Author

Topic: 11 btc gone from my account at 6:00 just a few hours ago, HELP! (Read 2943 times)

full member
Activity: 147
Merit: 100
mulletwang: PM
legendary
Activity: 2646
Merit: 1137
All paid signature campaigns should be banned.
I remember reading this a month ago. Very happy to see you recovered your coins Smiley
I do not think he really recovered them.

The 11 BTC in question are here:  https://blockchain.info/address/1LqYm5CM6T7QS9kDHRfPckMxZa2nfFN1wV

I think what happened is he added the address (which he does not really control) to his wallet.  That is all.  The BTC are still stuck until they get moved by whoever has the private key of that address.
hero member
Activity: 504
Merit: 500
I remember reading this a month ago. Very happy to see you recovered your coins Smiley
legendary
Activity: 2646
Merit: 1137
All paid signature campaigns should be banned.
This is what is promps me once i try to transfer bitcoins out of this address.  Huh Huh Huh i really want my BTC back please help

This action requires the private key of bitcoin address 1LqYm5CM6T7QS9kDHRfPckMxZa2nfFN1wV. Please enter the private key below.
Then you do not have the private key...
member
Activity: 110
Merit: 10
This is what is promps me once i try to transfer bitcoins out of this address.  Huh Huh Huh i really want my BTC back please help

This action requires the private key of bitcoin address 1LqYm5CM6T7QS9kDHRfPckMxZa2nfFN1wV. Please enter the private key below.
legendary
Activity: 2646
Merit: 1137
All paid signature campaigns should be banned.
If it is not listed in your "From" addresses then you do not have the private key.  So, you do not own the BTC.

Whoever has them has not moved them...  Interesting.

It IS listed in both send and receive areas!!!!
Cool, so you just sent it from one of your addresses to another one of your addresses.  You can spend the BTC if the address is listed as one of your from addresses.  You can try transferring the BTC somewhere and see if you can do it.
member
Activity: 110
Merit: 10
i thought that i might own this address but it was somekind of "change" address that was somehow was lost. I
 am not super technically savy but i am trying to make heads or tails of the situation. I have heard of people recovering bitcoins from similar situations and though this might be possible, please share your opinions of what you think the situation might be and some possible ways to correct what i hope is just some misplaced bitcoins. PLEASE PLEASE PLEASE help me get access to my bitcoins.
member
Activity: 110
Merit: 10
If it is not listed in your "From" addresses then you do not have the private key.  So, you do not own the BTC.

Whoever has them has not moved them...  Interesting.

It IS listed in both send and receive areas!!!!
member
Activity: 110
Merit: 10
Burt i do see a transaction on that day for -0.002 transaction. in the to\from section it says in gray "moved between wallet"

Again what would the private key be? is that something i should know or have access to? i do have backups of my wallet send regularly to my e-mail.
donator
Activity: 1218
Merit: 1079
Gerald Davis
The 1 BTC in question are still here: http://blockchain.info/address/1LqYm5CM6T7QS9kDHRfPckMxZa2nfFN1wV
Log in to your Blockchain.info wallet.
Go to the "Spend Money" tab.
Click on "Custom"
There should now be a list of "From:" addresses in the Custom Transaction area.
Look through all the "From:" addresses.
Is 1LqYm5CM6T7QS9kDHRfPckMxZa2nfFN1wV listed?

Report back.

ALSO

Go to the "My Transactions" tab.
Navigate back in time to 2013-04-07 10:01:57 and see if there are any transactions around that time in your wallet.
Report back what it says about the transaction.

FINALLY

Go to the "Receive Money" tab.
Look through all the addresses listed there.
Is 1LqYm5CM6T7QS9kDHRfPckMxZa2nfFN1wV listed?

Report back.

Thanks!


ALright you are right about it being a watch only, i cannot spend without the "private key". Any idea what this might be, or how i would figure it out. But yes i did see the address listed and also in the receive money it is listed, as a watch only address though

You can't.  That is the security of Bitcoin.  Only the holder of the private key can spend the funds.  If you could "get" the private key you could "get" the private key for MtGox cold storage address and help yourself to thousands of coins.
legendary
Activity: 2646
Merit: 1137
All paid signature campaigns should be banned.
If it is not listed in your "From" addresses then you do not have the private key.  So, you do not own the BTC.

