeled attack switch, paste, and watch the swap happen to you. Feeling it once beats reading about it ten times.
Fictional addresses only. Your clipboard is touched only by your own copy & paste.
Pretend a friend just sent you this address to pay. It is fictional and deliberately invalid, but your clipboard treats it like any other text. That’s the point.
bc1qdemox7k4fyn2vw9plt8u3sa6hqe5cg0notrealOFF: Copy is honest and puts exactly what you see on the clipboard
This send form is a prop. The button never sends anything, to anyone, ever. Paste the address you just copied and look closely before you “send”.
What you saw (and thought you copied)
What your clipboard actually delivered
The first 8 and last 8 characters are identical. Attackers generate vanity addresses to match the ends, because the ends are all most people check.
In this demo the swap survived a glance at both ends. Here is what it does not survive:
Not two or three. Compare a solid run at each end (eight or more), and spot-check the middle. Poisoning kits match short ends cheaply. Every extra character you verify multiplies their cost. Read it off the recipient’s screen, not from memory.
For any transfer that would hurt, send a tiny amount first. Confirm with the recipient, through another channel, that it arrived. A swapped address steals the small test amount, not the balance. Only then send the real amount, to the address the test proved.
A hardware wallet shows the true destination on its own display, out of the malware’s reach. If the address on the device screen doesn’t match the one you meant to pay, the computer is lying to you. That screen exists for exactly this attack.
Why checking a few characters fails: generating an address whose first and last few characters match a target is just brute force. It is cheap at 3 characters per end, expensive at 8, and the middle never matches. The demo’s look-alike matches 8 + 8 on purpose.
The malware that rewrites your clipboard runs on the same machine where people keep seed phrases in notes apps, private keys in text files, and 2FA backup codes in screenshots. A clipboard watcher doesn’t just swap addresses. It scans everything that passes through for anything shaped like a key. Unencrypted text on an infected machine is already gone. The address swap is just the version you get to watch happen. That is the case for keeping keys and codes in an encrypted vault on your device, and for never letting a real seed phrase touch a clipboard at all.
Both demo strings are fictional AND provably invalid. They contain the letter “o”, one of the four characters (1, b, i, o) the bc1 address format deliberately excludes to prevent misreading. So no wallet will accept them, and they can’t collide with anyone’s funds. Real clipboard malware watches and rewrites your clipboard continuously, in the background, forever. This demo performs the swap only at the moment you press Copy with the attack switch visibly on. The page never calls any clipboard-read API. The only text it ever sees is what you paste into its one field, and that is compared against the two demo strings locally and discarded. Nothing is stored, nothing is sent, and reloading resets everything.
Sealby keeps seed phrases, keys and codes encrypted on your iPhone. They are decrypted only inside the vault, never left as readable text where a clipboard watcher looks. No account to phish, deniable if it matters.
iPhone & iPad · iOS 17+ · Free