Bitcoin Forum

How can this happen?

A guy came over to my house last night and bought my 7970.

He sent me BTC.

I gave him the card.

He plugged in some USB stick and sent me BTC.

Now, I check my wallet today and my BTC is missing.

Did he do something and steal my coins?

he plugged in his usb on your computer? probably a bitcoin stealer on there. how many you lost?

100% of my BTC is gone.

Can you post your BTC addresses in this thread, we'll be able to tell you more then.

Do not let strangers plug hardware into your computer.

You let a person you don't trust run an unknown program on your computer?  

Most likely he compromised your system.  Installed a rootkit, keylogger, made a copy of your wallet.dat, etc.

Why, why why would you let someone use the computer containing your bitcoin wallet?

why would you let him plug a usb in your pc? never trust anybody.

This. More than likely the btc stealing software. Face2Face is not always a good decision. Never allow someone to install something, or put something into your computer. I would have had him write down his address, not bring a flash drive. Your bitcoins can possibly be returned if you backed up your wallet with an encryption. He shouldn't be able to do anything with them as long as you did that. Also why do you post this in the noob section? Shouldn't this go in the support section?

I think we will fail as a society when I read topics like this.
Never allow random dude plugging things to your computer if it's not good friend or close relative.
Never allow any bitcoiner plugging things to your computer even if it's good friend or close relative.

Also you should watch this project: bitcointrezor.com (http://bitcointrezor.com/)
It's physical USB device which can save you from scams like this in the future (It's not ready yet). Device can hold your private keys and it show transaction details on internal LCD display when making a transaction. Transacton is created & broadcasted only after you press the confirmation button on the device itself. If there is something wrong wit the transaction, you can just switch to secure PC and try again. Also physical wallet cannot be copied. It has to by stolen physically to do any harm.

I don't know.  He seemed cool.  He brought over his 3 year old daughter too and my son played with her while we did the transaction.

Seems like a clean cut nice guy.

I have his personal information though.

I will blast it all over the internet and file a police report too.

My BTC wallet is ...

19QXrx5FGgepoqdyMMvk5cDxGCQCN5bLut

I am a newbie and just got my ass handed to me.

This feels great... glad I joined the BTC community.

Now I am screwed on my bills.

Ouch, live and learn.

so he stole 3.87224984 BTC??

Where do you get this idea?  If the coins are gone they are gone.  There is no getting them back (at least not through the protcol).  An encrypted version of the wallet does nothing if the attacker has access to your system.  They can install anything including a keylogger to record and transmit your passphrase the next time you type it and a rootkit to hide any trace it ever existed.

He stole more than that....

Do you honestly think that the hardware he bought was a measly 1 btc?

In otherwords, you think the guy spent hundreds of dollars for hacking software to gain a couple btc? I doubt anyone would want to go through that much trouble, or even gain federal offences on their names over something that does not truely exist.

Oh dear.
I wonder if the police report is going to be of any use.

no... 3.37324984 BTC

There is chance that he brought some virus on the USB flashdisk unintentionally.

pretty smart way to get free mining gear. I wonder how many times he did this.

That doesn't include the BTC that he supposedly paid for the hardware. Hence why I said he stole more than that.

this is info for the address you gave.
http://blockchain.info/address/19QXrx5FGgepoqdyMMvk5cDxGCQCN5bLut

Pretty smart way if you want to get shot! How do you have no information on him? I am sure this will catch up with him, like 'a drug deal gone bad'.

Yes ... he stole my entire wallet amount.

3.87224984


^^^ I just talked to him on the phone.

He said mysteriously some of HIS btc is gone too and was hacked somehow and "he is freaking out too"

He said that maybe his USB stick had a virus.

I told him bring back my 7970 and we will not have a problem.

He said he is bringing it back tonight.

We will see... I guess.

I have his LinkedIn page ... his personal cell phone number.

He brought his 3 year old daughter to my house to play with my son while we did the transaction.

But really, having his phone number is all I need to find out anything I want about him.

He lives in the same city as me ... used to live in the same apartment complex as I do.

I even have the old unit number.

Well, first off do not use that computer until you reformat it. There is a possibility that the virus was copied to your computer, you don't want any more BTC to be stolen, or even your PayPal or CC info, so make sure you reformat that PC ASAP.

There is a possibility that spyware on your PC had previously got your wallet and it was just waiting until you received a sizeable amount of BTC before emptying it.

