Bitcoin Forum

As of block 450293 872.89153671BTC has moved, and according to the OP of the above reddit thread they have been sent to various exchanges (possibly to see how they will react to receiving deposits of these stolen coins).

I seriously wonder if these stolen coins will ever be recovered? I mean, it doesn't seem impossible with companies devoted to blockchain analysis.
Does anyone know of any examples of large Bitcoin thefts where the perpetrators were caught in the end? 

Seems to be a fraction of the whole booties. I would announce doubts about the exchanges reacting in a way that is satisfying for the thieves, which will just drain that flow again. Evading further observations. This time they just got caught, next times not.

If I were to bet on it, I would say they will be recovered. The exact addresses of where the coins are "sitting" are very well known, and are well publicized. I would doubt that any exchange would hesitate to freeze the account of anyone who receives any of the stolen coins. If a mixer were to receive any of the stolen coins, they would probably not "mix" the stolen coins because their customers would be unable to use those coins on an exchange. So, the hacker's only likely choice would be to deal with bitfinex to try to negotiate the return of some of the stolen coins.

I am not aware of any large thefts/hacks in which the thieves ended up getting caught, although I think this is different because of the above.

I am not quite sure what you are trying to say.

I don't think that most mixers would have the morality to not mix these coins because their customers would not be able to use them.

About that, would they really not be able to use them? I would assume that blockchain analysis is something that takes time.

Drew Samsen, Applications Team Leader at Bitfinex, told CCN that it appears coins have been moved to LocalBitcoins, Xzzx, BTC-e, Bitcoin.de, Coinbase, Kraken, CoinsBank and quadrigaCX. He further stated that Kraken has frozen 0.4BTC, but it is not clear whether some of the other exchanges will follow suite.

The Kraken has frozen 0.4BTC, but nobody knows if the other exchanges will all freeze the coins. I bet Coinbase chooses to freeze. I have never heard of Xzzx or quadrigaCX.

https://www.cryptocoinsnews.com/bitfinexs-hacked-bitcoins-move-5-recovery-bounty-offered/

It would be very funny if he/they convert to fiat and make a bank transfer :O who know... it's clear he is not 100% sure with how to move all this.
We are seeing a thief in real time. Kraken has frozen a deposit already and I am sure some others will follow the same path, I heard there is a good communication between some exchanges... If they all do this, it can ve a great message for the bitcoin comunity and outside bitcoin

I seriously wonder if these stolen coins will ever be recovered? I mean, it doesn't seem impossible with companies devoted to blockchain analysis.
Does anyone know of any examples of large Bitcoin thefts where the perpetrators were caught in the end? 

It would be very funny if he/they convert to fiat and make a bank transfer :O who know... it's clear he is not 100% sure with how to move all this.
We are seeing a thief in real time. Kraken has frozen a deposit already and I am sure some others will follow the same path, I heard there is a good communication between some exchanges... If they all do this, it can ve a great message for the bitcoin comunity and outside bitcoin

It will be interesting to follow this out until the end.  These coins will be under a microscope at every move they make.

Are mixers or tumblers really definite at leaving no trace?  Whats the point of a large theft such as this if the coins can never really be spent?

I believe there are a few blockchain forensic companies because of thefts such as these ...

The Kraken has frozen 0.4BTC, but nobody knows if the other exchanges will all freeze the coins. I bet Coinbase chooses to freeze. I have never heard of Xzzx or quadrigaCX.

https://www.cryptocoinsnews.com/bitfinexs-hacked-bitcoins-move-5-recovery-bounty-offered/

I seriously wonder if these stolen coins will ever be recovered? I mean, it doesn't seem impossible with companies devoted to blockchain analysis.
Does anyone know of any examples of large Bitcoin thefts where the perpetrators were caught in the end? 

I seriously wonder if these stolen coins will ever be recovered? I mean, it doesn't seem impossible with companies devoted to blockchain analysis.
Does anyone know of any examples of large Bitcoin thefts where the perpetrators were caught in the end? 

Probably those bitcoin cannot be longer retrieved by the owners. There are no central agency that is controlling bitcoins and so there will be no group that will chase the hacker and put them in jail. Thats the problem with decentralization, though its freedom from the slavery of banks but its hard to be free from hackers, scammers that will take away your hard earned coins.

I don't think that most mixers would have the morality to not mix these coins because their customers would not be able to use them.
About that, would they really not be able to use them? I would assume that blockchain analysis is something that takes time.

