Bitcoin Forum

My Hero account (manselr) has been potentially hacked. My password doesn't work, and I can't access my email. What's weird is, when I try to recover my pass with my secret question thing for the email, the website says my email doesn't exist. I thought the email got expired because I didn't log in on there for a while, so I tried to register again the same email but it says it's not availible.. weird.

https://bitcointalk.org/index.php?action=profile;u=381190

It seems no new posts have been made and I don't remember when I exactly logged off yesterday so im not sure if someone has accessed it.

I have seen that this forum has the option to ask you "your secret question" to try to recover the password but I don't remember ever being asked to enter a secret question and answer during registration, in fact when I just registered this account, there was no such thing in the registration process.. also weird.

Anyway I have all info you need to recover my pass, including my 2 lasts passwords, email, and any address used to recieve payments in signature campaigns for example (I could sign one to prove I own these BTC addressess) but be quick in case the hacker changes the BTC addresses to his addresses to recieve the money himself, but I hope you can see any further post edits from now on and know that isn't me (in any case let it be on record that for example my last used BTC address for this campaign: https://docs.google.com/spreadsheets/d/18HG1y8z7Ua-7iWfZiKGonvDlBpLAquXknEbG1fggHXg/edit#gid=0 is 1fuCrK2gq9jiQsy375hexRnNMun8gJvJp)

You can't recover forum passwords using the secret question right now. Attempting to do so results in your account being locked for security reasons.

Seclog shows two actions for your account in recent times:
Today at 09:45:49 AM - manselr - password changed
Today at 09:26:08 AM - manselr - password reset via email

---

If you're sure you don't have access to your account anymore and want to recover your account, follow the steps here:
-> https://bitcointalk.org/index.php?topic=497545.0

Someone has definitely done that and it isn't me... do you have their IP's? I will read that thread now.

I have sent the PM as explained on that thread to admin "Cyrus" a couple of hours ago. How much does it take in average to get this type of thing solved? Im worried the hacker causes havok in my account.

Here's an screenshot of the post containing the BTC address I used to sign in case hacker modifies it:

http://image.ibb.co/jN5UBG/manselpost.png

Plus there's also that same address on the google spreadshet of the sig campaign.

In any case, if hacker modifies the post, I can sign any other address from ages ago in some locked thread, I think I should have one in the Bitmixer thread, but please act fast im worried.

How about this addy: http://archive.fo/tBwvf

There you have it. I don't want to make public the email, Cyrus has it on the PM but I still didn't get any replies back.

All you can do is wait. Account recovery is low priority.

I wonder who is faster recovering accounts, theymos or Cyrus. I sent it to Cyrus because he was online but I saw theymos post right now :p

If you have already sent to theymos and he fails to see the required proof, he will ignore you after that. May have a better shot with Cyrus but don't spam him to death.

https://bitcointalk.org/index.php?topic=497545.0


    
Recovering hacked accounts or accounts with lost passwords
March 02, 2014, 08:45:09 PM
   
 #1
If you use any sort of Google email service, then the password recovery email will go to your spam folder.

If you want us to recover a hacked/lost account, you need to prove that you own it. Typically, the only acceptable method of proving ownership is by signing a message (including current date and desired new email address) using a Bitcoin address or PGP key associated with the account. A Bitcoin address or PGP key is associated with the account only if the account posted the key/address, sent it in a PM, or if it is still listed in the account's profile.

I very rarely recover accounts if you can't prove ownership as described above. There are alternative ways of proving ownership, but they take too much time. If I point you to this thread, you can't prove ownership properly, and then I ignore your future PMs, this means that I'm not going to recover your account. Create a new one.

Send one PM to either me or Cyrus. When sending a PM, use a template like this:

Quote
-----BEGIN BITCOIN SIGNED MESSAGE-----
My account <account> has been hacked/lost. Please reset the email to <email>. The current date is <date>.
-----BEGIN SIGNATURE-----
<insert address here>
<insert signature here>
-----END BITCOIN SIGNED MESSAGE-----

Here is the unedited post where I posted that address: ...
OR
I sent that address to someone in a PM with PM ID#...

All required info must be in one PM.

Do not create your temporary account using the same email address you want for the hacked/lost account. No two accounts can have the same email address.

Ok I will wait.

Btw I just learned that signing such a generic message may be a mistake because someone else could use it to impersonate me...:




Makes sense. So should I sign the same address again with a better message? (and edit the post above)

Always add the current date and even time if you wish, but I would follow the above link to the letter. You could sign another here and send Cyrus the link.

You have to be patient waiting for their reply regarding your problem case because you are not the only one who sent pm and send inquiries to them. For sure as soon as they find out that you are the real owner you will have your account back. My friend also have same issue and it was resolve after 1 week of sending pm to the mods. Just follow this steps https://bitcointalk.org/index.php?topic=497545.0

Ok edited the post above with a better message:


This should do.

