Chapter 13
Malware that steals cryptocurrency
What you'll get from this chapter: How hidden programs swap the address you paste or record what you type, and how a hardware wallet keeps your keys safe even on an infected computer.
In this chapter
- Words in this chapter
- Your steps
Some theft never asks you a question. A program on the computer changes what you paste, or records what you type.
A watches the clipboard, which is the temporary place a computer stores what you copy. When you copy a wallet address, the program replaces it with the criminal’s address. The first characters often still match, which is why comparing only the beginning is not enough. A records keystrokes, including passwords and , and sends them out.
are a frequent hiding place. An extension is a small add-on inside Chrome, Edge, Brave, or Firefox. Fake wallet extensions are published to look like MetaMask or a hardware-wallet companion. If an extension asks you to type a recovery phrase, that request is the theft.
Keep large balances on a . A hardware wallet is a small device that stores the offline and shows the transaction on its own screen. Private keys are the secret numbers that prove you control the cryptocurrency. Even if the computer is infected, the keys do not leave the device, as long as you confirm the address on that screen and you bought the device from the manufacturer.
The single most valuable thing in crypto is your recovery phrase. The next chapter shows how to protect it.
Words in this chapter
- . that replaces a cryptocurrency address you copied with the criminal’s address when you paste.
- . Malware that records what you type.
- . A small add-on inside the browser. Wallet extensions are useful and also a common place for fakes. Install them only from the wallet’s official website.
- . A small device that keeps cryptocurrency offline and shows the destination address on its own screen before you approve a payment.