I've been hacked (Electrum 4.3.2)

[julerz12]

PLANS FOR REIMBURSEMENT | REIMBURSEMENT INFO | MOVEMENT OF HACKED FUNDS

I'm not entirely sure how this happened but I'm pretty sure I've been hacked.

I am holding the funds for Coinomize and Yo!Mix Signature campaign, around $5,000 which is a lot of money here in the Philippines.
https://blockstream.info/tx/b7d7c5c5516c605bf76107d4f8984b581632df845ad2fceaf4dcfe788943620e
https://blockstream.info/tx/7905f4f56cb80162152f1a211acb76312372eaa382bac063b5e571ee52d8c9aa

I am using this version of Electrum 4.3.2 which I've downloaded from the official website.

I know this looks bad and would probably look as if I ran with the funds, but honest to God, I did not.

I am devastated and ruined and quite frankly pretty angry at how stupid I am for not using my hardware wallet (Ledger) and just relying purely on Electrum. Either this old version is corrupted or they got into my system.

To those who hacked my wallet and owned this address: bc1qd5chfxnqa7gvrvl6cmqcvcvu3rjsl9gwa2juz8 you should know that you ruined my life.
https://blockstream.info/tx/2793ed8971ca14ed86fb510db9996dd37e4de6793c643b534c5feada898e9a61

I depend on this little hustle of bounty management to support the needs of my family.

Edit

As the first part above was just the thoughts pouring in to my mind that I had to post it immediately.

Here's some clarifications.

Again I am using Electrum 4.3.2. That wallet has been telling me to update itself but I neglected that info thinking the wallet is safe.

The 12 word pass phrase was never written on any document online. I wrote it down directly into my personal notebook. The password to it is also unique for which I have never used anywhere else.

The problem is my system had no anti-virus or whatsoever, it does have windows defender but now, I think that shitty app isn't doing anything. I got zero ping that someone is accesing my system. If I haven't been informed by Coinomize team that the funds were transferred, I wouldn't have notice it since the Electrum wallet was last openned four hours ago after the funds were transferred. Meaning, the wallet is offline.

I know all of you will not believe me but I will do everything I can to repay the lost funds even if it takes a while.

The Yo!Mix team and Coinomize team will probably post a scam accusation soon and rightfully so since I have no means to prove my innocence. I will accept whatever this community would think of me as I know this is all my fault for being so careless and stupid.

I've been in this forum since 2017 and I'm truly heart broken that this happened.

Edit again, some screenshots and timestamps (UTC):

January 03, 2023, 06:13:36 AM: Received funds to run Coinomize Signature Campaign ($1,000 in BTC) for 1 week [TXID]
January 03, 2023, 06:41:38 PM: Ran Coinomize Signature Campaign (Coinomize funds are untouched in Electrum for 6 days)
January 09, 2023, 10:48:00 PM: Received funds to run Yo!Mix Signature Campaign ($4,000 in BTC) for 4 weeks but initial funds sent are only for 1 week [TXID]
January 09, 2023, 11:43:26 AM: Ran Yo!Mix Signature Campaign
January 09, 2023, 01:35:00 PM: Electrum wallet drained [TXID]
January 09, 2023, 04:13:21 PM: Coinomize team informed me that the funds have been transferred
January 09, 2023, 04:24:58 PM: Paused Yo!Mix Signature Campaign. Informed all currently accepted participants through private message.
January 09, 2023, 04:51:41 PM: Posted this thread.

I think i can see something, regarding the hacker's address, it seems the hacker has started dumping the stolen BTC to two different addresses.

ID: https://www.blockchain.com/explorer/addresses/btc/bc1qd5chfxnqa7gvrvl6cmqcvcvu3rjsl9gwa2juz8

New disposal address for a total of: $5,915, halved.

0.30000000 BTC/$5.663
bc1q0r3fwzyrspdl34nsrxm5354wx96zsnfrt9nvmt

0.01337655 BTC/$252
bc1ql008q9cjhfcsmn7sujg99d79n0r4v0yuxgke6s

Is there a possibility that the two disposal addresses above, can be traced.......!

