Clipboard hijackers, keyloggers, and drainers — covered in our crypto malware types explainer — can only steal from a device they’ve already infected. Every attack starts the same way: malware needs a way in. Close the entry points and the attack never begins. This guide covers the infection vectors, how to recognise a compromised machine, and how to clean up.
The Infection Vectors
| Vector | How It Works | Risk Level |
|---|---|---|
| Fake downloads | Lookalike wallets, exchanges, and “update” installers that are malware | Very high |
| Cracked software | ”Free” copies of paid tools bundled with info-stealers | Very high |
| Phishing attachments | PDFs and Word docs with macros that install a payload | High |
| Malicious extensions | Browser extensions that read pages and intercept wallet activity | High |
| Malvertising | Malicious ads on legitimate sites | Medium |
| Supply-chain | Legitimate-looking apps or packages compromised at source | Medium |
| USB / juice jacking | Infected USB drives and public charging stations | Low-medium |
Fake Downloads and Fake Updates
The #1 way crypto users get infected. You search “MetaMask download”, click a sponsored ad, install “the app”, and restore your wallet with your seed phrase — you’ve just handed it over. The same trick works for fake exchange apps and “critical security update” popups; real wallet updates never arrive via an email link or a redirected website.
Protection: Download wallets and exchanges only from their official website, saved as a bookmark. Never click sponsored results or install updates from email links.
Cracked Software
Pirated games, “pro” tools, cracked wallets — attackers deliberately seed these with stealers that wait for you to log into an exchange. There is no such thing as a safe crack.
Protection: Use free or open-source alternatives. Never run pirated installers on any machine that touches crypto.
Phishing Attachments
Phishing emails pose as an invoice, tax document, or “trading report”. The attached PDF or Word file contains a macro that runs a payload the moment you open it. They’re personalised — attackers use your name and a plausible excuse.
Protection: Don’t open attachments from unexpected senders, and verify surprise invoices by phone or a known channel. A Word document demanding you “enable macros” is malware by definition.
Malicious Browser Extensions
Extensions requesting “read and change all your data on all websites” can intercept copied addresses, read pages you’re logged into, and inject drainer transactions. They use plausible names (“MetaMask Helper”, “Gas Tracker”) with a handful of installs.
Protection: Install extensions only from the official Chrome Web Store or Firefox Add-ons, from the verified developer. Review installed extensions regularly and remove anything unused.
Supply-Chain Attacks
The scariest vector: legitimate-looking code compromised at the source. Attackers plant malicious npm or PyPI packages, or hijack a project’s update server to push a poisoned release. Even “official” downloads can be infected.
Protection: Verify desktop wallet downloads with checksums and signatures (see Electrum’s signed releases).
Signs Your Device Is Compromised
| Symptom | Likely Cause |
|---|---|
| Clipboard pastes different addresses than you copied | Clipboard hijacker |
| New browser extensions you didn’t install | Extension malware |
| Random popups, redirects, changed homepage | Adware / browser stealer |
| Slow performance, fans constantly running | Miner or remote access trojan |
| Antivirus disabled or won’t update | Malware neutralising defenses |
| Outbound network traffic at odd hours | Data exfiltration |
| A wallet prompts for your seed phrase out of nowhere | Drainer |
The Cleanup Plan After an Infection
Act in this exact order — the sequence matters:
| Step | Action |
|---|---|
| 1 | Disconnect from the internet — unplug or toggle Wi-Fi. This cuts the data path immediately. |
| 2 | Move funds from a clean device. Use a trusted phone or friend’s laptop — create fresh wallets and transfer every balance out, without logging into anything sensitive. |
| 3 | Document what you can. Screenshot unusual transactions; note addresses and dates. |
| 4 | Boot a clean environment. Use a Linux live USB (or Tails) to copy only files you need — never wallet files. |
| 5 | Wipe and reinstall. A factory reset or fresh OS install is the only reliable cleanup. |
| 6 | Change all passwords and 2FA from the clean device — email first, then everything else. |
| 7 | Revoke token approvals on your old wallet with a tool like Revoke.cash, from a clean device. |
Prevention: Close the Doors
- Download wallets and exchanges from official, bookmarked sources only
- Never install cracked software; never open unexpected attachments
- Use an ad blocker and a reputable antivirus (Malwarebytes, Bitdefender, ESET)
- Keep the OS, browser, and extensions updated via official channels only
- Use a hardware wallet: keys never leave the device, so on-device malware has nothing to grab
- Verify checksums and signatures for any desktop wallet you install
Related: How to Recover a Hacked Account | Common Phishing Attacks | How to Create a Strong Security Plan
Bottom Line
Malware doesn’t teleport onto your device — it needs a door. Fake downloads, cracked software, phishing attachments, malicious extensions, and poisoned supply chains are the doors. Close them with official sources, ad blockers, and updates, and the clipboard hijackers and keyloggers have nothing to steal from. Already infected? Disconnect, move funds from a clean device, wipe, and change everything.
What matters most
The single fact that changes how you should think about malware is that it must get onto a device before it can steal. Every clipboard hijacker, keylogger, and drainer depends on an entry point you allowed. That makes security less about advanced tools and more about closing obvious doors: download wallets only from official, bookmarked websites, never run cracked installers on any machine that touches crypto, and avoid opening attachments from unexpected senders. Even the most sophisticated attacks fail when there is no way in.
How to harden your device now
Securing a device that already holds crypto does not require technical skill. Start with the highest-impact changes and work down:
- Bookmark the official pages of every wallet and exchange you use, and only ever download from those saved URLs.
- Install an ad blocker and a reputable antivirus (Malwarebytes, Bitdefender, and ESET are widely used) and let them update automatically.
- Review your browser extensions regularly and remove anything you do not actively use, since a single malicious extension can read every page you visit.
- Move long-term holdings into a hardware wallet, where the private keys never leave the device and on-screen malware has nothing to grab.
- Verify desktop wallet downloads with checksums and signatures before running them, exactly as outlined in the supply-chain section above.
You do not have to do all of this in one sitting — every step you complete removes a realistic infection path. The crucial habit is to treat any unexpected download, update, or attachment with suspicion rather than speed.
What to avoid
The most common way people get infected is not failing to recognise an exploit but rushing past the obvious warning signs. Avoid clicking sponsored results when searching for a wallet — fake downloads are the fastest way to hand over a seed phrase. Never install “critical security update” popups that arrive through an email or a redirected website, since real wallets never push updates that way. Do not open a Word or PDF attachment that demands you “enable macros,” and do not run pirated software on any machine that touches crypto. None of these are technical mistakes; they are almost always a matter of acting before verifying.
Common questions
Q: Is a trusted antivirus enough on its own? A: No. Antivirus catches known signatures but often misses fresh, custom malware, clipboard hijackers, and drainers. It is one useful layer, not a substitute for official downloads, a hardware wallet, and careful behaviour.
Q: What should I do if my wallet suddenly asks for my seed phrase? A: Assume your device is compromised. Close the wallet, disconnect from the internet, and move your funds to fresh wallets created on a clean device before doing anything else. A legitimate wallet never asks for your seed phrase outside of an initial restore.
Where to go next
If you suspect your device is already infected, the cleanup sequence above is the place to start — it tells you exactly what to move and when. For deeper background, our guides on recovering a hacked account, common phishing attacks, and building a strong security plan cover the surrounding threats. Revisit this page whenever you upgrade a wallet or add a device, since the entry points shift as your setup grows.