Why You Shouldn’t Trust Your Clipboard [Practical]

[Dave1]

It's never too late to have this kind of reminders, I guess from time to time, we need to remember this old by still very tricky situation wherein newbies might just rely on the simply copy-and-paste and don't check everything before sending.

But the users above has pointed out several threads already on how not to fall victim to it.

So again, we need to be very careful and before clicking send, double or triple check everything. Otherwise, it will be too late when you found out that you become the next victim of this old scam.

[PrivacyG]

This is why you should always verify before sending:

• Check the first part middle part and last part of the address.
• Do not only check the first 4 or last 4 characters.
• For large amounts send a small test transaction first.

I will adjust your advice and say you should check ALL CHARACTERS of an Address every single time.  Simply checking the first, last and middle, say six letters leaves you with 24 more characters to check for your example Address.  So if you check 18 characters anyway, spend a few more seconds to check ALL of them.  By spending the extra seconds to check all characters you do not even need to send a small test transaction any more.  Less Fees spent and you are at least sure the copied Address is the correct one.

[joniboini]

• Also avoid downloading cracked software unknown extensions fake wallet apps and random scripts.

I assume there's a comma between them. I don't remember when was the last time a malware from extension targeted our clipboard, but it's definitely a possible scenario. Not to mention supply chain attacks are so common nowadays. Even legit extension might get hacked due to developer mistakes and we somehow got a malicious one because of an update or something else. At that point, a clipboard hijack is probably the least of our worries.

[Comeacross]

This topic has been discussed many time in this forum but people just ignore it because they think it will not happen to them. Here I'm showing it practically why you shouldn't trust your clipboard.

You put practical in your thread tittle. I expected to see a real practical of how this scam works from the first step until the last step where they succeed. I mean how do people get infected with this clipboard virus that make them or nearly lose their coins to scammer address? If people know how they get infected, they can protect themselves in advance instead of trying to avoid it by checking through address multiple times before sending. Now, if you get infected, how do you get rid of it? Or do you continue using your device like that and being vigilant when sending? I expected to read everything in your thread after seeing (practical) in your tittle.

[uchegod-21]

Copy > Paste > Verify > Send

People will not understand how important this rule is. This simple rule has saved lots of people from sending their bitcoins to the wrong address. No one should get tired of verifying addresses whenever they intend to send bitcoins. Bitcoin transactions are irreversible unless the receiver agrees to send the coins back willingly. It is definitely worth it to spare a few minutes of your time to cross-check thoroughly before going ahead with the transaction.

OP is right with all he has said. This information is not for newbies alone; old users still make the same copy-and-paste mistake without verification.

[BitMaxz]

Buying and using good AV software for finding malicious things and clean them up on your devices is good but such AV software is only a secondary protective layer. The first layer should be habit when using devices, and when you're online, that means having a good and safe Internet surfing habit as well as when using devices offline are the most important protection.

First and most important, keep your devices clean by good offline use like no arbitrary connect it to any USB sticks, disks that can infect the devices. Then it will be a next online habit, and together good habit offline and online will mostly keep your devices out of threats.

Lastly AV software will provide extra protection for your devices, wallets and accounts but it might have false negative or false positive so relying completely on AV software is not actually safe.

I agree that it is still up to us how we access any website. AV will remain necessary; at least, you will be able to filter out infected files online, not new viruses and malware, but those that are already in their database and can be removed from your PC immediately to protect it.

If you have good PC specs, extra RAM, and a drive, having VirtualBox with an installed OS would be another layer of protection because most people usually access random and potentially dangerous sites that contain malware without their knowledge. Having a VM in your PC is good because all your browsing activity should be in your virtual PC, and if that becomes infected, it will only infect that virtual PC and not the main PC if you set it up properly, such as by turning off shared folders.

The normal habit cannot always be followed, but having an extra device or virtual machine is always a better option for avoiding online attacks, plus having AV is another layer.

[PX-Z]

If you think your clipboard are not trusted, then don't trust your device at all. Reflash/reformat or boot a new OS on it for peace of mind of getting malware from clipboard malware.
While on the other hand, being a crypto user it should be a standard practice to always double to triple check the receiving wallet address when sending even if its already save on address book if that feature exists on the wallet.

