Wrong BTC Adress, copied from Binance's Dashboard

[LittleBigIvan]

Hey there guys, im creating this topic just to share and "maybe discuss" my case with Binance's support;

At the moment i didnt knew what exactly happened, but, i've copied the adress 13PcbKjLBjVUYcSevYELQDc1pLDm6Bb9Di
from the "Copy Address button" and deposited 0.10 BTC "That's a high value for me"

At that point, everything is ok.
Been waiting 10~20 minutes, and my balance haven't updated.
Ok, something wrong is happening here
For instinct, i've just checked my wallet again, and, for my hopelessness, my real BTC wallet is 19rRmQXDKxu8bQki2tJqdPJ2H1SfoYunHC

The "Copy Adress is automatically copying the adress 13PcbKjLBjVUYcSevYELQDc1pLDm6Bb9Di"

PS: I've also recorded with OBStudio what just happened; https://youtu.be/EqUqI6eaU6I

Ok, that's a problem. since i have already deposited 0.10 BTC in ANOTHER wallet.
No other way to solve it, i had to open a ticket.
And that's the answer i've received;


Binance's answer ;
Dear Ivan,

Thanks for reaching out.

We are sorry for what you encountered. Please go through following tips immediately before you take any further action.

1. Install anti-virus software to scan/kill Trojan and other viruses as soon as possible;
2. Disable plug-in/extensions for your browser, trading bot or third-party APP and uninstall unknown software on your computer;
3. Change the password for your devices and accounts;
4. In a critically dangerous situation you should format your hard drive and reinstall the OS (operating system) on your computer (If you are not sure how to do this, seek professional assistance);
5. Consider seeking help from an information security expert to determine how to achieve the best possible level of security;

Thank you for your understanding.

Best Regards,
Binance Support Team

My reply ;

Right.

But, what about my 0.10 BTC's?
How can i get it back?

Binance's reply ;

Dear Ivan,

Thank you for your follow-up.

As shown in the website, your BTC deposit address should be 19rRmQXDKxu8bQki2tJqdPJ2H1SfoYunHC. If the address changes after you copy and paste it, you will need to check the security status of your device. You can refer to the instructions offered by Elaine before.

In addition, I regret to tell you that, given that the destination address does not belong to Binance, we are not able to freeze any funds/accounts tied to the recipients.

If you are interested in pursuing this case, we recommend that you file a police report or cyber-crime report so that you may receive assistance as soon as possible.

Your understanding is much appreciated.

Kind regards,
Binance Support Team


The point is;
I have already formated my computer, downloaded the official .ISO from microsoft, paid for the OS, the anti viruses is ok, nothing have been detected.
Do you think the Binance's support is right in that case?

I agree that i should have paid more attention, yes, but, the "error" is occurring only on the "Copy Address button", not in my Ctrl + C / Ctrl + V


That's it guys, thank you for reading.

[o_e_l_e_o]

There are two deposits of 0.08 and 0.02 made a few minutes apart which could belong to the OP. The change address for the first transaction is used as an input in the second transaction, so they certainly came from the same person.

As to OP: You have clipboard malware. Binance are correct in saying you should format your computer, and there is nothing they can do to recover your funds.

[Danydee]

There is been existing malwares like the one called "Bitcoin Stealer" that target and monitor the clipboard to replace bitcoin addresses copied with the hackers addresses,  So this one reconize and replace the address even if it's copied after simple text selection
 The thing you encounter is suggesting that the failure is present on the code of the page, or on the browser

 Ill suggest you if you still encountering the issue to save a copy of the web page, that's trying keep proofs for what is happening

[LittleBigIvan]

There are no transactions in the block chain sending 0.10 BTC to 13PcbKjLBjVUYcSevYELQDc1pLDm6Bb9Di. Why is that?

Oh yes,

The first transaction is 0.8 BTC, and the other one is 0.2 BTC, both from 3HiNx4fouYf8w153bserjrfrkw1J8VgFPb

[tsaroz]

That's why you always need to double check your address while making a transaction. The reason for email confirmation is also to prevent users from sending coins to unwanted address. Clipboard malware are a old and popular way people are scammed. Be sure you know all of the software and browser addons you have installed. Don't allow any access to websites unless you are completely sure. Keep your browser as addon/extension free as possible.