I've been trying to find connections with that address here in this forum and even on other crypto-related forums but so far, I found nothing and its quite frustrating.
*bc1qd5chfxnqa7gvrvl6cmqcvcvu3rjsl9gwa2juz8  - this address seems created fairly new and has no other addresses within the same wallet
https://www.walletexplorer.com/wallet/d3a7bd26c2f5ecb4/addresses

Same goes for the two new addresses:
*bc1q0r3fwzyrspdl34nsrxm5354wx96zsnfrt9nvmt
https://www.walletexplorer.com/wallet/a3c595887e1163d2/addresses
*bc1ql008q9cjhfcsmn7sujg99d79n0r4v0yuxgke6s
https://www.walletexplorer.com/wallet/8479fa3aa408c558/addresses

Stolen funds have now been transferred to a bunch of addresses which I assume is either a mixer or the hacker's collection point.
See here: https://www.blockchain.com/explorer/addresses/btc/bc1q0r3fwzyrspdl34nsrxm5354wx96zsnfrt9nvmt

bc1q0r3fwzyrspdl34nsrxm5354wx96zsnfrt9nvmt (along with 50 other btc addresses) transferred BTC to 30 addresses (each address has $11,000 worth of BTC).
bc1q0r3fwzyrspdl34nsrxm5354wx96zsnfrt9nvmt is now connected to a wallet with a total of 17,606 addresses (according to: https://www.walletexplorer.com/wallet/0008dcb537375e73/addresses)

[EDIT]^1/22/23 I've been informed that the addresses the hacker sent the funds to were apparently from ChipMixer. With that being said, tracing the stolen funds is now utterly useless.


Plans for repaying lost funds

My plan is simple.
As I've previously mentioned on this thread, I've got a motorbike, probably cost around $1,000 if I sell it which I will. That should cover the lost funds for Coinomize ($1,000). Although it might take a while for it to get sold so I'll start sending whatever amount I can gather for now.
Also, a portion of my upcoming bounty management fees will be used to pay these debts that I now owe to Coinomize and Yo!Mix. For starters, I just launched another campaign yesterday for which I was paid $400 to manage it for 4-weeks (here); I've already informed both project teams (Coinomize & Yo!Mix) that they'll be refunded with $150 each for now. I still need $100 for my family's expenses which isn't much but we will try and make do for the rest of the month.
Any means of additional income I get, a portion of it will be sent to these project teams. Signature payouts, management fees, etc.

The $320 BTC management fee from Yo!Mix that they've also sent upfront prior to the incident will also be returned to them today.
I just need both parties to confirm the BTC addresses they've given (through private messages) here on this thread so the whole community would know that I'm sending out refunds to correct wallet addresses and not to just some random wallet address that I made up.

Code:

Coinomize:
Great Thanks ;)

BTC Address: 17fd4FLbj7rQCCPhRo3yqdZQPtKggs7mqc

Code:

Yo!Mix:
hello, sorry we have only btc
bc1q5xzdzzdagmtny5n285q02hfczjcm6hpdwu6mr3

Code:

Coinomize:
Great Thanks ;)

BTC Address: 17fd4FLbj7rQCCPhRo3yqdZQPtKggs7mqc

Address Confirmed.

Code:

Yo!Mix:
hello, sorry we have only btc
bc1q5xzdzzdagmtny5n285q02hfczjcm6hpdwu6mr3

Confirmed.

