Crypto holders are a favorite target for malware, since stolen funds are final. This guide is part of our section on crypto threats and scams. See also our everyday guide to password-stealing malware.
The main types
| Malware | What it does |
|---|---|
| Clipboard hijacker | Replaces a copied address with the attacker's |
| Infostealer | Copies wallet files, browser extensions and saved passwords |
| Screen recorder | Watches for phrases and transactions |
| Keylogger | Records what you type, including passwords |
| Fake wallet extension | Pretends to be a real wallet |
| Remote access trojan | Lets an attacker control your computer |
| Malicious app | A fake wallet or tool on your phone |
How clipboard hijackers work
Crypto addresses are long, so everyone copies and pastes them. A clipboard hijacker watches for anything that looks like an address, and silently replaces it. The transaction looks normal, but it goes to the attacker. Some use lookalike addresses that match the first and last characters.
How to protect yourself
- Check the full address on your hardware wallet's screen. Compare more than the first and last few characters.
- Send a small test first for large amounts.
- Use saved contacts in your wallet, once you have verified them.
- Do not copy addresses from your history. See address poisoning in wallet drainers.
Keep your secrets off the device
Malware can only steal what is on your computer. If your words have never been typed, photographed or stored, then it cannot find them. See storing a seed phrase digitally.
A hardware wallet keeps your keys off your computer. Software wallets store them on it, encrypted, so a compromised computer is a serious risk.
How it gets onto your computer
- Pirated software, game cheats and cracks.
- Fake trading tools and "airdrop checkers".
- Fake job offers that ask you to install software.
- Malicious browser extensions.
- Links sent on Discord and Telegram.
Good habits
- Use a separate device or user account for crypto, if you can.
- Keep everything updated.
- Install wallets only from official links.
- Keep browser extensions to a minimum.
- Do not grant screen-sharing permission to strangers.
If you think that you are infected
Do not sign anything else on that device. From a clean device, create a new wallet if your software wallet or phrase may be exposed, and move your funds. Then clean or reset the infected computer.