The PM that I sent to Cyrus with the email included also the date so I will just wait, hopefully he sees this thread too for further proof.

I just want to know: Am I supposed to get a PM reply back or I will get an email at a random time?

Is any progress being made? im pretty nervous man. Is my account at least locked for now?

Your account has negative feedback and everyone checking it can find this thread.

Account recovery is among the lowest of priorities for the admins. My account was also hacked and I had sent PMs to Cyrus few days ago. All we can do is wait, maybe send a weekly PM to admins to have a look again. Your account manselr now has negative trust. So probably members will be careful when dealing with that account for now. In the mean time, keep following your account activity. If the hacker posts anywhere, immediately post in that thread that its your account and that it has been hacked and add the link to this thread. This way, you'll be safe.

Yes, but giving negative feedback doesn't stop the guy from accessing the account and sending PM's, editing posts etc. It seems nuts to me that admins don't have a way to entirely block access to the account until it's solved.

What's the average to wait for the recovery? i've seen some guys waiting for more than a month, that's just not fair.

Btw I guess the negative trust can be removed later right?


But it says send PM ONCE, so I don't want to send another PM to try to remind them in case the admins are grumpy about it.

I understand it's low priority but people that have been here for years like us Hero+ members should have an higher priority.

At least it blocks them from earning money with your account. The last thing you'd want is for the account to get sold or for the hacker to profit from a sig campaign.


I've seen people waiting for over 2 weeks with no response. I don't know what's going on. Is it that hard to hire someone to deal with it. I'm sure some trusted posters would be willing to help out for a few $.

Yes, you just need to contact the person that gave it to you.

I was told to send weekly reminders to the admin to recover the account but not spam them with the requests.  I suspect that the admins get loads of PMs and they might miss out on a few messages. What is worrying at least for me is that, I'm unable to use my account when I needed it the most. One thing that is at least a bit satisfactory is the DT members verifying the BTC address signature and quoting the text along with their approval. This makes it a lot easier for the admins to restore the accounts.

Impersonate or not, as long as you only have your private keys for yourself, no one can create/sign a message using your address no matter how generic your messages can be. But to play it safe, add what's the purpose of the message, the date you created and signed the message and you're golden.

It has been a week now. I saw this account recovery here from 13th of october:

https://bitcointalk.org/index.php?topic=2267151.msg23024794#msg23024794

Considering mine was hacked in october 9th, im starting to lose hope. I need some sort of input of what's going on.

I just can't believe I was about to become Legendary, and some jackass stole my password and now im stuck. I had PM's to answer and I had to talk to some people and every appointment I had is now on hold.

Did you sign a Beast Mark on your forehead, I mean sign a BTC message with your stacked address?

If so, by right it should be fast, as I see some fake account is getting.

I am not as lucky as you. I didn't stack any BTC address here, so my hacked account is 100% not recoverable.

In fact, I wrote in my post that the email address used in my hacked account, before the hack, is the same email address used in this account, but I deleted that post just in case the hacker sees my post again.

Technically, if I am the imposter, I would never be able to register an account with the "victim's" email address.
Even if I know the "victim's" email address, I can't be sure if he changed his email on October 11th in the security log.

For the admin to ignore this simple technical evidence is suspicious.

I have posted several addresses across the years that I've been posting here. I can sign a message with any of them, including locked threads. manselr is obviously me but I haven't had any reply back from Cyrus yet. It's been 10 days.

I don't think we are going to get our accounts back any time soon. If accounts can be restored the same day they are reported stolen, why not ours which we have proved enough? This is not fair from Cyrus.

I am in the same boat here...my acc "sikkan" got compromised a few days ago. I have PMed mods with apropriate signed message. Hope I will be able to get my acc back soon... :/

Create a thread like this one and post the proofs. One of the DT members will verify the signature and tag the account.

Still no reply.

Maybe post some screenshots too? Private message some moderators?

Not sure what else you can do for now... but I wish you the best!

What screenshots?

I already signed 2 addresses and PM'd Cyrus with one signed address as requested weeks ago, still no reply...

not only your account was hacked. bitcointalk and my account was hacked too.
and my friends account, etc, etc. i wrote many PM's without answer

What do you mean Bitcointalk was hacked? the forum's database? looks like it since a ton of people are making threads with hacked accounts.

And I still have no reply from Cyrus, now it has been 21 days..

That was a bit ago, where salted hashes were leaked. This is why there is a consistent number of accounts being hacked (though if someone has a strong password or changes their password frequently it's unlikely to happen without stupidity).

I'm inclined to say that the increase in threads is because of the new security feature which absolutely stumps account trading. More account sellers may have decided to recover their accounts in this way and scam prospective buyers out of their new accounts. This is both a good and bad thing, but if it decreases the amount of trading, then it's an overall boon to the forum.

