Topic: "Warning: Cryptocurrency Theft Involving Kaspersky Password Manager - My Story" (Read 479 times)

Storing your private keys (aka seedphrase) in a password manager is no less safe then storing all your sensitive passwords in a password manager, IMO.
For some it might be safer to use a PM then keeping a physical copy in their house where it could be lost or stolen.

Millions of bitcoins have been lost forever because people lose the physical copy of their seedphrase.
So it might be argued that storing a physical copy of it somewhere  is no less risky then storing it online.

But if you do decide to store it online make sure to make use of Bitcoin's hidden wallet feature.
So even if someone steals your private key they will never be able to access your wallet without knowing your secret passphrase to open the hidden wallet.
Obviously, don't ever store your passphrase with your seed phrase. And make sure you don't ever forget your passphrase because without it
you will never be able too access your wallet with the seedphrase alone. Ideally your passphrase should be stored only in your head.

For those who don't know a hidden wallet, also known as a 25th word, is simply a wallet that is accessed with a passphrase that you make up to access your wallet.
Many hardware wallets such as Trezor and Coldcard offer this feature. It is a wallet within a wallet.

Hidden wallets are a great security feature that everyone should learn how to use IMO.

Very sad story and I understand your feelings towards  Kaspersky team members who  you have blamed of being involved into the  stealing of your SEED. As has been said by others the use of any software  to keep SEED is a bad practice. However there might have  been on your machine a malware which has stolen   your SEED by some way. Why don't consider such development?

Are you sure this is your transaction? Can you give us the address that you kept these coins on?
Can you explain what motivated you to store coins on a password manager, especially after the Last Pass incident?
I also use a password manager for some things (power company payment panel, emails that I rarely use, online stores) and I feel fine doing int because what's the worst thing that can happen? If somebody hacks it they'll get my name and address... boo hoo, pretty much like every store that delivered something to my home. I'd never keep my seeds there, because you have to realize what could happen if there's a leak. Your whole money could be gone without a trace, so let's not be scared to use a password manager, just do it for things that can't hurt you.

I'm sorry for your loss, but I wonder why you would use a third-party password manager to keep your seed phrase when you have such a large amount stored in your wallet, and you shouldn't be using Trust Wallet to keep your assets in the first place but instead use a completely decentralized wallet to store your assets if the amount is high and anything above 0.5 BTC is very high in my opinion, you should even buy a hardware wallet to store your assets since it's a much safer way.

Google is one of the trusted platforms on the internet, and I would even be hesitant to use Google's services to store my sensitive information such as private keys or seed phrases because I know no matter how safe it is, it is still a third-party and anything can happen.

I'm not sure that victim-blaming is the best choice for this kind of situations. Of course we all know (theoretically) that we should avoid storing important information in app/programs like password managers, and actually I use one as well but I don't store any crypto information in it, anyway if it's actually Kaspersky's fault than it's clear that they are to blame. OP is paying for a service that is corrupted. Blamed him is just ridiculous for me. Should have he been more cautious? Yes. Did he do something bad? No.

It's probably another shit-post. But what kind of shit-post? Tin-foil hats on, but this might be a sort of 4D Chess "test" to know who might feed the troll and continue the discussion.

This topic might be deleted/transferred to Archival probably within one week.

¯\_(ツ)_/¯

This is what I am talking about, how can you have over 1 BTC and choose to use a password manager to store your seed? You can afford a hardware wallet like Trezor or some brand new airgapped device like Keystone 3, mine came with a steel for writing down the recovery seed if you want to and still keep in a case that comes with the hardware wallet.

You obviously don't know a lot about crypto wallet and things you must not do with your wallet, keeping recovery seed or private key online will expose it to others, they are to be kept offline that's why I will always recommend a offline wallet like Trezor or Keystone, it's not too late to learn from your mistake.

This is going to be a painful lesson that would probably take a very long time to forget, over 1 BTC right now is not a small amount of money, I hope you will accept your mistake and work towards buying back what you've lost, sorry for your loss..

yes, this is also a mystery to me, there were 1.32605552 BTC in the wallet. Why this happened I don’t know

you didn't have to tell us everything about yourself; we're definitely okay with the fact that your OP says - ulitov43... This is exactly the type of mistakes you make with your assets too.. cus why would anyone store their seedphrase on a browser/password manager?