Transaction details and amounts

*Yo!Mix total amount to be reimbursed: $4,320 in BTC ($4,000 in Signature campaign bounty pool + $320 upfront management fee)
Remaining: $2653
1/10/2023: $320 management fee returned + $150 initial refund for the lost funds: https://www.blockchain.com/explorer/transactions/btc/bdae89f63a82d45cde5412b6c9dd63802a999cb389a3da51adb63d289842c579
1/21/2023: $100 reimbursed to Yo!Mix team: https://www.blockchain.com/explorer/transactions/btc/6e9bb2b1d8d86fc4e1980c3aecace153dc5f87d847c5788800e44a16e11a1b19
2/12/2023: $100 reimbursed to Yo!Mix team: https://blockstream.info/tx/986031a7ef00168075ed0336296978c6d7f6e8ab276e9846b681b9c4144cd434
3/14/2023: $100 reimbursed to Yo!Mix team: https://blockstream.info/tx/d7b29c41ffff0b2b2542b0904bf83b2dbc0a28ddae9295c7d1aad7364c2faa89
3/27/2023: $100 reimbursed to Yo!Mix team: https://blockstream.info/tx/7a42a6433e150bbdc81826abd27430c20fa30c9fda47fbc25aa99d64a9e1c88a
4/03/2023: $100 reimbursed to Yo!Mix team: https://blockstream.info/tx/f85ba90422c0d32eb2c792a8412bbc8aacca22174fb73c6b7e311c348a2a95c5
4/11/2023: $100 reimbursed to Yo!Mix team: https://blockstream.info/tx/0e057c40c13d7b7f302026c730ac602e4914a9d7b760c5b5eb265efeb63edac1
4/29/2023: $200 reimbursed to Yo!Mix team: https://blockstream.info/tx/c600594c5ffb5f80e9d535c7a3b2db3149b275fdea18770e8269c1f7460650e8
5/18/2023: $147 reimbursed to Yo!Mix team: https://blockstream.info/tx/3387aac565baee92b32547663d1507efab8b2f2c70e593c89f229d3e000e0491
5/29/2023: $100 reimbursed to Yo!Mix team: https://blockstream.info/tx/c6fa428f93daeac6769d1f3bde44f315b9fc7c60896002a084e15693eeef84f8
6/19/2023: $150 reimbursed to Yo!Mix team: https://blockstream.info/tx/268d4ab15ba90700945fd2e803654faee1c18bed4d354dedc0541c432ad447ca

*Coinomize total amount to be reimbursed: $,1000 in BTC
Remaining: fully reimbursed
1/10/2023: $150 initial refund for the lost funds: https://www.blockchain.com/explorer/transactions/btc/246520fe68abe0439c1ea10f8cb17c1f8ff4699fe78e2044102427a637af84e5
1/16/2023: $160 has been automatically reimbursed to Coinomize team. Payment was from my management fee from managing their Signature campaign, ($80/week) + ($80/week) for wearing their signature.
1/23/2023: $160 has been automatically reimbursed to Coinomize team. Payment was from my management fee from managing their Signature campaign, ($80/week) + ($80/week) for wearing their signature.
1/30/2023: $160 has been automatically reimbursed to Coinomize team. Payment was from my management fee from managing their Signature campaign, ($80/week) + ($80/week) for wearing their signature.
2/06/2023: $160 has been automatically reimbursed to Coinomize team. Payment was from my management fee from managing their Signature campaign, ($80/week) + ($80/week) for wearing their signature.
2/13/2023: $160 has been automatically reimbursed to Coinomize team. Payment was from my management fee from managing their Signature campaign, ($80/week) + ($80/week) for wearing their signature.
2/20/2023: $160 has been automatically reimbursed to Coinomize team. Payment was from my management fee from managing their Signature campaign, ($80/week) + ($80/week) for wearing their signature.
2/27/2023: $160 has been automatically reimbursed to Coinomize team. Payment was from my management fee from managing their Signature campaign, ($80/week) + ($80/week) for wearing their signature.

