$140,000 worth of Bitcoin disappeared. Investors should be careful of this Trojan virus

According to the latest report from Kaspersky Lab, which detects and kills malicious viruses, the newly discovered CryptoShuffler Trojan can steal cryptocurrency by replacing the cryptocurrency address on the target device.

Scammers have used the CryptoShuffler Trojan to steal 23 BTC, worth about $140,000, from victims’ wallets. According to Kaspersky Lab, the malware has been running for a year and targets Bitcoin, Ethereum, Dash, Monero and other cryptocurrencies.

This type of "clipboard hijacking" attack has occurred in the past, usually targeting online payment systems. Attacks on cryptocurrencies are less common.

How it works

CryptoShuffler commonly attacks daily transaction steps. The Trojan monitors the clipboard of the victim's device in real time. Once the payment is made, when the Trojan-infected device copies and identifies the recipient's wallet address, the virus will replace the target address to complete the transaction. The victim is unaware that the Trojan has replaced their wallet address with malware.

When the victim pastes the identified wallet address into the destination field, they are not sending the money to the original destination address, but to the scammers. This process takes only milliseconds.

Cryptocurrency users don’t usually check multiple digits to verify the address when making payments.

Sergey Yunakovsky, a virus software analyst at Kaspersky Lab, said that people who are considering investing in cryptocurrencies need to pay more attention to protecting the security of their investments.

Kaspersky Lab also advises cryptocurrency users to carefully check the destination wallet address number when making payments. It should also be noted that invalid addresses and wrong addresses should be distinguished. Invalid addresses can be detected and the transaction will not be completed. Wrong addresses can complete the payment, and users will lose the money they paid forever.

Users can also protect themselves by scanning for security vulnerabilities of entities known to have been scammed.