Damn, that's quite an experience. Personally I haven't faced such a situation in crypto. I have faced it on Social media though (getting a social media account hacked and then successfully retrieving it back).
There are a few things to talk about here. Reading the comments I got to know that the exchange you are talking about is Binance.
It's a well reputed exchange with a lot of fake phishing websites. May be you clicked some phishing website which you don't even remember.
It happens with the best of us. May be it was an insider job(though the probability is low, it can still happen)
May be someone had access to your devices which were earlier used to login to binance.
May be someone who knows you had planned to hack you
The reason might be anything. Unless you are an active trader it is always advised to store your coins in a custodial wallet rather than an exchange.
Topic: Almost lost all of my coins in an exchange last week - page 2. (Read 892 times)
No emails from them that are in the spam box. I have no problem receiving their support email before they stopped responding.
Don’t know how they can hack a phone which has the Google Authenticator that is not even turned on.
Don’t know how they can hack a phone which has the Google Authenticator that is not even turned on.
If you are 100% sure that your email/mobile is not compromised, then it is the fault of the exchange. I guess the hacker has made use of some vulnerability within the website, which would allow passwords to be reset even without the email confirmation. Or it can be an inside job (but the chances are even lower). I can see that you have already got the funds moved from the exchange wallet. So it may be good, if you post the details about the exchange. Let them respond to it, and explain how this issue has occurred.
You mean if I mentioned their name in the thread they would respond? I just added some information to my original thread. If my email were compromised, why didn't the hack redirect my emails to the junk box so that I won't see them? Also, how did they by passing my Google Authenticator while the iPhone was turned off and that I had never saved the recovery code (unintentionally) for anyone to recovery it?
By the way, does anyone know how to effectively reach out to them - maybe through FB, Reddit, or other social media sites?
Wow, this can be a very rewarding experience and makes us more alert. In fact, when we are careful and try to secure our data, hackers are smarter and they can bypass the security. Really glad that you still can own your assets and move it.
OP isn't yet unlucky as he is in the perfect timing where he Login and read all the notification. Because in some cases, upon Login you will just surprise that the password is already changed. Good thing that there is an email message that saves OP otherwise, he definitely lost all of his assets/coins.On the other hand, this might be an additional lesson for us at least to check email regularly for emails and notifications from exchanges and monitor them.
Indeed, in this crypto world, nothing is perfect. Of course, there will be a downside and this is what hackers use to steal our assets.
A simple mistake will lead these hackers to take all our coins. This what I worried about before and that it makes me decide not to leave a huge amount of tokens/coins in any exchanger for long days, once deposited I have to trade it ASAP. This is not a practice of many, but what happened to OP will give some hints to the others. Indeed, in this crypto world, nothing is perfect. Of course, there will be a downside and this is what hackers use to steal our assets.
Most of my coins also were already traded because the price has been already increased, there's no sense if I'll still hodl those coins on the highest peak. It's a good welcome for me in the year 2021 so I didn't hesitate to trade my coins and sell all of them since those are potential coins. I won't hodl my coins in any exchange since there are still risks that our account might still get hacked or all of our assets will be gone because of mistakes.
Long time ago I also experienced the same scenario where my account received a request for password reset but good thing is that I haven't made any transactions with the exchange.
and this happens to me when I forget the password on my exchange account, then I have to verify it via email, while my email that I used has been a long time ago and I used a cellphone number that I no longer use, so I can't pass verification. There's about $ 366 in there, can it be saved?
I think it's unlikely you'll recover your account but still possible if the exchange is willing to cooperate and if you can show some proof of ownership like signing a message from one of the transactions you used to deposit on your account. I know it's possible for them to disable 2fa but not all of them are willing to do so since it's only inconvenience for them unless there's a fee. 
No emails from them that are in the spam box. I have no problem receiving their support email before they stopped responding.
Don’t know how they can hack a phone which has the Google Authenticator that is not even turned on.
Don’t know how they can hack a phone which has the Google Authenticator that is not even turned on.