Enough time for someone (someone getting those mixed coins) to use those tainted coins before anyone noticing perhaps?

This topic from 2014 talk about previous Bitcoin thieves being caught and there are some that were, if you read the entire thread.
Though not many high profile cases.
https://bitcointalk.org/index.php?topic=500212.0

It's really scary to know like a third of the coins were stolen but at least BIFINEX is not closing down and will compensate everyone so customers have not lost out.

It's funny though that they are offering a bounty even to the hacker lol. He should be rewarded for hacking? I am not so sure, but if he returned the dough that would be something.

I sincerely hope stolen coins get frozen. Crypto scum should never be allowed to profit from their crime. It undermines trust into the community and gives them ideas to repeat the whole process.

This is interesting with the published address there's a high level certainty that the coins shall be returned by the exchanges though I can't remember when was the last time something like this ever happened. I read there a 5% reward per coin, which raises a suspension in my mind, what if the exchanges are involved in it. The guy who stole it could have a pact with them right, so both would profit as the risk of being caught would reduce, or I am thinking wrong?

I seriously wonder if these stolen coins will ever be recovered? I mean, it doesn't seem impossible with companies devoted to blockchain analysis.
Does anyone know of any examples of large Bitcoin thefts where the perpetrators were caught in the end? 

If I were to bet on it, I would say they will be recovered. The exact addresses of where the coins are "sitting" are very well known, and are well publicized. I would doubt that any exchange would hesitate to freeze the account of anyone who receives any of the stolen coins. If a mixer were to receive any of the stolen coins, they would probably not "mix" the stolen coins because their customers would be unable to use those coins on an exchange. So, the hacker's only likely choice would be to deal with bitfinex to try to negotiate the return of some of the stolen coins.

I am not aware of any large thefts/hacks in which the thieves ended up getting caught, although I think this is different because of the above.

I am not quite sure what you are trying to say.

I seriously wonder if these stolen coins will ever be recovered? I mean, it doesn't seem impossible with companies devoted to blockchain analysis.
Does anyone know of any examples of large Bitcoin thefts where the perpetrators were caught in the end? 

If you think logically, then there is no point for the hacker to return whatever number of coins to Bitfinex.

It's clear that if you cause so much damage to an exchange, that you as hacker don't have any moral problems with keeping these coins even though you know that innocent people have been suffering.

If these coins do get returned, which I can't see happening, then it's an ultra foolish hacker. Another possibility is that it was an insider job where the people behind this attack are trying to slowly return a small portion of these coins.

I still fully think that Bitfinex are the ones that stole those coins, I really HOPE they aren't but my gut says that this is all them.

I guess they're trying to get their name out a bit right now.

It's clear that if you cause so much damage to an exchange, that you as hacker don't have any moral problems with keeping these coins even though you know that innocent people have been suffering.

I sincerely hope stolen coins get frozen. Crypto scum should never be allowed to profit from their crime. It undermines trust into the community and gives them ideas to repeat the whole process.

Compensating people in form of worthless tokens that people can exchange to a certain amount of equity in the main company is not really a worthy compensation if you ask me. People simply want their cold hard coins back. This "comensation" is just set up to keep people their mouths shut for a good while

It's indeed funny, but at the same time quite a desperate call as well. Especially if you consider that there might not have been a hack at all. But in case these coins are really stolen due to a hack, then a bounty could be a last resort option. If you don't try, you won't gain anything. But there is more to it than simply a reward. I am sure that they try to contact the "hacker(s)" in the hope that they make a mistake where they potentially can be traced one way or another. Nothing will be done without a reason. Thieves won't be rewarded just like that. ;)

Bitfinex is offering a 5% reward for each coin anyone can return to it. Any exchange sent stolen coins can claim 5% of them and return the rest to bitfinex. Dong that would pay them more money than they would get if they let the hacker withdraw or trade any coins he deposited to an exchange. All those exchanges will probably opt to claim the 5% reward because of the financial incentive.

There is not only the economic incentives that likely for an exchange are not very large compared to an individual. Think of it however as a collegiality and solidarity. If you were one of the shareholders of another exchange I believe that you would like the same way others to do for you, don't you? In these circumstances there is no the competition issue but anyone accepts or receives stolen goods then is called conspirator or fence and this action is a criminal offence punishable by the law in any country of the world

The mixer services are currently under scrutiny from most governments and they will possibly work with the authorities to identify

the people behind this hack. If they resist, they will just attract a lot of negative attention and they do not need that now. The

authorities do not need to ask nicely, they can just force them with a Subpoena through the courts. The exchanges is no problem,

because they already work with most governments, if they adhere to AML/KYC regulations.  ::)   

How do you know that?

