Malware installed on a device (often bundled with pirated software, a fake wallet app, or a malicious browser extension) runs quietly in the background, monitoring the clipboard for anything that looks like a cryptocurrency wallet address.
When you copy a wallet address — intending to paste it as the destination for a transfer — the malware detects the pattern and silently replaces it with an address the attacker controls, all within a fraction of a second.
If you don't double-check the pasted address carefully before confirming the transaction, funds are sent directly to the attacker instead of the intended recipient, with no way to reverse it once confirmed.