Why You Shouldn’t Trust Your Clipboard [Practical]

[MisFoxie]

This topic has been discussed many time in this forum but people just ignore it because they think it will not happen to them. Here I'm showing it practically why you shouldn't trust your clipboard.

Most people believe that if they copy a address from a website or wallet or maybe from notebook and pate it to another place the same address will be paste. But that isn't always true. If your device is infected by malware you may not notice it but when you try to paste the address it can change your address silently. When you sent fund and didn't receive as original address that's the moment you actually notice your address is changed.
This type of scam is commonly known as a clipboard hijacking scam.

How it works in simple words:
The scammers software always monitor your clipboard when you copy a address the software notice it and replace with scammers address. And you may think you pasting what you copy but it actually paste a different address.

If you do not check carefully and send Bitcoin to that changed address, your coins are gone permanently. Bitcoin transactions cannot be reversed.

Example:
You copy this address:

Code:

bc1qhcw3mj52uxrh0wvwsvj0kyy2f0mx6qmnuesp4n

But after pasting it may become another address controlled by the scammer.
The dangerous part is that many users only check the first few or last few characters. That is not always enough some scam addresses may look similar at a quick glance especially if the user is in a hurry.

This is why you should always verify before sending:

• Check the first part middle part and last part of the address.
• Do not only check the first 4 or last 4 characters.
• For large amounts send a small test transaction first.
• Also avoid downloading cracked software unknown extensions fake wallet apps and random scripts.
• If possible use a hardware wallet and confirm the address on the device screen.
• If the pasted address changes even once stop immediately and clean your device.

Practical demonstration:
In the GIF below, the user copies a Bitcoin address, but when it is pasted into the comment box a different demo address appears. This shows how dangerous it can be if someone blindly trusts copied text.



Of course, this is only a safe demo to show the idea. Real scammers use the same kind of trick silently, without showing any warning.

My advice to beginners:
Never rush when sending Bitcoin. Before clicking send, always compare the address carefully.
A simple habit can save your coins: Copy > Paste > Verify > Send

Bitcoin gives you full control but full control also means full responsibility. Your clipboard is useful but it should never be trusted blindly.

[Mahiyammahi]

Lol this is ransom malware sitting on your clipboard. Just use any antivirus it won't be there anymore. I remember getting attacked by this particular shit. The catch is whenever you're copying a long string you copied item is getting replaced by scammer address. I recalled a event, I was in charge of more than 300 people's fund distribution. Whenever I was pasting those addresses it was jnjecting that malware and getting replaced. Thank god I did noticed and take necessary action.

Although I didn't find a solution to this problem in an instant. I did faced some difficulty with this issue.

[Charles-Tim]

Yes, it is good to check and recheck bitcoin address before you click on send. But not only that, also check and recheck the address that you want to send to the sender.

The dangerous part is that many users only check the first few or last few characters. That is not always enough some scam addresses

It is not enough for many altcoins. The last few characters of many altcoins addresses will be similar to the attackers address in address poisoning, but despite that it is possible with bitcoin, it is very difficult to achieve. To generate a vanity address for bitcoin in a way the last characters will be the same last that of attackers is difficult to be achieved by the attackers because it requires high computational power, unlike the altcoins.

[Pablo-wood]

This clipper malware is already becoming rampant lately. But i keep wondering how this program swaps and substitutes address that shares the exact same first few and last few characters. Although after a few research I discovered it is as a result of a malicious script in the victims system. It is even more scary how it detects the address copied and instantly replaces the address in the background with a spoofed address controlled by the attacker.

Which means what eventually get pasted becomes the attackers address which looks very much identical on the start and end of the address but the middle is entirely different. I think at this point it is best to identify copied address on  a secondary device or preferably scan for malware antivirus software before sending because most times eyes scan might be too overwhelming.

[Catenaccio]

When you sent fund and didn't receive as original address that's the moment you actually notice your address is changed.
This type of scam is commonly known as a clipboard hijacking scam.

It's a dangerous threat and this scam method is very popular too.

How to lose your Bitcoins with CTRL-C CTRL-V. It's only a guide for practical steps but firstly as a prevention, keep your devices clean by using it safely and carefully so that you can reduce risk of that device compromised to as least as possible. I would like to do a small transaction for testing before making a second transaction that is bigger and to complete that business deal.

[tech30338]

It seems that your device are compromise that is why its behaving like that, most of the time if the last copy is the one that is being paste on the field you want to paste something, if its behaving like that putting a wrong address, it means your computer or device is being manipulate or being control by a malware.
This is why you don't mixed other stuff with financial activities or things that are being use for money or trading or crypto, you should be very careful because if you don't it might cost you everything, scan the device and remove everything or sign-out things that are log-in things are going to get messy of you don't.