---

it's unlikely that your actions were inadvertent and it didn't even occur to you until it was stolen... You seee, this is exactly the same thing I keep preaching everyday in here: you can't eat your cake and have it so it must be made clear that your wallet's security lies solely in your own hands.
Sorry for your loss though.

Sandra 🧑‍🦰

Sorry about that.

You own more than 1 btc and yet you saved your seed phrase to a password manager. It's always been tipped that you shouldn't put your seed phrases to a cloud storage whether it's from kasperky or any known anti virus password managers.

It is a very vital information and people working from these companies have an idea on what we're saving from them especially if it's requiring to be updated and connection on the internet.

The most basic way of keeping the phrase is through writing on a piece of paper and keeping that offline with some backups. I hope that you recover from this loss.

Sorry for your loss, 1.32BTC is a lot of money. But let's see. First of all, there is no proof that the reason it happened was a Kaspersky product. Apart from phishing, there are lots of other ways bad guys can steal your precious coins.

I somehow didn't get the part regarding the second copy of your wallet on your phone.. You claim that your balance is still there? How is that possible? 

At first I thought OP had linked the transaction hash where their hacked coins were consolidated along with others but I went to check all the inputs and couldn't find any amounting to "1.32605552 BTC" 

It's either OP confused some data or this is just another fake story (meh) -- yet another regular day in bitcointalk lol.

Hey OP, that's a tough situation with your crypto getting swiped. It's super important to look out for security in the crypto world. Maybe try chatting with some cybersecurity peeps? They might have insights into any weak points in your setup. Stay on guard against phishing and keep an eye on your accounts for anything fishy. It's a bummer losing funds, but I'm rooting for you to get things sorted out!

Your story is sad, but who can you blame but yourself? You yourself made a mistake (neglected security) with your assets. Cryptocurrencies primarily imply personal responsibility for crypto safety. What they call here “being your own bank”. The seed-phrase should not have been shared (stored in a Kaspersky Password Manager) with anyone. What is gone can't be returned. Get used to it with cryptocurrencies.

Could you tell us on what basis the criminal case was initiated? Was this charged as theft? As far as I know, bitcoin is not an officially recognized financial asset (or anything like that). Stealing something that doesn't officially exist is not theft, right. I know it sounds contradictory, but while the legal status of cryptocurrencies has not been determined, this is exactly what happens.

Notepad? Are you kidding?

That's probably even worse than writing all your passwords on sticky notes and putting them on your PC.

Why don't you use a local password manager like KeePass XC or BitWarden, it is much better than using a notepad without the possibility of getting hacked like many of these commercial and insecure password managers.

That's why it's a really bad idea to use a password manager, it was never a popular thing in the first place so it's really weird that people are using them and it's a surprise that there's still people using them despite all of the hacks and breaches on this services. That's why you should always just go for the old school way of password management, Notepad or maybe even a piece of paper because that way, you're only vulnerability is that you're going to be breached on your own computer which is highly unlikely when you know how to keep yourself safe and you don't just download files and games online anywhere that's not even remotely trusted. If you're still using some sort of password manager that's connected to a database then you should know that you're risking all of your accounts being stolen by malicious entities that will stop at nothing in accessing your accounts and getting what valuables you've got.

I do not even need to read the rest of the post.  I am not saying what happened was a good thing but it was your mistake.  When holding Bitcoin you have to trust NO BODY.  Not even the 'best Password Manager' available.  The point was not having to trust any body at all and rely on our own responsibility.  You failed that step and this is what happened.

Sorry about the loss.  But you need to take more care about your own Wealth and stop trusting strangers.  Would you give me your Seed to hold it for you?  Probably not.  Then why give it to a random Server you know exactly nothing about.

I sincerely hope you can recover your coins, unfortunately this is unlikely even if the amount that was stolen should guarantee some sort of investigation, however if the person that stole your coins is not on your country the chances of recovering your coins will drop even further.

