I just got hacked - any help is welcome! (25,000 BTC stolen)

[Xenland]

I didn't read too many pages in so I'll just throw my two cents in,
This sounds like a case of lack of security.
Trojan or not if you made as many backups and encrypted as much as you say you did
this shouldn't be a problem.
Nobody just has fat stacks of BTC/cash just lying around ready for anybody to take especially in this economy.
Next time encrypt your wallet.dat file copy it to an inaccessible folder in your smart-Phone like i do,
Delete the wallet.dat file from your computer.
Problem solved!

[1714022195]

1714022195

[1714022195]

1714022195

[1714022195]

1714022195

[1714022195]

1714022195

[bcearl]

What do I get if I get your money back?

[benx009]

It's stuff like this that gives govt's a legitimate reason to shut bc down, unfortunately...  Banks have protection against this sort of stuff, at least.  If this was a really was remote cyber attack, which seems likely given the circumstances, I highly doubt the perpetrator is noob enough to start selling massive amounts of BTC on mtgox, which can probably be traced back to him.  Chances of the reversibility of this transaction are bleak at best, though from what I gather, that's supposed to be one of the fortes of bc.

My condolences to the OP.  Hopefully people learn from this.

[wareen]

I didn't read too many pages in so I'll just throw my two cents in,
This sounds like a case of lack of security.
Trojan or not if you made as many backups and encrypted as much as you say you did
this shouldn't be a problem.
Nobody just has fat stacks of BTC/cash just lying around ready for anybody to take especially in this economy.
Next time encrypt your wallet.dat file copy it to an inaccessible folder in your smart-Phone like i do,
Delete the wallet.dat file from your computer.
Problem solved!

His "problem" is that he just lost 500k$ - and no, your suggestions have not solved his problem.

Sorry but I think the last allinvain needs now is another 100 people coming here and telling him what he should have done - I'm sure he has a pretty damn good idea about that himself by now.

[kwukduck]

allinvain, you're not the only one.
Same hacker got to my mtgox account, he converted the USD i had to bitcoins and transfered them to the same address.

I'm not sure how he got in, if my pc is compromised or how this happened, i've been scanning and analyzing my pc for the past hours but nothing indicates a virus or whatever...

[FreeMoney]

I agree with people saying this was probably a physical attack. Wait to see which co-worker stops coming in?

I'm not sure though because of the backups you exposed and the coins left behind makes it seem like an out of date wallet could have been used. Can you examine the coins remaining and see if they are the newest addresses somehow? Was it a truly trivial amount left behind or something a thief would normal take?

[benx009]

allinvain, you're not the only one.
Same hacker got to my mtgox account, he converted the USD i had to bitcoins and transfered them to the same address.

I'm not sure how he got in, if my pc is compromised or how this happened, i've been scanning and analyzing my pc for the past hours but nothing indicates a virus or whatever...

I agree with people saying this was probably a physical attack. Wait to see which co-worker stops coming in?

I'm not sure though because of the backups you exposed and the coins left behind makes it seem like an out of date wallet could have been used. Can you examine the coins remaining and see if they are the newest addresses somehow? Was it a truly trivial amount left behind or something a thief would normal take?

If kwukduck really got hacked by the same person, a physical attack seems unlikely.  Unless kwkduck and the OP are acquaintances IRL...

[SlaveInDebt]

Conveniently blockexplorer is down as well... Im sure many have their eyes out for you and surely someone could be hired to help you recoup your lose given the right incentive. Light speed and good luck OP.

[fireside]

so my only question is how can we be sure that this guy really had and lost all of this BTC? I mean really all a person would have to do is see someones posted address in there signature in the forums or in a reported block then post ehre saying please help me get it back! ( which translates to please help me steal this persons money for me!) lol.

But if this is in fact legitimate then i do feel empathy for you... to lose that much is horrible.. But to get that much is questionable...

[defxor]

UNENCRYPTED wallet on multiple websites?

This is the most shocking part for me... he actually uploaded a half-million-dollar wallet.dat to the internet in the clear.

Wuala encrypts user side before uploading to the cloud, and I believe the same applies to Spideroak. OP mentioned he stopped using Dropbox as soon as he realized they don't.

Don't know what's shocking about that since it's very much not "in the clear" or "unencrypted".

However, this and other stories like it builds a case that there might be active attacks being made on Bitcoin participants, and if it's more than a few then meatspace explanations become statistically unlikely. I'd rather lean towards exploitable C-code in the client.

[NO_SLAVE]

allinvain, you're not the only one.
Same hacker got to my mtgox account, he converted the USD i had to bitcoins and transfered them to the same address.

I'm not sure how he got in, if my pc is compromised or how this happened, i've been scanning and analyzing my pc for the past hours but nothing indicates a virus or whatever...

wow, this is the last straw. Shutting MTGox account....Hacker currency isnt working out too well....whod have thunk it...

[wareen]

What do I get if I get your money back?

Is there hope after all?

[allinvain]

The more I read this thread the more absurd it gets

Work computer?
25k on computer used for browsing web?
UNENCRYPTED wallet on multiple websites?
Forensics can't do shit?

You must be either a troll or incredibly stupid. If it's the latter, and you obviously have no clue about online security, I suggest you still turn that computer off and hire someone reputable to take a look at it.

No it's my home computer. I use it to run online forums and other important stuff, plus it's trading forex right now and I had a trade going which I'm not sure if it closed successfully

the wallets were encrypted on all websites...I only had it once unecrypted on dropbox but then I deleted it when I read that their employees could read the files possibly.

the only unencrypted wallet was on my home computer...

[FreeMoney]

so my only question is how can we be sure that this guy really had and lost all of this BTC? I mean really all a person would have to do is see someones posted address in there signature in the forums or in a reported block then post ehre saying please help me get it back! ( which translates to please help me steal this persons money for me!) lol.

But if this is in fact legitimate then i do feel empathy for you... to lose that much is horrible.. But to get that much is questionable...

I don't think many are posting addresses that they use to move their savings around with. Besides OP can prove ownership of the original address easily if there was suspicion.

I highly highly doubt this is fake and feel very bad for OP.

[midnightmagic]

For a bitcoin wallet backup, personally I ain't letting anyone else have physical possession even with incredibly strong crypto

Actually, there are provably secure systems which have nothing to do with encryption, and very little to do with the idea of a OTP.

[FreeMoney]

The more I read this thread the more absurd it gets

Work computer?
25k on computer used for browsing web?
UNENCRYPTED wallet on multiple websites?
Forensics can't do shit?

You must be either a troll or incredibly stupid. If it's the latter, and you obviously have no clue about online security, I suggest you still turn that computer off and hire someone reputable to take a look at it.

No it's my home computer. I use it to run online forums and other important stuff, plus it's trading forex right now and I had a trade going which I'm not sure if it closed successfully

the wallets were encrypted on all websites...I only had it once unecrypted on dropbox but then I deleted it when I read that their employees could read the files possibly.

the only unencrypted wallet was on my home computer...

Would you know if someone broke into your house? Who comes into your house regularly? Who has ever been in your house that knows about Bitcoin? Who knows you use Bitcoin at all?

[Indemnified]

The more I read this thread the more absurd it gets

Work computer?
25k on computer used for browsing web?
UNENCRYPTED wallet on multiple websites?
Forensics can't do shit?

You must be either a troll or incredibly stupid. If it's the latter, and you obviously have no clue about online security, I suggest you still turn that computer off and hire someone reputable to take a look at it.

Yeah, I know he has over 800 posts. But "Allinvain"? The whole story reads like a very hip joke, or a deep cover sleeper troll.

"Allinvain" ----- get it?

[Ricochet]

the wallets were encrypted on all websites...I only had it once unecrypted on dropbox but then I deleted it when I read that their employees could read the files possibly.

the only unencrypted wallet was on my home computer...

If it's because of DropBox, know that as long as you hadn't done another 100 transactions since that point, a DropBox employee could use that old unencrypted backup and spend some/all the coins.

[fireside]

so my only question is how can we be sure that this guy really had and lost all of this BTC? I mean really all a person would have to do is see someones posted address in there signature in the forums or in a reported block then post ehre saying please help me get it back! ( which translates to please help me steal this persons money for me!) lol.

But if this is in fact legitimate then i do feel empathy for you... to lose that much is horrible.. But to get that much is questionable...

I don't think many are posting addresses that they use to move their savings around with. Besides OP can prove ownership of the original address easily if there was suspicion.

I highly highly doubt this is fake and feel very bad for OP.

Check out this thread. http://forum.bitcoin.org/index.php?topic=15984.0  according to this post puts the addresses in the blocks for the public to see. So all this guy would have to do is watch that site, find a large amount being transfered, then either troll the site for fun or actually look for a hacker to help him in his time in need.... If this post i am refering to is another troll post then forgive me i have never checked out blockexplorer.com before but everyone talks about it and says you can see the addresses..

[allinvain]

I just read a part of allinvain's older posts. A day ago he noticed someone changed his payout address in the Slush pool. And he was using strong password.

Considering this, I think that the attack was committed from his own Windows machine. Someone got access (probably even physically).

It could be a sophisticated virus. But if it would steal his pool password, it could not grab his wallet. And vice versa. Would I design a worm stealing Bitcoins, I would not care about some pool payout address. I would just grab wallets.

So, someone who can gain access to your PC might stole your Bitcoins.

I'm looking into this as well. The thing is this happened at 12:00 in the afternoon when I was sleeping with all my doors locked. I would've noticed if someone physically had access to my computer. Also maybe someone stole the wallet earlier? I have to serious do some searching into who was at my place over the last month.