Okay, here is the proof.
=========
[Bittrex] Re: Your account appears to be compromised
14-06-11
####
: R###### (Bittrex)<
[email protected]>
####
##- Please type your reply above this line -##
Your request (###) has been updated. To add additional comments, reply to this email.
R######
Ri###### (Bittrex)
Jun 10 14:44
Sorry, there was a typo... your 2fa was NOT on...
R####
R#### (Bittrex)
Jun 10 14:29
Sorry to inform you but it looks like someone has hacked your accounts and performed enough fraudulent trades on it to drain the balance. We tried to stop the transactions and subsequent withdrawals but was unable to. I'm providing as much detail as I can in the hopes you can take legal action to recover your funds:
First it looks like your 2fa was on which allowed the attacker to log in:
UserName PasswordHash SecurityStamp Uses2FA Secret2FA
#############################################
Second, here is the IPs from which someone logged into your account:
123.143.140.90 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36 2014-06-09 01:31:05.860
123.143.140.90 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36 2014-06-09 05:11:45.940
123.143.140.90 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36 2014-06-09 08:29:14.697
123.143.140.90 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36 2014-06-10 03:24:43.800
123.143.140.90 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36 2014-06-10 09:27:14.283
67.248.223.88 Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/537.36 2014-06-10 14:23:30.360
95.130.9.190 Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0 2014-06-10 18:44:29.460
77.247.181.163 Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0 2014-06-10 19:10:58.693
95.211.191.40 Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0 2014-06-10 19:36:32.293
The person then proceeded to BUY CAIX at 12btcs per a unit at 2014-06-10 19:13:03.457
The person that received the proceeds is c#######@gmail.com from the follow IPs:
188.138.9.49 Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0 2014-06-10 14:39:26.547
89.207.132.76 Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0 2014-06-10 16:04:17.397
46.165.223.130 Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0 2014-06-10 18:08:46.013
77.247.181.162 Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0 2014-06-10 18:13:58.217
193.111.141.30 Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0 2014-06-10 18:25:28.293
94.23.63.47 Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0 2014-06-10 19:09:42.933
129.123.7.6 Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0 2014-06-10 19:13:45.497
128.204.203.103 Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0 2014-06-10 19:46:19.583
If there is anything else we can provide, please don't hesitate to ask.
Thanks
R####
123.143.140.90
123.143.140.90
============================================================
And finally you can find how much the hacker took here,
https://www.bittrex.com/Market/?MarketName=BTC-CAIXYou can find the 47 BTCs transaction on the time that this email described.
My btc was hacked by this motherfucking bitch,too.