Topic: wtf? i woke up and it says my bitcoin got sent to some one's address (Read 3831 times)

You don't have to be dumb to get a virus and stuff, you just have to be running an insecure version of Windows. Some versions can have a running VNC server injected into memory, the attacker can log on to it as SYSTEM, and you are pwned without ever clicking on a link, or getting a funny email. Some tools let you remotely add a user.

And never use Linux to store your wallets ?
Too big.
Give us an alternative.

Mind telling us the versions of Multibit, Windows and Java?

I ask because the original bitcoin client seeds the random number generator "with a screen scrape and other hardware sources", specifically when it's running on Windows.

Whereas bitcoinj (which Multibit relies on) simply calls SecureRandom() without seeding the PRNG first.

I'm sorry for the OP's loss.

I would say if you have more than 5 Bitcoins, buy a cheap laptop (second hand if you like) and dedicate it to storing your Bitcoins, and nothing else.
You can use Armory for signing your transactions with an offline computer that never touches the internet.
Every online Bitcoin service should be using 2FA, if they don't have that facility, then don't use them.

Holding 5 bitcoins, your cheap laptop is only going to be 10% of your Bitcoin worth, and you will be almost guaranteed security (unless someone breaks into your house whilst you have your wallet unlocked).

Until something like Trezor comes along people need to take serious precautions.
I wouldn't walk around with the equivalent of 10bitcoins in the leather wallet in my back pocket, and people shouldn't put Bitcoins in a internet connected computer that you do lots of other things on.

Come on people,  it may be virtual money, but its not virtual pain when you lose it. 100's of people on this forum can help you with securing your Bitcoins, pull you finger out and do it properly.

Just use www.blockchain.info to watch your Bitcoin wallet, for Litecoin I use http://explorer.litecoin.net
My real wallet is on an encrypted Ubuntu home partition. I only log into when I want to buy something.

Install altcoin clients on different encrypted home partitions. Never run a miner and your wallet in the same place. Never trust a 3rd party to hold your Bitcoins! 

Don't install any suspicious bitcoin-related software and you'll be fine on any os, or if you really have to, install it on another computer.

Are mac users like myself less likely to have this issue?Or should I just be vigilant as everyone else needs to be?What solutions exist for an offline wallet?As I'm looking into one due to recent unusual access attempts to my online wallet (it's safe as I have 2 factor login).My coins are still safe/there it's just more important now to get them moved to an offline wallet though.

Hauwd-the-noo people.

Can we get back to the OP's post for a moment. We don't even know what wallet they were using or whether it was encrypted or not.

Could the OP please provide some details about that ? e.g. was it QT with a password encryption ?

How did you check the balance - using the blockchain or the wallet ? Did you definitely check the blockchain? Are you sure you didn't make a payment or something and your wallet sent the change to change addresses ? In that case the blockchain would show your original address as empty but your wallet would still have access to the change addresses.

If your wallet wasn't encrypted then it may simply have been 'stone' by a virus. What software have you downloaded that may have piggy-bagged a trojan ? Are you on Windows ?

I'd be interested to know more about this.

People can encrypt the wallet file using truecrypt or archive softwares with a good password, before putting it on dropbox.

If you are a miner, save, and make multiple backups of a wallet to keep in cold storage.
Go ahead and have the network send bitcoins to this wallet, but don't actually have the wallet open.

When you need to access the money in the wallet, to be most secure, copy the wallet on a safe computer to make whatever transactions you need out of it.
Immediately afterwards, delete all files from the computer, but keep wallet backups.

Maybe they phished you. Maybe someone at drop box stole your wallet. Remember you have no idea who stole your coins. There is just this address you see. Anyone in the world who had access to the file could have stolen it. Cloud backups are supposed to be spread around multiple servers in multiple data centers all in the name of redundancy. How can you secure money in such a system?

You can install a watch only wallet. You will need a deterministic wallet like Electrum or Armory or the upcoming multibit hd.

that would be my guess as well but if my wallet was not shared publicy, they would still need both my dropbox username and corresponding pw to obtain access to my wallet.

My guess would be it was stolen from your dropbox. Not the first case I have heard of wallets being stolen from dropbox.

no, so i have my wallet on 2 computers, my personal one and my work computer at work and im the only one that uses it.  i scanned my computer and its cleaned, except for false positives.  theres no way someone could have vnc into my computer.  the only thing i can think of is that i backed up my wallet onto my dropbox.  (not shared publicly)  dumb move, i know.  i already removed it from the dropbox.  created a new wallet from an ubuntu live cd with no internet connected and stored onto a thumb drive that will never be connected to the internet.  

all i know is something got compromised, but pretty sure its not my computer.  if a keylogger was installed on my computer, pretty sure alot more would have been stolen other than my btc.

btw, scammer alert.  i received a PM from this user "promithios".  really, im not that dumb.  already reported to forum admins.

