On June 13th, 2018, Chinese security firm Qihoo 360 Total Security announced the discovery of a cryptocurrency clipboard hijacker that infected over 300,000 computers. A recent analysis by Bleeping Computer revealed that the problem is even more widespread than originally believed.
Far greater than the original estimate of 400,000-600,000 monitored cryptocurrency addresses, the analysis reported that the bug monitors 2.3 million bitcoin addresses in hope of stealing the world’s most valuable digital currency.
The Clipboard Wallet Hijacker
The Trojan operates by monitoring the clipboard activity of computers to detect if it contains a string similar to Bitcoin or Ethereum addresses. If detected, it then tampers with the receiving address to redirect the transfer to their own wallet.
This is problematic to users, who still often copy and paste long addresses to receive and send cryptocurrency. If one isn’t careful and fails to check, one can fall prey to the lurking bug and unknowingly send their crypto to the hackers.
Fortunately, by checking Blockchain.info and Etherscan.io, it appears the hackers have only received .51 BTC and 0 ETH thus far. While this is a relatively small amount, approximately $3,000, it is always prudent to protect one’s cryptocurrency assets.
The Giveaway Scammers
Overall, this malware only had minor success in stealing user’s cryptocurrencies. In comparison, the Ethereum “giveaway” scammers that plagued Twitter, stole 8,148 Ether, worth over $4 million.
The giveaway scammers operate by making Twitter accounts that impersonate popular crypto accounts to trick unsuspecting crypto users into sending them Ethereum. Many prominent crypto twitter personalities have also complained about how the scammers ruined productive conversations by littering threads with fake promotions.
Control Your Keys
Although these scams are problematic, the number one cause for lost or hacked coins is the failure of the exchanges. By entrusting an exchange with digital currency, we forfeit their power to control their private keys and rely on the exchange to protect our assets. However, this hasn’t always been the case.
Some of the biggest hacks in crypto history include:
- Mt. Gox (twice) – This exchange once handled over 70% of the world’s bitcoin transactions. In two hacks, it lost 2609 BTC (2011) and 750,000 BTC (2014)– approximately $350 million at the time. It has since shut down.
- Bitfloor – In 2012, this exchange was hacked for 24,000 BTC. While considered a small hack at the time, today that amount is worth around $150 million. It has since also shut down.
- Bitstamp – The Slovenian exchange was hacked for 19,000 BTC in 2015. Although temporarily shut down, it still handles over $70 million in daily volume today.
- Bitfinex – In 2016, the exchange lost 120,000 BTC, a total of $72 million. It compensated its users and still operates today.
Protect Yourself
Cryptocurrencies continue to attract scammers and hackers eager to steal valuable digital coins. Here are a few tips:
- Until a more user-friendly method address validator is implemented, always double-check and confirm addresses when sending and receiving cryptocurrencies, especially if you copy and paste.
- Do not send your digital assets to seemingly legitimate users even if they promise 5-10x returns. If it’s too good to be true, it likely is.
- Be cautious about storing your assets on an exchange. Consider an external hardware wallet like a Trezor or Ledger Nano S.
As a cryptocurrency owner, it is important to follow these steps to prevent unnecessary risk and losses of your funds.