It's also a possibility that the other dude's PC was infected & it copied itself onto the USB drive and then infected your PC.

The guy could've just straight up robbed you, but IMO it takes some balls to do that to someone on a face-2-face transaction.

Is there any other info that we can learn from this?!

I should also ditch this wallet, right?

Guess I will be reinstalling Windows right now ...

Oh yes, of course do not put another satoshi into that wallet and create a new one. Make sure you update withdrawal addresses on any pools etc

Not sure what you mean by satoshi but yeah I am deleting this wallet and reinstalling windows right now.

My only pool account is perm locked so I am cashing out my .08 BTC and hoping I can get it to an exchange before it magically disappears.

At least my LTC are safe on my other computer ...

This dude better bring back my 7970 like he said.

What evidence do you have that the guy who bought your card stole your btc? Your computer could be hacked any time you were sleeping.

You just sent 0.08450933 BTC to the same address knowing someone else has access to it?! http://blockchain.info/tx/a26a61a018f41ddc50dc007adf93171761f70f2c1981fc94e6714f9a748f9d22

Transfer it out QUICK!

Would be an amazing coincidence.

My wallet is ALWAYS open.  Since the day I got it ... it is always open.

All the sudden ... this guy comes over with his USB drive.  Starts doing a bunch of stuff.  Remoting in to his computer etc.

While I am in the kids room making sure they are not getting hurt while they are playing.

His daughter was jumping off my sons desk on to his bed.  So I went in there to make sure they did not get hurt and stop the jumping.

6 hours later ... my BTC are missing.

So to think my computer was hacked from the time that guy left to 6 hours later ... is a long, long, long shot.  Like, LONG shot.

Come on man lol it's pretty clear what happened here.

Please read the post above what you just wrote.

I am cashing out the rest of what I have from ABCPool ... because my address is perm locked.

Then I am reformatting this machine.

Yeah it is not a lot but I am gonna transfer it to CBX as fast as possible.

This is so frustrating.  I do not have a lot of money to begin with.

Why are you sending funds to a compromised address?  Very likely the attacker will see the new funds and instantly create a tx to spend them before you.  Now you simply put yourself in a race with the attacker for your funds.  Maybe you win but the attacker has nothing to lose.  He will gladly play 'race for kenji coins" all day everyday.

Well I didn't know that.

It is one transaction for .08 ... I will take my chances.

You suggesting I just reformat my computer and not even try to get the coins I mined?

You need to transfer it like right now, get off the forums and open your client, fast!

Its possible that your wallet will be automatically sweeped out at any second.

My wallet is 3 inches away from the window that the forum is on.  I am staring at the confirms.  It has not even confirmed once yet.

Well if there is no override for locked address on your pool account then I guess you don't have much choice.  Maybe the attacker will be slow.  As soon as you get 1 confirm spend the coins to an exchange or ewallet.

Oh, I didn't know you couldn't spend unconfirmed tx's on the main client.

Got the "Send Coins" tab ready to go ... sending to my CampBX account.

Just waiting for the BTC to become available.

All anyone is suggesting is not using that wallet anymore.

I'd at least try to get ABC Pool to change my receiving address before giving a thief an opportunity to steal more money from me.

Yeah QT client requires at least 1 confirm before spending (no override without recompiling).  A smart attacker would be creating a tx with the unconfirmed input my guess is the attacker isn't that smart so OP may have a shot.

ABC Pool makes you lock your BTC address and cannot be changed :(

This guy could do anything to your computer while you were away. He could copy your private key and then use it to take your btc out of your wallet, and you can not say for sure if he did this or not. Technically, you can blame only yourself in this situation.

The fact that he agreed to return your card is suspicious though. If the guy is not guilty, why would he want to pay for your fault?
 

lol give me a break man.

Only one to blame is myself?

MY FAULT?!!?!

lol Good Lord!

So if someone steals money from a donation trey at Church.  Is it the Pastors fault for passing it around?!

lol I got robbed here man.  I am almost offended you say it is my fault.

It is partly your fault, you shouldn't have your wallet unencrypted and open on your PC.

The BTC were actually transferred about one hour and forty-three minutes after they were first sent to this wallet.

What I really don't get is why he had to do anything to your computer at all. There are so many ways to get your BTC address that don't require him even seeing your computer.