Did you click on any link that has javascript? 

I won't join the OS flamewars, but to the OP, if you had a keylogger, they've got everything. They can VNC/RDP into your machine. They don't need to then break into Multibit they can just log in like you do  (or any client, or any website, or any email service). Move any btc to cold storage until you can verify your machine is clean. Right now, it certainly isn't.

Who's stopping them.  They just only use Linux on my computers.  They can buy and use whatever they want.  But, if you knew them, you'd realize they don't have a preference.  They use the same apps on both. 

There is a lot of money behind Linux.  A TON.  IBM alone sinks over $1 billion a year on it.  There's RedHat.  Heck, Microsoft has become a top contributor to the kernel now.  Over 95% of the world's top 500 supercomputers run it.  It runs Android and Chrome OS.  It is in many of the hardware devices you use, like blu ray players, media players, etc,... 

As for Aero, Linux had that first.  People were shocked at all the kool things my windows could do in Linux, like wabble when you dragged them.  Then Aero came out -- which was understandably the first introduction to kool desktop graphics for Windows users. 

I use Windows over 90% of the time for work, running Win 7 VMs inside of Win 7 on i7s, and hosting eBusiness solutions on Win 2008 servers, in addition to AIX, in DCs.  I personally run all my servers on Centos, though. 

Wait a minute, if your children are 18 or above, why would you stop them from using any OS? More So if they can buy their own gadgets. Linux is actually a kernel, but the rest of the OS is what is usually crappy. Bad UI layout, a ton of people set on making CLI for the rest of their lives, not enough love for the GUI.

The argument I love to use is, just like mining, if there is no money involved(and a job) people just don't do very good. I mean look at Windows's UI(Not W8's Metro thingy), we have Aero, bunch of cool stuff like that.

Hardware wallets will likely be the best thing for non-technical.  Third-party services, like Coinbase and blockchain.info are good options, too, particularly for under 1 BTC for things like TigerDirect purchases and ordering a pizza. 

There's a risk they could get robbed, but hopefully they've learned to use cold storage.  But, for 1 BTC or so, I wouldn't sweat using them.  For long-term storage, they do need to make cold storage easier.  Coinbase makes creating a paper wallet very easy, but I'm not sure I like using a third party to create a paper wallet.  Nevertheless, that's probably as easy as a paper wallet is going to ever get for a non-technical person. 
 

I havent searched around but is there a sticky anywhere on the forum which is like "wallet security for dummies" that teaches step by step on how to properly secure and create both online and offline wallets. A lot of people getting into bitcoin now are not tech professionals, and these hacking incidents are going to hinder mainstream adoption (which i am assuming most of us want).

I got some help directly from one of the trusted members here, but for newbies, creating a cold storage wallet can be seriously intimidating. Remember when you got your first bitcoin? How complex everything seemed?

I think the only difference between a child/teen its they have interest/passion/curiosity. Older people (+25-30)  just want turn on the computer, open web browser and join to facebook. They don't want any different than that. Facebook, maybe search any plane ticket or read some news in their usual newspaper. 

"We very rarely change our music genre beyond age 25"

Jesus, I better stop listening to gangsta rap.

It's ironic that people use the kids argument, because they, like I said, learn rapidly on either OS, because they are wired to learn rapidly.  Thus, they are usually as productive on either, and can easily switch between them.  

What I've discovered, though, is that adults who have used Windows for a long time have a hard time using Linux for the first time.  I've concluded it's not because one is easier than the other, but simply because, like music and many other things, they've become set in their ways and don't adjust to change easily, or learn as rapidly as kids do.  Our brain connections begin to decrease around 18.  We very rarely change our music genre beyond age 25.  

As for mining, well, when I got into it the biggest problem I found was lack of good up-to-date documentation.  It's a fast changing thing.  Heck, I finally got it working with my GPUs on Fedora and Ubuntu, only to learn that ASICs were kicking butt.  SIGH.  

That said, if I were to get into it today, it would be with a raspberry pi and a version of linux setup just for mining on the raspberry pi with USB ASICs.  Here's a youtube to get your started.  

Don't put your wallet on mining PI.  

The only problem by me about Linux is. If something happens and all people die less 2 linux users, they use different distro. This is the problem of Linux.
The companies can offer good support on linux just for linux, its just a kernel.
Its nice have your own system. You choose your favorite philosophy, but the price of that philosophy usually its problems.

