₿ Crypto 🌍 United States

Microsoft Uncovers Malware That Steals Crypto Wallet Keys via USB Sticks

Microsoft researchers have identified a worm that spreads via USB drives, intercepts Windows clipboard data to steal cryptocurrency wallet private keys, and swaps in attacker-controlled addresses during transactions, posing a direct threat to crypto holders.

📅 June 19, 2026 🕐 1 min read 📰 CoinDesk

2 assets impacted (Crypto). Net bias: 0 Bullish, 2 Bearish, 0 Neutral. Strongest signal: BTC/USD ↓ 4/10 (70% confidence).

📊 Affected Assets (2)

BTC/USD

Bearish 🤖 70%

📅 Short-term 🌍 Global ✨ Inferred

The malware explicitly targets crypto wallets by harvesting private keys and replacing destination addresses. As the largest cryptocurrency by market cap, Bitcoin wallets are a primary target. The threat could erode user trust and prompt short-term selling pressure from security-conscious holders.

Catalysts

▼ Microsoft disclosure of clipboard-hijacking worm targeting crypto wallets

Risk Factors

▲ Rapid antivirus signature updates could neutralize the threat quickly
▲ Low prevalence of malware may limit actual financial damage

▼ Show FAQ (3) ▲ Hide FAQ

How does this malware impact Bitcoin holders?

It can steal Bitcoin private keys from the Windows clipboard and replace Bitcoin destination addresses during transactions, leading to direct loss of funds.

Is Bitcoin's network itself compromised?

No, the malware operates at the user level on Windows systems; the Bitcoin blockchain remains secure.

What should Bitcoin users do to stay safe?

Use hardware wallets, avoid copying private keys, manually verify addresses, and keep antivirus software updated.

ETH/USD

Bearish 🤖 70%

📅 Short-term 🌍 Global ✨ Inferred

Ethereum wallets are equally vulnerable to clipboard hijacking because the malware scans for any wallet address or private key. With Ethereum's large user base and DeFi activity, the worm can intercept transactions and drain ETH or ERC-20 tokens, posing a direct threat to holders.

Catalysts

▼ Worm targets all crypto wallet addresses, not just Bitcoin

Risk Factors

▲ Ethereum's transition to staking may reduce clipboard usage for transfers
▲ Users increasingly rely on hardware wallets which are immune to clipboard attacks

▼ Show FAQ (3) ▲ Hide FAQ

Does the malware affect Ethereum-based tokens?

Yes, it can replace any Ethereum wallet address during token transfers, potentially stealing ERC-20 tokens or ETH.

How does this compare to previous crypto malware?

Previous clipboard hijackers targeted only Bitcoin addresses; this worm appears to intercept a broader range of crypto wallets and spreads via USB, making it more persistent.

Is MetaMask vulnerable?

MetaMask and other software wallets can be affected if a user copies a private key or address to the clipboard on an infected Windows machine.

🎯 Key Takeaways

Microsoft has uncovered a malware strain that spreads via USB and targets crypto wallets.
The malware intercepts shortcut files to install a worm on Windows systems.
Once installed, it monitors the clipboard for private keys and crypto wallet addresses.
When a user copies a destination address, the malware replaces it with an attacker's address.
This technique can silently redirect funds during transactions.
The worm relies on removable media, making air-gapped systems vulnerable if USB drives are shared.
Users should avoid copying private keys and verify addresses before confirming transactions.

📝 Executive Summary

The software intercepts shortcut files and directs them to install a worm that harvests private keys from the Windows clipboard and inserts its own destination wallet addresses when it detects a transfer.

❓ FAQ

How does the malware spread?

It spreads through USB sticks by intercepting shortcut files and installing a worm on Windows machines.

What does the malware do to crypto transactions?

It monitors the clipboard for wallet addresses and private keys, and when it detects a transfer, it swaps the user's destination address with an attacker-controlled address.

Who discovered this malware?

Microsoft researchers identified the threat.

📰 Related Articles

🏷️ Tags

📰 Source

CoinDesk

🔗 View Original Article