Why You Shouldn’t Trust Your Clipboard [Practical]

[MisFoxie]

This topic has been discussed many time in this forum but people just ignore it because they think it will not happen to them. Here I'm showing it practically why you shouldn't trust your clipboard.

Most people believe that if they copy a address from a website or wallet or maybe from notebook and pate it to another place the same address will be paste. But that isn't always true. If your device is infected by malware you may not notice it but when you try to paste the address it can change your address silently. When you sent fund and didn't receive as original address that's the moment you actually notice your address is changed.
This type of scam is commonly known as a clipboard hijacking scam.

How it works in simple words:
The scammers software always monitor your clipboard when you copy a address the software notice it and replace with scammers address. And you may think you pasting what you copy but it actually paste a different address.

If you do not check carefully and send Bitcoin to that changed address, your coins are gone permanently. Bitcoin transactions cannot be reversed.

Example:
You copy this address:

Code:

bc1qhcw3mj52uxrh0wvwsvj0kyy2f0mx6qmnuesp4n

But after pasting it may become another address controlled by the scammer.
The dangerous part is that many users only check the first few or last few characters. That is not always enough some scam addresses may look similar at a quick glance especially if the user is in a hurry.

This is why you should always verify before sending:

• Check the first part middle part and last part of the address.
• Do not only check the first 4 or last 4 characters.
• For large amounts send a small test transaction first.
• Also avoid downloading cracked software unknown extensions fake wallet apps and random scripts.
• If possible use a hardware wallet and confirm the address on the device screen.
• If the pasted address changes even once stop immediately and clean your device.

Practical demonstration:
In the GIF below, the user copies a Bitcoin address, but when it is pasted into the comment box a different demo address appears. This shows how dangerous it can be if someone blindly trusts copied text.



Of course, this is only a safe demo to show the idea. Real scammers use the same kind of trick silently, without showing any warning.

My advice to beginners:
Never rush when sending Bitcoin. Before clicking send, always compare the address carefully.
A simple habit can save your coins: Copy > Paste > Verify > Send

Bitcoin gives you full control but full control also means full responsibility. Your clipboard is useful but it should never be trusted blindly.

[Mahiyammahi]

Lol this is ransom malware sitting on your clipboard. Just use any antivirus it won't be there anymore. I remember getting attacked by this particular shit. The catch is whenever you're copying a long string you copied item is getting replaced by scammer address. I recalled a event, I was in charge of more than 300 people's fund distribution. Whenever I was pasting those addresses it was jnjecting that malware and getting replaced. Thank god I did noticed and take necessary action.

Although I didn't find a solution to this problem in an instant. I did faced some difficulty with this issue.

[Charles-Tim]

Yes, it is good to check and recheck bitcoin address before you click on send. But not only that, also check and recheck the address that you want to send to the sender.

The dangerous part is that many users only check the first few or last few characters. That is not always enough some scam addresses

It is not enough for many altcoins. The last few characters of many altcoins addresses will be similar to the attackers address in address poisoning, but despite that it is possible with bitcoin, it is very difficult to achieve. To generate a vanity address for bitcoin in a way the last characters will be the same last that of attackers is difficult to be achieved by the attackers because it requires high computational power, unlike the altcoins.

[Pablo-wood]

This clipper malware is already becoming rampant lately. But i keep wondering how this program swaps and substitutes address that shares the exact same first few and last few characters. Although after a few research I discovered it is as a result of a malicious script in the victims system. It is even more scary how it detects the address copied and instantly replaces the address in the background with a spoofed address controlled by the attacker.

Which means what eventually get pasted becomes the attackers address which looks very much identical on the start and end of the address but the middle is entirely different. I think at this point it is best to identify copied address on  a secondary device or preferably scan for malware antivirus software before sending because most times eyes scan might be too overwhelming.

[Catenaccio]

When you sent fund and didn't receive as original address that's the moment you actually notice your address is changed.
This type of scam is commonly known as a clipboard hijacking scam.

