Quote from: sokani on April 09, 2025, 02:44:35 PM

Quote from: Outhue on April 09, 2025, 08:45:59 AM

Am I dumb or something? Since attackers needs to exploit the BTC wallet interface why are we not asking ourselves how this will be carried out? Isn't the access needs to be granted somehow by the wallet owner? How can someone or a hacker have the ability to mimic your wallet interface?

It can be done with the help of a Bitcoin vanity generator. You can read about it here: https://bitcointalk.org/index.php?topic=25804.0

What scammers normally do is that, they will pick out an address from the blockchain with frequent wallet activities. Generate a similar looking address and send dust to it with hope that in attempt to copy the address, the potential victim would mistakenly copy the fake address and send Bitcoin.

Quote

Let's say I am using trust wallet now and I had to copy the last address I sent BTC to, the only way this can be possible is if.....

Clipboard malware is active, maybe while copy pasting the clipboard hijack malware switch the copied address to another.

Address poisoning can be avoided by copying the address directly from the wallet and not from transaction history.

Clipboard malware is different. It's mostly spread through malicious file downloads but in both cases it good to crosscheck the receiving address.

Ohhh thanks for explaining this better, I was confused to be honest because I've never fall for such scam before but I guess that's because I don't copy address from transaction history, to think of this is even scary, because transaction history is available on explorers which can easily be tampred. I am used to copying inside my bitcoin wallet rather.

As for the clipboard malware it is not always about downloading malicious file alone, someone close to be was a victim years back, all he did was downloaded a third party keyboard on his smartphone and he is also using a rooted Android phone, the keyboard was the problem but the script was activated because he is running a rooted phone.

This attack will hijack any sensitive words or passwords and send them into the cloud without you knowing and when you copy paste address it changes like it always happen on a malware infected computer.