Beware of Cryptoshuffler

[Forever101]

THE LATEST SCAM IN CRYPTO: You Can Lose All Your Coins in Seconds

Scams in the crypto space have evolved and become more sophisticated over time due to various factors, including the increasing popularity of cryptocurrencies, the relative anonymity of transactions, and the lack of regulatory oversight in some jurisdictions.

Scammers can now get access to your phone when you click an unsuspecting link on social media platforms.

The latest scam is called Cryptoshuffler. This trojan steals coins under your nose by replacing your copied wallet address in your clipboard. Ordinarily, when you copy and paste wallet addresses, you have nothing to fear until cryptoshuffler comes into play.

Now your copied wallet address can be replaced with a scammer's address without your knowledge.

Stay safe, guys.

Credit : https://www.binance.com/en/feed/post/921977?

[1714917220]

1714917220

[1714917220]

1714917220

[1714917220]

1714917220

[1714917220]

1714917220

[1714917220]

1714917220

[SquirrelJulietGarden]

If you want to get a ban, continue to use your referral link.

If you don't want to be banned, remove the referral link.

4. No referral code (ref link) spam. [1]

[Forever101]

Not a referral link, I saw the post and I think it is useful, that's why I posted it

[Learn Bitcoin]

If you want to get a ban, continue to use your referral link.

If you don't want to be banned, remove the referral link.

4. No referral code (ref link) spam. [1]

I have checked the archive of this post and visited the link as well. I don't think it was a referral link. It was linked to the article on this original topic. He has to provide the source of the content he is sharing in this forum to avoid getting banned for plagiarism. Maybe because his link contained 921977?ref=79183127&utm_campaign=app_share_link, you thought it was a referral link. No, When you read an article using the Binance app and try to share or copy the article link, it adds that part.

Not a referral link, I saw the post and I think it is useful, that's why I posted it

You should edit the topic and add the source link to the original content. You can remove the ref part, and it will still work.
Add this in your OP https://www.binance.com/en/feed/post/921977

[Porfirii]

If you want to get a ban, continue to use your referral link.

If you don't want to be banned, remove the referral link.

4. No referral code (ref link) spam. [1]

I have checked the archive of this post and visited the link as well. I don't think it was a referral link. It was linked to the article on this original topic. He has to provide the source of the content he is sharing in this forum to avoid getting banned for plagiarism. Maybe because his link contained 921977?ref=79183127&utm_campaign=app_share_link, you thought it was a referral link. No, When you read an article using the Binance app and try to share or copy the article link, it adds that part.

Not a referral link, I saw the post and I think it is useful, that's why I posted it

You should edit the topic and add the source link to the original content. You can remove the ref part, and it will still work.
Add this in your OP https://www.binance.com/en/feed/post/921977

If I'm not wrong, removing that part is always a good idea to avoid tracking, but as recently said, it doesn't seem to be anything according to the rules of the forum in this particular case. Anyway, it's always better to prevent when in doubt.

Back on topic, that copy-paste scam you talk about is not new and veterans here always double-check the pasted addresses before sending Bitcoin transactions. Newcomers should also take into account that just checking the first or last letters/numbers is not enough, because advanced tools can generate addresses with beginnings and endings similar to the original ones: it is better to check the digits in the middle of the address, when not every single one like it is advisable for large transactions.

[Pmalek]

This is a different type of clipboard malware that essentially works like any other versions. You copy an address and when you paste it, it gets replaced with one that belongs to the scammers. This should be easy to spot if you are careful and pay attention to where you send your coins.

There is always a source where you copied the address from.
If someone send you the address, compare the one you have pasted into your wallet to the one in the source.
If you are sending to yourself, check and compare with your own wallet.
If you are using a hardware wallet, the address will be displayed on the hardware wallet screen.

Careful individuals shouldn't become victims of clipboard malware. The virus can't replace the address in the source, so always compare to that and stay vigilant.

