Crypto Clipboard Hijacker Malware is monitoring 2.3 million Bitcoin addresses

2.3 million BTC addresses monitored by Bitcoin hackers

Cybercriminals are trying to take several actions to acquire Bitcoin in an illegal way. In recent months we have seen how trade and other platforms have been violated, such as Bithumb or BitGrail. Other ways to steal currencies are the use of ransomware and cryptojacking attacks, but this is another story.

The technology behind virtual currencies has not changed so much since they appeared in 2009, indeed most remain unchanged, including long addresses to send funds to another account.

Some users always use, copy and paste addresses to send coins to another user, but some hackers have already discovered how to exploit them and steal Bitcoins.

New methods of hacking

Hackers have discovered how to continue stealing currencies by exploiting the process of copying and pasting addresses. They created computer malware, known as cryptocurrency hijackers. The malware can monitor from 400,000 to 600,000 addresses at a time. And according to Bleeping Computer, over 2 million Bitcoin addresses are monitored.

For this to work, the user must install this program, which is a malicious DLL that is installed in the person's registry. The DLL called d3dx11_31.dll creates an autorun program that runs in the background and exchanges addresses.

The program is able to detect Bitcoin addresses and, once recognized, exchanges it for another address. It's a very simple attack that can be very damaging to users who are making important financial transactions. It is important to remember that cryptocurrency transactions can not be canceled and that funds can not be returned.

How to avoid them?

At the moment there are no measures to counter this exploit, but users should always monitor which files are downloaded and if they are virus-free.

For example, a good way to avoid these situations is to have an antivirus program that detects the presence of such malware. Because the cryptographic clip hijacker runs in the background, it will not cause any problems to the user and it will be harder to detect it.

Another way to solve this problem is to double check the addresses before sending funds. In this way, there will be less chance of making mistakes and sending money to another address. Also, if a user is making a transaction, it would be a good security measure to first copy and paste the address to the clipboard to verify that the address is the same.

If all the checks have been completed, it means that the address is secure and you can send your funds there.