[lovesmayfamilis]

This topic has been discussed many time in this forum but people just ignore it because they think it will not happen to them. Here I'm showing it practically why you shouldn't trust your clipboard.

You put practical in your thread tittle. I expected to see a real practical of how this scam works from the first step until the last step where they succeed. I mean how do people get infected with this clipboard virus that make them or nearly lose their coins to scammer address? If people know how they get infected, they can protect themselves in advance instead of trying to avoid it by checking through address multiple times before sending. Now, if you get infected, how do you get rid of it? Or do you continue using your device like that and being vigilant when sending? I expected to read everything in your thread after seeing (practical) in your tittle.

Didn't you follow the links provided by the users? How does this virus infect the clipboard? It's strange that someone doesn't know this yet. Basic computer security, the use of reliable antivirus software, and the separation of leisure and finance on the device.

Should I use an infected device? Everyone chooses for themselves. Those who understand the danger will not take risks; the rest is up to the user. The best thing a user can do for himself is to start studying Linux systems and work in it, and all other entertainment can be entrusted to Windows, which is suitable only for frivolous use and communication on the Internet.

[SquirrelJulietGarden]

Didn't you follow the links provided by the users? How does this virus infect the clipboard? It's strange that someone doesn't know this yet. Basic computer security, the use of reliable antivirus software, and the separation of leisure and finance on the device.

Using different devices for leisure, regular tasks and for Bitcoin storage is a very security method. If the device used to store bitcoin is kept airgapped, it's very good for security of that device and the wallet too.

Should I use an infected device? Everyone chooses for themselves. Those who understand the danger will not take risks; the rest is up to the user. The best thing a user can do for himself is to start studying Linux systems and work in it, and all other entertainment can be entrusted to Windows, which is suitable only for frivolous use and communication on the Internet.

If I know a device is infected, I will surely avoid using it but for people who don't have personal computer or laptop, using Tail OS can be a good choice in security.
How to Install Tails OS on USB flash drive for Wallet Purpose.

There are more tips for securing bitcoin.
21 tips for securing your bitcoin.

[ImGenius]

I will adjust your advice and say you should check ALL CHARACTERS of an Address every single time.  Simply checking the first, last and middle, say six letters leaves you with 24 more characters to check for your example Address.  So if you check 18 characters anyway, spend a few more seconds to check ALL of them.  By spending the extra seconds to check all characters you do not even need to send a small test transaction any more.  Less Fees spent and you are at least sure the copied Address is the correct one.

If most people are like you scammers will in die empty stomach. I will try checking all the characters until now I was checking only fast and last few character, To check all characters maybe it will take a whole minute or two, it's way more benifitial by giving 1 minute we can avoid being scammed by clipboard hack.

[retreat]

Clipboard hijacking is not a new malware, it is a malware that has been known for quite some time. However, it is important to remind people about the dangers of this malware because even though many people are aware of this malware, there are still people who are unaware that the devices they are using have been infiltrated by this malware, and do not bother to check whether the wallet address they copy and paste still matches the actual destination address. So even though it is so simple, there are still people who can fall for something like this.

[Floxynice]

I almost lost my coins one day because of a copy-and-paste mistake. On that day, I copied my Bybit address and pasted it directly into my wallet. When I first started using Bybit, I used to check the address before sending, but I stopped because it was always correct. On that particular day, I almost became a victim. Something prompted me to check again after I had already pasted it and was about to confirm the transaction. Surprisingly, it was a different wallet address.

If there is anyone still relying completely on copy and paste without verifying, they may not yet realize the kind of mistake they could be making. Always verify wallet addresses before sending; this is more important than anything else.

[PrivacyG]

If most people are like you scammers will in die empty stomach. I will try checking all the characters until now I was checking only fast and last few character, To check all characters maybe it will take a whole minute or two, it's way more benifitial by giving 1 minute we can avoid being scammed by clipboard hack.

I would probably check only part of the Address if I have to spend 5 Dollars.

But I would most probably check ALL the characters if I have to spend 500 Dollars.  2 minutes may be worth skipping for 5 Dollars but not 500.

On the other hand.  My paranoia probably never lets me ONLY check parts of Addresses.  Because why would I give a free sandwich to a scammer.