You got robbed, but you don't have any strong arguments against the guy whom you blame. In fact, if he was not stupid, he would deny everything and refuse to take any responsibility for your fault.
 

But to get to computer and copy wallet.dat to usb stick is the easiest thing to do, isn't it? I mean, even computer dummy can do this.

It seems you made it... right?
http://blockchain.info/address/19QXrx5FGgepoqdyMMvk5cDxGCQCN5bLut (http://blockchain.info/address/19QXrx5FGgepoqdyMMvk5cDxGCQCN5bLut)

I think you should demand your coins and card back. You know where he lives etc. He wasn't much of a crook giving you his details but crooks are often stupid and/or forgetful. Maybe it was just a crime of opportunity done on the spur of the moment so he didn't think it through. Nonetheless, get everything back.

There is no guarantee that the guy actually stole his BTC. Many wallet stealers won't take the funds right away but will wait until a sizeable amount is transferred into the wallet before it cleans it out.

Easier than emailing it to him? Easier than getting a QR code from blockchain.info and letting him scan it? Easier than texting it to him?

That's like saying, "I owed him some money and the easiest thing to do was give him unrestricted access to my bank account and let him do the rest."

I plan on sending and receiving bitcoins from individuals at the San Jose conference and I guarantee that I will not voluntary give anyone access to my phone or laptop. Heck, I'll be able to receive bitcoins several different ways even if I don't take my phone or laptop!

What are you talking about? To get btc out of the wallet you need access to private key. You can not get somebody's private key from blockchain.info

This is what I am talking about. There is 90% chance that he did stole btc from OP, but still 10% chance that he did not. There is no strong evidence.

There seems to be some misunderstanding.

I meant, Kennji had no reason to let him touch his computer. I thought you were saying that it was the easiest way to give him the receiving address to send the funds to. I now see you probably meant it was the easiest way for a thief to gain access to his wallet and you're right, it is.

A question,please.

reformatting hard drive and reinstalling Windows will remove keystroke logger,viruses AND rootkits?

thank-you

I would say even less than 90%.

Evidence supporting this person was the thief:

• He had unrestricted access to the computer.
• The funds were transferred almost immediately after he left.

Evidence against:

• As Blazr mentioned, wallet stealers often wait until a significant amount triggers them into action and this address hardly had more than half a bitcoin in it before the day in question.
• This person should have known that he would be the first suspected and that his victim could easily track him down.

Technically, no. Like phones, computers have firmware. Anything you ever do, download, or see on your computer is embeded in your firmware. However, reformating can remove the virus from your computer rendering it useless, but that doesn't mean it is off of your computer for good.

"Remove" may be the wrong word. reinstalling windows will disable the rootkit/keystroke logger?

Yes, this is what I meant. Sorry for my bad English. After OP let the guy to log in to his computer, the guy could copy his wallet.dat by one click.

Yes, but if it copied itself onto some low-level firmware then no. So for most intents and purposes a reformat is enough.

thx

so he's returning the card out of the goodness of his heart and despite the fact he lost not only what he paid for the card but also money from his own wallet.

Note, when you reformat make sure that you write a new Master Boot Record to your drive, as malware can copy itself into it.

If I believed the other person needs it more than I do and was not responsible, I would.

Besides, if he was the thief and he returns the card, what has he gained? Just the BTC, right? They would both be back to where they started - Kennji would have his card back and the thief would have just stolen his own bitcoins back.

Yes, if he is really a thief, he is very stupid thief. If he would wait for several days before cash out, first of all, OP would not suspect him, and second, OP could put a couple of btc more to his compromised wallet. :)

It's not the first time I hear about petty criminals using children has a decoy to their misdeed, but bringing one's daughter to conduct a scam that could have gone wrong very quickly is just shocking to me!

I remember watching an interview with a car thief serving time in prison who claimed he always took his toddler daughter along so as not to look suspicious.

Well, I'd say yes, under the following conditions:
- You do a full reformat (ie not the the 'quick' one your OS might offer you during the install).
- You make sure your computer is offline during the process (pull the ethernet cable/disable the wifi card if any)
- You make sure you're not reinstalling the said malware in the process: Clean, official windows CD purchased in the store, legitimate software etc
- You immediately install an antivirus (try avast) and antimalware (try superantispyware)
- Using a different, safe machine or even better, someone with more IT experience than you, destroy/wipe any remove media you may have used on the compromised machine (usb sticks, etc)

Good luck!

