If your antivirus flagged the Monero GUI wallet or monerod, take a breath. A virus warning on Monero software is common and does not by itself mean the file is malicious. The Monero website says antivirus programs may flag its programs as malware. What matters is whether your copy is the genuine one, and you can prove that in about five minutes.
This guide explains why the alerts happen, shows how to verify your download step by step, and says what to do if the file turns out not to be the real thing. It does not ask you to switch off your antivirus. Please do not.
- Antivirus tools often flag Monero software. The Monero site acknowledges this.
- Where the file came from, and whether its hash matches, tells you more than the alert does.
- Verify with the signed hashes on getmonero.org. Do not trust the file name or a download page you reached from an ad.
- Never turn your antivirus off. If you must allow a file, allow only that one verified file.
- A file from anywhere other than the official site should be treated as malware.
The short answer
The official Monero downloads page says that some antiviruses and firewalls may flag the Monero executables and archives as malware, and it strongly advises you to verify the hash of the archive you download. It also notes that a corrupted archive could result in lost funds.
So there are two possibilities. Either the file is genuine and the alert is a false positive, or the file is not genuine and the alert is right. You cannot tell which from the alert. You can tell by verifying the download.
Why antivirus flags Monero software
The Monero FAQ describes antivirus tools that warn about, or even silently remove, the GUI wallet or the daemon. It gives the likely cause as the integrated miner: some antivirus programs wrongly judge the miner to be dangerous and act to remove it. The FAQ adds that the problem is being discussed.
There is a second reason, one we can only describe in general terms. Malware that secretly mines Monero on someone else's computer, called cryptojacking, has been around for years. Security tools learn to distrust anything that looks like it. A real wallet shares enough code and behaviour with that malware to trip some detection rules.
Why checking still matters
If false alarms are common, it is tempting to wave every alert away. That is exactly what an attacker hopes for. The official site has been targeted before.
On November 19, 2019, the Monero project warned that the binaries of the command line wallet downloaded from its website had been compromised and a malicious version was being served. The affected downloads were made on Monday, November 18, between 2:30 AM and 4:30 PM UTC. The problem came to light after a GitHub issue reported mismatched hashes. The project told people tocompare hashes, delete anything that did not match, and never run the compromised binaries. Press coverage at the time reported the altered files were built to steal seeds.
A user's hash check exposed a real compromise. Hash checks work because the check does not rely on any one download page.
Both things are true: antivirus often cries wolf about Monero, and real tampered copies have existed. Verification is how you tell them apart.
Verify your download step by step
You are going to check two things: that the list of hashes is genuinely from the Monero project, and that your file's hash appears on it. Start at getmonero.org/downloads, typed by hand or from a trusted bookmark.
- Get the files from the official site
Download your wallet and the signed hash list,
hashes.txt, from getmonero.org. If your antivirus has already removed the wallet, download it again from the same page. - Get the release key and check its fingerprint
The official guides use the signing key of binaryFate, published in the Monero repository. The fingerprint shown in the guide is
81AC 591F E9C4 B65C 5806 AFC3 F0AF 4D46 2A0B DF92. If the fingerprint on your screen differs, stop. - Check the signature on hashes.txt
Beginners on Windows can use Kleopatra from Gpg4win. On the command line,
gpg --verify hashes.txtshould report a good signature from binaryFate. A bad signature means delete the file and fetch it again. - Hash your downloaded file
On Windows, in a command prompt in the folder with the file:
certUtil -hashfile FILENAME SHA256. On Linux or macOS the guide usesshasum -a 256 FILENAME. - Compare
Find your file's name in
hashes.txt. The long string next to it must equal the one you just generated, ignoring spaces. They match, the file is the real one.
Follow the official guides rather than only this summary: the beginner guide for Windows and the advanced guide for all systems.
If the check fails
- Do not open or run the file.
- Delete it, and delete the hash list too.