I'm more inclined to think that the laws differ significantly between countries in this respect, especially if you don't know and can't know for sure that these coins have been actually stolen. For example, Bitfinex claims that coins in a certain wallet are actually theirs, but why should anyone consider them as trustful in the first place? What is the difference between some exchange claiming the ownership of certain coins from someone else claiming the same? The owner of that wallet may just say that Bitfinex is spreading deliberate lies about their real ownership

What are they going to do with their coins if they keep them? As of now, they are unable to exchange them for fiat, and are unable to use them to buy anything of any meaningful amount.

Don't forget that money moves mountains where literally everything is possible on the black market. I am sure there are enough people looking to bank by buying these coins at a massive discount even though they know these coins are stolen.

They are indeed in a stuck situation when it comes to their coins, but there are a few options that they can consider when it comes to liquidating their coins.

* In a certain way (could be with middlemen) cashing out their coins on the black market where significant discounts are given to attract buyers. It's obviously not without danger of getting busted.

* Slowly mixing their coins where they do it with small amounts at a time to not attract any unwanted attention. Of course not through the well known mixers as they will most likely put these coins on hold.

Don't forget that money moves mountains where literally everything is possible on the black market. I am sure there are enough people looking to bank by buying these coins at a massive discount even though they know these coins are stolen.

But then wouldn't those people have difficulty moving those coins??  It doesn't matter how heavily discounted the coins are if you can't spend them!

This transparency of the open ledger has always been something that has made Bitcoin seem so very special to me. The very idea of tracking funds (and as here in the Bitfinex case: stolen funds) on a ledger that anyone in the world can see is pretty exciting.

This is not the first bitcoin exchange hack and not a single coin has been recovered till now,it is good to see people actively monitoring the wallets containing the coin,since the number of wallets are huge it is really difficult to monitor all of them and top of that the hacker must be a brilliant individual who knows how to handle these coins.

Well known mixers maybe will not accept to mix such coins, but there are not so well known mixers in the deep web or dark net and the Shield mixer there works well and is not scam yet so I think they will not give a damn about these coins if they are stolen or not.

Let's not forget Hashocean, everyone know they moved away with 5249 BTC, yet nothing happened to them. I don't believe any stolen coin will be ever returned unfortunately. That's why is never recommended to keep your coins in any exchange.

If the coins do end up getting returned, then this will be a turning point for Bitcoin as in major BTC related thefts/losses in the past

I would answer. Yes, the laws differ from country to country but a thief is always a thief like as anyone accepts stolen goods. Have you any proofs about laws that say the opposite?
The difference between two exchanges are the customers of bitfinex. How many people can claim that hacker stole their coins? Ten, one-hundred more and hacker is only one. That means there is no court that believes him. On the other side some of the customers may have proofs that bought their coins from other exchanges, ATM machines, localbitcoins using sepa or web banking and so on. The owner of that wallet must prove where are these coins come from.

I sincerely hope stolen coins get frozen. Crypto scum should never be allowed to profit from their crime. It undermines trust into the community and gives them ideas to repeat the whole process.

I don't know if this is a good solution. because all coins are created equal, and frozen coin means even censorship.
Actually in such case could be the right solution (why an exchange need to deal with stolen coins?)
But one day the community could argue the same for coins passed form a political activist or even the government could decide to mark a coin

I have doubt that they will choose to move them through some smaller and local exchanges as these exchanges are not much expert in that cases.
But before any further disappearance I want that the developer start work to recover tha stolen bitcoin if they will get success in recovering that then no one in the future will ever think to hack bitcoins.

Even by doing all sorts of pretty work of hacking the wallets, but still the hacker is not able to enjoy it, it should be a long term process as now he will also be knowing that all his wallets are open to the world so any transactions to this wallets will lead him to the trouble. So it will take more years to clear it for him.

But it is better than stealing a bank,you are not hurting anyone ;D to enjoy your loot you need to have patience if not you will be caught without any doubt,i really hope these hackers get caught and be dealt with seriously and made an example out of it so that future wanna be hackers would think twice before doing these sort of activities

I seriously wonder if these stolen coins will ever be recovered? I mean, it doesn't seem impossible with companies devoted to blockchain analysis.
Does anyone know of any examples of large Bitcoin thefts where the perpetrators were caught in the end? 