[Ndabagi01]

A user once complained about something similar to what you just said in the forum. When he pastes a copied address into another wallet on his PC, he receives a different address. This is clipboard malware; perhaps cryptoshuffler is just another term for it to confuse people.  You can read the post to learn more about how to deal with such situations when they arise. Click here; I need solution to this malware problem.

[tech30338]

This malware is dangerous because you will never realize that you computer is infected, since you computer acts normal, I work in a company, their computers are mostly above minimum specs of computers, but they are complaining about the speed sometimes it slows down, so i have scan their computers and found crypto miner in the system, which been installed together with pirated software's,  
Here is the link also about the crypto shufflerhttps://www.kaspersky.com/blog/cryptoshuffler-bitcoin-stealer/19976/
so this malware is not new its been terrorizing since 2016.

[Awaklara]

The latest scam is called Cryptoshuffler. This trojan steals coins under your nose by replacing your copied wallet address in your clipboard. Ordinarily, when you copy and paste wallet addresses, you have nothing to fear until cryptoshuffler comes into play.

I also initially used to frequently copy and paste addresses for BTC transactions. but lately, I prefer to scan barcodes. I don't know if allowing our address on exchanges or other platforms can change. but I'm just anticipating if it happens and will get the wrong address when sending.
we all must realize how important it is to double-check addresses, networks, and nominal values every time we make a transaction. however, scammers will always upgrade their ways to harm others.

[Nwada001]

This kind of virus is the reason why one should be very careful with things that they download online and in app stores, as downloading some unknown apps is a good way for scammers to penetrate the user's device and access whatever they want without the user's knowledge. Especially all these fancy keyboards that offer some kind of special future that makes them appear to be better than others should also be avoided, including some games apps as well. In fact, anything that appears to be unnecessary on one's gadget shouldn't even be downloaded to that device for security reasons, especially on a device used to run financial transactions. I believe this is one of the reasons why LoyceV doesn't usually like anything that will lead to downloading an external app on its mobile device.

[LoyceV]

I believe this is one of the reasons why LoyceV doesn't usually like anything that will lead to downloading an external app on its mobile device.

Not only on mobile It's quite simple: there may or may not be malware in software, but if you don't install it, you're sure it's not on your system.

[Doan9269]

Now your copied wallet address can be replaced with a scammer's address without your knowledge.

There's a thread that talks more extensively on this https://bitcointalk.org/index.php?topic=5190776.0 how to loose you bitcoin using copy and paste, this call for us to be very careful on how we carelessly allow the introduction of these malware into our device we used through the downloads we made and some unsecured sites we visit, when copying and pasting of any address, we should always very the same address copied is what was pasted for us from the clipboard and not just assum it was, we have to verify and be certain, because while pasting, they might have been replaced since the clipboard is already under attack in some cases, address copied must always tally with the one pasted.

[Dr.Bitcoin_Strange]

PC users will be more familiar about this, I think it's also the same thing as the clipboard virus, of which I have read more than two cases. Someone who is familiar with such cases (clipboard Virus) would already be aware of these trending malwares that can be used to steal one's assets without the victim's knowledge. Non the less, anyone who is copying a wallet should also be sure to cross-check the wallet before sending out funds to it because this malware is becoming a problem for crypto users and other internet users. You can also read "Warning when using mobile device wallets (Android, iOS)." There are just a lot of malware attacks from hackers this time around, and everyone just needs to be very careful and make their security a priority.

[SamReomo]

The hackers and scammers always find a way to hack the coins of the users that's why I always recommend everyone to keep their coins in a cold wallet instead of hot wallet. In cold wallet someone is sure that the system is secure and is free from any type of malware, and even if someone connects it back to internet in order to transfer the coins into another wallet this type of malware won't harm such users as their system has been offline and they haven't installed any software into it.

Such type of hacks are often very hard for someone to notice because they change the address of the wallet and if someone is trying to send thousands of dollars worth of Bitcoin then that user will face huge losses because of such malware. The only good option to be safe from such software is the cold wallet option and I recommend everyone to go for that if they are holding good amount in Bitcoin.

I believe this is one of the reasons why LoyceV doesn't usually like anything that will lead to downloading an external app on its mobile device.

Not only on mobile It's quite simple: there may or may not be malware in software, but if you don't install it, you're sure it's not on your system.

I agree with you, the only safe option to be free from malware is to avoid installing the software or apps on a system where you store your online wallets. We must have to have some wallets that we use for transactions and for such wallets safety we should avoid installing any software or applications that could penetrate our system.

[tech30338]

I believe this is one of the reasons why LoyceV doesn't usually like anything that will lead to downloading an external app on its mobile device.

Not only on mobile It's quite simple: there may or may not be malware in software, but if you don't install it, you're sure it's not on your system.

this is true because once its already installed, you don't know if it already infected the systems once its already there since in mobile application they always asked you to allow the application to change something, but just want to add that ignoring unknown software which you think will harm the system in the first place, is the best option, is not to even look or click something if you are not sure, this always comes on emails or even a link from a friend which he/she is not aware of the danger, he became the spreader and carrier at the same time.

[jrrsparkles]

It doesn't seem any different than clipboard hijacker which appears to be exists for years in PC as well as smartphones.

So if you ever want to avoid losing bitcoins via such attacks then better read this How to lose your Bitcoins with CTRL-C CTRL-V

And FYI, it is possible to get complete control of your smartphone when you click the link send by an attacker which includes access to your camera, microphone, File manager, display and everything.

[arwin100]

I believe this is one of the reasons why LoyceV doesn't usually like anything that will lead to downloading an external app on its mobile device.

Not only on mobile It's quite simple: there may or may not be malware in software, but if you don't install it, you're sure it's not on your system.

this is true because once its already installed, you don't know if it already infected the systems once its already there since in mobile application they always asked you to allow the application to change something, but just want to add that ignoring unknown software which you think will harm the system in the first place, is the best option, is not to even look or click something if you are not sure, this always comes on emails or even a link from a friend which he/she is not aware of the danger, he became the spreader and carrier at the same time.

For this we should not download anything random especially those unknown to us even if we think its useful since we don't know if this is totally safe and there are to many bad guys planted something illegal just to take advantage to those unaware people about such schemes. To many reminders that never click anything unfamiliar since we might spot a malware like this if we are curious on every link we encounter.

[albon]

This Trojan is not common, although it was discovered by Kaspersky several years ago. I think it is less dangerous than other Trojans, as this CryptoShuffler trojan only affects the clipboard of the victim's computer, especially targeting crypto miners and people who download from torrent sites. This type of Trojan horse does not steal the victim's information or steal his files as a ransom, so what it only does is replace the pasted address while the victim copying and pastes his wallet address and press send; if the victim has enough focus and compares the address that was entered carefully, he will be able to differentiate between the hacker's address and his address and escape from this fraud. Suppose the victim's computer has a powerful antivirus running in the background, constantly scanning the device and the downloaded files. In that case, the antivirus program will be able to determine whether or not his computer has a Trojan horse called Trojan-Banker.Win32.CryptoShuffler.gen, block it and remove it, and the victim will be on the safe side, of course.

[Dave1]

Yes, this is nothing new, this is called Clipboard stealer, and there are a lot of variants of it along the years and it has been called with different names.

@LoyceV even created a dedicated thread for it here: How to lose your Bitcoins with CTRL-C CTRL-V.

So the best thing to do is just to check multiple times the addresses before we send anything to it.

[CryptSafe]

A high  rank member made a post of a similar occurrence last week of an account holder facing similar issues and in a tone of $20 million but no virus of such name as you mentioned was noted on the post. I just believe it is a similar occurrence repeating itself that is why one needs to be careful of links you click through telegram platform, emails, social media  etc so as not to download their programmed virus into your device which would give scammers and hackers straight access into your details and using them to steal from you.

Here is the thread to the link of the $20m similar attack.
$20M stolen by "Zero Transfer Scam" phishing trick