wrong bitcoin address

[boris singer]

maybe your computer has been infected with a keylogger, and you happen to allow the option to save passwords in your browser. Try checking first because this includes the hijacking mode, if it still doesn't change it's better to reinstall, or reset all data from different computer because the malware has infected sensitive parts of the system including your antivirus.

[1715635952]

1715635952

[1715635952]

1715635952

[1715635952]

1715635952

[1715635952]

1715635952

[tora]

Getting of topic here. There is no porn on my device. I have not downloaded any software or installed any apps or extensions.

[HCP]

Ok... so you'd need to correctly identify what the root cause was before you can judge whether or not you've fixed anything and the likelihood of it reoccurring in the future. So, back to the original problem of addresses being automatically changed to 13gwPnRgJjqsg2T1QQ6LQXtxWJAQDJWD6z.

If you copy/paste the following addresses one at a time:
1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2
17VZNX1SN5NtKa8UQFxwQbFeFc3iqRYhem
1CC3X2gu58d6wXUWMffpuzN9JAfTUWu4Kj

Do those addresses paste correctly or are they changed to something else?

Does it only do it on a particular website (ie. ONLY on Kucoin)? or does it do it when you paste an address everywhere (text editor, browser, Word document etc)?

If it ONLY happens in the browser and only on one (or a couple of) particular site(s), it might be a Tampermonkey type extension designed to mess with particular websites only... if it does it EVERYWHERE, then it's most likely a generic clipboard hijacker.

[tora]

Hello HCP.
thanks for your reply. It only happens on Kucoin and only with bitcoin.

[HCP]

It only happens on Kucoin and only with bitcoin.

Then the possibilities I can think of are:

1. Phishing/Fake website... you're not actually logging into Kucoin, but a scam clone version that is hardcoded to use hackers address. Check the URL very carefully... perhaps try to type it out manually instead of relying on a bookmark.

2. Bad browser extension... what browser are you using? and have you looked at the settings to see what extensions/addons are running? Maybe try a different browser to see if the same thing happens.

3. Do you have tampermonkey or greasemonkey installed? If so, check to see what scripts are running... Again, try a different browser to see if the same thing happens.

4. Kucoin specific clipboard hijacker. Can't say I've heard of a clipboard malware that was specific to one site... but it might do it on other exchanges as well. Have you tried other exchanges? or just Kucoin?

[tora]

Hello. Thanks for reply.
1) I do not use bookmarks on any financial site.
2) I am using Opera as browser. I only have Opera ad blocker as extension.
3) I have neither installed. Do not even know what they are.
4) Other exchanges are fine.
 Is it safe to download Spyhunter to remove clipboard malware if I am infected?
Again,thanks for all your help and suggestions.

[HCP]

I'd check with both "MalwareBytes" and "Spybot Search and Destroy"... to see if they find anything. Not that that really guarantees anything one way or the other due to false positives and that they generally only detect "known" malware.

Personally, when it comes to malware removal... I would be inclined to simply format the machine and reinstall the OS from scratch. It can be a bit of a hassle backing up data and reconfiguring apps etc... but it is generally far more effective in removing malware completely.