Whoever has them has not moved them...  Interesting.
member
Activity: 110
Merit: 10
The 1 BTC in question are still here: http://blockchain.info/address/1LqYm5CM6T7QS9kDHRfPckMxZa2nfFN1wV
Log in to your Blockchain.info wallet.
Go to the "Spend Money" tab.
Click on "Custom"
There should now be a list of "From:" addresses in the Custom Transaction area.
Look through all the "From:" addresses.
Is 1LqYm5CM6T7QS9kDHRfPckMxZa2nfFN1wV listed?

Report back.

ALSO

Go to the "My Transactions" tab.
Navigate back in time to 2013-04-07 10:01:57 and see if there are any transactions around that time in your wallet.
Report back what it says about the transaction.

FINALLY

Go to the "Receive Money" tab.
Look through all the addresses listed there.
Is 1LqYm5CM6T7QS9kDHRfPckMxZa2nfFN1wV listed?

Report back.

Thanks!


ALright you are right about it being a watch only, i cannot spend without the "private key". Any idea what this might be, or how i would figure it out. But yes i did see the address listed and also in the receive money it is listed, as a watch only address though
full member
Activity: 147
Merit: 100
up! Please read the update on original post.

Dude. It's a watching only address. You can add any address there. You can't spend that. Add this address and your balance will be 111k.

http://blockchain.info/address/1933phfhK3ZgFQNLGSDXvqCn32k2buXY8a
legendary
Activity: 2646
Merit: 1137
All paid signature campaigns should be banned.
The 1 BTC in question are still here: http://blockchain.info/address/1LqYm5CM6T7QS9kDHRfPckMxZa2nfFN1wV
Log in to your Blockchain.info wallet.
Go to the "Spend Money" tab.
Click on "Custom"
There should now be a list of "From:" addresses in the Custom Transaction area.
Look through all the "From:" addresses.
Is 1LqYm5CM6T7QS9kDHRfPckMxZa2nfFN1wV listed?

Report back.

ALSO

Go to the "My Transactions" tab.
Navigate back in time to 2013-04-07 10:01:57 and see if there are any transactions around that time in your wallet.
Report back what it says about the transaction.

FINALLY

Go to the "Receive Money" tab.
Look through all the addresses listed there.
Is 1LqYm5CM6T7QS9kDHRfPckMxZa2nfFN1wV listed?

Report back.

Thanks!
member
Activity: 110
Merit: 10
up! Please read the update on original post.
member
Activity: 110
Merit: 10
ourch this bitcoin loss hurts when bitcoin keeps climbing~!  Angry
hero member
Activity: 616
Merit: 500
Firstbits.com/1fg4i :)
It would be nice if that blockchain online wallet service changed their name to not confuse newbies. That is a third-party service, not a part of Bitcoin proper...
legendary
Activity: 2128
Merit: 1002
Another forum member reported someone attempting to guess his blockchain.info wallet password earlier today https://bitcointalksearch.org/topic/m.1761904 .

Always use 2 factor folks.  Sorry for your loss.

+10
legendary
Activity: 2128
Merit: 1002
legendary
Activity: 1204
Merit: 1002
RUM AND CARROTS: A PIRATE LIFE FOR ME
Not to spread FUD, but I have the Javascript notification plug in and several times it's poped up a warning. It only did this when I was refreshing the page mid load (or something like that) but I'll tell them anyway.

I use blockchain to monitor accounts (watched addresses) and use two factor. Although I wish there was something like Yubikey support as well. If you steal my computer- I'm logged into my email.
legendary
Activity: 2198
Merit: 1311
Always use 2 factor folks.  Sorry for your loss.

This. This. This.

Sadly we see dozens and dozens of these reported cases and not a single one involving 2FA.  Granted 2 factor isn't a magical bullet.  With clever use of trojan/rootkit an attacker could trick you into giving them access to your wallet (or in the case of something like MtGox trick you into withdrawing BTC to their address) but the 2 factor greatly increases the security.



This is going to continue to be a big problem, I think.  Lots of the people getting into bitcoin right now are not well enough acquainted with good security practices regarding passwords, let alone 2 factor auth.
donator
Activity: 1218
Merit: 1079
Gerald Davis
Always use 2 factor folks.  Sorry for your loss.