- Download both again from getmonero.org, typing the address yourself.
- Check again. A single character off means a mismatch, so compare carefully.
- If it still fails, stop and ask in an official Monero community channel, and describe exactly what you did.
A mismatch is more often a cut-off download than an attack, so one clean retry is normal. Still, never use a file that did not pass.
If the file came from somewhere else
If you got the wallet or daemon from an ad, a search result you cannot vouch for, a forum, a chat message, a torrent or a mirror, treat it as malicious, even if it never produced an alert. The antivirus alert may be the only thing that saved you. Fake wallets are the main way Monero users lose money, as covered in how Monero phishing sites work.
If you ran it, act in this order
- Disconnect the device from the internet and stop the program.
- Ask yourself one question: did I create or restore a wallet in it, or type a seed anywhere? If you did, assume that seed is exposed.
- On a clean device, such as another computer or a freshly reset phone, create a brand new wallet with a new seed from an official source.
- Send everything from the exposed wallet to the new one. Do this quickly, because anyone holding the seed can do the same.
- Scan the original machine with your security tool, and consider reinstalling the operating system before using it for money.
- Change passwords for any accounts you used on that machine.
If you never entered a seed and never opened a wallet, your funds are most likely unaffected, but clean the machine anyway. Our guide to restoring a wallet shows how to bring a wallet back on a clean device.
What about an exception?
Do not turn off your antivirus. Switching protection off leaves you open to everything else on the internet while you do it, and many people forget to switch it back on.
The Monero FAQ suggests that once you have verified the software, you can add an exception so the antivirus stops removing it. If you do, keep it narrow: allow one verified file or one folder that holds only verified Monero files, not a whole drive and not the Downloads folder. Do it only after the hash matched. Every antivirus tool words this differently, so check your product's own help page.
If you would rather not deal with this at all, a browser wallet has no installer to be flagged. MonkStash is a free, non-custodial browser wallet for small amounts. It is an early preview and has not been independently audited.
Staying safe from now on
- Reach the Monero site by bookmark. Never from a promoted result.
- Verify every wallet, daemon and miner download, including updates.
- Keep your seed on paper, and never type it into a website that asks you to prove ownership.
- Use a hardware wallet for savings. See the safest Monero wallet guide.
- Choose between the graphical and command line wallets with our GUI versus CLI comparison.
Frequently asked questions
Is the Monero GUI wallet a virus?
No, the official wallet from getmonero.org is not a virus. The Monero website itself warns that some antivirus and firewall programs may flag its executables as malware. But a file from anywhere else may be a fake, so verify yours with the published hashes.
Why does my antivirus flag Monero?
The Monero FAQ says it likely happens because of the integrated miner, which some antivirus tools wrongly treat as dangerous. Monero is also often associated with cryptojacking malware, which makes detection rules cautious.
Is monerod flagged as a trojan safe?
It can be, if it came from getmonero.org and its SHA-256 hash matches the signed list. If you cannot confirm where it came from or the hash does not match, delete it and download again from the official site.
How do I verify the Monero GUI download?
Download hashes.txt from getmonero.org, check its signature against the Monero release key, then compute the SHA-256 hash of your file and compare it with the matching line. On Windows, the command is certUtil -hashfile followed by the file name and SHA256.
Should I turn off my antivirus to install Monero?
No. Leave protection on. If you verify the file and still want to keep it, add an exception for that one file or folder only.
What if the hash does not match?
Delete the file and do not run it. Download it again from getmonero.org, then check again. If it still fails, stop and ask on an official Monero channel.
I ran a Monero wallet from a link or a forum. What now?
Treat it as malware. Disconnect it from the internet, and if you ever entered a seed into it, create a new wallet on a clean device and move your funds right away.
Do Monero miners get flagged too?
Yes. Mining software is flagged by many antivirus tools because malware often installs miners secretly. A miner you chose to install still deserves a verified download.