Topic: Attention! This address is stealing BTC now! - page 2. (Read 5226 times)

I'd say they are pretty good. Do you think none of the programmers working at dropbox know about bitcoin?... "Hey guys, I just published that password code, see you after lunch!" ... (quick trip to starbucks to download a few wallet.dat files) ... "hey guys, I found a problem with the password code... oops!"

OK, so your Mtgox and Drop box were compromised... buy you say: "encrypted disk image to store the wallet" <--Was that PassWord the same too? and then you say: "zipped the wallet file with a long password"

So, you backup your wallet to Dropbox that could have been compromised, in a Encrypted .DMG that might have had the same password, that was Zipped with a long PW <--- BTW Zipped PW is by far full-proof...

I am thinking it is more likely your computer is compromised.... better check that also...

just what are the odds that someone knew what to look for when dropbox had their technical issue?
honestly.. unless there was some way to use google to identify wallet files on dropbox's website OR
someone knew it was there..

i find it highly doubtful that a person on the internet just happened to come upon that file on dropbox
and had the insight to brute force the password.. and then transfer the bitcoins. heck.. just finding a
person on the internet who even cares about bitcoins is a challenge let alone finding a wallet file during
a few hour period.

A firewall is better than an av scan to protect your wallet.dat Probably there will be more and more exe's that look for wallet.dat and upload to a server somewhere. A lot of time it will come in the guise of a special video player or something along those lines. Even with a firewall, people are inclined to grant internet access to it because otherwise, the video won't play.

In this case sounds like it was likely the copy on dropbox.com.

Sorry to hear about your loss nakowa. I hope you did not loose too much.

Please notify all the major exchanges about this so they can keep an eye on transactions flowing from those two addresses.

Can you elaborate on why running namecoin binaries in general (and not just any binary) is risky?

OP, how strong was your password on the zipped wallet that was on DropBox? How many chars, and what kind of mixture of lower case, upper case, numbers, punctuation, etc, did it contain?

And what format was the zipped file in? WinRAR?

I hate when people make these posts and make you ask every little detail in order to try to help them figure out what may have happened. It's like pulling teeth. Just fucking give us all the info instead of making us ask for every little thing. Don't make assumptions like "I'm 99% sure that XYZ happened" and then think that posting additional details is no longer of any use. You are of course free to make your assumptions about what might have happened, but at least post all the necessary info that is required to come to that conclusion. If you leave things out like the info I asked above, you leave the possibility in everyone's mind that your zipped & password protected file might actually have been impossible to brute force. And then the community still has no idea what happened in your case and we are no closer to figuring out how people are getting hacked, and your entire thread was a waste of everyone's time. That also leaves open the possibility that all the "I was hacked" threads are troll or FUD threads.

Sorry, OP, this is not meant to single you out. This is a common theme in all the "My BTC was stolen due to hack" threads.

You knew about this, and didn't move your coins to a new wallet!?  If your zip file was password protected using the old standard zip password protection, it is vulnerable to a known plaintext attack.  Your wallet.dat contains many known strings of sufficient length.  Cracking it takes a few minutes at most on a normal desktop computer, no matter how long your password is.

thats why I'm leaving, got no email from them about this security issue, ridiculous
gonna try skydrive + truecrypt combo now

Dropbox didn't require a login password for a while a couple weeks ago.  Anyone storing a wallet file on dropbox should've promptly transferred the bitcoins to a new wallet file.

I'm 99% sure now that someone hacked into my dropbox account, where I stored the first backup of my wallet.dat a few months ago, when I started mining. The file was compressed and with a rather long password, but I assume It wasn't a problem for some bruteforce app to crack it.
I'm so glad that this was my very old backup and I lost only 0.46 BTC (doing encrypted backups only on usb drives now)

btw http://techcrunch.com/2011/06/20/dropbox-security-bug-made-passwords-optional-for-four-hours/

goodbye dropbox...

@presha

A targeted virus, one that just opens wallet.dat and sends it off, one that you ran on your own accord, will not be detected by antivirus. No antivirus company yet looks for programs trying to access your wallet.dat.

Please tell us what you have downloaded and run lately so that we can find the program doing this.

Sure it was sent by your client, or did you store your wallet.dat somewhere else as well?  Look up the transaction ID in blockexplorer, and search for the first 20 bytes of it in debug.log.  (It is in ~/.bitcoin/ under Linux.  Have no idea where Wintendo stores it.)  If you see an "askfor tx transactionid" somewhere, the transaction was initiated by someone with a copy of your wallet.dat.  It looks like your own, because you have the same wallet.

I would in this case, format everything and start fresh.  But thats just me. 

my client sent 0.46 btc to this address today.. by itself.
im on win7x64 with latest updates, scanned the whole pc, checked open ports and autoruns.. and nothing.

i need help cus this is serious, if my antivirus and 4 anti-troyan apps say my windows is clean and it clearly isnt, there is something wrong.

http://blockexplorer.com/address/18hMx774ULBKJKMbwo5reBm3zW8unJ92FW

The address had .02 in it then it got sent out.

can anyone verify this adress:
18hMx774ULBKJKMbwo5reBm3zW8unJ92FW

?

my btc-client told me, I transfered the btc I got earlier from deepbit (but i didn't transfer anything)

are you running MS windows

There have been several threads about people who's money was sent to the same group of addresses. We are still trying to figure out how the computers are being compromised.

Could you give us a list of bitcoin related downloads you have made.
Do you feel like your computer is susceptible to traditional viruses?
Do you have your wallet online anywhere unencrypted?
Have you run any namecoin binaries?

from where?



how much?