Bitcoin QR Security Warning

[jdarren]

I hadn't really heard much about this but apparently four out of five results returned when asking Google for a 'bitcoin qr generator' lead to scam websites. The sites then generated a QR code that encodes an address controlled by the scammers instead of the one necessary for the user.
Apparently instead of scammers making their own fake QR codes they have a blockchain explorer API to generate the QR for their address.

This scam falls into the reported $4 billion of digital currency stolen in Ciphertrace AML report.

https://www.forbes.com/sites/billybambrough/2019/09/12/researchers-have-issued-a-serious-bitcoin-qr-code-warning/#3ef6ff256d12

[1714791243]

1714791243

[1714791243]

1714791243

[Bountyhonter]

Why search google for bitcoin QR generator when most bitcoin wallets (if not all) shows the QR code of your bitcoin wallet.

[pixie85]

Is bitcoin gained this way really stolen? I would call it given away by idiots. When somebody takes something away from you it's theft but when you don't pay attention and lose it it's as much your fault as that scammer's. There were even bitcoin generators that were supposed to hack the blockchain to steal some coins off other people's transactions. If you fall for this you're a loser.

Why would you need a qr code generator? Even exchanges generate codes for your addresses for free.

[harizen]

Sending BTC via QR code must only be done on the specific exchanges where the funds should be transferred.

And $20,000 recently got lost due to QR scam? Why should someone scan and sent BTC to some random QR codes out of Google search results?  

[Velkro]

This scam falls into the reported $4 billion of digital currency stolen in Ciphertrace AML report.

That is shocking actually. Had no idea people using QR codes that much and for such high value transfers also.
Double check/triple check address you are sending to is a must even if scanned with QR scanner or not.
Be vigilant, someone compared Bitcoin world now to westworld which is quite smart comparison.

[btc-facebook]

this is a new way to do fraud, and very smart in my opinion,
because we will never know whether the QR code is a blockchain Explorer API or indeed just a normal BTC address,
avoiding QR codes for the time being is better to avoid hacker attacks,

[Fundamentals Of]

There are already countless of cases involving QR codes. And if the data you are speaking of-- that "four out of five results returned when asking Google for a 'bitcoin qr generator' lead to scam websites"-- is true, it is further confirmed that using QR code is of very high risk. If the QR code does not come from a very reliable source such as your very own wallet, it is much better to avoid it. Using the actual address is not too much of a hassle as against using QR codes, for example. Better be safe than sorry!

[Juggy777]

I hadn't really heard much about this but apparently four out of five results returned when asking Google for a 'bitcoin qr generator' lead to scam websites. The sites then generated a QR code that encodes an address controlled by the scammers instead of the one necessary for the user.
Apparently instead of scammers making their own fake QR codes they have a blockchain explorer API to generate the QR for their address.

This scam falls into the reported $4 billion of digital currency stolen in Ciphertrace AML report.

https://www.forbes.com/sites/billybambrough/2019/09/12/researchers-have-issued-a-serious-bitcoin-qr-code-warning/#3ef6ff256d12

@jdarren who uses QR codes to send bitcoins? and one should never rely on google when it comes to new sites because it’s really easy to rank a scam site on the front page of google. I would advise all to send their coins using the old method, that is copying the address and then verifying it’s the correct address.

[seoincorporation]

...

Well, we already know it's a big risk to generate a wallet or a address online. Is one of the worst ideas ever. The problem here is the ignorance, the newbies who don't know how to generate an addy or how to do it by the safe way will trust in google. Too bad the hackers are good with search engine optimization.

Stop this kind of scam will be hard because google is the one who decides if index or not a site and in what place it should be.

[pooya87]

'bitcoin qr generator'

i still don't understand why would anybody even search this term in first place!
all the wallets that i have seed are already supporting QR codes, specially if you are building a cold storage like a paper wallet and want to print your private keys they already do that for you.
additionally if it is general things you want to turn into a QR code like your transaction or your address,  then searching QR code generator would suffice although still not a good idea to use them.

[killat]

You should always verify the destination address of your Btc.

QR is nothing but a faster way of sending your Btc. Behind there is the same principle: the address,  that might be unfortunately hacked. So, be careful.

[jossiel]

I think that whoever lost that $20,000 and used this fake QR code generator is a complete newbie. I'm using QR codes but I'm also checking the address of it to make sure that it was my transaction and address not the scammer's.

Just simply copy pasting the address will ease this and by being vigilant of checking the address twice or more than that will secure yourself. Another thing is stop downloading something on the internet that you don't understand and unfamiliar.

[Kakmakr]

The developers should definitely consider developing some OpenSource QR scanner that can be used to scan or create QR codes for Bitcoin purposes. We are very reliant on QR scanning for Bitcoin addresses because those addresses are case sensitive and it is also too long to remember. 