This. This. This.

Sadly we see dozens and dozens of these reported cases and not a single one involving 2FA.  Granted 2 factor isn't a magical bullet.  With clever use of trojan/rootkit an attacker could trick you into giving them access to your wallet (or in the case of something like MtGox trick you into withdrawing BTC to their address) but the 2 factor greatly increases the security.

hero member
Activity: 784
Merit: 506
Another forum member reported someone attempting to guess his blockchain.info wallet password earlier today https://bitcointalksearch.org/topic/m.1761904 .

Always use 2 factor folks.  Sorry for your loss.
newbie
Activity: 31
Merit: 0
Too bad BTC is untraceable, good hackers wouldn't do it if they weren't
good enough to think they weren't get caught, if someone stole it, its gone.

It sucks sorry dude, move on, acquire more and youll make youre money back when
BTC doubles in price within a month. Use more protection (auth)
sr. member
Activity: 392
Merit: 250
Isn't it necessary to know wallet id (GUID) as well?


My wallet username was the same as my forum one, and my password was 1234567890.
I found out that the 1234567890 username had the same password. Same goes for 0123456789.

So, even if I had only 0.4 mBTC in my wallet (which is like 5 cents), I changed my password, and I put a confirmation by email on login.
member
Activity: 110
Merit: 10
my allias is kinda obvious but somewhat obscure, how would that llow someone to take me coins?
legendary
Activity: 2646
Merit: 1137
All paid signature campaigns should be banned.
Maybe you got bruteforced ...

Brute forcing SHA256 is out of the question, people.


SHA256? What is it?
I found out 5 passwords of blockchain accounts with only a 10 caracters password yesterday, just trying easy ones.
Both 5 accounts were 0 btc :p

Isn't it necessary to know wallet id (GUID) as well?
He may have an obvious alias (I know I do).
hero member
Activity: 504
Merit: 500
Wow that really sucks. Don't give up on Bitcoins though, hopefully this won't occur again!
legendary
Activity: 2646
Merit: 1137
All paid signature campaigns should be banned.
yesterday i was sending identity conformation to BTCJAM and mtgox. i don't know if that is relevant to anything or not but i did check my btcjam acc and mtgox and they are not there. as i stated earlier i did not make any transfer as i was asleep.
Question:  did you have any other accounts?  StrongCoin for example?  Did you use the same password on any other accounts?  Mt Gox for example?

They may have gotten your password from another account if you use the same password any other place.

In Bitcoinland I use a different password for every single Bitcoin related account.
legendary
Activity: 2142
Merit: 1009
Newbie
Maybe you got bruteforced ...

Brute forcing SHA256 is out of the question, people.


SHA256? What is it?
I found out 5 passwords of blockchain accounts with only a 10 caracters password yesterday, just trying easy ones.
Both 5 accounts were 0 btc :p

Isn't it necessary to know wallet id (GUID) as well?
sr. member
Activity: 392
Merit: 250
Interesting.  Why are you trying to hack into peoples accounts?  Are you a thief?


no, was just curious to see if people would use the same username / password.
legendary
Activity: 2646
Merit: 1137
All paid signature campaigns should be banned.
Maybe you got bruteforced ...

Brute forcing SHA256 is out of the question, people.


SHA256? What is it?
I found out 5 passwords of blockchain accounts with only a 10 caracters password yesterday, just trying easy ones.
Both 5 accounts were 0 btc :p
Interesting.  Why are you trying to hack into peoples accounts?  Are you a thief?
legendary
Activity: 2646
Merit: 1137
All paid signature campaigns should be banned.
Maybe you got bruteforced ...
Bitcoin network not possible.

Password maybe.

Did you use a strong password?

Still, the most likely attack vector was a key logger as suggested above.  Check your computer for virus, key logger, etc.

Only thing you can do now is watch the address and see where they go next.
sr. member
Activity: 392
Merit: 250
Maybe you got bruteforced ...

Brute forcing SHA256 is out of the question, people.