With that being said, you need to change the way you secure your coins, as it is widely accepted that storing your coins in any device that is online all the time is a bad practice that can lead to your coins being stolen, a reality you can confirm due to your own negative experience.

I don't agree with the general sentiment on this thread that password managers are never to be trusted.

If password managers are so bad then why aren't we hearing a lot of stories in the media about people having their passwords compromised or hacked into?
The only major thing I ever heard was Lastpass having their users emails compromised but as far as I know these kind of hacks  did not involve any actual breaches of stored passwords.

I'm not advising people to store their private keys online that is their own decision to make but to say that password managers are never to be trusted does not make any sense to me either.
If there has been any actual breaches or hacks of the password manager software resulting in people actually  having their passwords stolen I would love to know about it.

Also it is just not practical to have to memorize hundreds of different passwords or write them all down, so most people have no choice but to use a PW manager.

Having said that, some password managers are better then others and again personally I would not use any password managers that are not 100% verifiably open source.
Since Lastpass and Kaspersky password managers are not open source I would not use either one of them.
 

That's the reason why I don't trust password managers, because the thing is it is connected to internet and database and because it is an application for password for sure those hackers or malicious intents targets this kind of application, that might explain why you've lose your bitcoin, I hope you've learn your lesson that instead of storing your password in important account such as crypto wallets better store it in a paper or any kind just don't put it in internet because it can be easily compromised, well, for me I have a special way of storing my passwords and seed phrase but its a secret, its just I have a multiple series of condition before I can access my password storage but do not I'm not storing it in internet. Maybe you have your own way of securing and storing your passwords rather than relying on applications that will handle your passwords.

One of them main reasons on why people do lost coins which is "lack of knowledge", sorry to say but due to this reason you have lost your coins.
If you've been able to give up some time on reading up about crypto security or safe keeping or safety or whatsoever correlated to it, then you would definitely be able to read up
that storing up your keys or phrases on any forms online or services is never been safe. Its true on what those people been saying above that writing it on a piece of paper
is much more safer rather than on saving i up with those password manager on which you are really that putting up yourself on such big trouble when it comes to privacy.
We do know that they do have those access if they wanted too and since 1+ BTC amount isnt a small amount then its not shocking that they will not be interested with that.
Sorry for your loss.

Pardon me, but I'm confused. The transaction during July 12, 2023 shows that more than 1.32605552 BTC was sent to 3LwDzjA1xH8amCHuvU9YjWST6rsyfPmvmU

Kaspersky employees may not be involved as much as they do not encrypt passwords well or there are hackers who managed to find out the Kaspersky Password Manager password, taking into account that such data is stored in the cloud and there is a good possibility that third parties may You can access the encrypted version.
Encrypting seeds individually is considered a risk, let alone a third party. It is always better to store them cold and write the words on a piece of paper.

Never store your seed phrase inside a password manager. The only exception would be if you encrypted the seed phrase with your own encryption, such as an RSA-2048 key and GPG, before uploading it to the password manager. But even that is risky if you don't password-protect your encryption private key as well.

It seems that you cannot trust the security of password managers, not even the well-known ones.

It's really sad that in the process of trying to secure your sensitive information you end up losing the primary reason for securing it, being your Bitcoin, it can be really frustrating and I'm sorry for your lose. I learned in this forum that it's not safe to store your sensitive crypto information, like your seed phrase online, that it's far better to store them manually, write them down on papers and hide in different secured locations.

I don't think that it was necessary for the OP to share his name and the city where he lives, this is an anonymous forum and such information is not necessary here, just as Bitcoin is decentralized and promotes privacy, the forum also promotes privacy.

In the present time password theft has increased in the world of internet. It's really sad that your story turned out so bad afterwards. The stolen item may not be recoverable and you can move forward by learning from now on without despair. It will increase your awareness and henceforth you must verify everything before sharing your personal information. Phishing attacks are one of the most common types in the crypto space and can cause significant financial losses to victims. Therefore, digital asset investors and users must be cautious and cautious when dealing in digital assets. Recent reports show an increase in the number of scams targeting the industry. That is why it is important that investors only use trusted exchanges and wallets.