Next time:

don't let others remote into their computers, you never know if their PC wasn't set up to steal from yours or whether it wasn't hacked by someone else
DISABLE autorun for all devices (cd, usb, hdd, etc.) so even if there is a virus on a USB memory (or any other device) it won't be able to start up and wreak havoc

He's only returning the card because he was caught.

I can't believe how people on here seem to want to go for the most elaborate scenario possible when it's obvious what happened. Anyway good luck to the op.

I agree that he is the most likely culprit, I'm just pointing out details that show it isn't as "obvious" as it might seem.


He wasn't caught, he was accused.

Believe it or not most of the other scenario's mentioned in this thread happen to people all the time, and aren't as elaborate as you might think.

He was not caught, but he freaked out nonetheless. This is very suspicious, indeed.

If it was me and I accidently infected OP's PC with malware that I didn't know was on my USB stick I would feel guilty for OP's loss and return the card.

Well, if I was sure that my USB stick caused a problem, may be I would do the same. But honestly, this story about accidental malware sounds like BS to me :)

I lived in not very safe area for a while. My car was cracked 3 times there, and things were stolen. I knew teenagers who did that, but I could not prove that they did. Reporting to police was useless, they could not do anything too. So, this is a situation when you can blame only yourself if hoodlums steal from you.

Good luck.  :-\

Why would you let someone do that? Really? Unless they are someone you know well never let them plug something into your computer and if you are planning on doing that, have a separate computer (maybe a separate wallet.dat) that has no BTC on it for people to plug in stuff when trading and then clear it afterwards.

you want to delete all the partitions first,

then install windows (which will create a partition that takes up 100% of your drive, and format it)

Full format does not write anymore more then quick format, it just tests if it can read sectors and marks bad ones bad. So there is no need to do a full format, quick is fine

Sorry if its already been mentioned, but https://bitcoinarmory.com/ is what i use to store my wallets. make a paper backup of an offline wallet and you're good :)

hopefully it'll stop it from ever happening again

THIS. The whole "oh some malware got on his USB stick and it autoran on your computer" is sooooo unlikely, that is not how most malware is spread whatsoever, and most people have USB autorun off, I think it's off by default in most modern Windows installs.

The argument of "he didn't do this scam in the same way that many thieves do scams!" is just silly, there are tons of novice criminals, dumb criminals, etc., and it's even possible that he had only vaguely thought of it before, but once he was there and you left the room, he went "ah why not".

Anyhow, if the guy claims he ALSO had coins stolen at the same time, I'd like to see him prove that, show a transaction at the same time from an address he can prove is his. THEN maybe I'd start to believe him.

gl OP

He probably just copied your wallet.dat file to the usb drive.  Then he spent your coins when he got to another computer.

yeah, probably. a simple batch file would have done the trick.

You know what I would do if someone ripped me off like that? Id get my revolver put it to his head and make him empty his wallet.

But thats just me.

Wrong, malware is spread on USB sticks and very often the autorun is turned on on default, this is one of the ways Stuxnet, Flame, Conficker and others spread onto so many computers.

This makes me facepalm, dont give a s**t who you are, you aint pluggin NOTHING into my pc.

Feel bad for you man but that was a really silly thing to let someone do.

Don't do that, First try to find what is on your pc, usually bitcoin stealers send wallet to FTP etc
check running files, do virus scan if you find some random .exe file running find location of that file and zip it then you can contact me for analysis.

otherwise you will never knew who stole it.

Was the OP's wallet encrypted?

Probably not and OP let him use his PC.

@OP how did he sent you bitcoins from your pc

Your Bitcoin client?

Does Windows have any kind of logging in which you can see what devices were mounted and if the file was copied to it?  This could be used as evidence against the thief.

I finally got done reformatting and reinstalling Windows on my machine.

He gave me back the card.

What a horrible experience this is\was.

I lost .5 BTC in the whole thing because the thief (whoever it is... I am so confused) got everything in my wallet and I had .5 before this entire transaction with the USB stick and the 7970 sale happened.

I have no idea the many different ways to transfer BTC from wallet to wallet.

I kept asking him how we were going to do this.  I thought he would just bring over his Laptop or something and transfer me the coins.

But he never answered.  Just came over and got this USB stick.  Said he can use that to transfer me coins.