Around 120000 BTC have been stolen from bitfinex.It is not yet clear whether the theft was an inside job or whether hackers were able to gain access to the system externally.The attacker has moved at least 153 BTCs with 38 transactions.

This mission would not be easy at all since we all know the capability of bitcoin regarding on transfer and we do know that there are mixers out there which would really makes those coin would be hard to be traced even we saw it it starts to move now.If they will use exchanges then they should be aware.

Around 120000 BTC have been stolen from bitfinex.It is not yet clear whether the theft was an inside job or whether hackers were able to gain access to the system externally.The attacker has moved at least 153 BTCs with 38 transactions.If the attackers bring it to an exchange, we can expect a huge dump in bitcoin price as they have to sell it as soon as possible.I hope all the other exchanges like kraken will also freeze the bitcoins."For an attacker, the cost-benefit strategy is quite easy: How much is in the pot and how likely is it that I'm getting the pot?"

Im afraid not enough analysis will ever be enough if they know what they are doing. All they need to do is run the coins through the Helix tumbler using Tor. Yes it will take a while since it has a limit of coins, so it will be made in small batches and some money will be lost due the fees, but they can end up cutting the trace of the coins. Unfortunately at that point it's clear the coins will never be ever recovered.

How do you suggest a mixer like Bitmixer.io to provide any assistant to governments with or without court order when they literally have nothing to give them? or maybe you think they are lying about destroying all the logs after 24 hours?

If those bitcoin could be recovered, it will lead to more attraction about bitcoin. People will say: oh finally no so bad lol

as this much humans keeping eyes on those transactions even after so long time seems like thieves are relly getting fucked up this time, they can not even touch those coins becuase that will panic everyone that someone is playing wih those stolen coins. why did someone even steel any thing which he can not even spend

I still fully think that Bitfinex are the ones that stole those coins, I really HOPE they aren't but my gut says that this is all them.

I guess they're trying to get their name out a bit right now.

why did someone even steel any thing which he can not even spend

It seems they are testing levels of interest for now. Which are relatively low.

interest here does seem low at that.

i would of figured this would be bigger news. as it stands this thread just kind of dribbles along.

It blows my mind we can have a hack this big and nobody really cares.

It blows my mind we can have a hack this big and nobody really cares.

It's not that people don't care about what has happened, but it's around 6 months ago that the news about the hack became public.

Another thing is that quite a large group of people simply don't believe that Bitfinex was hacked. They believe it was a well set up insider job where Bitfinex just blames hackers for what they actually did themselves.

I'm also inclined to think that it was an insider job. It's utterly amateurish that hackers or whatever else you want to name them can exploit a vulnerable spot in their exchange and walk out with well over 100K BTC.

That's why I don't believe anything from what Bitfinex is saying. It smells so bad, that I find it very worrying and dangerous that this exchange still seem to enjoy whatever form of popularity. Doesn't make any sense.

It it is that easy to catch the culprit they would have done that already.These hacks cannot be traced that easily and none of the funds that were hacked are not traced till now and so this will be the case in Bitfinex too ,the FBI is investigating the case and i hope they could break open the case ,it all depends upon the hackers skills .

That's the transparency of the blockchain. Nothing can be moved without people not being able to see when and where these coins are moved to. In that matter, it will be a tough job to ever spend or sell these coins. If you look at it from that point, they have gained (stolen) a huge load of wealth, but it's pretty much worthless at the same time. It's easy to say that these coins will get mixed, but they will risk having their coins seized once sending coins to whatever mixer as I am quite sure any service is keeping an eye on the stolen coins.

I dont think so they will ever be caught. They can make 1000 different wallets and  divide the coins amount those wallets and spend everywhere online and offline. Its almost impossible to track. Using Bitcoin Mixer services can make even more difficult. Transfer to the exchange and convert them to Altcoins. Move altcoin between exchanges and convert to bitcoin again. So many options are avaible to utilize the theft coins without being caught

No way, there is no way to recover those bitcoin. Think about if those people who did stole those bitcoins will have a good samaritan feeling and just voluntarily return it to them. They will be forever lost and it seems those people are doing a sneaky move for their coins now, probably they need to use it for building another exchange and reasons out the same way to hide their crime.

They hack those coins because they want money and they would never tend to give it back to bitfinex.They exert efforts on getting those funds thats why they are making a move now and for sure it would be really be planned in able for them not to be traced.