[Doan9269]

Clipboard malware is one of the devastating means through which scammers are using to make sure that the poison your address for you through copy and paste and you don't even suspect such occur after they would have invaded you clipboard, you must have done something wrong that would have made such malware to attack our device which we are using and that is why we have to be more careful with online platforms and links that we click or download, here is more advanced learning on this regard that had been discussed https://bitcointalk.org/index.php?topic=5190776

[tbct_mt2]

It seems that your device are compromise that is why its behaving like that, most of the time if the last copy is the one that is being paste on the field you want to paste something, if its behaving like that putting a wrong address, it means your computer or device is being manipulate or being control by a malware.
This is why you don't mixed other stuff with financial activities or things that are being use for money or trading or crypto, you should be very careful because if you don't it might cost you everything, scan the device and remove everything or sign-out things that are log-in things are going to get messy of you don't.

If you realize that something is wrong before you broadcast a transaction, it's good enough but sometimes people only realized about that when they already broadcasted a transaction and lost their bitcoins to hackers.

To avoid losing big fund, it's recommended to test your wallet, device with a small transaction. After broadcasting it, you can check the transaction detail with your wallet, and see whether the receiving address is accurate like what you actually intended to send your coins too. If anything was wrong, you will only lose small fund for that testing.

Clipboard malware is one of the devastating means through which scammers are using to make sure that the poison your address for you through copy and paste and you don't even suspect such occur after they would have invaded you clipboard, you must have done something wrong that would have made such malware to attack our device which we are using and that is why we have to be more careful with online platforms and links that we click or download

Getting links to download from official websites, and with wallet softwares, verify them before using.
[GUIDE] How to Safely Download and Verify Electrum.
The paranoid user's security guide for using Electrum safely.
How To Verify the Downloaded Version of Ledger Live
Officially visit websites & download apps, not fake ones.

[Shadiq]

We are constantly learning new things on the forum. One of them is how to protect yourself from fraud. Clipboard hijacker or crypto clipper malware has become a big concern for crypto users. If a hacker or fraudster finds out that you are a crypto user or a Bitcoin user, then those fraudsters will try to target you.

It is especially important for those of us who make large transactions in Bitcoin or crypto to be careful. Because fraudsters target those who make large transactions. The main weapon to protect yourself from clipboard hijacker or crypto clipper malware is awareness and testing small transactions or carefully monitoring the address before each transaction. Trusting the clipboard can cause harm, so always try to verify the information.

[KiaKia]

Thanks for talking about this, I got tired of repeating the same warning over again and it's why I don't even get bothered anymore, I became a victim of this myself and it's why I sold my old phone.

In the past I always believe that this happens only on laptops and PC, but thankfully I saw what happened on my phone that day, I copied address and paste it into an exchange for withdrawal and it changed, i screamed that day,, because i wasn't expecting it.

I even uninstalled my keyboard and the same still happened, then I discard the phone for another brand new,  I knew that something is very wrong with that old phone, I don't use it for transactions anymore but the problem is still present on the device.

[Patikno]

Lol this is ransom malware sitting on your clipboard. Just use any antivirus it won't be there anymore. I remember getting attacked by this particular shit. The catch is whenever you're copying a long string you copied item is getting replaced by scammer address. I recalled a event, I was in charge of more than 300 people's fund distribution. Whenever I was pasting those addresses it was jnjecting that malware and getting replaced. Thank god I did noticed and take necessary action.

Although I didn't find a solution to this problem in an instant. I did faced some difficulty with this issue.

I don't recommend simply using an antivirus on an infected device. It is should be better to reset your computer, and make sure to back up any important data (including your crypto-related data) externally, and offline first. After installing a new operating system (I recommend an official one), install an antivirus on your computer. Essentially, we should be skeptical of any device infected with a virus or attack, and don't take the matter lightly, I emphasize that.

Basically, An infected device or computer may still have a vulnerability. So, I hope anyone who has a case like that, then you should follow my advice.

[Davidvictorson]

Lol this is ransom malware sitting on your clipboard. Just use any antivirus it won't be there anymore. I remember getting attacked by this particular shit. The catch is whenever you're copying a long string you copied item is getting replaced by scammer address. I recalled a event, I was in charge of more than 300 people's fund distribution. Whenever I was pasting those addresses it was jnjecting that malware and getting replaced. Thank god I did noticed and take necessary action.

Although I didn't find a solution to this problem in an instant. I did faced some difficulty with this issue.

Thank you for sharing your experience. Your attention to detail and also knowledge saved you. This is an important piece sometimes, what I do is that when I copy an address, I look at the digits at the start and at the last few digits at the end and compare them with the original. That’s one of the ways i stay watchful. What I am curious about though is whether standard antivirus software reliably detects clipboard hijacking malware specifically, and if so which ones have proven most effective against it?

[coinlary]

The interesting part is that you won't  even know something has been altered while constructing your transaction if you don't  verify anything. Infact you can still follow it up on a block Explorer ,wait for even hours  till it gets  confirmed without  doing anything to stop it  .