If you are 100% sure that your email/mobile is not compromised, then it is the fault of the exchange. I guess the hacker has made use of some vulnerability within the website, which would allow passwords to be reset even without the email confirmation. Or it can be an inside job (but the chances are even lower). I can see that you have already got the funds moved from the exchange wallet. So it may be good, if you post the details about the exchange. Let them respond to it, and explain how this issue has occurred.
for the account problem linked to the email, I think it's difficult to hack because it has to go through verification. and this happens to me when I forget the password on my exchange account, then I have to verify it via email, while my email that I used has been a long time ago and I used a cellphone number that I no longer use, so I can't pass verification. There's about $ 366 in there, can it be saved?
Hoping next time you can name that exchange so that we can also avoid using that.
I don't want to mention the name directly, but it has been mentioned in this thread by others. You will need to look for it.
Do you remember something or anyone that saw your Google Authentication recovery key? I've been using it for 6 years and I've not yet experienced nor heard a news that their google auth 2fa was compromised. Nevertheless, this would remind to the members of this forum to take extra caution on their private accounts. Secure them properly and make sure you are the only one that knows it. If possible prevent other people from borrowing your device if you think they are capable of stealing your private accounts.
I did not keep the recovery key. At the time of setting it up, I did not even know that we should keep our recovery key.
Something just clicked. I am wondering, why did the hacker change the password instead of just transfer the coins out. Unless they did not really have the code which was sent to my email and the Google Authentication code. Besides, the phone with Google Authentication installed was not turned on. Because these codes are also needed to transfer coins each time.
After I pull out my last coin (which is a very small portion relative to the original amount), I will try to contact them using VPN as ask them to investigate. It is for their own good that they do investigate. If they don't, it will be their own loss.
Else, how can the hacker by passing the email code verification and the Google Authentication process?
Do you remember something or anyone that saw your Google Authentication recovery key? I've been using it for 6 years and I've not yet experienced nor heard a news that their google auth 2fa was compromised. Nevertheless, this would remind to the members of this forum to take extra caution on their private accounts. Secure them properly and make sure you are the only one that knows it. If possible prevent other people from borrowing your device if you think they are capable of stealing your private accounts.
Wow, this can be a very rewarding experience and makes us more alert. In fact, when we are careful and try to secure our data, hackers are smarter and they can bypass the security. Really glad that you still can own your assets and move it.
On the other hand, this might be an additional lesson for us at least to check email regularly for emails and notifications from exchanges and monitor them.
Indeed, in this crypto world, nothing is perfect. Of course, there will be a downside and this is what hackers use to steal our assets.
On the other hand, this might be an additional lesson for us at least to check email regularly for emails and notifications from exchanges and monitor them.
Indeed, in this crypto world, nothing is perfect. Of course, there will be a downside and this is what hackers use to steal our assets.
this is very awful , and its good you were able to remove your coins. this attacks could be from some phishing links you might have clicked. an insider wont even need to enter your email to login, however we need to be careful of such exchanges so you need to let us know or hint us.
I do not click on email links. I always go to the site directly to check if the email message is legit.
I use iPad and iPhone. They should be safer than Android phones.
I will repeat what I had mentioned before:
In order to change password, they need 1. a security code sent to my email address and 2. code from Google Authenticator. The Google Authenticator associated to my account is in an old iPhone which was turned off at the time during the hack. And I did not even keep its recovery code.
The last email (which I initiated) from them asked me to withdrawal my coins to avoid potential losses. They told me I cannot trade or exchange, only withdrawal. I replied to them, but they stopped responding since. As of today, I still don't know what they meant by "potential losses" and how.
It is really better to store your coins in your own wallet. Even if the exchange is a trusted one or top exchange, you have no assurance about the security of your coins. Let us say you are very careful in terms of security of your account, still when your coins are out there, is vulnerable to potential attacks.
this is very awful , and its good you were able to remove your coins. this attacks could be from some phishing links you might have clicked. an insider wont even need to enter your email to login, however we need to be careful of such exchanges so you need to let us know or hint us.
I do not click on email links. I always go to the site directly to check if the email message is legit.
I use iPad and iPhone. They should be safer than Android phones.
I will repeat what I had mentioned before:
In order to change password, they need 1. a security code sent to my email address and 2. code from Google Authenticator. The Google Authenticator associated to my account is in an old iPhone which was turned off at the time during the hack. And I did not even keep its recovery code.
