Bitcoin QR Security Warning

[jdarren]

I hadn't really heard much about this but apparently four out of five results returned when asking Google for a 'bitcoin qr generator' lead to scam websites. The sites then generated a QR code that encodes an address controlled by the scammers instead of the one necessary for the user.
Apparently instead of scammers making their own fake QR codes they have a blockchain explorer API to generate the QR for their address.

This scam falls into the reported $4 billion of digital currency stolen in Ciphertrace AML report.

https://www.forbes.com/sites/billybambrough/2019/09/12/researchers-have-issued-a-serious-bitcoin-qr-code-warning/#3ef6ff256d12

[Bountyhonter]

Why search google for bitcoin QR generator when most bitcoin wallets (if not all) shows the QR code of your bitcoin wallet.

[pixie85]

Is bitcoin gained this way really stolen? I would call it given away by idiots. When somebody takes something away from you it's theft but when you don't pay attention and lose it it's as much your fault as that scammer's. There were even bitcoin generators that were supposed to hack the blockchain to steal some coins off other people's transactions. If you fall for this you're a loser.

Why would you need a qr code generator? Even exchanges generate codes for your addresses for free.

[harizen]

Sending BTC via QR code must only be done on the specific exchanges where the funds should be transferred.

And $20,000 recently got lost due to QR scam? Why should someone scan and sent BTC to some random QR codes out of Google search results?  

[Velkro]

This scam falls into the reported $4 billion of digital currency stolen in Ciphertrace AML report.

That is shocking actually. Had no idea people using QR codes that much and for such high value transfers also.
Double check/triple check address you are sending to is a must even if scanned with QR scanner or not.
Be vigilant, someone compared Bitcoin world now to westworld which is quite smart comparison.

[btc-facebook]

this is a new way to do fraud, and very smart in my opinion,
because we will never know whether the QR code is a blockchain Explorer API or indeed just a normal BTC address,
avoiding QR codes for the time being is better to avoid hacker attacks,

[Fundamentals Of]

There are already countless of cases involving QR codes. And if the data you are speaking of-- that "four out of five results returned when asking Google for a 'bitcoin qr generator' lead to scam websites"-- is true, it is further confirmed that using QR code is of very high risk. If the QR code does not come from a very reliable source such as your very own wallet, it is much better to avoid it. Using the actual address is not too much of a hassle as against using QR codes, for example. Better be safe than sorry!

[Juggy777]

I hadn't really heard much about this but apparently four out of five results returned when asking Google for a 'bitcoin qr generator' lead to scam websites. The sites then generated a QR code that encodes an address controlled by the scammers instead of the one necessary for the user.
Apparently instead of scammers making their own fake QR codes they have a blockchain explorer API to generate the QR for their address.

This scam falls into the reported $4 billion of digital currency stolen in Ciphertrace AML report.

https://www.forbes.com/sites/billybambrough/2019/09/12/researchers-have-issued-a-serious-bitcoin-qr-code-warning/#3ef6ff256d12

@jdarren who uses QR codes to send bitcoins? and one should never rely on google when it comes to new sites because it’s really easy to rank a scam site on the front page of google. I would advise all to send their coins using the old method, that is copying the address and then verifying it’s the correct address.

[seoincorporation]

...

Well, we already know it's a big risk to generate a wallet or a address online. Is one of the worst ideas ever. The problem here is the ignorance, the newbies who don't know how to generate an addy or how to do it by the safe way will trust in google. Too bad the hackers are good with search engine optimization.

Stop this kind of scam will be hard because google is the one who decides if index or not a site and in what place it should be.

[pooya87]

'bitcoin qr generator'

i still don't understand why would anybody even search this term in first place!
all the wallets that i have seed are already supporting QR codes, specially if you are building a cold storage like a paper wallet and want to print your private keys they already do that for you.
additionally if it is general things you want to turn into a QR code like your transaction or your address,  then searching QR code generator would suffice although still not a good idea to use them.

[killat]

You should always verify the destination address of your Btc.

QR is nothing but a faster way of sending your Btc. Behind there is the same principle: the address,  that might be unfortunately hacked. So, be careful.

[jossiel]

I think that whoever lost that $20,000 and used this fake QR code generator is a complete newbie. I'm using QR codes but I'm also checking the address of it to make sure that it was my transaction and address not the scammer's.

Just simply copy pasting the address will ease this and by being vigilant of checking the address twice or more than that will secure yourself. Another thing is stop downloading something on the internet that you don't understand and unfamiliar.

