Topic: 24 BTC stolen from my bitstamp account 2FA and email confirmation protected (Read 14977 times)

Its been 6 months and the money still hasn't moved.

Why steal money and not transfer it out? Especially when back in Feb it was worth double of what it is worth today.

Is it possible that the machine you used to gpg encrypt them is compromised?

This couldn't happen with strong security measures.
It 's time to demand that the exchanges do their job seriously.

http://dassori.me/2014/03/06/open-letter-dear-bitcoin-exchanges/

I am guessing that you have an android phone? 

This part only makes sense if you have a keylogger.

I agree... Do you know a good address tracker? I used one last year but I don't even remember the name (it wasn't so good anyway)

Sad and expensive indeed ...
I hope you will recover soon.

Try to keep tracking their wallet address with your btc. One day they must spend it. Maybe they will do a small mistake and you will be able to track them. But perhaps this would be difficult.

This would have been my guess also, but from the history it says:


109.163.234.9 is a TOR relay, so it seems it was the hacker that did a full logon from TOR using 2FA (also it is the same address that withdraws the BTC).

The most likely option then is that they have access to (atleast) your phone.

I think the reason the hacker changed the password was so you would not log on yourself and change the password in case you saw the withdrawal email. He then changed it back to cover his tracks, just in case you would not notice.

* Did he delete the confirmation emails bitstamp sent from your email?

* You should make a list of all ip addresses the hackers used and confirm that they are TOR relays on https://metrics.torproject.org/relay-search.html
Not likely, but the hacker might have made a mistake somewhere in not using TOR.

* It would be interesting if you could export a list from your Android phone of all the applications installed and post it here, especially those installed just (1-2 weeks) before the hack.

No offense, but what the hell is this supposed to mean? "I did it and forgot about it?" Who moves 11000-16000 USD and "forgets" about it?

if I read correctly it seems they managed to restore your usual password after the hack, am i right?

this seems like the most likely to me. it bypasses 2fa and if they already had your email it would be easy. wait till you log in to bitstamp, initiate withdrawal, confirm the email.

if it is from inside bitstamp it's very scary thought to have.

The only form of 2FA possible on Bitstamp is Google Authenticator.

I don't use authenticator, is it possible to just log into your regular google account and disable it in settings? Attacker seemed to have used email as 2FA.
Your phone should've sent you all sorts of notifications when you got those emails unless you turned them off, or the attacker immediately turned off sync/notifications when they got control of your gmail.

I also endorse the immutable withdraw address(es) option to prevent this in the future. They will need control over your wallet as well to get the coins or somehow social engineer the exchange into resetting the immutable withdraw addresses.

Yes I have logged in from my phone to bitstamp and I had there my google authenticator installed.
Yes I had my email account with the password saved on the same phone
Yes it was connected to a 3g data plan

If i understood properly from what i read, my bets would be on the the hacker having had access to your smartphone.
Either via some malware you installed OR via known security holes in the software installed on your device and or known backdoors the NSA builds into every such spy-device known as smartphone, the hacker also knew about.

It is my understanding that via your smartphone you accessed also your email, were trading on bitstamp and also using it for the 2FA

So the hacker had access to your email password via the phone, bistamp password, and of course the 2FA  (be it a keylogger, trojan with full access, NSA backdoor, security hole in your smartphone OS etc)


The above is the reason why i refuse to own a smart(dumb)phone and decided to use an old laptop with linux to do the 2 factor authentication for me.

The laptop will never touch the internet ever again. The codes for the 2 FA are on a usb stick and also printed out in case of hardware damage allowing me to restore the 2FA on another device if ever required. (you have to make sure the clock on the laptop displays the right time or 2FA won't work)

There are probably many ways to do the 2FA in linux, like using jauth, or installing virtualbox and then install android within it(old laptop too slow for this), but i decided to use wine and used winauth inside it.

To use winauth you first have to install dotnet 4.0 however, and that is not so easy. Tutorials on the net using winetricks did not work for me. I ended up copying the whole msnet 4.0 folders into the appropriate locations in the wine folders from a win98 install in virtualbox and to my surprise it worked...

Most likely a login session on the phone was not terminated, so hacker simply re-enter bitstamp and at the same time email account is usually auto-login, no 2FA is required

There is a weakness from bitstamp's side: You don't need 2FA code for withdraw. Since usually your email session is always logged in, once a malware took control of the device, he only need to wait until you logged into bitstamp

I just checked my computer, my email session is always automatically logged in, so it is also possible a malware can withdraw all my coins when I logged into bitstamp. Scary but true

Disgrace is how Bitstamp indeed is threating their customers. MtGox had same problem.. perhaps both exchanges will get their lessons..

Sorry for your loss OP

Do we have a list of exchanges that have implemented this locked-withdrawal address? I heard of it earlier but can't remember the site that was going to use it.

I think given the implications, that this feature should be universal in all exchanges.

they took 5 days to answer you? thats a fucking disgrace

Does you cellphone have access to your email and  Google Authenticator?
If so could somebody got access to your phone while on vacation?