Code:

Changelogs:
1/10/2023: Resized screenshots, Added plans for repaying lost funds, added Coinomize/Yo!Mix confirmations to their own BTC addresses, added timestamps
1/16/2023: Added info to Coinomize reimbursement
1/21/2023: Added info to Yo!mix reimbursement
1/23/2023: Added info to Coinomize reimbursement, Info about stolen fund's transfers and movement on the blockchain
1/27/2023: Added remaining amount of funds needed to be reimbursed.
1/30/2023: Added info to Coinomize reimbursement
2/02/2023: Added quicklinks
2/06/2023: Added info to Coinomize reimbursement
2/12/2023: Added info to Yo!mix reimbursement
2/13/2023: Added info to Coinomize reimbursement
2/20/2023: Added info to Coinomize reimbursement
2/27/2023: Added info to Coinomize reimbursement
3/14/2023: Added info to Yo!mix reimbursement
3/27/2023: Added info to Yo!mix reimbursement
4/03/2023: Added info to Yo!mix reimbursement
4/11/2023: Added info to Yo!mix reimbursement
4/29/2023: Added info to Yo!mix reimbursement | Added some colors to some texts.
5/18/2023: Added info to Yo!mix reimbursement | Updated images and re-uploaded to TalkImg
5/29/2023: Added info to Yo!mix reimbursement
6/19/2023: Added info to Yo!mix reimbursement

[1714197181]

1714197181

[1714197181]

1714197181

[Charles-Tim]

But what evidence that you have that anyone will believe that you are hacked? No evidence. If a campaign manager is not yet reputed on this forum, there is nothing bad for you and the site that brought signature campaign to use 2-of-2 multisig wallet for it. If 2-of-2 multisig wallet is used, it would have been better.

You can use 2FA on another device with Electrum, you can use multisignature on Electrum, you can setup Electrum on airgapped device. There are ways to use Electrum without thinking of a hardware wallet except that you want to use it also for altcoins as Electrum do not support altcoins. But this is a bitcoin signature campaign.

What did you think would be the consequence of this? No one will believe you. Or if they believe you, the conclusion would be that you are not capable of holding a company's coin safe and secure, which supposed to be used for a campaign on this forum, one of the first qualities a campaign manager should have.

[Coinomize.biz]

Yeah, that's not really trustworthy after the first signature campaign here and before our first payout....

[NeuroticFish]

I'm not entirely sure how this happened but I'm pretty sure I've been hacked.

The first question is: where were you holding that money? Was it in a hot wallet? Because if so, it was a big mistake, no bounty manger should hold such funds without a proper setup - cold storage, hardware wallet, maybe even multisig.

If it was a hot wallet that got emptied, you'll need to see what you have installed on the computer(s) and/or smartphone(s) you've accessed that wallet with.
If it's a cold wallet, you'll have to see how you've generated it and where you've stored the safety backup/seed.

Expecting the thieves give you back that money is, sorry to say, pretty much a hope in vain and also counterproductive.


LE: wow, you have Ledger and still used a hot wallet. Impressive! How could you go this wrong?!? 

[LoyceV]

around $5,000 which is a lot of money
~
I am using this version of Electrum 4.3.2

If it's a lot of money, why are you using a hot wallet?

how stupid I am for not using my hardware wallet (Ledger)

That's not even a rookie mistake, and you're not a rookie.

look as if I ran with the funds

From the campaign's perspective, the result is the same.

[Mpamaegbu]

This isn't looking good at all, even on the forum. No matter how I (or anyone else) want to say you're one of the reputable managers here, facts and concrete evidence are going to be needed to prove your innocence to start with. This isn't a situation anyone will wish to be in. My advice to you is to lay the facts of what happened bare. What you've in the OP isn't enough to convince anyone yet.

[Swordsoffreedom]

I am using this version of Electrum 4.3.2 which I've downloaded from the official website.

You just scared me! If this is the case then I would say no online wallet is safe.

I would like to know if you hired any staff for campaign management, Or do you handle all the work by yourself single handly? Find out if someone else is using your computer.

Many times we use "Team Viewer" or "Any Desk" software for online meetings, and these are one of the reasons for getting hacked.

[Little Mouse]

I never felt like julerz12 would be untrustworthy. I had a long chat with him regarding campaign management.
I got a PM few minutes ago by Yomix in my telegram, I was looking for verifying if he is the real one because I already had seen julerz12 managing the campaign but got surprised when he said me this happened.

This is really a stupid one to hold fund on hot wallet. And when it comes to escrow fund, we should be more concerned and must use cold wallet. It doesn't take a lot of time of course.