[Chris Barth]

From my diagnosis, the 0.1 bitcoin actually exists in 13PcbKjLBjVUYcSevYELQDc1pLDm6Bb9Di. I'm sorry for your loss. However, I am not sorry. When copying and pasting a wallet address, you're meant to look closely at what you're doing. When I copy a wallet address (for my little $20 transaction), one of my modes to check if it's OK is checking the first and the last characters of they correspond to that of the source. It could have been better if just a character was tempered with but here, you copied a whole different wallet address and send a whooping 0.1bitcoin without caring if it's destination was right.

[LittleBigIvan]

From my diagnosis, the 0.1 bitcoin actually exists in 13PcbKjLBjVUYcSevYELQDc1pLDm6Bb9Di. I'm sorry for your loss. However, I am not sorry. When copying and pasting a wallet address, you're meant to look closely at what you're doing. When I copy a wallet address (for my little $20 transaction), one of my modes to check if it's OK is checking the first and the last characters of they correspond to that of the source. It could have been better if just a character was tempered with but here, you copied a whole different wallet address and send a whooping 0.1bitcoin without caring if it's destination was right.

Mhmmm, i agree with you, but, since i'm not expert, n have created my wallet in April/2020 "around 10 days or less", im a newbie and don't know those things.
Don't you think this issue is a really bad one?

What about the new investments? Newcomers?

I agree there's a lot of malwares / scamwares / viruses, but, if the virus exist, and it only affect a button, its a simple button, what about protect that button? or maybe making a different kind button?

In that case, the button should'nt exist then, right?

Well, my ctrl + c / ctrl + v is working good. if there's was no "Copy Address" this problem wouldn't happen, agree?

[KrisAlex18]

I don't think that there is other way to recover your money. Once your money has already transfered with other btc wallet, you cannot get it back again because the money has already transfered, just accept the fact that your 1.0 BTC cannot get back, the only thing you may do is to call for professional assistance so they can help you with your problem.

I think your computer has virus created by hackers or scammers because as what you have said, once you copy your BTC address, different wallet address has been copied and I can't judge you with that because just like me once I alredy copied my btc address, I will paste it to the filling form and don't even check it again. Maybe that virus comes by unsecured websites or advertisement because those are the common ways to get virus on your computer.

The good thing is that you already formatted your computer, I hope that it won't happen again. Maybe this would be a lesson for you.

[maydna]

Mhmmm, i agree with you, but, since i'm not expert, n have created my wallet in April/2020 "around 10 days or less", im a newbie and don't know those things.
Don't you think this issue is a really bad one?

What about the new investments? Newcomers?

I agree there's a lot of malwares / scamwares / viruses, but, if the virus exist, and it only affect a button, its a simple button, what about protect that button? or maybe making a different kind button?

In that case, the button should'nt exist then, right?

Well, my ctrl + c / ctrl + v is working good. if there's was no "Copy Address" this problem wouldn't happen, agree?

Your "my ctrl + c / ctrl + v" is okay I guess, but the malware immediately changes the wallet address, so you don't realize it. That happened too with some of my friends, but then they formatted their laptops and installed a new system. After that, they try to copy-paste the wallet address, and they are fine, and the malware is not there. You should format your computer, and instal a new system if you don't want to get the other bad experience.

This lesson is worth for you, at least, you know that there is a malware which can infect your copy-paste command, and you should be careful. Make sure you double check or triple check on the wallet destination and make sure it is right before you click the send button.

[LittleBigIvan]

I don't think that there is other way to recover your money. Once your money has already transfered with other btc wallet, you cannot get it back again because the money has already transfered, just accept the fact that your 1.0 BTC cannot get back, the only thing you may do is to call for professional assistance so they can help you with your problem.