It's a dangerous threat and this scam method is very popular too.

How to lose your Bitcoins with CTRL-C CTRL-V. It's only a guide for practical steps but firstly as a prevention, keep your devices clean by using it safely and carefully so that you can reduce risk of that device compromised to as least as possible. I would like to do a small transaction for testing before making a second transaction that is bigger and to complete that business deal.

[tech30338]

It seems that your device are compromise that is why its behaving like that, most of the time if the last copy is the one that is being paste on the field you want to paste something, if its behaving like that putting a wrong address, it means your computer or device is being manipulate or being control by a malware.
This is why you don't mixed other stuff with financial activities or things that are being use for money or trading or crypto, you should be very careful because if you don't it might cost you everything, scan the device and remove everything or sign-out things that are log-in things are going to get messy of you don't.

[Doan9269]

Clipboard malware is one of the devastating means through which scammers are using to make sure that the poison your address for you through copy and paste and you don't even suspect such occur after they would have invaded you clipboard, you must have done something wrong that would have made such malware to attack our device which we are using and that is why we have to be more careful with online platforms and links that we click or download, here is more advanced learning on this regard that had been discussed https://bitcointalk.org/index.php?topic=5190776

[tbct_mt2]

It seems that your device are compromise that is why its behaving like that, most of the time if the last copy is the one that is being paste on the field you want to paste something, if its behaving like that putting a wrong address, it means your computer or device is being manipulate or being control by a malware.
This is why you don't mixed other stuff with financial activities or things that are being use for money or trading or crypto, you should be very careful because if you don't it might cost you everything, scan the device and remove everything or sign-out things that are log-in things are going to get messy of you don't.

If you realize that something is wrong before you broadcast a transaction, it's good enough but sometimes people only realized about that when they already broadcasted a transaction and lost their bitcoins to hackers.

To avoid losing big fund, it's recommended to test your wallet, device with a small transaction. After broadcasting it, you can check the transaction detail with your wallet, and see whether the receiving address is accurate like what you actually intended to send your coins too. If anything was wrong, you will only lose small fund for that testing.

Clipboard malware is one of the devastating means through which scammers are using to make sure that the poison your address for you through copy and paste and you don't even suspect such occur after they would have invaded you clipboard, you must have done something wrong that would have made such malware to attack our device which we are using and that is why we have to be more careful with online platforms and links that we click or download

Getting links to download from official websites, and with wallet softwares, verify them before using.
[GUIDE] How to Safely Download and Verify Electrum.
The paranoid user's security guide for using Electrum safely.
How To Verify the Downloaded Version of Ledger Live
Officially visit websites & download apps, not fake ones.

[Shadiq]

We are constantly learning new things on the forum. One of them is how to protect yourself from fraud. Clipboard hijacker or crypto clipper malware has become a big concern for crypto users. If a hacker or fraudster finds out that you are a crypto user or a Bitcoin user, then those fraudsters will try to target you.

It is especially important for those of us who make large transactions in Bitcoin or crypto to be careful. Because fraudsters target those who make large transactions. The main weapon to protect yourself from clipboard hijacker or crypto clipper malware is awareness and testing small transactions or carefully monitoring the address before each transaction. Trusting the clipboard can cause harm, so always try to verify the information.

[KiaKia]

Thanks for talking about this, I got tired of repeating the same warning over again and it's why I don't even get bothered anymore, I became a victim of this myself and it's why I sold my old phone.

In the past I always believe that this happens only on laptops and PC, but thankfully I saw what happened on my phone that day, I copied address and paste it into an exchange for withdrawal and it changed, i screamed that day,, because i wasn't expecting it.

I even uninstalled my keyboard and the same still happened, then I discard the phone for another brand new,  I knew that something is very wrong with that old phone, I don't use it for transactions anymore but the problem is still present on the device.