Bitcoin Forum

My computer was hacked last night. I was stupid and clicked on a email I should not have and before I knew what happened my coins were transferred from my wallets. I had PW set on the wallets but still they were able to transfer out. Is there anything I can do or is it gone. Really sucks.

Did you log into your bitcointalk account from the same computer that you downloaded the alleged malicious attachment? Do you have an AV?

How strong was your wallet password? Did you use the same wallet password for anything else? Did you have your wallet password stored in plaintext anywhere on your computer?

Txids of the transactions?

Check the wallet, is there transactions?

If not you will still have your funds.

If its has gone then:

you may have a RAT  installed. https://en.wikipedia.org/wiki/Remote_administration_software

These softwares can also get your passwords from your browser history, if you used the same password as that on a site as your bitcoin wallet... thats how it would have happened. These softwares can also check your screen - files etc.

Do you have any malware/av installed?

check if you have any dodgy processes running your dont recognise. It could sometimes be undetected using a FUD Crypter.

I have Norton on my computer and it blocked the malware or so I thought. But then the next day I checked my wallets and all my coin was transferred out. I don't have the pw of the wallet written down so don't know how they got past that. Really sad.


txids 5511a16add0a44869791175d9849567f846d7a8662e4775c1783567863203d34

cant find txid,

What file did you download? from which site? It may be a known scam.

if you post the link remember to change http:// to hxxp:// so it doesn't show up as a hyperlink and other people cannot click on it.

Well that really sucks.. cause anything transferred or any bitcoin transaction for that matter is non-reversible.

Unless the person who stole your bitcoin returns it to you out of some moral sympathy. I`d try to contact that person if its possible, and say hey you got me! I`ll send you $40 starbucks gift card or something along those lines or something, boasting his/her ego.

Hard lesson learned. Get a cold wallet.

Like secrethedgehog said, the txid is invalid. Can you please re-check and post exact txid or post your Bitcoin address from which the coins where stolen?

That is a LTC txid, not a bitcoin one. He claims to have had both BTC and LTC stolen and should provide a BTC txid as well.

sorry for your loss. i would buy a hardware wallet to be more safe!

https://bitcointalk.org/index.php?topic=899253.0

Are you sure the transactions id is right? I can not find the given transaction.  ::)

https://blockchain.info/de/search?search=5511a16add0a44869791175d9849567f846d7a8662e4775c1783567863203d34

As quickseller said below. its an LTC TXID

If you are sure someone has transferred the bitcoins, you can't do anything to recover them
sorry,at least this can be a lesson for the future

they brute forced your pass maybe? was a strong password? because otherwise they cannot do anything with a wallet that is protected with a strong password

you clicked on a link in the mail or you opened a file inside it? did the malware spread through only by clicking on the mail? because i clicked on some malicious email once, i just wanted to read it, and nothing happened

if no key logger stole your password as Amph stated the password could have been brute forced but this is not that easy..........

also a valid tx id number will not recover your coin however you may be able to trace them and seek professionals to see if they show up,  for example,


if a valid tx id shows the coins sent to another address, then in the block crawler we see a day later those coins are 'spent' at a known place it may be possible to find out who is responsible,


a long shot and doubtful you will recover your coin,


take advice of others , be careful, practice good security always and depending on your level of comfort use advanced methods and a hardware wallet for protection....

Well, first... hard lesson and you knew you shouldn't have clicked on the suspicious email in the first place.  Oh well...

If your wallet was truly password encrypted, then the malicious software that invaded your system from clicking that email would have to access that password.  Did you enter that password at any time (key logger)?  Did you store that password somewhere on your infected hard drive (i.e. passwords.txt)?  Did you use the same password for the wallet as you use on other sites, and store that password in your browser?

Sorry your coins are gone. Nothing can be done.
Game over. Instad of being sad use your energy for somethings positive.
Make some money, buy new bitcoins. Don't spend any more time on how you got robbed.

One thing though... You might want to educate your self a bit so you dont get robbed again, its really not too hard to avoid, just study the options a little, already a bunch of good advice in this thread.

your coins are gone, but make sure to clean your pc.

programs you must have:

Avira anti-vir
malwarebytes


download them asap.

I find it weird how the anti virus didn't scan it once it is on the computer and blocked it.

I doubt professionals would be able to trace it to someone since most hackers uses mixers. When it is mixed, the coins that is involved will be associated with someone else.
Antiviruses aren't the answer for everything. Many viruses out there don't have their signatures on the malware's database and some viruses have stubs to prevent antiviruses from detecting them. The best way to prevent infections is to not click on suspicious link and not to download anything suspicious.

true as stated above. anti-virus/ anti-malware dont catch everything... but they still have value...

the number one thing to remember is browsing safety/security. you already know you were wrong to click the link in an email... that should never happen. I dont even click links in emails from trusted sources/senders. If you absolutely MUST click a link, check it with virustotal.com first... it is pretty reliable for spotting malwares... but even then you must be super careful.

I lost some btc last year, because I was lazy and foolish. but I purchased a hardware wallet (a ledger wallet) and I feel much safer now.

getting robbed really sucks, and happens a LOT with btc, sadly. The experience can drive away new adopters more than anything else you might encounter in the btc world. developments are being made constantly to address the problem, but it is still a risk, even for the seasoned user. sorry dude, hope it doesn't turn you off for good.