Confirm the first 6 and the last 5 characters is usually enough, there's nothing bad in confirming to last  character either, before broadcasting your transaction.

[BitMaxz]

This is a common clipboard hijacker; many scammers and hackers right now are using this to unprotected laptops and PCs since it is open source and you can find this on GitHub mostly, and it records all of your clipboards and can also edit the content data in your clipboard system to keep pasting their own address every time you copy any BTC address.

Having some AV could protect you from most recent clipboard hijackers, except for the newly developed one, so you better have a separate machine to keep your wallet away from these attacks and avoid this malware virus.

Your suggestion is fine for making a habit of checking the address, but having a cold storage wallet makes it more effective because you can bring the raw data to an offline machine, which is not infected, and you can double-check your transaction from it if you are actually sending to the right address before signing the transaction.

The reason why I recommend this clipboard virus is that it can be developed into something unnoticeable in the future, making it more not easy to determine (invisible) if you are using the same machine when sending coins. They can maybe able to hide that you are pasting a different address, but in your eyes, you see that you pasted the right address. So your procedure above won't work because the PC/laptop you're using is infected.
So to make your procedure more effective, you need two separate devices: one is online and the other one is an offline machine. At least all of your wallets and keys are safe from online attacks.

[jossiel]

That's the common clipboard malware and I agree with OP that it should remind people to always check their pcs and laptops or whichever device they're using.

Because if they commonly use it for downloading stuff that has to be installed into theirs, and little did they know that it's an unofficial app.

It's likely that they'll contain this malware. The solution aside from finding out what you have downloaded wrongly and uninstall it is to always manually check your transfer and check the characters for a couple of times.

[UchihaSarada]

This is a common clipboard hijacker; many scammers and hackers right now are using this to unprotected laptops and PCs since it is open source and you can find this on GitHub mostly, and it records all of your clipboards and can also edit the content data in your clipboard system to keep pasting their own address every time you copy any BTC address.

Having some AV could protect you from most recent clipboard hijackers, except for the newly developed one, so you better have a separate machine to keep your wallet away from these attacks and avoid this malware virus.

Buying and using good AV software for finding malicious things and clean them up on your devices is good but such AV software is only a secondary protective layer. The first layer should be habit when using devices, and when you're online, that means having a good and safe Internet surfing habit as well as when using devices offline are the most important protection.

First and most important, keep your devices clean by good offline use like no arbitrary connect it to any USB sticks, disks that can infect the devices. Then it will be a next online habit, and together good habit offline and online will mostly keep your devices out of threats.

Lastly AV software will provide extra protection for your devices, wallets and accounts but it might have false negative or false positive so relying completely on AV software is not actually safe.

[tech30338]

Lol this is ransom malware sitting on your clipboard. Just use any antivirus it won't be there anymore. I remember getting attacked by this particular shit. The catch is whenever you're copying a long string you copied item is getting replaced by scammer address. I recalled a event, I was in charge of more than 300 people's fund distribution. Whenever I was pasting those addresses it was jnjecting that malware and getting replaced. Thank god I did noticed and take necessary action.

Although I didn't find a solution to this problem in an instant. I did faced some difficulty with this issue.

I don't recommend simply using an antivirus on an infected device. It is should be better to reset your computer, and make sure to back up any important data (including your crypto-related data) externally, and offline first. After installing a new operating system (I recommend an official one), install an antivirus on your computer. Essentially, we should be skeptical of any device infected with a virus or attack, and don't take the matter lightly, I emphasize that.

Basically, An infected device or computer may still have a vulnerability. So, I hope anyone who has a case like that, then you should follow my advice.

Antivirus sometimes are being bypass not by the malware but by the users sometimes users are the one who allowed the malware to get in the system, for example installing a software downloaded in some sites, since users are sometimes don't want to pay, they resort in this things, not knowing its already been altered or there is a malware inside the software, or when install we see something that is unusual but we let it run anyway, and its slowly controlling the system, the moment we realized it its already been running there for a long time, and yes reinstalling the system and application is the best way, but its already done its purpose and damage.

[Bger]

I’m skeptical that member of this very old forum will ignore the basic on the clipboard check.

Only newbie might possibly be lazy to check the copied address but not for an old time member that frequently copied wallet address due to bunch of transactions since they started on Bitcoin.


I’d like to know if there’s a clipboard malware that can identify the wallet address structure and use a wallet address almost identical to the copied address?

[Outhue]

Most people use their smartphones to send coins from a wallet to another and it's not very common for clipboard attacks to happen on a smartphone but there are ways that you can become a victim of this.

1. Running a custom ROM on your phone.
2. Downloading a third-party keyboard on your phone.
3. Installing anyhow apps on your phone that ask for extra permissions.

One of my favourite way to avoid this clipboard mess is using QR code scanner, it's way better and easier using this than copy pasting, there is no way you will get an address wrong doing this, unless you scan any QR codes you find online.