Crypto Crooks Hijack Bitcoin Swaps with Browser-Based Pastebin Scam

It started with a promise of easy riches-a “leaked” exploit, a quick $13,000, and just a few simple steps. But for unsuspecting cryptocurrency enthusiasts, the latest scam making the rounds on Pastebin is more than just another get-rich-quick scheme; it's a sophisticated browser-based attack that quietly reroutes Bitcoin swaps into the pockets of digital thieves.

The Anatomy of a Browser-Based Heist

The scam begins innocently enough: Pastebin users find comments on their posts touting a lucrative “arbitrage exploit” on Swapzone.io, complete with a link to an external site. The lure is a supposed insider method to exploit outdated backend nodes for outsized Bitcoin payouts. The “documentation”-hosted on Google Docs-walks readers through a series of steps, culminating in a critical instruction: copy a snippet of JavaScript code from paste[.]sh, then paste and execute it directly in the browser’s address bar while visiting Swapzone.io.

This clever abuse of the browser’s javascript: URI feature gives the attacker’s code free rein to manipulate the Swapzone page in real time. Once executed, the malicious script silently loads a secondary, heavily obfuscated payload. This payload overrides legitimate site scripts, specifically targeting the Bitcoin swap interface. The result? The victim sees a perfectly normal swap process, but the deposit address-where they send their Bitcoin-has been stealthily swapped out for one controlled by the attacker.

To further the illusion, the script even alters displayed exchange rates and offer values, making it seem as if the arbitrage “exploit” is working as promised. In reality, every Bitcoin sent is irretrievably lost to a criminal wallet, and the victim is none the wiser-until it’s too late.

A New ClickFix Threat Vector

This scam represents a novel twist on the so-called ClickFix attack, a social engineering tactic that usually tricks users into running malicious commands on their computers. Traditionally, ClickFix targets the operating system with PowerShell or shell scripts; here, the attackers pivot to the browser, leveraging JavaScript to hijack web sessions and steal cryptocurrency in real time. It’s a chilling evolution that blends technical cunning with psychological manipulation.

Lessons for a Trustless Age

The attack’s genius lies in its simplicity: no malware download, no phishing site-just convincing instructions and the victim’s own browser. As cryptocurrency adoption grows and the value of digital assets climbs, so too does the creativity of cybercriminals. For users, the lesson is clear: never run code from untrusted sources, no matter how tempting the promise. In the world of crypto, a single misstep can mean the irreversible loss of everything.

WIKICROOK

• Pastebin: Pastebin is an online service for sharing plain text, often used by attackers to distribute malicious code, instructions, or leaked data.
• JavaScript URI: A JavaScript URI lets you execute JavaScript code directly from the browser’s address bar or links, but it can introduce security vulnerabilities.
• Arbitrage: Arbitrage exploits price differences between markets. In cybersecurity, scammers use fake arbitrage opportunities, especially in crypto, to steal funds from victims.
• Obfuscation: Obfuscation is the practice of disguising code or data to make it difficult for humans or security tools to understand, analyze, or detect.
• ClickFix Attack: A ClickFix Attack tricks users into running commands that seem helpful but actually infect their devices with malware or give attackers access.