This thesis explores cybersecurity from the perspective of the attacker, with a particular focus on the vulnerabilities of cryptocurrency wallets. While modern cryptographic mechanisms and authentication methods provide a strong level of protection against brute-force or direct exploitation of software vulnerabilities, attackers often choose a more pragmatic route: targeting the human factor. Social engineering, combined with malicious software such as trojans and keyloggers, remains one of the most effective and prevalent methods to compromise sensitive user data.
The research highlights how attackers bypass technical safeguards by manipulating user behavior. By presenting deceptive messages, updates, or applications, victims are persuaded to install software that secretly records keystrokes or forwards private information. Trojans in particular act as delivery vehicles, silently installing keyloggers that capture seed phrases, passwords, and recovery keys essential for accessing cryptocurrency wallets. Experimental demonstrations within a controlled virtual environment confirmed that this combined approach of social engineering and malware provides attackers with a reliable and efficient path to compromise a wallet. In contrast, other studied methods such as phishing, SQL injection, and passive network sniffing proved either less effective in the context of cryptocurrency wallets or dependent on specific, less common circumstances.
The practical part of the thesis simulated various attack vectors, including the setup of phishing websites, exploitation of vulnerable applications, and deployment of a trojan with an integrated keylogger. Among these, the trojan–keylogger combination emerged as the most dangerous, since it is relatively easy to implement and can remain hidden for long periods while collecting valuable credentials. The findings reinforce the argument that the weakest link in security remains the user, not the cryptographic technology itself.
Finally, the thesis provides recommendations for improving protection. These include the use of hardware wallets for secure offline storage of keys, critical assessment of software sources, regular updates and antivirus protection, and most importantly, user awareness of social engineering techniques. By combining technical defenses with education and cautious behavior, individuals can significantly reduce the likelihood of compromise and better protect their digital assets.
|