Try to write him again.

I was very lucky to wait just not so much.

Still nothing. I will wait until 9th to complete a month of wait and if Cyrus doesn't reply i will try with theymos. I have provided enough cryptographic proof, but I will look for all the addresses I can find that I posted with my account and I will sign all of them.


In my case, that is my original account since day 1, so I have no idea how my password got hacked, im a bit paranoid right now about it. Im almost 100% sure I got a new password after the database hack and it's pretty complex. The realistic possibility I see is that the email got hacked since I had a shitty password an never logged in there anyway.

It's been more than one month now. Should I try again with Cyrus or send a PM to theymos? I have lost hope that Cyrus will ever reply.


How much did you wait and when did you send the PM?

If there is a queue it doesn't make sense that some people get it done before you do when you have been waiting a long time.

I waited about 10 days

I have been waiting since October 31 . No answer.

Try to write again

Well, then I don't get it. How come I have been waiting for 40 days and no reply, and you only waited 10 days? if it was a queue, it doesn't make much sense.

Ok so I finally took the time to search for every address that I used here that I could find. Thanks to participating in several sig campaigns I was able to find a couple, and I signed all of them:


1fuCrK2gq9jiQsy375hexRnNMun8gJvJp
https://bitcointalk.org/index.php?topic=2050527.msg21678339#msg21678339
https://archive.is/KCKR4 (reply #235)


13VHwYZNr4sQQ8DkUYDgpufQN5UHxyFqjK
https://bitcointalk.org/index.php?topic=2038052.msg20402540#msg20402540
https://archive.is/y9tKr (reply #129)


1FxAP5PC2wvMQA6XSNLtz3tVsxrJ8LCMuP
https://bitcointalk.org/index.php?topic=1560376.msg19083793#msg19083793


16eHhVn39dDhGRNkcwtCAsy8xfXiJ6v7wc
https://bitcointalk.org/index.php?topic=1119780.msg11906565#msg11906565
https://archive.fo/Lec0M (post #66)


One of these threads has been closed for a long time, so no chances of being edited. The others are unedited posts so I archived them in case the hacker decides to be a jackass and edit them.

After more than a month with no answer from Cyrus I guess I will try sending this to theymos now.

Try again send to all Admins and ask also moderator if can help you.

I tried many ways it helps me

It looks like the scammers are more than real members, I just joined airdrop from this scammer post and now I am seeing the whole story.

I hope you will get the account back, but what type of email you used and did you not kept phone verification to that email?

These hackers are accessing from some other sources to get both passwords.

Now some guy bought my account and is using it to advertise some ICO. This shit is inadmissible. Please admins get it together before 2018, it's been months.

That's a lot of signatures. I verified the message of all of them on my Bitcoin Core node and it seems all of them are correct, so im sure that you will eventually get your account back, just keep trying, theymos and cyrus are very busy. Currently more and more people keep getting hacked, just look on the page 1 of the meta section. This must definitely be a database hack or something, it doesn't seem normal, but then again, this is one of the biggest forums i've ever seen, so maybe the rate of hacks to users is actually reasonable, hard to say.

The guy that bought my account contacted me via PM saying he would give me my pass again but he has not connected since then. Please recover my account...

Looks like im going to hit 2018 without still no reply from Cyrus or theymos after delivering all the proof in the world.  ::)

And still no PM's. Im supposed to get a PM, or I get an email to the requested email address?

Still nothing...  ::)

Did you try to contact all administrators, moderators told them you are waiting so long?

It's been 6 months... this is insane.


I contacted cyrus and theymos as requested, and all mods have seen this thread already.

It's been 8 months and counting, still no reply from either cyrus or theymos. This is insane. C'mon guys... this must be a joke.

Really strange

Maybe I can make a new record of 1 year of wait after giving all the proof needed that someone hacked my account. Unbelievable how fucked up this forum is.

Monthly bump.

Guinness world record

This is absolutely fucking insane. I have been waiting for more than a year to get my account bank. I need it for tax stuff as well as getting in contact with people that I was sending PM's with. Please someone send this whole thread to theymos and Cyrus. STOP THE MADNESS!

Im trying to get my account back through the new method. Already sent the signatures that they requested via email. I still have all of the addresses I used with my account so I can sign all of them. My question is, I was asked to click on a link, it says:

"OK, your current IP was recorded and will be used as part of verification."

But I clicked while using Tor, so the IP changes all the time. Is there a problem with that? even my real IP changes all the time as it's dynamic. Anyway, I haven't been explained what this link is for. Im just hoping the signed BTC addresses are enough to recover the address, if that isn't enough to get an account back then I wonder who is getting their hacked accounts back.