Wallet seeds must be stored custodial and offline.

I don't know Kaspersky Password Manager will store user passwords on their database or on other third party databases. The practice to rely on a third party to back up a wallet seed is basically terrible.

How to back up a seed phrase? will help OP to have better pracitce on backing up a wallet seed.

I can't comment on the kaspersky employee accusation as it's hard to come to such conclusion from this story alone plus it doesn't rule out the problem did not come from your end. It also doesn't help that you had a poor setup in safekeeping the B's.

I'm curious tho if you end up using a my kaspersky account for the password manager? from what I read, this enables cloud storage + data syncronization accross devices so as a start, try to request for a login session list from kaspersky and see if you find anything you don't recognize.

Thanks for sharing your story and I'm so sorry for your loss. I think you're at fault, you shouldn't have stored your seed phrase on a password manager. It doesn't matter how reputable the company is, as long as it's connected to the Internet, it's not safe. Since Kaspersky's didn't report any security breach at their end, it's very likely your device is compromised and an infostealer had stolen your seed phrase right from the password manager. I don't think you'll have any luck recovering your funds but I hope you learn your lessons and you use offline backup next time.

Sorry to hear about your loss. Unfortunately, I don't think that you will get back your Bitcoins.
I have never used a password manager in my entire life. I don't store important passwords even in my browser's password manager.
Why would you store your 12 word seed phrase in a centralized password manager? This is like giving your credit card details to a random stranger. Never trust anyone when it comes to your private keys/see phrase. Trust yourself and keep the private keys/see phrase in a piece of paper that is hidden in a good place. Maybe having several cold wallets and not keeping all eggs in on basket is another great advice, but I see that you already did this. I would totally freak out if I have all my BTC stored in only one cold wallet.

Sorry to hear about your loss. But when you are using a password manager, it essentially means you are entrusting your secrets to a third party. Pretty much how you entrust banks with your money. Banks do take responsibility but such third party tools do not take responsibility.

Paper wallet is the safest wallet if you are living in your own house and no random persons are coming inside. But the moment you are using a third party tool to safeguard your password, your safety is already compromised. I am sorry that you had to learn it in a hard way.

The police won't help you in Russia, you know that yourself. Now, if you lived in America, it would be another matter, since bitcoin is accepted by them. And in Russia, bitcoin is nothing, and therefore nothing has been stolen from you...

This is where the mistakes lies, you cannot manage to have your private keys stored on any centralized website or platform, its good to have your seeds backed up in two different means, but using a centralized means is a very bad idea, just as the case of OP using Kaspersky, we should even avoid the use of any password manager or google stores or cloud storages, as long as we are not the only one having access to these keys, anyone can tap into having access on them, but i will like to give some recommendations as alternatively to the ways we can safely secure our seeds without falling under risk.

storing seed phrase with washers
https://bitcointalksearch.org/topic/securing-your-seed-phrase-with-washers-5389446

seeds backup tools
https://bitcointalksearch.org/topic/list-bitcoin-seed-backup-tools-5263482

additional security to your seed phrase
https://bitcointalksearch.org/topic/crypto-security-additional-protection-for-your-seedprivate-keys-5230920

Here is what you can do in this case. You can sue the company you think is responsible for this. Some people have done this in past like you can read in this article:

https://timesofindia.indiatimes.com/gadgets-news/lastpass-data-breach-someone-sued-password-manager-after-losing-bitcoin/articleshow/96769155.cms

Chances of getting the funds back or getting paid the compensation is very less but still you can take this route if you want.

This is not the first time such a case is happening. If you check online forums, you can find many other such similar cases like this one:

https://twitter.com/RMessitt/status/1723141037856596175?s=20

May be you can connect with such people and ask for what actions they took.