I often use QR codes for the scanning of the address and I always have to double check the result to make sure that the address being scanned are the one from the source. These exploited QR code scanners act as a man in the middle attack to scam people and we as a community should act on that to report it and also to list legitimate QR code scanners for the public. 

[bob123]

The developers should definitely consider developing some OpenSource QR scanner that can be used to scan or create QR codes for Bitcoin purposes.

There are multiple QR scanner available. You don't necessarily need one especially for BTC.
Simply scan the QR with any scanner and copy/paste the address into your wallet.

On a mobile, most wallets already support scanning QR codes. You just need to verify the address and amount and can send your funds with one click.

I don't really see the necessity for a bitcoin-related QR scanner. Either a mobile wallet or any other standard scanner is good enough IMO. There wouldn't be any advantages.

[Johnyz]

Never trust any sites even google because they can still scam you and they will do that at no cost. Never heard about the bitcoin QR code can increase the security of your wallet, you'd better to transact with the top exchanges or become a victim of this scam. This is just one of so many ways to scam, its not new anymore.

[shield132]

Why search google for bitcoin QR generator when most bitcoin wallets (if not all) shows the QR code of your bitcoin wallet.

+1 to this one but I amn't astonished with this news because lately there was accident that phishing page of one exchanger had better ranking in google than original one, phishing one was 1st and original one - second, this leaded to a massive money steal.
Btw idea is really quite something different and unique compared to other scam methods (cloud minings, hyips, mixers and etc), seems there is really improvement in social engineering. Curious to see what will be next method.

[Diirtmaan]

I hadn't really heard much about this but apparently four out of five results returned when asking Google for a 'bitcoin qr generator' lead to scam websites. The sites then generated a QR code that encodes an address controlled by the scammers instead of the one necessary for the user.
Apparently instead of scammers making their own fake QR codes they have a blockchain explorer API to generate the QR for their address.

This scam falls into the reported $4 billion of digital currency stolen in Ciphertrace AML report.

https://www.forbes.com/sites/billybambrough/2019/09/12/researchers-have-issued-a-serious-bitcoin-qr-code-warning/#3ef6ff256d12

Can someone explain to me why 'bitcoin qr generator' is needed indeed?

[Mandoy]

There are many fake websites who are disguising as qr generators. Some will give you a qr which has no connection to your keys but instead they will give you a qr that will lead you to a certain site to increase their traffic volumes. Also other sites will give you fake download links that when you click downloads a software that is not related to qr generator while other contains viruses.  

In line to this, it is not necessary to download qr generator and create a qr code for our bitcoin addresses.  Instead of downloading qr generators it is much safer to register and create a wallets on some website hosted wallets such as the wallets on blockchain.com, coinbase and other trusted sites since the qr codes are already provided.  

[zviadits]

There are already countless of cases involving QR codes. And if the data you are speaking of-- that "four out of five results returned when asking Google for a 'bitcoin qr generator' lead to scam websites"-- is true, it is further confirmed that using QR code is of very high risk. If the QR code does not come from a very reliable source such as your very own wallet, it is much better to avoid it. Using the actual address is not too much of a hassle as against using QR codes, for example. Better be safe than sorry!

I don’t know why people are too lazy to use the actual address and are looking for an easier way. I hope this tread helps beginners understand that the QR code is completely unsafe.

[pixie85]

There are already countless of cases involving QR codes. And if the data you are speaking of-- that "four out of five results returned when asking Google for a 'bitcoin qr generator' lead to scam websites"-- is true, it is further confirmed that using QR code is of very high risk. If the QR code does not come from a very reliable source such as your very own wallet, it is much better to avoid it. Using the actual address is not too much of a hassle as against using QR codes, for example. Better be safe than sorry!

I don’t know why people are too lazy to use the actual address and are looking for an easier way. I hope this tread helps beginners understand that the QR code is completely unsafe.

QR code generated by a trusted software can be trusted. Electrum wallet generates codes and if it gets compromised it won't be the code that falls first but your private keys.

People are lazy and don't understand that the convenience of using a scanner to read an address should not turn them into lazy donkeys who won't even check the scanned address. You have to verify everything before pressing the button.

[audaciousbeing]

Why search google for bitcoin QR generator when most bitcoin wallets (if not all) shows the QR code of your bitcoin wallet.

Exactly the point. People sometimes willingly enter into a problem. Majority of wallets whether online of desktop version have their own QR generator where you can scan and make your payment and as a second check, you the expected address is displayed for anyone to do verification that the scanned address is the intended address. If the hackers are able to penetrate a site QR generator then the vulnerability is from the site admin and they should be held liable for such.