Did you access the forum via tor normally when you were using it previously? Or did you access it from your local internet connection? Even if your IP address were to change, the ISP you are using would show as being the same, along with your general location.

Being that you opened this thread years ago, it may not be unreasonable for either of these to have changed, so you may not pass this verification.

Considering the amount of time that has passed, I would strongly encourage you to create a new account. You would probably be legendary by now if you created one in 2017, or close to one.

The IP address will be used to make comparisons with your IP address logs just before the account was hacked. The IP addresses don't have to be exactly the same but it could give a clue about the difference in your location and the hacker's IP location which can help the recovery team decide on whether to start off with the process of recovery or not.

If necessary, i think you should send them another message explaining that you visited the IP verification link using Tor so that you can retry the step.

Yes, I used Tor and I think most people here with a clue would use Tor or VPNs, because there's scammers everywhere trying to dox you/hack you/etc. IP should be pretty irrelevant, what matters most is signed BTC keys, and I still have all of my keys. I tried with the old method years ago and eventually gave up, recently I wanted to post again and so tried again. Even if im inactive I don't want my account to end up in some ICO scam or being used to promote other scams (and that is what happened as you can see on my latest posts).


I already told them that I clicked it using Tor. Like I said before, IPs are pretty irrelevant these days. The whole point of people stacking addresses here is if something goes wrong you can recover the account. I have addresses from years ago in unedited posts, closed threads etc. I can sign all of them.

Did you ever restore access to your account? It's been years since you started this.

By the way, staking a PGP key in the bitcointalk PGP key database at https://bitcointalk.org/index.php?topic=1159946.0 would've helped you recover your account faster because that is what PGP is intended to do, identity verification, as opposed to bitcoin address signing which, while also reliable, wasn't what bitcoin was designed for in the first place. More people look at PGP than bitcoin addresses as a utility to verify identity.

Did you follow the instructions in Recovering hacked/lost accounts (https://bitcointalk.org/index.php?topic=5089777.0)? There's an email address there in which you can send a signed message to. Try to send your signed bitcoin messages to that address because it's unlikely that theymos saw this thread. Although since you can't access your email your chances of getting your account back are low especially since you've waited for a long time, years in your case. Bumping the thread probably won't help at this point.

If your email was compromised by password guessing/stolen password hash or SIM swap then you should take the time to use BIP39 passphrases for your email without a linked phone number https://iancoleman.io/bip39/. Security and convenience are usually exclusive.

I would take this experience as a hard lesson to use PGP in your daily online forum life so that you can recover from this kind of incident quicker. I am not suggesting you make another account and I don't know how you should go forward after this. Maybe you should ask other people around here if you can continue posting with this account.

It's not useless as you think. The pattern of the IP helps logs provide evidence that indeed you account changed hands of course taking into account your staked addresses too.

I also lost my account to hackers once and do you know what saved me? That IP recording thingy and my original email address. I didn't even have a staked bitcoin address.

Otherwise, good news for you OP. Your account has been Queued for recovery. In a few days you should be able to access it.
https://talkimg.com/images/2023/05/14/blob833aee403d7c9f03.png

2 years and 4 months!!

https://i.imgur.com/HkTGE4h.jpg

Admins or whoever work on saving accounts are lightning fast in this forum! And OP is still around too. Never give up!

https://i.imgflip.com/o910c.jpg

So I've finally got the account back. I would appreciate if some admin can delete threads by these scammers:

https://bitcointalk.org/index.php?topic=5116776.msg50017443#msg50017443
https://bitcointalk.org/index.php?topic=5117080.msg50027067#msg50027067
https://bitcointalk.org/index.php?topic=2466182.msg25260675#msg25260675
https://bitcointalk.org/index.php?topic=2466173.msg25260537#msg25260537

I would also appreciate if Lutpin can remove my negative trust thing that was set as a precaution.

Well i would love to first congratulate you. Persistence finally paid off after all that long time.
You can edit the posts to just a dot ".", Change the title to "delete"  and the move them to the archival board (https://bitcointalk.org/index.php?board=59.0)

You can also contact both Lutpin and KWH through PM and inform them that you have recovered you account so that they can remove the feedback in case they don't see these thread.

Meanwhile while he waits for Lutpin for remove his precautionary negative trust rating, I gave manselr a neutral trust rating saying that he restored access to his account. The negative rating should still be removed though in my opinion. And welcome back OP.

I gave a merit to you for being a persistent person.

I believe this is the first one you ever earned ;D

The others were airdropped to you.

I also gave him a trust.

A sight for sore eyes.

Two years, four months just for account recovery. That's one long phase, but better late than never! :)

Also, better close the thread now it's all resolved.

The one good thing the hackers did to your account is rank it up from Hero to Legendary  :P JK.

Congrats on getting your account back. Never seen someone so persistent to recover a forum account which was hacked 2 years back :)