Funds withdrawn from Stake without 2FA.

Symphonized

member

Activity: 2226

Merit: 57

Primedice.com & Stake.com

Quote from: holydarkness on December 20, 2023, 12:20:10 PM

Stake has a representative that forward every case against them on this board to their team to be addressed, you probably want to try to PM him to get to the bottom of this issue, Symphonized, though he probably is already aware of this situation.

I usually gladly invite representatives of casinos to address an issue or to simply inform them about an open accusation against their platform, but on our previous exchange of PM, he informed me that he's well aware of every case against Stake and asked me to stop sending him PM for such matter. Thus I am not doing it in concern that my PM will be considered as unsolicited.

I have since 18th...

holydarkness

legendary

Activity: 2506

Merit: 1398

Yes, I'm an asshole

Should have asked about this sooner... OP, to be sure we cover all the bases [well, at least several of it] with the proper format for scam accusation, can you complete this thread with the supporting evidence? Screenshot of the said withdrawal from your stake account, the IP from stake's log [please cover your own IP], and conversation with their support and your host discussing as what you describe on the opening post will be much appreciated.

CryptSafe

sr. member

Activity: 714

Merit: 421

So sorry for your loss, OP. This is funny how funds could be withdrawn from your stake account without you getting any notification. I am becoming more interested in this case because it is not possible for an account with a 2FA function to be bypassed to take or withdraw funds from it. Does this mean that stake security apparatus is that weak for an account with the 2FA function to be hacked without the owner of the account getting notification about it?. Ordinarily, we all know the 2FA function, but I am still curious how this happens without any trace. This is a good follow-up to see how it happened.

yhiaali3

legendary

Activity: 1666

Merit: 1836

#SWGT CERTIK Audited

Quote from: ubercool on December 18, 2023, 11:16:28 AM

Another point I want to ask to everyone here
Why there is not authenticity check when the user logs in from a different country in a day's time or even whenever he logs in from a different country rather than his home country.?

This is a very important point to consider, but I expect the default response from the platform will be that they allow the use of a VPN and therefore the IP used can change several times per day.

This is not an acceptable excuse of course, even if using a VPN there should be at least a warning message in the email that you are logging in from a different IP. This will make you verify your account immediately.

Sunderland

sr. member

Activity: 1046

Merit: 363

Bitcoin Casino Est. 2013

Quote from: holydarkness on December 22, 2023, 01:33:13 PM

Quote from: ubercool on December 22, 2023, 12:53:54 PM

@Sunderland
Which Police/Authority you are talking about..? Is there any "Bounty hunter" to search and hack the hacker which did this to me..?
[...]

I am not sure about fixedfloat, but binance allows account freezing if you can give them an official investigation letter from your local police and you can connect the dots [they provide a table for this] that prove the address used by the scammer is one of theirs. Maybe he's referring to this authority, your local police.

Quote from: Potato Chips on December 22, 2023, 02:59:35 PM

IIRC Fixedfloat claim they do too. But since the trade has most likely been completed and money has already left their end, they will just add the address/es involved in their blocklist then freeze funds if the perp transacted with the same address.

OP could try to request the perp's trade information as well but as always, fixedfloat will most likely request legal paper/s from op's local police too.

Correct, this is a screenshot of email from Fixedfloat to one of NFT scam victims:

They suggest to contacting cipherblade but they dont take cases under $100k, and a basic report costs $100, adding a police report brings the price to $350.

Potato Chips

hero member

Activity: 2674

Merit: 865

yesssir! 🫡

Quote from: holydarkness on December 22, 2023, 01:33:13 PM

I am not sure about fixedfloat, but binance allows account freezing if you can give them an official investigation letter from your local police and you can connect the dots [they provide a table for this] that prove the address used by the scammer is one of theirs. Maybe he's referring to this authority, your local police.

IIRC Fixedfloat claim they do too. But since the trade has most likely been completed and money has already left their end, they will just add the address/es involved in their blocklist then freeze funds if the perp transacted with the same address.

OP could try to request the perp's trade information as well but as always, fixedfloat will most likely request legal paper/s from op's local police too.

holydarkness

legendary

Activity: 2506

Merit: 1398

Yes, I'm an asshole

Quote from: ubercool on December 22, 2023, 12:53:54 PM

@holydarkness
I have sent a PM to the team but no reply yet.

[...]

Maybe they're trying to get to the bottom of this situation before reaching out to you with a concrete answer. I'd suggest we wait a little while.

Quote from: ubercool on December 22, 2023, 12:53:54 PM

@Sunderland
Which Police/Authority you are talking about..? Is there any "Bounty hunter" to search and hack the hacker which did this to me..?
[...]

I am not sure about fixedfloat, but binance allows account freezing if you can give them an official investigation letter from your local police and you can connect the dots [they provide a table for this] that prove the address used by the scammer is one of theirs. Maybe he's referring to this authority, your local police.

ubercool

hero member

Activity: 1078

Merit: 504

@holydarkness
I have sent a PM to the team but no reply yet.

@TheUltraElite
I used to gamble frequently, thats why the BTC was there..
Hopefully, someone from the team will see this and will get a better reply from Stake.

@Sunderland
Which Police/Authority you are talking about..? Is there any "Bounty hunter" to search and hack the hacker which did this to me..?

@sokani

NO
NO
NO

Thats why I am heavily disturbed by this.

@AHOYBRAUSE
Wondering the same...

@EarnOnVictor
You mean to say that even STAKE wont be knowing whether 2FA has been used for this withdrawal or not..?

Quote from: EarnOnVictor on December 21, 2023, 12:45:27 PM

My friend, hacking is more than this, authenticity checks will be a forgotten issue when they are in. Hacking has different levels.

Please let me know how to Bypass 2FA, Coz we have to find a solution for that... Otherwise there is no meaning in having it.

EarnOnVictor

hero member

Activity: 644

Merit: 592

Leading Crypto Sports Betting & Casino Platform

Quote from: ubercool on December 18, 2023, 11:16:28 AM

My Question: How can a withdraw gets accepted without 2fa?
Reply: There are numerous ways that we are not familiar with.

Stake team is not providing me any details about the withdrawal. And on that they say their security is impenetrable.

Sorry about this experience, but as unsatisfactory as the response of Stake's representative is, I'm afraid is true. There is fraud here and there, even in fiats online and in banks that were supposed to be more traceable than cryptocurrency, yet stealing in accounts happens and banks can't truly provide a detailed reason for it or trace it whatsoever.

And I believe Stake can't provide additional information more than what you already know yourself since it is BTC we are talking about. Every normal transaction flows are visible to all. Only that you and they can't access the receiving end account that could later use m!xer to make it untraceable. I don't see how they can help here, unless for a refund.

Quote

Another point I want to ask to everyone here
Why there is not authenticity check when the user logs in from a different country in a day's time or even whenever he logs in from a different country rather than his home country.?

My friend, hacking is more than this, authenticity checks will be a forgotten issue when they are in. Hacking has different levels.

Fixelifix

full member

Activity: 146

Merit: 102

This transaction? 0.54092117 BTC•$ 23,713.67

Thats a lot of money,,, hope it gets solved with stake.

AHOYBRAUSE

hero member

Activity: 574

Merit: 663

Top Crypto Casino

I recently read about a similar case in the stake forum.
This user also had 2FA enabled and his funds were transferred to an unknown address.

It's a shame stake support never takes these cases serious and just replies something like "There is nothing we can do. Everything looks normal." If everything would be normal the money would still be there.

Normally stake is fast in blocking account after whatever suspicious activity. I don't understand why they wouldn't do that when a login is happening from a foreign IP and instantly withdrawing all the funds to an address that has never been used before as well.
I also don't understand how this withdrawal can be processed without entering 2fA. These days even if you want to make a tip to another stake player you need to enter 2FA, in the past that wasn't the case.
It's sad to know that money in account seems to be less safe than expected. Yet another fail of security at stake so it seems, when will that ever change.

sokani

sr. member

Activity: 504

Merit: 421

Top Crypto Casino

Sorry for your loss op. I think the possible ways this could have happened is:

If someone close you had access to your device, possibly a friend or loved one.
If you stored your login details and 2FA backup code on a password manager, mail or on cloud storage that got compromised.
If you downloaded a malware infected application that accessed and stole your login details and 2FA backup code on your device.

Sunderland

sr. member

Activity: 1046

Merit: 363

Bitcoin Casino Est. 2013

Quote from: ubercool on December 19, 2023, 12:41:12 PM

The Bitcoin Address: https://www.blockchain.com/explorer/addresses/btc/bc1qyuqc9hc9kguk693zlgq6sfk568f7r205rhts4f

- snip -

Sorry for your loss, maybe out of topic but just in case you need to trace where the money goes:

Here is what I found,
The "hacker" withdraw with this address: bc1qyuqc9hc9kguk693zlgq6sfk568f7r205rhts4f
then sent the funds to bc1q72tgjdwj8svpmc5nent856zece47cxwav7g0lc (this is Fixedfloat hot address for "order") https://fixedfloat.com/en/

The user doesnt need to provide personal data to use fixedfloat, but maybe they able to provide you with the IP and address destination from that transaction with an official request from the police/authority.
Well, if the funds goes to an exchange with KYC - its possible to identify the bad guy.

holydarkness

legendary

Activity: 2506

Merit: 1398

Yes, I'm an asshole

Quote from: TheUltraElite on December 20, 2023, 12:33:36 PM

Case seems pretty puzzling to me as to how the hacker got access to your account. But we can only do so much as speculate and rule out the common causes. In depth investigation can be done from the Stake's owners side and thus I would advice the OP to PM Stunna and wait for them to respond to the thread.

Hoping Stunna/Mladen/Eddie to respond soon and the case to get resolved. Once again, sorry for the loss.

Side note - maybe dont use casino websites as wallets in future?

Stunna hasn't been online for a while, more than five months, I don't think sending them a PM will be beneficial and solve this case, given a very high probability the PM will not even be noticed.

TheUltraElite

legendary

Activity: 2828

Merit: 1213

Call your grandparents and tell them you love them

Case seems pretty puzzling to me as to how the hacker got access to your account. But we can only do so much as speculate and rule out the common causes. In depth investigation can be done from the Stake's owners side and thus I would advice the OP to PM Stunna and wait for them to respond to the thread.

Hoping Stunna/Mladen/Eddie to respond soon and the case to get resolved. Once again, sorry for the loss.

Side note - maybe dont use casino websites as wallets in future?

holydarkness

legendary

Activity: 2506

Merit: 1398

Yes, I'm an asshole

Quote from: ubercool on December 20, 2023, 10:10:51 AM

Quote from: holydarkness on December 19, 2023, 01:21:32 PM

Is it possible that they bypassed the 2FA through this method? Is there a log on your email account that shows it's accessed from different location than yours? IF we amuse your assumption for a while that someone has access to your email, perhaps the details asked by their security team are readily available in your inbox?

[...]
I use Google Authenticator, I have known only this one from the beginning and been using it since.

In an age where any device can be hacked from a distance why reputed, large scale websites are not doing anything regarding this.
In my case, Norway is like 24 hours away on an airplane.

There has to be some logical authentication method when a user logs in from a far away country within some hours.

Reading your reply to multiple questions, my initial thought when learning that you use GA as your 2FA and your email was not compromised was that maybe that hacker was someone close to you and bypassing your account by the security key that you probably wrote somewhere and store it in your home. But given the IP is from Norway... I think that's quite unlikely.

Quote from: ubercool on December 20, 2023, 10:10:51 AM

If there is anyone from Stake here, Do tell me whether the scammer has withdrawn with 2FA or if there is any other way.
Because this cant be an answer your user is expecting..

Quote from: ubercool on December 18, 2023, 11:16:28 AM

My Question: How can a withdraw gets accepted without 2fa?
Reply: There are numerous ways that we are not familiar with.

Stake has a representative that forward every case against them on this board to their team to be addressed, you probably want to try to PM him to get to the bottom of this issue, Symphonized, though he probably is already aware of this situation.

I usually gladly invite representatives of casinos to address an issue or to simply inform them about an open accusation against their platform, but on our previous exchange of PM, he informed me that he's well aware of every case against Stake and asked me to stop sending him PM for such matter. Thus I am not doing it in concern that my PM will be considered as unsolicited.

ubercool

hero member

Activity: 1078

Merit: 504

Quote from: holydarkness on December 19, 2023, 01:21:32 PM

Is it possible that they bypassed the 2FA through this method? Is there a log on your email account that shows it's accessed from different location than yours? IF we amuse your assumption for a while that someone has access to your email, perhaps the details asked by their security team are readily available in your inbox?

No. My email is not compromised.. I have checked the sessions of my mail and its clear.

Quote from: Upgrade00 on December 19, 2023, 04:40:49 PM

We do not have access to the behind the scenes, so cannot determine how there was a breach of the website. You can only get that response directly from a representative of Stake.

Isolated cases like this are not uncommon with crypto related websites, it could be due to a hack or you allowing someone else access to where you keep valuable information.

If you do not get a substantial answer after a few days, then you can try calling then out on other websites they are active on.

There is no proper response, nor from the live support or from my VIP host. They are just giving me defined automated answers.

Quote from: logfiles on December 19, 2023, 04:54:37 PM

OP, which app do you use for 2-factor authentication codes? Google authenticator? Authy?
How about the email you used for registering to stake... Gmail?

To this date, some sites are not so strict when it comes to IP addresses. I don't know why. I used to like how some site would first have to prove if it's actually you trying to log in, regardless of your IP address.

I use Google Authenticator, I have known only this one from the beginning and been using it since.

In an age where any device can be hacked from a distance why reputed, large scale websites are not doing anything regarding this.
In my case, Norway is like 24 hours away on an airplane.

There has to be some logical authentication method when a user logs in from a far away country within some hours.

If there is anyone from Stake here, Do tell me whether the scammer has withdrawn with 2FA or if there is any other way.
Because this cant be an answer your user is expecting..

Quote from: ubercool on December 18, 2023, 11:16:28 AM

My Question: How can a withdraw gets accepted without 2fa?
Reply: There are numerous ways that we are not familiar with.

tabas

hero member

Activity: 2954

Merit: 725

Top Crypto Casino

If the 2FA method is through email then it's possible that it's your email that has been cracked by the hacker. Do you remember all of the websites that you've signed up for and did you use the same emails and passwords from all of those? Because I've read somewhere that there hackers actually goes through all of the credentials to the websites that they're in like finances, exchanges, casinos, etc. That's what I am thinking on your case. But if they're not telling you any reason or how did it happened, it actually go through the process and the money's gone so sorry about your losses OP. Remember which website you probably think the leak has happened and you're right that they should flag an account if ever some unfamiliar IP gets access and goes on withdrawal asap.

logfiles

copper member

Activity: 1960

Merit: 1638

Top Crypto Casino

OP, which app do you use for 2-factor authentication codes? Google authenticator? Authy?
How about the email you used for registering to stake... Gmail?

Quote from: ubercool on December 19, 2023, 12:41:12 PM

Does anyone have any answer to this.? A site like Stake or Binance or any exchange for that matter, why no one is doing this..?
Why there is not authenticity check when the user logs in from a different country in a day's time or even whenever he logs in from a different country rather than his home country.?

To this date, some sites are not so strict when it comes to IP addresses. I don't know why. I used to like how some site would first have to prove if it's actually you trying to log in, regardless of your IP address.

Upgrade00

legendary

Activity: 2016

Merit: 2169

Professional Community manager

Quote from: ubercool on December 19, 2023, 12:41:12 PM

The only dilemma I am having right now is even if someone have cracked my email and password and logged in, Still Stake asks for 2FA while withdrawing.
How did they passed that..?

We do not have access to the behind the scenes, so cannot determine how there was a breach of the website. You can only get that response directly from a representative of Stake.

Isolated cases like this are not uncommon with crypto related websites, it could be due to a hack or you allowing someone else access to where you keep valuable information.

If you do not get a substantial answer after a few days, then you can try calling then out on other websites they are active on.

holydarkness

legendary

Activity: 2506

Merit: 1398

Yes, I'm an asshole

Quote from: ubercool on December 19, 2023, 12:41:12 PM

[...]
The only dilemma I am having right now is even if someone have cracked my email and password and logged in, Still Stake asks for 2FA while withdrawing.
How did they passed that..?
Official reply from my VIP Host: "Nothing more than you could see in your transactions."

Does anyone have any answer to this.? A site like Stake or Binance or any exchange for that matter, why no one is doing this..?
Why there is not authenticity check when the user logs in from a different country in a day's time or even whenever he logs in from a different country rather than his home country.?

Is it possible that they bypassed the 2FA through this method? Is there a log on your email account that shows it's accessed from different location than yours? IF we amuse your assumption for a while that someone has access to your email, perhaps the details asked by their security team are readily available in your inbox?

ubercool

hero member

Activity: 1078

Merit: 504

The IP Address: 194.127.199.43

The Bitcoin Address: https://www.blockchain.com/explorer/addresses/btc/bc1qyuqc9hc9kguk693zlgq6sfk568f7r205rhts4f

Yes there was a session from that IP in my Stake account. As soon as I showed it to the customer care guy, he told me to remove the session ASAP. I did that and now even my VIP host doesnt have any details.

Stake doesnt send you an email even if you make a WITHDRAW. Roll Eyes

I have the same 2FA device for all my accounts. Exchanges and Stake but only my Stake account got emptied, my exchange balances were same, I have withdrawn everything now.
Only thing is that Email ID and passwords are not same for all.

I have scanned my PC and mobile and everything came clean. No malwares or viruses...

The only dilemma I am having right now is even if someone have cracked my email and password and logged in, Still Stake asks for 2FA while withdrawing.
How did they passed that..?
Official reply from my VIP Host: "Nothing more than you could see in your transactions."

Does anyone have any answer to this.? A site like Stake or Binance or any exchange for that matter, why no one is doing this..?
Why there is not authenticity check when the user logs in from a different country in a day's time or even whenever he logs in from a different country rather than his home country.?

TheUltraElite

legendary

Activity: 2828

Merit: 1213

Call your grandparents and tell them you love them

OP sorry for your loss,

I read your post but I could not confirm whether you actually had 2FA on during this entire time - I assume you did, otherwise you would not be speaking of the same.

If there a chance the hacker got access to your Google account and cloud synced the authentication codes on their device? Of course you could get security emails if they did but maybe you overlooked?

Also you can check the previous IP locations of the logins on Primedice, I am not sure if the same exists in Stake, but I assume you already did that in case you want to take the legal route.

robelneo

legendary

Activity: 3192

Merit: 1198

Bons.io Telegram Casino

Quote from: ubercool on December 18, 2023, 11:16:28 AM

My Question: How can a withdraw gets accepted without 2fa?
Reply: There are numerous ways that we are not familiar with.

Stake team is not providing me any details about the withdrawal. And on that they say their security is impenetrable.

Another point I want to ask to everyone here
Why there is not authenticity check when the user logs in from a different country in a day's time or even whenever he logs in from a different country rather than his home country.?

This is a rare complaint there was an intrusion on your account and we can only investigate if you care to send the latest transaction where you think the scammers withdrew your funds and how much funds and the time he withdrew it everything is available in your transaction page to check your email also if you're using an email confirmation for every action in your account, your login sessions is another, you have to check all areas of your account to see if there is an intrusion, Stake has no control on your action as long as you have the email or the tool that allow access your account, its better to change your password now both on Stake and your email.
You're a long-time member of this forum you should have followed the right format in creating an accusation that's always been the drill.

Oshosondy

legendary

Activity: 1414

Merit: 1118

...gambling responsibly. Do not be addicted.

Quote from: ubercool on December 18, 2023, 11:16:28 AM

My Question: How can a withdraw gets accepted without 2fa?

The most likely reason is that there is someone that used your 2FA to spend from your Setake account. Either the person was able to access the device your 2FA app is or you used 2FA like Google authenticator. If you save your username, password and 2FA backup on Google cloud, only what the bad actor needed was just to be able to access your email account. If you are using 2FA that your 2FA backup is backed up online or you backup your login passwords online, it is better you change the backups and deleted them from the online cloud.

logfiles

copper member

Activity: 1960

Merit: 1638

Top Crypto Casino

You may have kept your login credentials safely, but how about the 2FA recovery code?
There could have been a loophole somewhere, though you may not notice it right now due to the stress you have for losing the funds.

I would like you to check the login history on your account to see if there are any strange IP addresses that maybe been recorded while we wait for the representative to respond here

Cantsay

hero member

Activity: 700

Merit: 541

Top Crypto Casino

Sorry for your loss, Op…

Have you tried reaching out to other representatives after your interaction with the customer support? I will suggest you send a message to stunna if he can help you take a look at the incident and check what could have been the cause.

Quote from: ubercool on December 18, 2023, 11:16:28 AM

All of my BTC from my Stake account got transferred to some unknown address without my knowledge. I can firmly say that I dont click random website links and I can more surely say that I have never given my credentials to anyone. Also Stake asks for 2FA when you try to withdraw funds even when you are logged in. Still funds got transferred without my knowledge.

This is really strange, I’m not going to lie… if you don’t click on links what about files? Have you ever downloaded any file from a site that’s not secure? It could be one of those free movie sites that are overloaded with ads, anything at this point could have led to your system being infected by malware.

Well, just send Stunna a pm and pray he receives an email concerning the pm so that you can get a fast response from him. https://bitcointalksearch.org/user/stunna-81292

Mahdirakib

legendary

Activity: 1820

Merit: 966

In Search of Incredible

Quote from: ubercool on December 18, 2023, 11:16:28 AM

All of my BTC from my Stake account got transferred to some unknown address without my knowledge.

Can you post the Bitcoin address here in which your withdrawal was made?

Quote from: ubercool on December 18, 2023, 11:16:28 AM

Why there is not authenticity check when the user logs in from a different country in a day's time or even whenever he logs in from a different country rather than his home country.?

If 2fa is enabled on your account, then the 2fa code is required for accessing your account. Otherwise, Stake sends a login code to users email address whenever a user login from a new device or location. 2fa or the email code is also required for each withdrawal. Perhaps, your device has been compromised without your knowledge. Have you checked your login sessions? Is there any unknown IP address and location on your session activity?

Yamane_Keto

sr. member

Activity: 406

Merit: 443

Sorry for losing your money, but 2FA is an additional but essential verification method in all services. avoid using any service that does not have several layers of protection, and write what happened to you in detail, at least no one else will lose their money.

Wapfika

hero member

Activity: 1246

Merit: 560

Bitcoin makes the world go 🔃

Customer support usually choose the easiest way to close any existing open concern especially if the concern is already not solvable by them. It’s very hard to justify your case because you can’t provide any evidence that you don’t commit the mistake.

Even if Stake provide different IP login on your account, How can you prove that no one hacks your phone that install your 2FA. Also how did the hacker knew your login credentials?

ubercool

hero member

Activity: 1078

Merit: 504

Hi everyone,

I dont know if anyone remembers me or not but I was an active member on this forum for years..

I write this post with a heavy heart to tell everyone the incident happened with me 3 days ago.

All of my BTC from my Stake account got transferred to some unknown address without my knowledge. I can firmly say that I dont click random website links and I can more surely say that I have never given my credentials to anyone. Also Stake asks for 2FA when you try to withdraw funds even when you are logged in. Still funds got transferred without my knowledge.

The official reply from Stake to me:
"Please follow our instructions and you shouldn't experience any similar things ever again. We understand your concerns, but we are not able to track your activity across the web to be sure where the issue happened."
"We are truly sorry for what happened."

My Question: How can a withdraw gets accepted without 2fa?
Reply: There are numerous ways that we are not familiar with.

Stake team is not providing me any details about the withdrawal. And on that they say their security is impenetrable.

Another point I want to ask to everyone here
Why there is not authenticity check when the user logs in from a different country in a day's time or even whenever he logs in from a different country rather than his home country.?

Topic: Funds withdrawn from Stake without 2FA. (Read 394 times)