WTF its happening now.

Today i put 2 factor to any of my accounts just for that. Right now all related with Bitcoin its getting troubles with the security.
Of course i still thinking use Windows its a serious mistake, but Linux not is the best option, its really easy find many security holes on many Linuxes and more if it have java of any kind. And Chrome its a massive holes browser and the people still using it.

I don't doubt the OP its good IT but all looks like have any hole in your system

Linux has always given me a headache. Windows has better software, better drivers if you know what you're doing it wont slow down.

I'm not saying linux is bad it's just too damn complicated for the average user. I'm well above your average user and I still find it complicated.
Also each new release of linux breaks something. The latest releases of linuxes I wasn't able to get mining working. Although a year ago it was simply plug and play. Or should I say plug and mine. I think that may have actually been cgminers fault, I may have installed the latest one that doesn't have Scrypt support.

Okay lets assume your kid want's to install a game on linux. They have to get you to install it and setup wine.
Kid wants to install a game on windows, download game, click the exe, install, play.

Only problem with windows is that it is where the viruses/malware/etc live.

A gross misperception.  It wasn't until they were prolly 17 or so that their cousin told them it wasn't Windows.  and, the only downside he was able to point out to is that he couldn't hack it.  he liked to show off how easily he could hack windows, telling stories of how he got porn to pop up on all the computers in the class at the same time.  He had the nerve to ask me if he could download an illegal copy of windows and install it so he could hack it!  LOL

BTW, separately, when he was telling them how he did a FB phishing attack with a fake login, he told them I was the only one who didn't fall for it.  

Linux is at least as kid friendly.  You click on Firefox and it opens!  lol.  Facebook and Youtube look the same.  

I loved hearing the kids explain to other kids how it is "just like windows" and how you can do all the same things.  When people make false statements about Linux, I know they have little to no experience using it, because that's the only possible explanation.  Linux is super kid friendly.  It even has special versions for very young kids.  
 

I am not denying that linux is the "safer os", but since (imho) the majority of stolen wallets come with installing malicious bitcoin related software, that might be infected, it won't make much difference. It is not the tricky exploits that this software is using, people are knowingly installing and running it.

Harsh dude, windows is the most kid friendly os around.
They're really missing out.

i think what is happening is that the thief is adding all private keys which hold funds to his wallet so that the totals combine. and then he sends all funds to his address.

it is hard to know when the thief stole the private keys as he could have stolen them weeks ago and just sat on the private keys until he seen a balance total worth stealing

Shockingly, they've been happy with the PS2, PSP and then the PS3. They are grown up now, so they'll have to buy their own PS4. 

Setting aside games, they could do everything on the PC they ever wanted to do.  They never missed Windows, and absolutely love the performance.  They were never deprived.  I build the fastest machines, which, unlike Windows, never get slower. 

When we went camping, fishing, hiking, skiing and boating, we didn't use computers, TVs or the PSP (unless stuck in the tent in rain all day).  That didn't keep them from being really excited about going and having a great time. 

The next big gaming platform is likely to be Linux/Android, btw.  Not just because of Steam, but I demo my tablet with a wireless PS3 controller and HDMI into the TV at 1080p while playing games designed for Tegra 3!  The huge stationary console is dead.  Your phone plus a controller will blow away the PS3/Xbox soon. 

You would of loved me as a father.  Plus, you would of been a lot kooler to people on boards if you were my son.  lol

It is a bit silly to only mention windows. Apple users also run their sessions with full root access and also download their software from random sources. But I take it they would rather remain in silence in order to preserve their [ridiculous] cool factor of apple product owners than to talk about their bad experiences like op did.

But I agree "you use windows" is a bit a bullshit analysis. I've been running linux on all my computers for 8 years, I can defenately confirm that stupid people would not be saved by changing operative system. There are a couple of alternative coins I would like to try out and a shitload of projects on github I would like to toy around with, but I lack the time check the sources or, in some cases it's just binaries that I don't trust.

Then you are a really shitty father. Your kids might want to play something called games, most of which require Windows. Sure you can use Wine, but how stable will be the games there? Also, most games like BF3/BF4 require Origin which is Windows only afaik.

As someone who has used both nearly every day since the beginning for windows (3.1) and a long time for linux/unix (prolly near 2000), and spent a lot of time learning security, the security model is completely different, especially considering features like SE linux. 