[Kakmakr]

The developers should definitely consider developing some OpenSource QR scanner that can be used to scan or create QR codes for Bitcoin purposes. We are very reliant on QR scanning for Bitcoin addresses because those addresses are case sensitive and it is also too long to remember. 

I often use QR codes for the scanning of the address and I always have to double check the result to make sure that the address being scanned are the one from the source. These exploited QR code scanners act as a man in the middle attack to scam people and we as a community should act on that to report it and also to list legitimate QR code scanners for the public. 

[bob123]

The developers should definitely consider developing some OpenSource QR scanner that can be used to scan or create QR codes for Bitcoin purposes.

There are multiple QR scanner available. You don't necessarily need one especially for BTC.
Simply scan the QR with any scanner and copy/paste the address into your wallet.

On a mobile, most wallets already support scanning QR codes. You just need to verify the address and amount and can send your funds with one click.

I don't really see the necessity for a bitcoin-related QR scanner. Either a mobile wallet or any other standard scanner is good enough IMO. There wouldn't be any advantages.

[Johnyz]

Never trust any sites even google because they can still scam you and they will do that at no cost. Never heard about the bitcoin QR code can increase the security of your wallet, you'd better to transact with the top exchanges or become a victim of this scam. This is just one of so many ways to scam, its not new anymore.

[shield132]

Why search google for bitcoin QR generator when most bitcoin wallets (if not all) shows the QR code of your bitcoin wallet.

+1 to this one but I amn't astonished with this news because lately there was accident that phishing page of one exchanger had better ranking in google than original one, phishing one was 1st and original one - second, this leaded to a massive money steal.
Btw idea is really quite something different and unique compared to other scam methods (cloud minings, hyips, mixers and etc), seems there is really improvement in social engineering. Curious to see what will be next method.

[Diirtmaan]

I hadn't really heard much about this but apparently four out of five results returned when asking Google for a 'bitcoin qr generator' lead to scam websites. The sites then generated a QR code that encodes an address controlled by the scammers instead of the one necessary for the user.
Apparently instead of scammers making their own fake QR codes they have a blockchain explorer API to generate the QR for their address.

This scam falls into the reported $4 billion of digital currency stolen in Ciphertrace AML report.

https://www.forbes.com/sites/billybambrough/2019/09/12/researchers-have-issued-a-serious-bitcoin-qr-code-warning/#3ef6ff256d12

Can someone explain to me why 'bitcoin qr generator' is needed indeed?

[Mandoy]

There are many fake websites who are disguising as qr generators. Some will give you a qr which has no connection to your keys but instead they will give you a qr that will lead you to a certain site to increase their traffic volumes. Also other sites will give you fake download links that when you click downloads a software that is not related to qr generator while other contains viruses.  

In line to this, it is not necessary to download qr generator and create a qr code for our bitcoin addresses.  Instead of downloading qr generators it is much safer to register and create a wallets on some website hosted wallets such as the wallets on blockchain.com, coinbase and other trusted sites since the qr codes are already provided.  

[zviadits]

There are already countless of cases involving QR codes. And if the data you are speaking of-- that "four out of five results returned when asking Google for a 'bitcoin qr generator' lead to scam websites"-- is true, it is further confirmed that using QR code is of very high risk. If the QR code does not come from a very reliable source such as your very own wallet, it is much better to avoid it. Using the actual address is not too much of a hassle as against using QR codes, for example. Better be safe than sorry!

I don’t know why people are too lazy to use the actual address and are looking for an easier way. I hope this tread helps beginners understand that the QR code is completely unsafe.

[pixie85]

There are already countless of cases involving QR codes. And if the data you are speaking of-- that "four out of five results returned when asking Google for a 'bitcoin qr generator' lead to scam websites"-- is true, it is further confirmed that using QR code is of very high risk. If the QR code does not come from a very reliable source such as your very own wallet, it is much better to avoid it. Using the actual address is not too much of a hassle as against using QR codes, for example. Better be safe than sorry!

I don’t know why people are too lazy to use the actual address and are looking for an easier way. I hope this tread helps beginners understand that the QR code is completely unsafe.

QR code generated by a trusted software can be trusted. Electrum wallet generates codes and if it gets compromised it won't be the code that falls first but your private keys.

People are lazy and don't understand that the convenience of using a scanner to read an address should not turn them into lazy donkeys who won't even check the scanned address. You have to verify everything before pressing the button.