wrong bitcoin address | Bitcointalksearch.org

HCP

legendary

Activity: 2086

Merit: 4363

I'd check with both "MalwareBytes" and "Spybot Search and Destroy"... to see if they find anything. Not that that really guarantees anything one way or the other due to false positives and that they generally only detect "known" malware.

Personally, when it comes to malware removal... I would be inclined to simply format the machine and reinstall the OS from scratch. It can be a bit of a hassle backing up data and reconfiguring apps etc... but it is generally far more effective in removing malware completely. Undecided

tora

member

Activity: 532

Merit: 13

Hello. Thanks for reply.
1) I do not use bookmarks on any financial site.
2) I am using Opera as browser. I only have Opera ad blocker as extension.
3) I have neither installed. Do not even know what they are.
4) Other exchanges are fine.
Is it safe to download Spyhunter to remove clipboard malware if I am infected?
Again,thanks for all your help and suggestions.

HCP

legendary

Activity: 2086

Merit: 4363

Quote from: tora on November 20, 2019, 02:19:54 PM

It only happens on Kucoin and only with bitcoin.

Then the possibilities I can think of are:

1. Phishing/Fake website... you're not actually logging into Kucoin, but a scam clone version that is hardcoded to use hackers address. Check the URL very carefully... perhaps try to type it out manually instead of relying on a bookmark.

2. Bad browser extension... what browser are you using? and have you looked at the settings to see what extensions/addons are running? Maybe try a different browser to see if the same thing happens.

3. Do you have tampermonkey or greasemonkey installed? If so, check to see what scripts are running... Again, try a different browser to see if the same thing happens.

4. Kucoin specific clipboard hijacker. Can't say I've heard of a clipboard malware that was specific to one site... but it might do it on other exchanges as well. Have you tried other exchanges? or just Kucoin?

tora

member

Activity: 532

Merit: 13

Hello HCP.
thanks for your reply. It only happens on Kucoin and only with bitcoin.

HCP

legendary

Activity: 2086

Merit: 4363

Ok... so you'd need to correctly identify what the root cause was before you can judge whether or not you've fixed anything and the likelihood of it reoccurring in the future. So, back to the original problem of addresses being automatically changed to 13gwPnRgJjqsg2T1QQ6LQXtxWJAQDJWD6z.

If you copy/paste the following addresses one at a time:
1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2
17VZNX1SN5NtKa8UQFxwQbFeFc3iqRYhem
1CC3X2gu58d6wXUWMffpuzN9JAfTUWu4Kj

Do those addresses paste correctly or are they changed to something else? Huh

Does it only do it on a particular website (ie. ONLY on Kucoin)? or does it do it when you paste an address everywhere (text editor, browser, Word document etc)?

If it ONLY happens in the browser and only on one (or a couple of) particular site(s), it might be a Tampermonkey type extension designed to mess with particular websites only... if it does it EVERYWHERE, then it's most likely a generic clipboard hijacker.

tora

member

Activity: 532

Merit: 13

Getting of topic here. There is no porn on my device. I have not downloaded any software or installed any apps or extensions.

boris singer

sr. member

Activity: 882

Merit: 268

maybe your computer has been infected with a keylogger, and you happen to allow the option to save passwords in your browser. Try checking first because this includes the hijacking mode, if it still doesn't change it's better to reinstall, or reset all data from different computer because the malware has infected sensitive parts of the system including your antivirus.

Pmalek

legendary

Activity: 2730

Merit: 7065

Porn and illegal software, especially cracked Operating Systems and AV solutions should have no place on a device that stores sensitive information and is used in connection with our financials in either way. It's a ticking time bomb. Either watch XXX on TV or get another device just for your nasty habits and don't store any of your financial data on it.

The Cryptovator

legendary

Activity: 2408

Merit: 2226

Signature space for rent

After reading all of your reply it's been clear that your account has hacked individually. Exchange hasn't hacked since there is no any update about it. So your device is no more safe zone. First you need withdraw your fund from some others devices if needed. But please check carefully address again.

I will not say you are safe even you found malware on your device although you removed it. I will suggest format your device and erase everything and install original OP system from beginning. Then I might say you are on safe zone. You should do it because you are using this device for fund management like bitcoin. You should not install any unknown software on your device. Be careful especially when you are watching porn. Most of malware attacks came from porn sites.

Pmalek

legendary

Activity: 2730

Merit: 7065

It means installing a fresh copy of your OS, getting rid of every trace of the previous install. You didn't mention which OS you use. These are instructions for Windows 10.
Check out this source how to do it if you are not comfortable trying it out yourself:
https://www.laptopmag.com/articles/reset-windows-10-pc

Some videos
https://www.youtube.com/watch?v=TikFTiXTuNI
https://www.youtube.com/watch?v=8LgHNRjiekQ

tora

member

Activity: 532

Merit: 13

The attack happened between the evening of Wednesday 6th November and the morning of Thursday 6th November.
I had not downloaded any new programs or opened any email attachments.
I have opened new accounts with new passwords.

Does reformatting mean doing a factory reset? Any , easy, instructions available?

hugeblack

legendary

Activity: 2702

Merit: 4002

Quote from: tora on November 16, 2019, 05:21:36 AM

Here is trojan Win32:Trojan-gen C:\ProgramData\zxits\WerFault.exe

werfault.exe is used for Windows Error Reporting.
This file is not a risk in itself and may be affected by a virus.
Since when did this problem happen with you? Have you downloaded any program from untrusted sources or was the program untrusted?