I never let the kids use Windows, although I virtually never use it except for work, where i use it over 90% of the time.  On Linux, they can't install things because I don't give them root.  And, if they managed to install anything, the program would be limited to their access.  on linux, the default user access only includes write to their home and tmp, and no one can read another user's access. 

is it technically possible to compromise linux?  of course.  but, the contrast in likelihood is huge if you have kids using it, and you know how to secure the computer from the kids.  i tried and could not find a way to secure the computer from the kids in windows.  it's just to easy to hack -- and thus too easy for malicious software to infect. 

at the end of the day, knowing what i know, i would never put more than i need to spend in one transaction on windows or a mobile device, including Android, because I understand how easily compromised they. 

i may have created one of the first key loggers back in 1982 on an Osborne 1 with the CP/M OS.  it wasn't malicious.  i just wanted function keys in dbase II to work.  but, because it loaded as part of the OS, it was transparently intercepting all keystrokes no matter what software you were running.  i'd demo by telling people to type "this".  they'd be amazed when they watched and when they typed the last character, it would say "that".  basically, it monitored for words and replaced them. 

Then DOS came out with an official way to do this called the terminate stay resident function (TSR). Utilities such as Borland Superkey became available that used this.   

Windows descended from DOS.  Windows 3.1 originally ran on top of it. Being a single user OS, it has no security.  Then, later, security concepts were introduced. 

By contrast, UNIX was a network SO when linux was created by Linus.  So, it was always built with user security in mind rather than an after thought.  SE Linux is killer to have, especially on your servers, because it helps to lock down processes.  then there is chroot and other user and process isolators.     

Then there are the security implications of peer reviewed open source versus closed source.  History has proven that hiding the source does not hide the vulnerabilities.  Also, having a lot of developers collaborate on code is likely to be more secure than having very few develop and review critical parts.   

That said, paper wallets rock.  just don't lose, burn, get water on, etc,... your last copy!  that would suck.  While I trust Linux a heck of a lot more than Windows, if you have a lot, offload it to cold storage until you need it. 

That is fact because
1. The majority of people uses windows
2. Those who use linux are usually much more knowledgeable about how to keep the data safe

It has very little to do with the os itself.

Am I the only one that finds the tx strange? https://blockchain.info/bg/tx/1be54013944faaf392f2c864ba347e69716dfaf7caceb17c0ab5aca0c80308a5

Apart from OP's input, there were several others. 32 coins stolen? Also, what is the wallet client used?

If you have an offline wallet, you'll just the PUBLIC address to look it up someplace like blockchain.info

Don't put any private keys on that computer until you know what happened. And if any were on there, think about making new paper wallets and moving them. Better to be safe than sorry.

if i have an offline wallet, how do i see how much bitcoins is in my wallet?  (serious questions)
i usually just have it up on my screen minimized and i check it every now and then.

Majority of the people who got their wallet stolen uses Windows. That is a fact.

Yes, you've been hacked.

This is why many of us have been recommending offline wallets for a couple of years now.

Is it possible you've never heard of offline wallets?

Maybe you are lucky enough to have a zero day malware which just go into the wild. So your malware signatures doesn't have it yet.

Don't underestimate hackers, they become more and more crafty everyday.
Keylogger, they could also have used their mining rig to crack the password if it was weak enough.

This is bullshit. Using windows, never had any wallets stolen. Stupid people will install malicious software no matter which os they use. From what I see most of bitcoin stealing stuff comes with bitcoin related software, a different os will not protect you from that.

They would just need the private key(s).  Hopefully you don't have a virus or key logger but the odds are you have some type of malware given that is how most people lose bitcoin.  

If it's more than you could stand losing keep it secure and offline. With a cold wallet generated on an offline computer.
I'm going to open a safety deposit box for my Bitcoins and keep the coins distributed across several cold wallets stored in the box.

yea im running windows but how does that even happen.  im 99.9% sure i dont have a key logger.  i work in IT and im not that dumb to get a virus and stuff that easily.  they would need to have my my wallet in order to send themselves bitcoin right?  it is password protected.  im using multi-bit

You may have malware on your computer.  Was the wallet locked? What software was it? Was it a brain wallet?  Lots of variables, but you should assume that your machine is compromised.

If you have other bitcoins, it would be smart to move them to a new address using a safe machine in order to protect them.  Are you running Windows?

Let me guess, you are running Windows. 

Never use Windows to store your wallets.

its on my computer

It looks like it. You may have a key logger.  Where was this wallet? If it was a web wallet did you have two factor authentication on?  If on your own machine, you will want to check it.  I didn't retype the outgoing address to look at it.

did i get hacked?  how would they of hacked into my wallet?