Microsoft: USB-spread 'CryptoBandits' clipper swaps wallet addresses and steals seed phrases over Tor
Windows users who open shortcut files from USB drives
Microsoft reported a Windows crypto clipper, detected as Trojan:Win32/CryptoBandits, active since February 2026 and spreading through malicious shortcut (.lnk) files on USB drives. It checks the clipboard every half second, replaces copied Bitcoin, Tron and Monero addresses with lookalikes that share the first characters, grabs copied 12/24-word seed phrases and private keys, takes screenshots, and talks to its servers over Tor. Always check the whole address on your wallet or device screen before sending. No loss total was published.
Why this severity: Still active, many people exposed.
- Started
- Jun 17, 2026
- Closed
- Jun 18, 2026
- Method
- Clipboard hijackers
Indicators · never visit or send to these
- cgky6bn6ux5wvlybtmm3z255igt52ljml2ngnc5qp3cnw5jlglamisad[.]onion
- gfoqsewps57xcyxoedle2gd53o6jne6y5nq5eh25muksqwzutzq7b3ad[.]onion
- facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd[.]onion
What to do now
- Run a full antivirus scan and clean or reinstall the PC. If you ever copied a seed phrase or private key on that PC, move funds to a new wallet created on a clean device. Check recent sends against the address you meant to use.
Stay safe
Am I affected?
You may be affected if you opened a shortcut on a USB stick on Windows, files on the stick looked like shortcuts, and a pasted wallet address did not fully match what you copied. Microsoft Defender flags it as Trojan:Win32/CryptoBandits.
What to do now
Run a full antivirus scan and clean or reinstall the PC. If you ever copied a seed phrase or private key on that PC, move funds to a new wallet created on a clean device. Check recent sends against the address you meant to use.
How to avoid this
Turn off AutoRun for USB drives and do not open shortcuts from removable drives. Never copy seed phrases or private keys to the clipboard. Check the full receiving address on your hardware wallet screen before sending.
Timeline 2
Alerts & on-chain evidence 1
News & write-ups ›1
How this method works
Malware on your computer or phone watches the clipboard and swaps any wallet address you copy for the attacker's. Read about clipboard hijackers →
Follow new drains and updates in your feed reader or Telegram RSS bot.