Quote from: tora on November 16, 2019, 01:31:41 AM

I opened a new perfect money account and a new exchange account. Will the hacker have access to these accounts?
How would they hack my kucoin account?
Kucoin has 2FA. The email address I use is only for kucoin. The password I use is only for kucoin.
They accessed my perfectmoney account and my exodus wallet. All different email addresses and passwords.

What permissions are granted to that program? In general, you need to reinstall the operating system, change all passwords, and resend your currencies to new wallets.

joniboini

legendary

Activity: 2170

Merit: 1789

Quote from: tora on November 16, 2019, 05:21:36 AM

I have run malwarebytes and the result is negative, no virus,trojans or malware.
I have run AVG and found 1 trojan. I have quarantined it. Does this mean it is no longer active?
Here is trojan Win32:Trojan-gen C:\ProgramData\zxits\WerFault.exe

That could mean Malwarebytes database is not recognizing the malware yet. If I were you, I'd do what most people said above, which is reformat and reinstalling your system. The attacker might have planted some backdoor and your antivirus/malware didn't realize it.

I realize it might take some time but it's better than risking your computer to be monitored by somebody else.

tora

member

Activity: 532

Merit: 13

Hello.
Thanks for all the replies,help and suggestions.
I have run malwarebytes and the result is negative, no virus,trojans or malware.
I have run AVG and found 1 trojan. I have quarantined it. Does this mean it is no longer active?
Here is trojan Win32:Trojan-gen C:\ProgramData\zxits\WerFault.exe

tranthidung

legendary

Activity: 2310

Merit: 4085

Farewell o_e_l_e_o

To avoid future compromise on your bitcoin, I think you can apply the steps guide by @LoyceV.
How to lose your Bitcoins with CTRL-C CTRL-V
Copying part of your bitcoin address, and manually type the rest.
Doing double or tripple checks after you finish copy & paste & type the whole address. Doing this carefully before clicking on send button and / or confirm button/link from your email will help you safe.
More details can be found in the given thread.

It is a little off-topic but I think the lesson of sending bitcoin to bitcoin-A/B/C address and lose bitcoin is a painful lesson and if you are interested, please see the story: Sent BTC to BCH address. Andthe answer.
You have to be careful when choosing ticker of crypto currency on exchanges, make sure you choose BTC, not BCH or whatever B- or BT- coins.

To recap, please carefully check:
- Bitcoin address
- Ticker of cryptocurrency you want to withdraw or send.

joniboini

legendary

Activity: 2170

Merit: 1789

Quote from: tora on November 16, 2019, 01:31:41 AM

I opened a new perfect money account and a new exchange account. Will the hacker have access to these accounts?
How would they hack my kucoin account?

Based on what you posted above, maybe he's using a clipboard malware, or a keylogger to monitor your PC (which is even worse).

It might be difficult to remove it completely even if you use anti-malware, so the best thing you can do imo is: update all your supposedly affected accounts from another device (a secure one), backup your data from the infected pc and secure format your storage, run a fresh install of your OS.

tora

member

Activity: 532

Merit: 13

I opened a new perfect money account and a new exchange account. Will the hacker have access to these accounts?
How would they hack my kucoin account?
Kucoin has 2FA. The email address I use is only for kucoin. The password I use is only for kucoin.
They accessed my perfectmoney account and my exodus wallet. All different email addresses and passwords.

BitMaxz

legendary

Activity: 3472

Merit: 3217

Playbet.io - Crypto Casino and Sportsbook

KuCoin exchange is legit and I think you have a big problem with your PC and maybe someone is monitoring your PC.

Do you have any important files from your PC like a wallet? Make sure to backup them first because the only solution to remove all malware and viruses to your PC is to format the PC and install a fresh OS just like suggested above.

I believe that you're not using any protection in your PC so make sure to install one I recommend you to try Kaspersky Total Security they support crypto and it is a high level of security protection for your PC they have a 30 days trial. It can block the auto-install script when visiting suspicious websites if you don't have AV protection for both PC and browser the auto-install script will install silently and you will not notice if you are infected or not. That is why I recommend you to use AV.

Quote from: Quickseller on November 15, 2019, 04:53:58 PM

Even if you *think* you have quarantined the malware, your computer will still not be safe to use. Your computer may display one thing but will actually transmit other data to any website you are interacting with.

Yeah, I agree with you I just want him to quarantined the PC first to test if it's because of some infected files so that we will know what is the cause of changing bitcoin address every time he pastes his address.

khaled0111

legendary

Activity: 2744

Merit: 3097

Top Crypto Casino

Quote from: harizen on November 15, 2019, 04:37:48 PM

Or if you really need to do the transaction, try to do it on your other trusted machine, maybe from one of your family, friends, etc.

If I may add, in case you don't have access to another machine or don't want to, you can exclude the first two or three characters and copy the rest of the address then after pasting it you may add the missing characters manually. Don't forget to check the final address more than once before sending the transaction.

Quickseller

copper member

Activity: 2996

Merit: 2374

Quote from: BitMaxz on November 15, 2019, 02:59:47 PM

It seems your device or PC is infected with clipboard malware.
Let me ask if what exchange you are talking about?

Try to scan your PC first with Malwarebytes and antivirus like Kaspersky and scan the whole PC you might be infected with clipboard malware.
If they detect suspicious files try to quarantine them and try to paste the address again to any website.

Even if you *think* you have quarantined the malware, your computer will still not be safe to use. Your computer may display one thing but will actually transmit other data to any website you are interacting with.

Topic: wrong bitcoin address (Read 373 times)