No way, there is no way to recover those bitcoin. Think about if those people who did stole those bitcoins will have a good samaritan feeling and just voluntarily return it to them. They will be forever lost and it seems those people are doing a sneaky move for their coins now, probably they need to use it for building another exchange and reasons out the same way to hide their crime.

Yep, this has to be the most obvious inside job in Bitcoin history.

It is more about losing the traceability of the stolen coins (if we assume that they were really stolen). It doesn't matter into how many wallets you divide the coins, they can still be traced back to a wallet to which the coins allegedly had been moved by the hackers right after the hack. A simple program can easily do that, thus these coins will still remain tainted and can be frozen by any exchange or mixer that listens to or believes what Bitfinex is saying, i.e. that the coins from a certain wallet are theirs

I'd like to know If Bitfinex user accounts have 2 Factor Auth. Because If That's the case, It'll be an inside man kinda hack. as Far as I know 2 Fact Authentication can't be breached except there's an inside man who acts as an accomplice. Either Bitfinex I believe some day, The truth will soon be out

The Kraken has frozen 0.4BTC, but nobody knows if the other exchanges will all freeze the coins. I bet Coinbase chooses to freeze. I have never heard of Xzzx or quadrigaCX.

https://www.cryptocoinsnews.com/bitfinexs-hacked-bitcoins-move-5-recovery-bounty-offered/

Hmm, the hacker must be not happy because exchanges will freeze his money, but we are happy because those exchanges which freezes the hacker's bitcoin is moral action, cheers for moral action in the community.

Basically that. It really surprises me that there are still people not being able to understand that whatever you do with your coins, that everything can be traced quite easily. Another point of simple ignorace is the fact that they think these coins can be mixed, or be sent to an exchange where after that you convert these stolen coins into whatever altcoins. I can't think of any serious service or exchange that hasn't been notified about the addresses the stolen coins have been sitting in

The dàmage is already been made. Our trust is lost because of that incident. They should have did that earlier. Many months have passed and now they decided to chase the hacker. They are just doing this to catch our interest. Can they recover the stolen coins? I think it will take a very long time to happen.

Could someone please tell me how exchanges are going to know if they receive stolen bitcoins? is there some kind of alarm going off when they are deposited?

They had 2FA but it is irrelevant in this case

Since the hacker could just have broken into their servers from outside and stolen the keys totally bypassing this method of authentication. The coins hadn't been stolen from someone's account (as you erroneously seem to assume), they had been purportedly stolen from Bitfinex cold wallet(s) itself (themselves). But what is highly suspicious here is that all these wallets require multisignature. That pretty much means that all the sigs had been reachable to the attacker (which is yet more fishy) or it was exactly that, the inside job

In all these cases, as with Kenna’s, the hackers don’t even need specialized computer knowledge. The phone number is the key. And the way to it get control of it is to find a security-lax customer service representative at a telecom carrier. Then the hacker can use the common security measure called two-factor authentication (2FA) via text. Logging in with 2FA via SMS is supposed to add an extra layer of security beyond your password by requiring you to input a code you receive via SMS (or sometimes phone call) on your mobile phone. All fine and dandy if you’re in possession of your phone number. But if it’s been forwarded or ported to your hacker’s device, then that code is sent straight to them, giving them the keys to your email, bank accounts, cryptocurrency, Facebook and Twitter accounts, and more.

Last summer, the National Institutes of Standards and Technology, which sets security standards for the federal government, “deprecated” or indicated it would likely remove support for 2FA via SMS for security. While the security level for the private sector is different from that of the government, Paul Grassi, NIST senior standards and technology advisor, says SMS “never really proved possession of a phone because you can forward your text messages or get them on email or on your Verizon website with just a password. It really wasn’t proving that second factor.”

I don't think its stolen funds ethier, because bitfinex just sitting and drinking a bleach probly they stole it from users and call it a hack or whatever they want to call that shit.

May be it is true may be not. Either way the FBI is investigating the case and if it is an inside job sure they will catch the culprit as i think this is the only case investigated by the FBI when it comes to bitcoin exchanges.It is not that easy to recover the funds and if you check the history of bitcoin exchanges none of the coins have being recovered till now,so the hopes of recovery are very slim.