The last email (which I initiated) from them asked me to withdrawal my coins to avoid potential losses. They told me I cannot trade or exchange, only withdrawal. I replied to them, but they stopped responding since. As of today, I still don't know what they meant by "potential losses" and how.
this is very awful , and its good you were able to remove your coins. this attacks could be from some phishing links you might have clicked. an insider wont even need to enter your email to login, however we need to be careful of such exchanges so you need to let us know or hint us.
Why were you leaving it in an exchange? When you spend crypto how do you spend it if it is in the exchange. You should know and many people have just posted about it, that is to never keep coins on the exchange.
I really hope you put a link to this post somewhere where many will see it because this is very important. I am glad you got your crypto back shame your heart must be racing. Now you know never to do it again and I hope others will learn from this.
I really hope you put a link to this post somewhere where many will see it because this is very important. I am glad you got your crypto back shame your heart must be racing. Now you know never to do it again and I hope others will learn from this.
Every cryptocurrency user needs to be more careful this day because attackers will always come with a different kind of strategy and it better to avoid human error.
The OP issue seems to be an insider man job(someone who know the auth backup code), human error from the OP end whereby the google auth backup is exposed or a problem from Google auth app because some crypto users have also experience the same attack which is the reason why people are advised to use Aegis.
Having said that, I will advise the OP to follow the instruction of not using his exchange email account for any other thing online, save auth backup code offline, set IP restriction and withdraw password etc.
The OP issue seems to be an insider man job(someone who know the auth backup code), human error from the OP end whereby the google auth backup is exposed or a problem from Google auth app because some crypto users have also experience the same attack which is the reason why people are advised to use Aegis.
Having said that, I will advise the OP to follow the instruction of not using his exchange email account for any other thing online, save auth backup code offline, set IP restriction and withdraw password etc.
One of the lucky man. Hacker find your account but failed to steal your money. Some Hackers are very smart and they use linux system for hacking accounts. For this they use malicious or spam files and we click on it cause viral of our information to hacker.
Exchangea are not safe place for token store. Use wallet instead of it.
Exchangea are not safe place for token store. Use wallet instead of it.
You're really lucky that didn't happen. Be careful.
I had a similar experience with an Exchange. After the Bullrun of 2017 and 2018 i had some of coins parked in Polo... I didnt log in in a while and after a few month i came back,
We all better check our accounts frequently or take the advises from most people - store our coins in hard/cold wallet.
I had a similar experience with an Exchange. After the Bullrun of 2017 and 2018 i had some of coins parked in Polo... I didnt log in in a while and after a few month i came back, just to see they had delisted a coin.
Well first of all, sure my part was the negligence to hold them on an Exchange after all. A total no go.
But the reason i was really annoyed was, that the exchange didn´t send any E-mail or information out to its customers.
That was a scatchy move.
I since then abandoned the exchange. I use coldstorage and just move coins for trades to an exchange i "trust".
Its time for some good DEX.
Greetings
Well first of all, sure my part was the negligence to hold them on an Exchange after all. A total no go.
But the reason i was really annoyed was, that the exchange didn´t send any E-mail or information out to its customers.
That was a scatchy move.
I since then abandoned the exchange. I use coldstorage and just move coins for trades to an exchange i "trust".
Its time for some good DEX.
Greetings
I hope you did not lose much on that one. I heard that Coinbase is being regulated by the government closely, but because of that, they are probably more responsible for their customers' coins. The biggest con is that customers will lose their anonymity.
I had a similar experience with an Exchange. After the Bullrun of 2017 and 2018 i had some of coins parked in Polo... I didnt log in in a while and after a few month i came back, just to see they had delisted a coin.
Well first of all, sure my part was the negligence to hold them on an Exchange after all. A total no go.
But the reason i was really annoyed was, that the exchange didn´t send any E-mail or information out to its customers.
That was a scatchy move.
I since then abandoned the exchange. I use coldstorage and just move coins for trades to an exchange i "trust".
Its time for some good DEX.
Greetings
Well first of all, sure my part was the negligence to hold them on an Exchange after all. A total no go.
But the reason i was really annoyed was, that the exchange didn´t send any E-mail or information out to its customers.
That was a scatchy move.
I since then abandoned the exchange. I use coldstorage and just move coins for trades to an exchange i "trust".
Its time for some good DEX.
Greetings
Jump to: