Topic: I got hacked, I need your help.... (Read 561 times)

same thing happened with me in Nov 13 2017 and hacker was same .He controlled my pc too .

it was my transaction https://www.blockchain.com/btc/tx/cc2823f5f260d4dabe6c795071c4c1273203c5078a1d33a40b7ffa0d6a20b3a6

Honestly feeling really bad to hear something like this. Its always unexpected to face this kinda situation. I will suggest you to clean your PC as soon as possible and obviously you should increase its security before using any kinda crypto wallet again. If you still continue with your old device security system then obviously hacker will try to get access again.

Your device security is the priority now and after then you should increase your current wallet security to get rid off this kinda hacking attempt in the future.

You are right, didn't see the OP screenshots...

Fair points. Ignorance is a big factor indeed, which comes to show how not ready we are to onboard the average joes of this world. In that regard, it also makes sense for centralized entities such as Coinbase and Bakkt to offer custodial services, because the gap between a clueless crypto enthusiast and someone who knows how to be his own bank in a secure way is massive.

I know Bitcoiners don't like them, and that for a good reason overall, but these wouldn't exist if the demand wasn't going through the roof, hence these entities holdings billions on behalf of all sorts of holders.

Yes it is.
Check the link in my previous reply.

I don't think the hacker had full access to OP's computer, being hacked by a trojan or something like that is unlikely IMO.

It is so much easier to just get the user SEED on a gmail draft or something like that.Most people do not hand the seed with proper care.
THe hacker could have got access to the seed long ago and he was waiting the wallet to be funded....

Anyway, I wouldn't be so sure about that remote access from the hacker, unless if there is some evidence of that.

At last, you replied.
First: "Remote Utility - Host" is a legit application, it was just installed by the hacker/malware/virus to view and control to your PC using the client.
The main malware/virus must be something else, installed though other means like browsing/download.

Your case was exactly the same as this one: forums.malwarebytes.com.
But the case was closed without an answer.

There are two possible scenarios:
1. Hacked SEED: Because even with remote access, the hacker can't still decrypt your wallet.
Where did you keep your electrum SEED? in your email, cloud disk or local disk?
2. Keylogger and manual operation: When you're AFK and the PC's idle, the hacker installed keylogger using remote access, disconnect then wait for you to use your wallet;
Waited for another AFK cue, then he controlled your PC to manually send the transaction since he already have your passphrase.

Seriously, "needing the whole amount" isn't an excuse to not-to-use you ledger.
It's not a hassle to plug the device to sign a transaction, it's safe as long as you review the addresses of the transaction that you're signing.

This is why I stopped using Windows 10. Its full of bugs and backdoors. And even if it isn't then your browser most likely might not be fully secure and you can get some malware installed that way.

Its good that you are using a hardware wallet but for the coins you need to temporarily store on a hot computer, try using a different OS and maybe a different computer that you don't browse random websites with that might install something behind your back.

You seems to have a good knowledge of security and computers so the thief must of been pretty clever to get away with this. Its good that you used 2FA on your exchanges or most likely he would of stolen those coins also.

They answered that this isn't their address...


I use electrum which was password protected and I used these coins every day but last week or so I wasnt using them. I rus some exchanges and needed whole amount, that's way i didn't put on ladger.

Where I collected and installed his "tool" I really don't know but I know that he hacked my email which I only use for random stuff and when I wanted to login on some site it showed him on my email that someone with that IP wants to login and it was obviously my IP and he easily connected to remote...

Non of my antiviruses did go off or anything was alerted, but when I realized my email was hacked I immediately changed my IP. How he logged in on my electrum I really don't know. PC is now secured and everything is under my control.
BTC are gone, lesson learned, this was expensive one.  



That was remote tool

This was log from that tool

All in all, this looks to me as a lesson learnt. I don't know how many times users such as OP will be suffering from such issues as there's always a new type of scam taking place every single day trying to drag away your money out of your hands. Some people also don't have money to buy that much maybe because they could be from a third world country and/or not too much interested in crypto or have very less (not even $50 worth of BTC or alts) held in their bags for which they don't prefer to go for any hardware wallets.

---

That's true, the sort of security we need to take care of is very high in front of what people believe it is. This platform is new and so, chances of getting hacked and scammed are reaching newer peaks every single day with more and more adoption as it's all about getting exposure of these unknown buddies (those who don't know about anything technical) to these highly professional hackers who know how to get into somebody's wallet and get the coins. When we say we are our own bank by using crypto, we really do understand the level risks it possesses and when we put a step in, it's better to be cautious than hell in order to save our everything that's kept in our PC.


Don't forget to ask him not to save his old Windows.dat (old data) of the previous OS.

@OP, What I didn't get is - when you clicked that suspicious link, wasn't there any Antivirus in your PC that may have stopped or warned you for not visiting there?

1Referee, I would not say that only reason why people keep their coins in desktop/mobile wallets is because of money which needs to be invested in a hardware wallet, but also because most of them are not even aware that such security solutions exist at all.

On the other side, we have ignorance with a completely wrong premise about what is cryptocurrency. As a result of that, many crypto users do not realize how challenging it is to be their own bank.

---

Hacker did just what you let him to do, and the real question is at what point you click/download something bad on your PC. You are very likely infected with remote access trojan (RAT), and with that hacker is get full control over your PC.

Best thing you can do now is to format disk, your OS is completely compromised.

I don't think that's much of a problem if you for example use a hardware wallet where you physically have to confirm or reject value movements. In that regard, my question would be why OP didn't use a hardware wallet.

People quite often look at the initial purchasing cost and think they can avoid dealing with that by simply using a desktop/mobile client, but that's never a good idea as we can see from the many examples of how people lost their coins. The $100ish they try to save by not purchasing a hardware wallet leads to a loss of thousands of dollars worth of crypto. Pretty sad.

What made you keep all your coins in the same wallet is the first question that strikes my mind badly.

I believe this address was also involved in some HYIP investment activities like BitRegal (and maybe the admin was the guy himself who stole OP's funds)

Whole story below, please search for this address on that page: 12HfRnx47gQnnYn9Q3Zpiuzzv6yzXTKMEJ
https://x-invest.net/forum/thread-bitregal-10-daily-btc-only-13254?pid=184427&mode=linear

I've checked walletexplorer too and it's very strange that it is just a single address and no more addresses are in that wallet which made me believe it couldn't be of an exchange (maybe).

That's neat, I wasn't aware that some exchanges already have publicly available policies about such cases.



That's why the endgame is getting rid of exchanges altogether Either way Binance's 24 hours until a police report has been provided still beats PayPal's 180 days based on nothing. How coinpayments will handle the situation is a different matter however.

It seems the owner of that address scammed many people.

That address is also mentioned from this link below.
- https://www.complaintsboard.com/complaints/orbest-investments-pm-u7777777-c754714.html

It seems it's connected to "ORBEST INVESTMENTS LTD" there are many people scammed according to the link above most of them telling that their perfectmoney account was hacked and transfer to many different addresses including the address mention above.

It seems that the hacker is an expert on hacking.

Bitcoin payments are supposed to be irreversible. What do you describe could be compared to a 'chargeback'. In terms of abuse like merchands are abused with PP.
OMG if companies start to accept to do such practices then, it will be exactly like Paypal.
You buy something, wait for the item to be shipped, and then contact the platform to say "hello, I've been hacked here is a signed message!"

No harm done, but they still need to move quickly to get a police report because third parties don't have the authority to freeze funds indefinitely. This is Binance's policy for these situations:

I agree. Those bitcoins are out of your reach, as the are already in another country exchange, so it is going to be hard to get them back

I would format my computer and buy a hardware wallet, such as ledger nano or Trezor



I looked at many websites and couldn't find any relation to coinpayments as well.

I only found this website from bitshares telegram, where this address in mentioned in a conversation in  2018

http://bitshares-telegram.blogspot.com/2018/11/1541800808.html

For getting back their coins most likely. But if coinpayments is indeed the exchange that received the coins there's no harm done in contacting their support and triggering an investigation. Best case the account containing the stolen coins gets frozen until matters have been clarified.



OP should also wipe their computer and reinstall or factory reset their operating system. Otherwise it's quite likely that the attacker has yet another surprise in store. It would also be smart if OP changed passwords afterwards.

Which wallet are you using?

The address has been mentioned here aswell: https://www.reddit.com/r/Bitcoin/comments/bgrius/daily_discussion_april_24_2019/elp0ojx/ (talking about some Blockchain.info scam).

Do you use Blockchain.info's wallet?