The mixer services are currently under scrutiny from most governments and they will possibly work with the authorities to identify

the people behind this hack. If they resist, they will just attract a lot of negative attention and they do not need that now. The

authorities do not need to ask nicely, they can just force them with a Subpoena through the courts. The exchanges is no problem,

because they already work with most governments, if they adhere to AML/KYC regulations.  ::)   

Just like you're surprised at folks who can't understand that any transaction can be easily traced back to its origin, I'm no less surprised why people are as easily led to believe everything that Bitfinex says to us. Did they provide any evidence that the coins that have been recently reported as moving had actually been stolen from them? As a conspiracy theory, they (or someone closely affiliated with them) might have been moving the coins to test waters. Really, if they got frozen they are expected to get transferred back to Bitfinex. If not, they could be sold and their track thus would be lost for good...

In either case, Bitfinex is losing nothing if they are really behind this "hack"

2FA is useless if a customer service representative at a telecom carrier is negligent and forwards or ports your phone number to a hacker’s device. It's a common reason for big hacks.

Customer service representatives who don't ask all the security questions they should often give hackers control of people's phone numbers

Sad but totally true

I read a similar story when clients of a certain bank had their money stolen through this or similar method, through negligence of their mobile operator. I don't know all the technical details of that story but as I got it, hackers gained access to Internet banking by stealing logins and passwords of their victims, then managed to get SMS confirmations redirected to their phones and thereby they were able to successfully withdraw the funds. If I remember correctly, the bank in question had to refund the stolen money, though I'm not sure if it was entirely their decision or a court had demanded them to refund

What about the kind of 2FA that uses the google authenticator app? Those are much safer than the ones used via SMS. Didnt one of the biggest investors of Ethereum and Augur get his cellphone hacked and had all his ETH and REP stolen? I dont know the whole story of what happened but it there was a blog from Kraken that said the hackers were able to receive his 2FA codes

What about the kind of 2FA that uses the google authenticator app? Those are much safer than the ones used via SMS. Didnt one of the biggest investors of Ethereum and Augur get his cellphone hacked and had all his ETH and REP stolen? I dont know the whole story of what happened but it there was a blog from Kraken that said the hackers were able to receive his 2FA codes.

For using the Google Authenticator 2FA protocol, you don't need a device that's connected to the internet, it just needs to be set to the correct time and date. So, you could mitigate attacks against a phone by keeping a separate phone specifically for your 2FA keys and app, that has no SIM or any WiFi connection

Say, I have an Android emulator installed on my computer (I was using it when there hadn't yet been a tablet version of WhatsApp, and WhatsApp worked), so I could install Google Authenticator there, disable the network connection and use it safely?

Is FreeOTP available in Google Play? What is the basic principle behind this method of authentication, in two words (as you understand it)?

You could do that, although I would describe it as "safer", not absolutely safe. It's just a mouse move in the IT security cat & mouse game.


I believe Play Store has it, but I get my FreeOTP app from the F-Droid Store (https://f-droid.org)

It uses the same protocol as GAuth. The principle is that the app creates a "One Time" access code that is only valid for a few minutes. The website checking the access code has a copy of your GAuth key (they gave it to you to begin with), and so they can ascertain that the code you provide to them is authentic. It (the access code) is essentially just your Gauth key and the current time/date run through a hashing algorithm (I think it's a multiple hash algo affair, the codes are shorter than the bitlengths of the hash algos used)

That seems to be the point that I was missing in understanding what GAuth is basically about (and needed to know). But in that case, I can't possibly see how it can be safer than sms verification. Essentially, the hacker just needs to steal your GAuth code (which is simply your access key) to confirm anything which you set to confirm with it. Indeed, you would still need access to a user account for which the access code is being generated but you would anyway need this access to make use of a successful phone hack. Therefore, I guess, we can compare the security of these two methods of authentication directly, and I don't see any advantages of Google Authenticator. Stealing this key is likely much easier than hacking a phone

What else am I missing here?

For using the Google Authenticator 2FA protocol, you don't need a device that's connected to the internet, it just needs to be set to the correct time and date. So, you could mitigate attacks against a phone by keeping a separate phone specifically for your 2FA keys and app, that has no SIM or any WiFi connection.

I would recommend against using Google's closed source Authenticator client on a phone connected to the internet/phone network, but it's probably not an issue for an air-gapped phone. FreeOTP is a good open source authenticator that uses Google's protocol, if you're wanting to use an open source client.

The problem with SMS verification is that sometimes you don't have your phone with you. Unlike a 2FA google authenticator where you can install it on your PC, tablet, phone or whatever device that supports it. Though, I would say it is a layer of security that would not really be hard to crack like you said. An SMS verification is much more secure but give a lot of hassle in my opinion.