The point is as much as there are ways scammers are doing it we also need to be smart and be more careful on the internet. Moreso there are no perfect way. Those who have lost money knows how much the impact has made on their financial status but ultimately crypto needs to grow to the point where these set of people can be brought to book and face the consequences of their actions.

[Kakmakr]

The developers should definitely consider developing some OpenSource QR scanner that can be used to scan or create QR codes for Bitcoin purposes.

There are multiple QR scanner available. You don't necessarily need one especially for BTC.
Simply scan the QR with any scanner and copy/paste the address into your wallet.

On a mobile, most wallets already support scanning QR codes. You just need to verify the address and amount and can send your funds with one click.

I don't really see the necessity for a bitcoin-related QR scanner. Either a mobile wallet or any other standard scanner is good enough IMO. There wouldn't be any advantages.

Well, if those QR scanners are proprietary code, then you would not know if anything nasty is hidden in the code. This is why I would want to see some Open Source code that can be validated and signed by a reputable Bitcoin developer, so that we know that it is exploit free.

We have some very talented people, who created things like https://www.bitaddress.org/ that can surely help us to create a QR scanner just for Bitcoin users. 

I do not trust the other proprietary software that are out there. 

[bob123]

Well, if those QR scanners are proprietary code, then you would not know if anything nasty is hidden in the code. This is why I would want to see some Open Source code that can be validated and signed by a reputable Bitcoin developer, so that we know that it is exploit free.

We have some very talented people, who created things like https://www.bitaddress.org/ that can surely help us to create a QR scanner just for Bitcoin users. 

I do not trust the other proprietary software that are out there. 

There are open source QR scanner available on github.

I don't really see the necessity for a QR scanner to be signed by a bitcoin developer. Why give them more workload if everything you need is already available ?
And additionally, no software is free of exploits. You just can't know whether there is some hidden vulnerability.

Even with proprietary software, i think it is not too hard to check the first and last few chars of an address and the amount before sending the transaction.
Any QR reader can have a bug. IMO scanning for convenience, but checking for safety should be the way to go.

[lightningmelo]

If at all possible, never use anything that prevents you from validating that the address hasn't been compromised.

If you can't avoid it, use a well-tested, community reviewed QR code generator, and double check with some trusted app. Your iPhone has a built-in QR code reader in the Camera app that you can trust.

[virasisog]

I hadn't really heard much about this but apparently four out of five results returned when asking Google for a 'bitcoin qr generator' lead to scam websites. The sites then generated a QR code that encodes an address controlled by the scammers instead of the one necessary for the user.
Apparently instead of scammers making their own fake QR codes they have a blockchain explorer API to generate the QR for their address.

This scam falls into the reported $4 billion of digital currency stolen in Ciphertrace AML report.

https://www.forbes.com/sites/billybambrough/2019/09/12/researchers-have-issued-a-serious-bitcoin-qr-code-warning/#3ef6ff256d12

I think this is a very ignorant and a biased article from Forbes. Bitcoin adoption is not failing.
The popularity of cryptocurrency has boosted apparently,
however we cannot disregard this fact that scam schemes is taking advantage of this as well.

[kryptqnick]

I hadn't really heard much about this but apparently four out of five results returned when asking Google for a 'bitcoin qr generator' lead to scam websites. The sites then generated a QR code that encodes an address controlled by the scammers instead of the one necessary for the user.
Apparently instead of scammers making their own fake QR codes they have a blockchain explorer API to generate the QR for their address.

This scam falls into the reported $4 billion of digital currency stolen in Ciphertrace AML report.

https://www.forbes.com/sites/billybambrough/2019/09/12/researchers-have-issued-a-serious-bitcoin-qr-code-warning/#3ef6ff256d12

Wow, I've never heard of it either, thank you for spreading the warning! I don't use QR code generators, and honestly, I usually type in the Bitcoin address instead of scanning a code, but there are many people that really use QR codes. 4 out of 5 is a terrible number, and this is the case we need cyberpolice for. Such crimes should not be left unpunished, scamming websites should not dominate the area. Or, another option, we need at least one trusted QR code generator for everyone to use and not worry about such things... I do agree with virasisog, though, that it does not mean Bitcoin is disappointing.

[jdarren]

The last time I used a QR code was in association with my wallet. I went to this event where you could only purchase drinks from the bar paying with crypto in which the bartender scanned to redeem the money.

[hatshepsut93]

Is bitcoin gained this way really stolen? I would call it given away by idiots. When somebody takes something away from you it's theft but when you don't pay attention and lose it it's as much your fault as that scammer's. There were even bitcoin generators that were supposed to hack the blockchain to steal some coins off other people's transactions. If you fall for this you're a loser.