[DYING_S0UL]

Lol this is ransom malware sitting on your clipboard. Just use any antivirus it won't be there anymore. I remember getting attacked by this particular shit. The catch is whenever you're copying a long string you copied item is getting replaced by scammer address. I recalled a event, I was in charge of more than 300 people's fund distribution. Whenever I was pasting those addresses it was jnjecting that malware and getting replaced. Thank god I did noticed and take necessary action.

Although I didn't find a solution to this problem in an instant. I did faced some difficulty with this issue.

The malware OP was referring to is called clipboard malware or hijacking.

Ransomware malware is of a different species. In ransomware malware, it encrypts your whole device, making the data unreadable or unusable. And the only way to restore your data is through the decryption keys, which can only be obtained after paying the hacker. "WannaCry" is known as one of the deadliest ransomware malware. It gives you a popup with a crypto address and a timer & forces you to pay the hackers.

As for the clipboard malware, it replaces the original address with a hacker's address, but there is no fear of data loss, afaik. I have experience with both of them, and the ransomware one is the worst of all. Because if no public decrypting keys are available at this moment, then you are basically fucked up. I had to format my whole harddisk. As for the clipboard, it can be removed by using antivirus software.

[Nwada001]

Lol this is ransom malware sitting on your clipboard. Just use any antivirus it won't be there anymore. I remember getting attacked by this particular shit.

Not all antiviruses can get it out. I can remember having such an experience, and there were even active antiviruses installed on my PC, yet the clipboard virus was as active as fuck. I had to change my OS from the pirated one before I was able to get rid of it; if not, any address I copy that looks like a crypto address changes.

My error comes from the pirated Windows 10 operating system, which was installed on my PC, which I was never aware was pirated; all pirated software is dangerous.

[Rubuchi]

I will adjust your advice and say you should check ALL CHARACTERS of an Address every single time.  Simply checking the first, last and middle, say six letters leaves you with 24 more characters to check for your example Address.  So if you check 18 characters anyway, spend a few more seconds to check ALL of them.  By spending the extra seconds to check all characters you do not even need to send a small test transaction any more.  Less Fees spent and you are at least sure the copied Address is the correct one.

I have a friend who does that. Before you send money to him for the first time through his wallet, he will ask you to send a small amount out of it for him to verify if really the address he is using was rightly entered by you or not. No matter how you tell him you have cross checked, he will tell you to send some small portion of the money to him first to verify even when you insist you gat everything covered by your cross checking. I don’t see his faults for practicing such principles because it really minimizes your chances of losing funds through to the system. Sometimes those small fees you are scared off that made you not to do any test run before sending it out fully. In the event where something may wants to happen, it is such precautions you took that will guarantee you form not losing funds yourself

[UchihaSarada]

I will adjust your advice and say you should check ALL CHARACTERS of an Address every single time.  Simply checking the first, last and middle, say six letters leaves you with 24 more characters to check for your example Address.  So if you check 18 characters anyway, spend a few more seconds to check ALL of them. 

I really agree with you because checking all characters in a Bitcoin address is not too time consuming. People can spend a lot of time, several hours a day for using Facebook, X, Youtube, Tiktok that are useless and time wasting, so how can they ignore checking all characters of a Bitcoin address that costs much less time?

While this checking step is very important. I would like to check it two or three times before broadcasting my Bitcoin transaction, as I see time I spend for 2 or 3 times of checking is valuable, it's not time wasting.

I have a friend who does that. Before you send money to him for the first time through his wallet, he will ask you to send a small amount out of it for him to verify if really the address he is using was rightly entered by you or not.

It's recommended in How to back up a seed phrase?

Deposit a small amount of funds into the wallet, like $10 or $20 worth.

[Peanutswar]

This is why you should always verify before sending:

• Check the first part middle part and last part of the address.
• Do not only check the first 4 or last 4 characters.
• For large amounts send a small test transaction first.
• Also avoid downloading cracked software unknown extensions fake wallet apps and random scripts.
• If possible use a hardware wallet and confirm the address on the device screen.
• If the pasted address changes even once stop immediately and clean your device.

Actually, not only with the middle part of the address but instead all of the characters so you dont need to do it manually because even with the use of an single excel work file is you can validate the address.

<copied address>=<paste address>

The excel cell will return you a Boolean expression just return only two values True: False or 1: 0.

Also I do not recommend installing unknown softwares to your computer unless you have a good layer of security such as AV. Now once you feel your device compromised. Clean.