Yes, this is by far the biggest issue we as a community face.

Talking about increasing adoption and volatility and so no.. none of that makes any sense until the currency can be stored and owned securely by the average person.

there is already a way to spend your btc offline, the problem is that many will find it troublesome, it need to be implement in a more accessible way, and it should be done with one click only, because we know that the majority are lazy, and want everything automatic

Did he ever identify the malware that cause this or maybe wallet he downloaded, i would like to know more about the method use to deliver the malware so we could all be more careful in our actions.

You might had been Phished, now only one thing can be done. >>  :'( <<
Good luck, Next time.

A tip for you, Just dont visit to sites which offers you unbelievable stuff or coins.
Visit trusted sites.

It's strange that they would've been able to steal both your BTC and LTC just like that. The email trap would have to be pretty sophisticated to achieve something like this. Did you confirm that it was indeed the email link that caused you to lose your coins? Did you consider other possibilities? Do other people have access to your computer?

these threads always make me nervous :S i wish that OP would have added some more information about how exactly he lost the coins and what kind of wallet he was using.
from what i have read i think he might have been using a weak password for his wallet and the hacker might have brute forced the password of the two wallet files.

If the OP's wallet files had no or weak passwords then it would have been trivial to get the private keys. Another possibility is that the OP had entered his wallet password after his computer was infected with the malware on his both LTC and BTC wallets which would have caused the unencrypted wallet files to be temporarily stored in RAM while the wallet software is signing the transactions.

This is an example of why it is important to use a strong wallet password (that you do not store on your computer). If you do this and realize that your computer has been infected with malware then you can quickly recover your wallet from a backup on an alternate computer and spend your funds to another newly created wallet/address that was created on a computer not infected.

If you enter your wallet password on your wallet software after your computer is infected with malware then there is not very much you can do to prevent your money from being stolen. The only thing you can really do is change the settings on your wallet software so that it will store your unencrypted wallet keys in RAM for as little time as possible, this will force you to enter your password every time you spend funds in your wallet however it will give the malware a shorter amount of time to grab your private keys, most of the time this will not result in keeping your money safe, however it will with a very small subset of malware. Another thing this will do is protect you from physical theft of your computer because if your computer if physically taken from you shortly after you spend your Bitcoin then the attacker will likely not have access to your unencrypted private keys.

Indeed... But had you typed in your Wallet password ? or was your wallet.dat stolen ?

Also Which malware file you downloaded and where from ?

It's EASY to bypass antivirus. Especially if you are running 0-day virii. Antivirus can only catch things that are known and spread, so non-script kiddies generally aren't affected by them.

There is not much you can do without legal intervention.  Depending on the means in which access was gained to your system, the attacker could have left traces if they were not careful.  Hopefully they did not use a proxy and their IP is logged somewhere in your access logs.

What can be done?

Not a darn thing.... that is what.

These are the 'joys' of bitcoin being pseudononymous and transactions irreversible.

Happy days for criminals.

..

(I love bitcoin and the underlying tech but really.... some of the supposed 'benefits' I just really cannot see as net benefits for none-criminals at all)

If they has taken your bitcoins nothing can be made. The bitcoins are lost. The transaction are irreversible.

the only thing to get bitcoins back is to somehow find the computer that now has bitcoins and hack it back to get the wallet back and so on, though its nearly impossible to do

+1
wise advice.

I dont think anything could be done if someone stolen it.

A lot can be done actually.   For one never keep a lot in hot wallets this solves a lot of problem's.  Cold wallets are where your wealth should be.

Also if you have a hot wallet don't surf stupid sites, open bad emails, etc.  If you do chances are eventually you lose some. 

Look into cold storage and encryption.

advise to get a cold wallet isnt the best in my opinion how to transfer funds from cold wallet? Isnt it much harder than doing hit wallet transfers?

No, it is not and cold wallet is a very safe way to store Bitcoin especially if you don't know how to secure your hot wallet.

im afraid that it can happen to me either, am i secure if i use blockchain wallet and i dont have any wallet files on my pc? i was thinking about cold wallet but i was too lazy to create it

The whole point is it takes more to get to the wallet.  Cold storage works amazing if don RIGHT.    Is it as quick as leaving up a hot wallet? No

But is it worth the extra time to be safe ... yes!    And you can still keep a hot wallet just make sure to use cold for most of your assets.

no, it actually "is" the best option. as long as the cold wallet is created in a safe way and without any malware on the equipment that you use for creating it, it can be the best option.

paper wallet is hard to use because you have to sweep the keys and create a new paper wallet after usage to be ultimately safe.

but if you use an offline wallet and sign the transactions offline and broadcast it on another pc which is online , it can be easier to use.
i know of two wallets that do this so far (there might be more but i am not familiar with them) and those two are Electrum (which is SPV wallet) and Armory (which is full node) .

If you can't use a cold wallet, use a hot wallet such as Electrum(with 2FA). If you think you can't secure your computer enough to secure your wallet, use a shared wallet such as GreenAddress. Don't use Blockchain.info. It is not a good wallet. It was removed from Bitcoin.org. Their wallet is very buggy and many users Bitcoins were stolen because of their mistakes. Move your coins from there.