This is quite a bold accusation against a company that is engaged in catching scammers. But tell me, OP, if the doors in your house are simply closed but not locked, will someone be to blame for this? Storing your seed phrases in managers, on iPhones, or in places where viruses can penetrate is akin to walking on the edge of a knife.
Why are you sure that your iPhone is virus-free? Do you think Apple products are invulnerable? I see you have created a complaint on the Kaspersky forum, so we can see what the answers are.

https://forum.kasperskyclub.ru/topic/443489-preduprezhdenie-krazha-kriptovaljuty-s-prichastnostju-kaspersky-password-manager-moja-istorija/


But Kaspersky itself gives recommendations, and since you are a Russian speaker, I don’t think you need a translator.
https://www.kaspersky.com/about/press-releases/2023_doublefinger-on-the-trigger-a-multi-stage-malware-targeting-cryptowallets
https://vc.ru/crypto/727570-laboratoriya-kasperskogo-kriptokoshelki-podverglis-slozhnoy-mnogoetazhnoy-atake

Damn, sorry for your loss. I've been keeping my seed phrase only on a piece of paper, and passwords in excel documents. I don't trust those passwords managers.

That's really tough, OP. It's frustrating when you've taken precautions and things still go south. It's indeed a reminder for everyone to be cautious and prioritize manual storage for sensitive information. Sharing these stories helps create awareness. Hoping for better crypto experiences for you in the future

Thank you for sharing your story and we are really sorry for your loss. It's really surprising that it is from a trusted company like Kaspersky, but they are not guilty until it was proven so it's really important not to save anywhere online your private key the writing method is way more better than saving it or you can save it online but in an encrypted container.

We really not sure how do they managed to get it and we are not sure whether your device is infected and they managed to go to your system without you noticing it. Now I was thinking that even though if you have hardware wallet, there's still risk if you have save your seeds online.

Sorry for your loss. But you have the most part to be blamed for.

You store your seed phrase on a password manager. That is wrong. Having it stored on a paper is better. You can have like three copies of it stored in different locations. If you are afraid of those that can see it, then use passphrase with it.

Another thing is that you are using a close source wallet. Use open source wallet instead although this is not about what you are talking about but close source wallets should be avoided.

Storing vital information online is high risk,  and no one with knowledge of that risk will ever advice the use of online storage both for password or storing other vital info,  any ways sorry for lost and thanks for bringing this up here I believe this will help other users of online strong managers to be careful and take action when need be.

I hard an ugly experience also some time ago where I lost my funds from phishing attack on my trust wallet,  can't clearly say how it did happen but I guess it will be something similar to this your own situation.

Since then,  I have become extremely careful and I try as much as possible to do manual storage instead of online,  because there is always a backend person watching you.

Very sorry for your loss.

Many would say to never store such information online. But if you must store it online, use only software that is 100% open source.
There are some great open source password managers out there. Some are even free or very low cost.
Password managers hold the most critical and sensitive private data of our lives. So I would never trust one that is not verifiably open source, with well-known history and great reputation.

Again sorry for your loss.

Dear colleagues,

I want to share a story with all of you that happened to me and may be of interest to everyone who uses cryptocurrencies and security technologies. My name is Igor, I am a resident of the city of Slavgorod in the Altai Krai, Russia.

On July 12, 2023, I became a victim of cryptocurrency theft in the amount of 1.32605552 BTC. I had access to my wallet only on a paper medium, as well as through Kaspersky Password Manager, where 12 secret words were stored to access the wallet in the Trust Wallet application on my iPhone XS Max. Amazingly, my funds were transferred to another wallet, despite the fact that I did not receive any phishing or spam emails. Kaspersky suggested contacting the police to initiate an official investigation, which I did. A criminal case was opened, but, unfortunately, Kaspersky does not respond to police requests.

I am convinced that employees of Kaspersky are involved in this case, as I have a similar wallet on another iPhone with the same secret words in Trust Wallet, but without using Kaspersky Password Manager, and my funds remain intact on it.

It is very important to me that other users learn about this fraudulent scheme to avoid becoming its victims. The lost funds are of great value to me, so I appeal to you for support and advice. Perhaps someone among you has encountered a similar situation and can share their experience and advice.

Thank you for your attention and understanding.

Igor.
Transaction hash: 81cfe97cc16a49398d6986032ec8f6970ea80df5aa0990dcf0164de87136f5bf