Why would you need a qr code generator? Even exchanges generate codes for your addresses for free.

If we applied this thinking to everything in our life, our whole society would crumble, because scammers would be everywhere. Everyone starts as a beginner, you can't really expect people to know everything, so what's the point of blaming the victim? Everyone makes mistakes, but scammers are shitty people because they take advantage of people's mistakes, and they are especially bad for Bitcoin because of its irreversible transactions, and a lot of Bitcoin's bad rep comes from abundance of scammers in its economy.

[MetalGear]

I hadn't really heard much about this but apparently four out of five results returned when asking Google for a 'bitcoin qr generator' lead to scam websites. The sites then generated a QR code that encodes an address controlled by the scammers instead of the one necessary for the user.
Apparently instead of scammers making their own fake QR codes they have a blockchain explorer API to generate the QR for their address.

This scam falls into the reported $4 billion of digital currency stolen in Ciphertrace AML report.

https://www.forbes.com/sites/billybambrough/2019/09/12/researchers-have-issued-a-serious-bitcoin-qr-code-warning/#3ef6ff256d12

It is inevitable to have scammers in every technology that's why bitcoin could also have the risk of being attacked by it. Newbies are mostly the victim because of being naive about how crypto space works and what threats are in it. Now attackers are on it, using QR codes to manipulate and have everything in their hands, we can't stop them from doing so, but we can watch out and be careful in every move we are about to do inside the crypto space. Making sure that we are using a reliable and trusted QR generator could avoid you from losing something irreversible.

[ReiMomo]

I hadn't really heard much about this but apparently four out of five results returned when asking Google for a 'bitcoin qr generator' lead to scam websites. The sites then generated a QR code that encodes an address controlled by the scammers instead of the one necessary for the user.
Apparently instead of scammers making their own fake QR codes they have a blockchain explorer API to generate the QR for their address.

This scam falls into the reported $4 billion of digital currency stolen in Ciphertrace AML report.

https://www.forbes.com/sites/billybambrough/2019/09/12/researchers-have-issued-a-serious-bitcoin-qr-code-warning/#3ef6ff256d12

It is inevitable to have scammers in every technology that's why bitcoin could also have the risk of being attacked by it. Newbies are mostly the victim because of being naive about how crypto space works and what threats are in it. Now attackers are on it, using QR codes to manipulate and have everything in their hands, we can't stop them from doing so, but we can watch out and be careful in every move we are about to do inside the crypto space. Making sure that we are using a reliable and trusted QR generator could avoid you from losing something irreversible.

The best thing to do is always doubled check and compare the QR code address given above(it should above the QR code the address given).
Time to time scammers are getting smarter, they always find ways to get fall in trap those newbies victim. As a cryptocurrency user just always be careful in having a transaction. Verifying first in the manual before you click button confirm. Anyway if you know how to protect your mobile phone from possible malware infection in reading QR code, you must read this. https://www.lifewire.com/how-to-protect-yourself-from-malicious-qr-codes-2487772

[Zionatin]

Is bitcoin gained this way really stolen? I would call it given away by idiots. When somebody takes something away from you it's theft but when you don't pay attention and lose it it's as much your fault as that scammer's. There were even bitcoin generators that were supposed to hack the blockchain to steal some coins off other people's transactions. If you fall for this you're a loser.

Why would you need a qr code generator? Even exchanges generate codes for your addresses for free.

If we applied this thinking to everything in our life, our whole society would crumble, because scammers would be everywhere. Everyone starts as a beginner, you can't really expect people to know everything, so what's the point of blaming the victim? Everyone makes mistakes, but scammers are shitty people because they take advantage of people's mistakes, and they are especially bad for Bitcoin because of its irreversible transactions, and a lot of Bitcoin's bad rep comes from abundance of scammers in its economy.

I don't think he understands. When you scan a QR code to pay the scammers address replaces the address in the QR code. This is the same as the copy-paste one where your clipboard is replaced with their address instead of the one you tried to copy. Not all places have the address with the QR code. As long as you using a legit wallet with QR scanner everything is fine.

I do think sometimes people do sort of ask for it when they fall for really silly scams when they should know better but greed takes over and the scammer knows this so they charm you with offers to increase your greed to the point you don't think as you should and they exploit that.

[Kyraishi]

What's the reasoning behind someone sending their money to one of the random QR codes? Does the person think it's a wallet or a legitimate transaction? The only way I see this working is if someone scanned an address and then the APP just generated their own address and people got to lead to believe that it turned the address into a QR code.

Some people are really clueless, why don't they just use an address? Much safer, and easier, I personally have never used QR codes before, addresses are the way to go.