I was like "oh cool"  --  I didn't suspect any foul play.

Then 103 minutes later my coins are gone.

finally someone talking some sense. =P

Well probably he did that with bad intentions and thought to return card after getting caught otherwise if was in his place and didn't done this and also got my own bitcoins stolen i will contact you first because i plugged my usb in your pc.

But he didn't contacted you.


You are lucky that you didn't had your own bitcoins in wallet.

I'd check your little 'uns money box too if I were you.

A harsh harsh lesson.

Simple golden rule. Never trust anyone anywhere with Bitcoins. Chances are, a very large percentage of people 'invested' (in time and / or money) in Bitcoins are out to make a quick buck if they can.

I believe the least likely scenario is that he infected the computer with a wallet stealer via the USB stick. It is more likely that there was already something present on Kennji's computer, especially considering his naivete toward security, and it was just triggered by the additional BTC. If that was the case, it most certainly would have transferred itself to the USB and infected the other person's computer as well.

Of course, the most likely and simplest scenario is that the wallet.dat was simply copied while he was out of the room.

He plugged in some USB stick and stole yours BTC.

I can see how someone could fall for that - guy comes to pick something up in person, he's paying in bitcoin, he has his wallet on a USB stick.

Pretty ballsy move, if he did indeed snag a copy of your wallet/install a keylogger or similar.

this sucks now I know not to trade face to face lol.

lol just don't let him plug anything into your computer and you will be fine  :P

Quite sad, can the police help?

Gotta keep your puter to yourself

This really demonstrates the problem when a hot new cyber currency expands beyond those really knowledgeable about general computer security practices. I don't know if we should blame someone for being naive and trusting.

Do the right thing and have an old laptop or machine running linux, if you are going to store a lot of value in BTC.

If the guy did copy your wallet.dat, he wouldn't be able to do anything with it if it was encrypted.

sad, so sad, bad people

Just have to be careful to not let people put USBs into your computer if you don't know the person.

As a newb. This is very helpful for the future. *Starts encrypting wallet*

Yes, encryption seems a good idea

The encryption is of course the best way to lock your coins but a backup wallet is also a must have. If you have a offline backup and encrypted wallet you have nothing to worry about.
But seriously don't let anyone play with the host where the wallet is stored.

wow that is harsh, sorry to hear about it.

Sorry to hear what happened dude, but I wouldn't let a stranger use your pc, especially plug anything into your computer. As for encryption, use a random string as a password like 534jgkhfgSDFGergf34£%$&%egfs so it would be hard to brute force or dictionary attack.

Was the wallet encrypted?

Anyhow, is clear the dude stole your coins. Plugging an USB drive to your computer to send you coins... What he had there, his wallet.dat? And he opened it with your client? A text file with the URL of an online wallet? You said he remotely connected to his computer... Yeah, right. He was just stealing your coins.

you must use online wallet for more security 

You let a person you don't trust run an unknown program on your computer

eek, this is my biggest fear with these crypto currencies

jaysus, very sorry to hear m8, how much did you lose? just highlights the importance of securtity

*facepalm*

I'm not even going to begin to explain how wrong you are.

x1

=(


Sorry to hear about your troubles.

Allowing someone unrestricted access to your computer is just asking for trouble even if you've never touched a crypto-currency.

;/

 I'm glad to hear that all is well and that you got your coins back.

Whatever happened... it serves as a good warning for newbies to learn about security before getting too deep into the rabbit hole.

 I will take more precautions now to protect my coins.

Look at the bright side, at least you did not lose BTC25,000 (https://bitcointalk.org/index.php?topic=16457.0)

He probably brougt a keylogger is my guess.

That's going to be a bit of a pain to type in any time you need to use the wallet.

It's a bit awkward I guess if someone says "Can I use your computer" and you have to say something like "Well, no, cos, erm.....", but I guess its the ony way.
Sorry your btc got stolen.

Did I miss something? I didn't see that he got his coins back...

You really have to be so careful and do everything you can to secure your coins. You should check out the thread about wallet safety.

I thought you lost 3+ BTC, you only had .5 total?

1. Before everything, he had 0.5 BTC and his card.

2. He then sold his card and had 3.873 BTC.

3. His BTC was stolen and he had 0 BTC and no card.

4. The prime suspect offered to return the card. If he did, Kennji now has 0 BTC and his card back.