SHA256? What is it?
I found out 5 passwords of blockchain accounts with only a 10 caracters password yesterday, just trying easy ones.
Both 5 accounts were 0 btc :p
member
Activity: 110
Merit: 10
yesterday i was sending identity conformation to BTCJAM and mtgox. i don't know if that is relevant to anything or not but i did check my btcjam acc and mtgox and they are not there. as i stated earlier i did not make any transfer as i was asleep.
member
Activity: 68
Merit: 10
Maybe you got bruteforced ...

Brute forcing SHA256 is out of the question, people.
sr. member
Activity: 392
Merit: 250
Maybe you got bruteforced ...
legendary
Activity: 2646
Merit: 1137
All paid signature campaigns should be banned.
Fishy.

Why didn't they take them all from you?  Why did they only take 11?

Indeed!
Are you SURE that you didn't transfer them somewhere?  BTCJam for example?
legendary
Activity: 854
Merit: 1000
Fishy.

Why didn't they take them all from you?  Why did they only take 11?

Indeed!
legendary
Activity: 2646
Merit: 1137
All paid signature campaigns should be banned.
Fishy.

Why didn't they take them all from you?  Why did they only take 11?
member
Activity: 110
Merit: 10
soooooooo disappointing.  Cry
legendary
Activity: 2646
Merit: 1137
All paid signature campaigns should be banned.
Well they are still at their new home as of now:  http://blockchain.info/address/1LqYm5CM6T7QS9kDHRfPckMxZa2nfFN1wV

2factor ID means you use something else to verify besides just password. Obviously your comp is infected with virus/trojan/botnet and somebody stole your wallet login

https://blockchain.info/wallet/sms-two-factor
https://blockchain.info/wallet/google-authenticator

He already did this (after the fact, but it is done):

i just changed it to two factor

Watch the new address and if they move you may (long shot) be able to see where they go.
hero member
Activity: 899
Merit: 1002
look at the transaction list
enable 2 factor auth cuz you are probably on a botnet and somebody is capturing all your logins

not sure what you mean, can you elaborate...


2factor ID means you use something else to verify besides just password. Obviously your comp is infected with virus/trojan/botnet and somebody stole your wallet login

https://blockchain.info/wallet/sms-two-factor
https://blockchain.info/wallet/google-authenticator
member
Activity: 110
Merit: 10
look at the transaction list
enable 2 factor auth cuz you are probably on a botnet and somebody is capturing all your logins

not sure what you mean, can you elaborate...
member
Activity: 110
Merit: 10
 Cry no was using just my password. i just changed it to two factor. here is the address they were dropped into 1LqYm5CM6T7QS9kDHRfPckMxZa2nfFN1wV

and the transaction 123fba6d51ae901719ca7853cf86aed1a05657927b00d1247cc15beef0be5560
hero member
Activity: 899
Merit: 1002
look at the transaction list
enable 2 factor auth cuz you are probably on a botnet and somebody is capturing all your logins
full member
Activity: 280
Merit: 102
Do you use two-factor authentication?
member
Activity: 110
Merit: 10
i use blockchain to access my bitcoins and i got email notification as i woke up out of bed.



 Huh pissed.
sr. member
Activity: 337
Merit: 250
Account where?
member
Activity: 110
Merit: 10
Hi i am posting because i had 11 BTC taken from my account just few hours ago. I am wondering if this is widespread or if maybe i have had a security breach of somekind. I have just over a bitcoin left in my account so the perpetrator did not clean me out, but near. Can someone help me out. i not too sure what can be done. i know almost nothing but i want to use this as a lesson. for myself and maybe others. Please let me know what information i can post to maybe shed some light on the situation.

Any help or input, other than trolling would be greatly appreciated.



*********UPDATE*********

RECOVERED MY BITCOINS!!!!!!!!!


This is how i did it. i went to import\export option in the blockchain website, after login in. I went to the "Add Watch Only Bitcoin Address" and inserted the bitcoin address where the coins were stored. It was this address for me 1LqYm5CM6T7QS9kDHRfPckMxZa2nfFN1wV. i added that address into that option an presto.... my balance update to the correct balance.



HORAY! Not too sure why this works or what happened but i am just happy all is well. maybe someone with technical knowledge can fill in the details. Thank you to everyone who contributed in this post and the community at large as i farmed the reddit r\bitcoin for info.

I am smiling from ear to ear.

 Cool Grin Cool Grin Cool Grin Cool Grin Cool Grin Cool

Jump to: