Bitcoin-stealing malware found in Chinese printer driver

[_act_]

Procolored, a Chinese printer maker transferred an infected driver from a USB flash drive and uploaded it to its servers for users to download. Not known if it is deliberate or done by a hacker. Security experts let people know about the malware and they said the malware has been used to steal at least 9.3 bitcoin.

https://www.mitrade.com/insights/news/live-news/article-3-829357-20250520

This is a lesson for those that have bitcoin on an online wallet not to trust anyone or company at all even if the company is reputable. Any file you download can have malware. Also this is a warning for people to have a cold wallet to store huge amount in coins. You can have a device that you will not be using for downloading files, app and others.

[Jegileman]

This may not be a deliberate attempt or may even be a deliberate one from an insider who knows that the USB flash was infected and would get to benefit well if the company uses that infected malware to convince its customers to download a software into their system when uploaded to their servers. This hacker has really gone very far in this game and their attempt become one to be fearful of if one uses an online wallet. They’ve tarnished the image of this company but better still, one needs to be careful with how they interact online to avoid such occurrence in the future for those using their online wallet with the same system they surf the internet with and make downloads on.

[Ultegra134]

What the hell, this shows how unsafe we are no matter what we do. The article doesn't mention online wallets as you said (but I'm guessing you're referring in general for terms of safety), and also claims that a similar attach was carried out in 2021, affecting Ledger users. I don't know for sure which one is the best way to store your coins, but I'm starting to believe that isolating a wallet on a separate computer with no internet access sounds best to me. Imagine downloading your printer's drivers and you find yourself with an empty wallet.

I searched the company and it doesn't look sketchy, as it's stated on the article, they outsource their software to third companies, perhaps a malicious employee planted this malware, which shows how vulnerable we can become just through the smaller link in a chain (just how Coinbase got its data leaked).

[Findingnemo]

Chinese company then it's not really a surprise. As you said it's a warning signal for who is holding crypto in their hot wallets and assuming the funds are completely safe but we never know as long as its connected to internet and the hackers are gonna develop more complicated ones in the future so better switch to Cold storage as soon as possible to safeguard the crypto assets from potential attacks.

[BitMaxz]

That is why offline or cold storage is a must to protect to any online attacks like this one.

I believe that once the driver is installed in your PC, it is undetectable. AV can't just detect them because it is a system driver. I'm glad that I only use my online PC to anything else no wallet are installed because I am not the only one who use it my kids use it to print and install something unknown.

My wallets are separated and saved to another phone with no internet connection. It looks like a hardware wallet because all offline transactions that I made were created through QR codes, and I scanned them with the camera to sign a transaction. This is safer than just using hot wallets; even if it is secured, there's still a possibility they can hack your wallet because your PC is always connected online and vulnerable to online attacks.

[Bitcoin_Arena]

The message has always been clear. Have your cold wallets, especially those with a lot of funds, run in Air gapped devices with a very clean OS. Any installation of random apps or connection to the internet increased the point of failure.

Chinese company then it's not really a surprise.

Chinese or not. A thief is always a thief. It's not like the hackers only originate from China, North Korea or Russia. They are all over the world.

[Publictalk792]

It shows us that we need to be careful with our Bitcoin even if we think we are dealing with company we can trust. Fact is that real company spread bad software proves that nothing you find online is completely safe.
Your advice about using cold wallet is exactly right especially if we have much of Bitcoin. Using one device just for cold wallet and not using it to download anything else online makes it more safer and helps to feel more secure. This Procolored is teaching that it is important to follow safety rules when dealing with digital money.

[Darker45]

Chinese company then it's not really a surprise.

I myself don't like and trust them, but what can we do, right? After god created the world in 6 days, China made the rest.

Anyway, this might not be a fair insinuation. As a matter of fact, I don't even believe this is intentional from the company itself. They have been in the business for several years, operating in many countries. I don't think the company is committing suicide by stealing Bitcoin. I think somewhere in their system, something's compromised.

[HeRetiK]

That is why offline or cold storage is a must to protect to any online attacks like this one.

The message has always been clear. Have your cold wallets, especially those with a lot of funds, run in Air gapped devices with a very clean OS. Any installation of random apps or connection to the internet increased the point of failure.

I think that's the main takeaway here. No matter how careful and tech savvy are, something will always slip through the cracks eventually if your device is connected to the internet.

[Findingnemo]

Chinese company then it's not really a surprise.

Chinese or not. A thief is always a thief. It's not like the hackers only originate from China, North Korea or Russia. They are all over the world.

It's not that I don't like China but they have always been caught up doing like these stuffs for example Chinese Mobile brands deliberately spy on the users using bloatwares which often can't be disabled, the Chinese social media platform like Tiktok steal userdata and sharing with Chinese Government (allegedly) that's why it's not a suprise even if we see a malware in their official website.

[PrivacyG]

but I'm starting to believe that isolating a wallet on a separate computer with no internet access sounds best to me. Imagine downloading your printer's drivers and you find yourself with an empty wallet.

It seems that you finally woke up to the harsh reality!  Isolating the computer with no internet access is DEFINITELY the best way to go.  The more you will read up on the subject of how easy it is to lose Bitcoin, the more you will be convinced of this.

Not only will you find yourself with an empty wallet, but you may not even realize where the hell the malware came from.  Back in the day before my paranoia, I would have never guessed my wallet can be emptied from what seems to be a legitimate driver.

I searched the company and it doesn't look sketchy, as it's stated on the article, they outsource their software to third companies, perhaps a malicious employee planted this malware, which shows how vulnerable we can become just through the smaller link in a chain (just how Coinbase got its data leaked).

It does not have to be a sketchy company.  Google used to praise not doing evil, now they changed their mind.  All sorts of people become criminals overnight and you would have never even guessed.  The point of this paranoia is having a safe Bitcoin wallet that offers no head aches.  Because why stress yourself out when you can live in a peace of mind?

Things can go very south even if you are usually very careful.  It is enough to do ONE mistake and it can all be gone.  You may be drunk one night and not realize you are clicking on the wrong website or download link.  Why stress out, I rather be peaceful instead.

[EluguHcman]

It is quite scary as the network company could not even detect if the act was carried by a third party as an invader or was a compromise of the server itself.

If not an insider that run this malware program or probably a collaboration with the third party, then it must be as a result of the webserver security worn-out to be vulnerable which can be as a result of the webserver creating vulnerability to the network where scammers facilitates with the exploit tools to compromise the server security.

“This printer’s official driver comes with backdoor code… which can hijack the wallet address in the user’s clipboard and replace it with the attacker’s own: 1BQZKqdp2CV3QV5nUEsqSglygegLmqRygJ.”

This appears to be one of the reasons why we don't need to follow the process of the copy and pastes of our wallet addresses when proceeding on transactions instead, it is better we write them down singles (one after the other) so as to restrain from the backdoor system which our device clipboard is being targeted for the scammers to steal our funds on pasting the wrong wallet address after service providers being intercepted and to the unknown, the users becomes the victims.

[rdluffy]

According to the article:

They noted that most hardware manufacturers in China outsource their software development to third parties. Thus, the third-party developer likely sent the driver to Procolored using a USB flash drive after adding the backdoor.

That's what I really thought, it's probably not the manufacturer itself that makes the software but third parties
Which could explain a lot
And the manufacturer probably won't be held responsible 

In these cases, I think the solution for the manufacturer is to have at least one developer analyze the software before it's released, to check for possible malware and viruses

I'm paranoid and even programs that are safe and famous make me suspicious, even with drivers from Epson, HP, Nvidia etc. I always think it's better to do what you've already suggested, have a PC just to use with crypto or use a hardwallet
In these cases, simply using a hardwallet would prevent any problems

[Ever-young]

This is a lesson for those that have bitcoin on an online wallet not to trust anyone or company at all even if the company is reputable. Any file you download can have malware. Also this is a warning for people to have a cold wallet to store huge amount in coins. You can have a device that you will not be using for downloading files, app and others.

We should just be careful out their with what we download and make use of as applications, even if we are truly in need of that app since we can't be too sure of what is inside the software even when it's downloaded from the right source we should have a sperate gadget for your online stuffs and also another device which you use for anything that have to go with wallet so they of anything mistakenly and unknowingly infect your gadget you won't be much affected and lose more, and even when you have a spending wallet which is sperate from your cold wallet, one still need to be careful as no money is considered to be too small to be lost to scammers without the person being affected.

[sokani]

This appears to be one of the reasons why we don't need to follow the process of the copy and pastes of our wallet addresses when proceeding on transactions instead, it is better we write them down singles (one after the other) so as to restrain from the backdoor system which our device clipboard is being targeted for the scammers to steal our funds on pasting the wrong wallet address after service providers being intercepted and to the unknown, the users becomes the victims.

Like anytime you wanted to send a transaction, you used to type every character of the receiving address one after the other? You must be joking, right? This is certainly not a good practice. Sometimes, being too paranoid can cause you more problems. Aside from being tasking and demanding, when you type the chances of skipping or mistyping a letter or number is high, and you may not notice it when cross-checking. The best practice is to simply copy and paste the address and cross-check the prefix and suffix as many times as you like before sending the fund.

[EluguHcman]

This appears to be one of the reasons why we don't need to follow the process of the copy and pastes of our wallet addresses when proceeding on transactions instead, it is better we write them down singles (one after the other) so as to restrain from the backdoor system which our device clipboard is being targeted for the scammers to steal our funds on pasting the wrong wallet address after service providers being intercepted and to the unknown, the users becomes the victims.

Like anytime you wanted to send a transaction, you used to type every character of the receiving address one after the other? You must be joking, right? This is certainly not a good practice. Sometimes, being too paranoid can cause you more problems. Aside from being tasking and demanding, when you type the chances of skipping or mistyping a letter or number is high, and you may not notice it when cross-checking.
The best practice is to simply copy and paste the address and cross-check the prefix and suffix as many times as you want before sending.

Typing in your wallet address one after the other seems stressful to you even though it holds the step of not making mistakes when executing your transaction right? So you want a quick process of copy and pasting without minding the risks it may come? Like seriously we don't know who is the joker here.
As for me, as much as I value my funds, I will abide to every diligence order that is to keep it safe for me.

well in either ways whether you copy and paste or you type them in sequentially, it is still required that you crosscheck very well to avoid stories.
Let me tell you, copy and pasting might be a smooth process for you and you will only be required to crosscheck if they are right correct. Right? Why? Because you are concious of not being a scam victim in this case of discussion where device clipboards are being manipulated through the software.

And bear it in mind that when you have been facilitating on this mode and never had been victimized for once, I bet you would get lost somedays and when you copy and paste, you will not be bothered to crosscheck at times due to overconfident after multiple times you have been put to track if the scammers is up to your device or wallet when your transactions has been going successfully.
But when you type it yourself, you will always be abided carefully checking anytime because you know your tips are not perfect enough to always type in those technical words and numbers correctly at all times.

So if safety of our funds is made a prior to us, then we should not be bothered of it safety demands even though it is tedious.

[Charles-Tim]

This appears to be one of the reasons why we don't need to follow the process of the copy and pastes of our wallet addresses when proceeding on transactions instead, it is better we write them down singles (one after the other) so as to restrain from the backdoor system which our device clipboard is being targeted for the scammers to steal our funds on pasting the wrong wallet address after service providers being intercepted and to the unknown, the users becomes the victims.

Like anytime you wanted to send a transaction, you used to type every character of the receiving address one after the other? You must be joking, right?

Typing in your wallet address one after the other seems stressful to you even though it holds the step of not making mistakes when executing your transaction right? So you want a quick process of copy and pasting without minding the risks it may come? Like seriously we don't know who is the joker here.
As for me, as much as I value my funds, I will abide to every diligence order that is to keep it safe for me.

There could be error if you are typing the wallet address. It is possible you type it correctly but I will not recommended it also.

If you copy and paste the address, just check the characteristics like two times and make sure it does not change which is enough. Or you can use the QR code instead which is not vulnerable to clipboard malware.

Typing it is also not vulnerable to clipboard malware but I cannot recommend it.

[Zaguru12]

~

Like anytime you wanted to send a transaction, you used to type every character of the receiving address one after the other? You must be joking, right? This is certainly not a good practice. Sometimes, being too paranoid can cause you more problems. Aside from being tasking and demanding, when you type the chances of skipping or mistyping a letter or number is high, and you may not notice it when cross-checking. The best practice is to simply copy and paste the address and cross-check the prefix and suffix as many times as you like before sending the fund.

Typing is usually prone to more error than actually copying and pasting it, but copying and pasting it also doesn’t eliminates the risk of address change most especially if you’re copying from the transaction history on that wallet, scammers using attacks like address poisoning usually gets it’s victims through this method most especially if you check the prefixes and suffixes as you have suggested, it is best to actually cross check many times and not only prefixes and suffixes because scammers can actually generate vanity addresses having similar prefixes and suffixes as yours and one can easily fall victim.

One way to actually avoid any of this is also to have the address stored offline where you can copy it and not directly from the wallet or best thing is to use QR code

[albon]

Security experts let people know about the malware and they said the malware has been used to steal at least 9.3 bitcoin.

9.3 Bitcoins at the current price is equivalent to $979,200, and that’s a huge amount that cannot be underestimated. . It shows how careless people are when it comes to protecting the Bitcoin they hold in their wallets. I don’t know how many victims there are in this incident, but certainly a large number must have installed the driver software on their main devices, which contain all their personal and sensitive data, wallets, and everything related to crypto. That is without a doubt the biggest mistake they have made.

Those who still store their assets online have not learned their lesson yet and deserve what happens to them. What happened to Procolored might have been a breach of their system, and this could happen to any other company, so the necessary security measures should never be taken lightly. And it is better to buy hardware, as it costs nothing compared to the level of protection it provides.

[Doan9269]

Procolored, a Chinese printer maker transferred an infected driver from a USB flash drive and uploaded it to its servers for users to download. Not known if it is deliberate or done by a hacker. Security experts let people know about the malware and they said the malware has been used to steal at least 9.3 bitcoin.

What a wicked world, I don't know what these guys stand to get from doing all these, they have the ability of using their brain for something quality enough for the world to accept and use than using it in the wrong way scamming, if they can acheive this for scam, then they could as well developed what will be useful for the people to use and help them solve their daily problems, instead of constituting more to the fraudulence going around the world, I just wish safety for everyone with their digital assets.