Didn't expect this. Hope you get this shit fixed, man. Good luck julerz12.

[dkbit98]

I'm not entirely sure how this happened but I'm pretty sure I've been hacked.

I don't want to rub salt into your wound, but you just made bitcointalk forum with all members look bad, and you damaged your reputation.
People trusted you on both sides, and I don't see you made clear step by step explanation what really happened with coins you received and lost.
Situation is even worse since you already own  a hardware wallet, and you could easily connect it with Electrum wallet.
I am not saying you stole the money, but acting this way is no better and I have seen people getting negative feedback for smaller mistakes.

[Yawa2020]

To those who hacked my wallet and owned this address: bc1qd5chfxnqa7gvrvl6cmqcvcvu3rjsl9gwa2juz8 you should know that you ruined my life.
https://blockstream.info/tx/2793ed8971ca14ed86fb510db9996dd37e4de6793c643b534c5feada898e9a61

I depend on this little hustle of bounty management to support the needs of my family.

This is one among the reasons why many people will not believe in crypto. Especially where I reside, once you mentioned Bitcoin or anything related to crypto they'll assume you to be a scammer. Their argument is always on why transaction can not be traced. It would have been a different experience if it happened to be a bank related issue. I pray God make things easier for you but regardless, your reputation is questionable henceforth. I really feel sorry for you.

[Hispo]

I just found out about this from the Campaign summary thread and it is simply heart breaking.
I am nobody to judge anyone here, but storing 5k USD in Electrum instead a HW sounds like insanity, even more if those satoshis are not one's.

I feel sorry for OP and the campaigns affected by this alleged hack, keeping an eye on this thread to see how situation evolves...


To all the people reading this, let us learn from this, and be aware we are in times when hot wallets are not safe anymore for any quantity of money, we live in an era where there is an army of criminals waiting for any of you to commit the smallest mistake to steal all your holdings. Hardware wallets cost 60-200$, get one today or learn how to build and handle your own, before it is too late.

[Edwardard]

The main question here is will @OP pay to the participants of coinomize signature campaign from his pocket or should we consider that we have advertised 1week for free?
PS: The first week payments are due this Thursday.

EDIT: Coinomize just confirmed they'll pay to the participants for the first week.

Since the wallet seems to have been hacked by our Bounty Manager @julerz12 (See: https://bitcointalk.org/index.php?topic=5433643) we have to pause the signature campaign.

But we will pay everyone their money tomorrow.

[NeuroticFish]

Unpleasant situation. If you are not lying and telling the truth, then I am sincerely sorry that you had such a trouble, but still you have obligations in your activities.

I have seen many times how managers, such as Hhampuz or DarkStar_, paid money from their own pocket if there were any difficulties with payment or communication with the owner of the advertised service was difficult for some reason. This is the price of the business, your reputation = your responsibility for the funds to the customer or to the campaign participants.

Be that as it may, but the responsibility for the loss of funds lies only with you. Sorry, but the situation is not in your favor, and if someone now wants to put a flag or a red tag on you, then it will be well deserved.

Very correctly stated. And, as a matter of fact, I've already seen another Reputation thread exactly on this: people asking who's to be blamed / tagged for the loses.
https://bitcointalk.org/index.php?topic=5433651.0;topicseen

(Of course, as usual, it's not the campaign members asking this in new thread; but that's another story.)

[salad daging]

This is really a stupid one to hold fund on hot wallet. And when it comes to escrow fund, we should be more concerned and must use cold wallet. It doesn't take a lot of time of course.

Very sorry what happened to the julerz12 manager now his reputation is at stake because of the failure to store escrow funds in a hot wallet,

He said he keeps his salary payments in ledger, but escrow funds in electrum, it's just stupid if he tells the truth.

So if julerz12 told YoMix the escrow funds are stored in a hardware wallet then why is he using the Electrum hot wallet? Was this from a  on purpose?

I was expecting something better from this problem.

[Hhampuz]

I know a lot of people want to try their hand at managing campaigns and handle a lot of money but just keep this in mind - If you don't have enough money yourself to cover any and all potential losses of your clients funds, don't accept it in the first place.

