QR Codes and Copy-Paste: When the Destination Address Lies to You

The everyday gesture that costs a fortune

In crypto, addresses are long, complex alphanumeric strings. No one types them by hand. To transfer funds, we all rely on two everyday gestures: copy-paste and QR code scanning.

Scammers know this. Rather than trying to break the blockchain's cryptography, they target these two gestures to hijack your funds at the exact moment you initiate a payment.

Definition — destination hijacking: manipulation that replaces or masks the address actually used for a crypto payment while the user still believes they are sending to the legitimate recipient.

Clipboard hijacking

Clipboard hijacking is dangerous because of its simplicity and stealth. It relies on malware silently installed on your computer or phone. The mechanic:

1. You copy the legitimate crypto address of your recipient.
2. The malware, monitoring your clipboard constantly, detects a string matching a crypto address format.
3. In a fraction of a second, it swaps the legitimate address for the attacker's address in your device's memory.
4. When you paste, the attacker's address appears in your wallet.

If you confirm without carefully re-reading the pasted address, your funds are gone.

QR code traps

QR codes make mobile payments easy, but they hide the actual data. A QR code is just a visual representation: it can contain a crypto address, a payment request, a WalletConnect URI or a phishing link.

Common QR fraud methods:

• Fake payment portal — The QR redirects to a website that perfectly imitates a legitimate platform, designed to steal credentials or trick you into approving a fraudulent transaction.
• Phone impersonation (FTC alert) — A scammer posing as an authority or customer service keeps you on the phone, walks you to a crypto ATM, and asks you to scan a QR code they sent. The code contains their own wallet address.
• Fraudulent sticker — In the physical world, criminals sometimes stick their own QR code over a merchant's legitimate one.

Attack vector recap

Vector	What the user sees	What actually happens	Priority check
Hijacked clipboard	Address just copied from a trusted source.	Malware swapped it before paste.	Compare pasted address with original source.
Fraudulent payment QR	A code labeled as a recipient's.	Code contains the scammer's address.	Confirm the address via a second channel.
Phishing QR	Quick access to a service.	Code opens a deceptive domain.	Read the domain and requested action first.
Overlaid sticker	A QR code posted in a physical location.	Original code covered.	Inspect the surface; ask the merchant.

Safety reflexes

• Always verify after paste. Compare the first and last characters of the pasted address with the original source.
• Beware of unexpected QR codes. Do not scan QR codes received by email, SMS or found on social media unless you can verify the origin.
• Protect your devices. Keep your OS updated and use a reputable antivirus to reduce clipboard-hijacker malware risk.
• Test-send when the stakes justify it. For a new address and a large amount, send a small transfer first — though this doubles network fees and does not replace address verification.
• Read the confirmation screen. Check network, asset, amount and final address. Technically valid ≠ legitimate recipient.

The Lumina approach: audit before send

Human error is inevitable, which is why a modern wallet must act as a safety net. Rather than using a universal scanner that could redirect you to a malicious site, Lumina separates use-cases. The send-screen scanner only reads crypto addresses; if it detects a web link or suspicious command, it blocks the action immediately.

Whether you paste or scan, Lumina does not just accept the address — it runs an instant security audit:

• Address format validation.
• Real-time cross-check against threat intelligence databases (like GoPlus Security) for phishing, blacklists and honeypots.
• Clear warning before you confirm the transaction.

You keep full control, and you gain the information needed to spot a hijack before it's too late.

Download on Google Play | Download on the App Store