I think your computer has virus created by hackers or scammers because as what you have said, once you copy your BTC address, different wallet address has been copied and I can't judge you with that because just like me once I alredy copied my btc address, I will paste it to the filling form and don't even check it again. Maybe that virus comes by unsecured websites or advertisement because those are the common ways to get virus on your computer.

The good thing is that you already formatted your computer, I hope that it won't happen again. Maybe this would be a lesson for you.

Yes, that have been really hard lesson for me.

[pooya87]

I agree there's a lot of malwares / scamwares / viruses, but, if the virus exist, and it only affect a button, its a simple button, what about protect that button? or maybe making a different kind button?

both the button and pressing ctrl+c do the same exact thing, they set the clipboard content to a string that is the address on the site. what malwares (known as clipboard hijacker) do is that they monitor clipboard and whenever the content is a bitcoin address they change it to the thief's address.

Well, my ctrl + c / ctrl + v is working good. if there's was no "Copy Address" this problem wouldn't happen, agree?

what do you mean by this? did you copy some random string or an actual address?
if you press ctrl+c on any address (such as the one you posted: 19rRmQXDKxu8bQki2tJqdPJ2H1SfoYunHC) and then pasting it pastes the 13PcbKj... address then you have the malware but if that doesn't happen it could be a bug in Binance system.

also check if you have any browser extensions that might interfere. they could also do weird things like this.

[Jako0203]

Hey there guys, im creating this topic just to share and "maybe discuss" my case with Binance's support;

At the moment i didnt knew what exactly happened, but, i've copied the adress 13PcbKjLBjVUYcSevYELQDc1pLDm6Bb9Di
from the "Copy Address button" and deposited 0.10 BTC "That's a high value for me"

At that point, everything is ok.
Been waiting 10~20 minutes, and my balance haven't updated.
Ok, something wrong is happening here
For instinct, i've just checked my wallet again, and, for my hopelessness, my real BTC wallet is 19rRmQXDKxu8bQki2tJqdPJ2H1SfoYunHC

The "Copy Adress is automatically copying the adress 13PcbKjLBjVUYcSevYELQDc1pLDm6Bb9Di"

PS: I've also recorded with OBStudio what just happened; https://youtu.be/EqUqI6eaU6I

Ok, that's a problem. since i have already deposited 0.10 BTC in ANOTHER wallet.
No other way to solve it, i had to open a ticket.
And that's the answer i've received;


Binance's answer ;
Dear Ivan,

Thanks for reaching out.

We are sorry for what you encountered. Please go through following tips immediately before you take any further action.

1. Install anti-virus software to scan/kill Trojan and other viruses as soon as possible;
2. Disable plug-in/extensions for your browser, trading bot or third-party APP and uninstall unknown software on your computer;
3. Change the password for your devices and accounts;
4. In a critically dangerous situation you should format your hard drive and reinstall the OS (operating system) on your computer (If you are not sure how to do this, seek professional assistance);
5. Consider seeking help from an information security expert to determine how to achieve the best possible level of security;

Thank you for your understanding.

Best Regards,
Binance Support Team

My reply ;

Right.

But, what about my 0.10 BTC's?
How can i get it back?

Binance's reply ;

Dear Ivan,

Thank you for your follow-up.

As shown in the website, your BTC deposit address should be 19rRmQXDKxu8bQki2tJqdPJ2H1SfoYunHC. If the address changes after you copy and paste it, you will need to check the security status of your device. You can refer to the instructions offered by Elaine before.

In addition, I regret to tell you that, given that the destination address does not belong to Binance, we are not able to freeze any funds/accounts tied to the recipients.

If you are interested in pursuing this case, we recommend that you file a police report or cyber-crime report so that you may receive assistance as soon as possible.

Your understanding is much appreciated.

Kind regards,
Binance Support Team


The point is;
I have already formated my computer, downloaded the official .ISO from microsoft, paid for the OS, the anti viruses is ok, nothing have been detected.
Do you think the Binance's support is right in that case?

I agree that i should have paid more attention, yes, but, the "error" is occurring only on the "Copy Address button", not in my Ctrl + C / Ctrl + V


That's it guys, thank you for reading.