I can understand wanting to hold several weeks worth of budgets for a bounty/sig campaign but while doing so you also assume all the risk associated with holding said funds. Most of my campaigns, even though I make sure I can cover a week or two, are on a week-to-week basis with receiving funds and sending it out to participants. It makes it easier, it makes it more secure and it gives me a lot less of a headache in case anything were to happen.

Like you said julerz12, $5000 is a lot in PH so could it be possible that someone in your circle may have had access to your computer while you weren't around and simply took the funds? I've seen people do a lot worse for a lot less and you never really know whether it's family or friends.

Sucky situation, however keep in mind that you can still offer a service here and participate in campaigns yourself in order to raise enough money so that you can pay back coinomize and YoMix - if you do care about it and if you feel devestated you know it'll be the right thing to do even if it may take a year+.

To Coinomize and YoMix - this is not normal. In fact I can't remember the last time I saw a campaign manager get a sizeable portion of funds and then lost/stole it so even though you may feel like this place sucks right now there's always a way out of it to make things right and to make people whole - for all parties involved. I'd gladly offer my services to manage your campaigns free of charge until this entire situation is resolved so that you at least can continue your efforts (if you so wish) and hopefully see a different side of this forum.

@julerz12, this may be a very expensive lesson for you but perhaps one you had to learn regardless. Time to change your mindset and just get on the grind to earn anything and everything you can in order to pay these two services back what is owed but remember that you can make this better and there is a way to come back from this. Don't give up and don't just leave the forum, you're better than that.

[Woodie]

What a start of the year, two different companies( [banned mixer] and YoMix) all hit at the same time and non of its participants got paid for their work and why is it that both are mixing companies that have been affected , anyway sorry for your loss pal this will be difficult to explain to anyone   I hope this hustle won't be affected after investing so many years in the sig business.

[pawel7777]

The main question here is will @OP pay to the participants of coinomize signature campaign from his pocket or should we consider that we have advertised 1week for free?

The main question is if the OP intends to repay all his creditors. As far as I know ~75% of the stolen funds were due to Yomix. Campaign participants do not have any priority here.

Emotions and judgements aside, the question is how do we proceed from here. I see 2 options:

1 - OP gets bashed left and right, gets multiple negative feedback  - result -> he's no longer able to earn from his bounty/signature campaigns activity -> leaves the forum -> creditors get nothing

2 - OP negotiates with creditors to work out some mid to long-term plan of repayment -> creditors withhold from giving him a neg trust until he's repaying -> he's still able to make income on the forum but obliges himself to use either multisig address or escrow service of a more trusted 3rd party until the debts are repaid. -> creditors get paid (slowly but still) and OP has a chance to keep his income stream and rebuild his reputation.

Thoughts?

[LoyceV]

we are in times when hot wallets are not safe anymore for any quantity of money

That's always been the case.

if someone now wants to put a flag or a red tag on you, then it will be well deserved.

Actually, unless OP pays them back, I believe a Flag is needed. Doesn't matter if OP did it on purpose or really "got hacked", by ignoring basic safety precautions, this applies:

Due to various concrete red flags, I believe that anyone dealing with this user has a high risk of losing money.

[YoMix]

Sometimes, bad days are there to remind us that we have good ones to look forward to. Sad it happened, we'll run new campaign soon managed by Royse777.

[Twentyonepaylots]

Now my suspicion from you just got stronger. My man, you're not a rookie campaign manager you should have known that for how many  years you've been around here. I tried to apply to your campaign, just minutes after I applied it went FULL. I was thinking if you really scanned the profiles of your SELECTED PARTICIPANTS. As I see it, it's full of unfamiliar usernames, don't get me wrong we're thousands here I may not be as active poster but I am an active reader so I know. Then I found out there were revived accounts, unqualified ones, and suspicious accounts. I knew it was something that uncertain, and this just happen.

I was thinking if I'm gonna post about you earlier coz I don't wanna judge, then this happened. You got 2 things you need to explain now.