Oh men, I think that's a malware or trojan like binance told you, maybe you clicked links in websites you've visted, many users encountered that particular problem the copy address schemes, I also encountered that problem once in e-toro, but its my fault i didn't check my recieving address so as result I just threw my money to someones wallet, keep safe everyone

[LittleBigIvan]

I agree there's a lot of malwares / scamwares / viruses, but, if the virus exist, and it only affect a button, its a simple button, what about protect that button? or maybe making a different kind button?

both the button and pressing ctrl+c do the same exact thing, they set the clipboard content to a string that is the address on the site. what malwares (known as clipboard hijacker) do is that they monitor clipboard and whenever the content is a bitcoin address they change it to the thief's address.

Well, my ctrl + c / ctrl + v is working good. if there's was no "Copy Address" this problem wouldn't happen, agree?

what do you mean by this? did you copy some random string or an actual address?
if you press ctrl+c on any address (such as the one you posted: 19rRmQXDKxu8bQki2tJqdPJ2H1SfoYunHC) and then pasting it pastes the 13PcbKj... address then you have the malware but if that doesn't happen it could be a bug in Binance system.

also check if you have any browser extensions that might interfere. they could also do weird things like this.

Erm... have you watched the video?
There's nothing wrong with my computer nor action "Ctrl + C / Ctrl + V", it's only happening on  Binance's "Copy Address" button.
And it happen's only for the 1st click, because if i click 2 times more, it copy my real wallet address normally

[UserU]

I noticed your browser has a number of extensions. Have you, by any chances recently downloaded any crypto-related or some shady ones?

These kind of things usually hijack your copy and paste contents.

[Debonaire217]

That is why, you always need to double check your address before you confirm the transaction, no matter how strong or genuine your OS or security it, it is still breachable because in the world of IT, there's no system that is safe. Meaning, you should be personally responsible and be observant. But you can reduce the risk of it happening again, install a genuine anti virus and prevent yourself from downloading from sites that aren't trusted. Make sure that you don't have any plugins even in your browser that causes this issue.

[NeuroticFish]

That is why, you always need to double check your address before you confirm the transaction, no matter how strong or genuine your OS or security it, it is still breachable because in the world of IT

And if one transfers to 3rd party services he can also make a habit from saving a print screen with the address they show in their page to be somewhat able prove them guilty if that's the case (but 99.9% chance it's not the case).

[leea-1334]

So sorry to hear about this OP and I know it is too late to do anything right now but I hope you know now every time you do Bitcoin transactions to double and even triple check manually,,, I always use copy paste but I see the first 5 characters to make sure it is the same before I confirm and I do it many times cause I am so paranoid!

[Kupid002]

I noticed your browser has a number of extensions. Have you, by any chances recently downloaded any crypto-related or some shady ones?

These kind of things usually hijack your copy and paste contents.

Its really possible  that this is what happen to him.

That answered in binance is normal thing they are not the one who's responsible for the lost amount . You should always double check  the address before sending money.
You can easily notice the difference between that address if you give at least second's to check it.

19rRmQXDKxu8bQki2tJqdPJ2H1SfoYunHC
13PcbKjLBjVUYcSevYELQDc1pLDm6Bb9Di

[Tipstar]

And these malware don't just change any text to address, they recognize the coin address and replace with respective address while they leave other text unchanged. If you mistakenly sent them, there's no way you'll get those coin back. So, it's a costly way to learn to carefully confirm the address.

[Lucius]

LittleBigIvan, that clipboard malware is very likely linked to your browser, some add-on or extension detects that you are in Binance and that you are copying the deposit address. I don't know what antivirus software you are using, but most should successfully block such things, so your AV is not protecting you as it should, or you ignore warning and allow that malicious application access to your system.

What you can do right now is scan your computer with the free version of Malwarebytes, and also with that AV you have (check virus definitions/updates before scan). Also good&free program from MB - Adwcleaner.

All this will not help you get back what you lost, but you can try to find out exactly what happened.