Bitcoin Forum

Hi,

So I take a look at the address I use to send my mining profits to and it's empty!

The transaction JUST happened when I saw it like 15 minutes!!!

https://blockchain.info/tx/92ba3aef0dc9f174e2de3b69f677ef27032a6da6b687eabdd2329372a519ea7b

19.00129451 BTC were stolen from my mining address 19isNwE5xs2YLgw2G1SLuarrxx2fBJbJMk and sent to 16hyuu6MQQ1hFcs13Aqow9VKL9ecvJabcc

At first I couldn't figure out what was going on because I always (well almost always I guess...) use an off line wallet to store my mining returns for safety.

Well, apparently I made a stupid mistake as I had imported the mining address to Blockchain.info to move the BTC but I forgot to delete it after those batch of coins were moved... so my miners continued mining and made a little over 19btc over the last couple months.  ONLY TO BE STOLEN!

I'm not sure how someone hacked my Blockchain.info account but apparently that's how they were able to access my funds because I didn't delete my mining address from the wallet.  It shows the transfer was made sometime around noon and has not been confirmed, it just amazes me that I basically WATCHED while my hard earned coins were stolen!  When I noticed the coins were moved it was still unconfirmed on the blockchain!

I have antivirus on my computer so I don't think that anyone used a key logger to get my password but I'm not sure how they were able to get into my account and steal my bitcoins or even know they got the correct account identifier!

If anyone can help me with tracking this down and hopefully, hopefully get those funds back I'll offer a 5 BTC reward.  I need those funds to pay for the mortgage or I will be homeless, not even including having to pay for all the extra power and time I spent making sure the miners were always mining!

So, I have about 3 days until I'm late for the payment and really need some help with what to do about this.  I will be forever grateful to anyone who can help recover these funds.

Thanks everyone.

Sorry for your loss.  :-[

You probably will not recover them.  Start making backup plans NOW for your mortgage (friends, family) and don't expect anything to come from this thread.

Sorry to hear that dude i checked that link and see your ip address but not for the receiving address of the coins , your near Chicago right? im new to bitcoin and im not sure you have any chance of this , you could put out a plea for donations to help you though a tough time seek the support of the community. im new i dont have any bitcoins yet just small fractions from a basic 2x 335Mhash mining rig if i could send you a bit coin i would.

i hope something good happens for you soon   

Sorry for your loss.

Other than trying to follow the money flow you're left with the IP address used to relay the transaction. It may be that whoever stole it didn't mask his IP and in that case maybe you can connect it to an account at blockchain.info, bitcointalk.org etc... not sure if they will help you with that though.

Googling the IP doesn't give us much, but we find this:
derekl [derekl!b83abf54@gateway/web/freenode/ip.184.58.191.84] has joined #zeromq

Apparently a guy "derekl" joined a chatroom with that IP. But does it belong to a gateway? I'm not sure how IRC works there, maybe someone else can comment.

Yeah... I'm just hoping that maybe, just maybe something could be done... I'm just so pissed that I pretty much watched it happen, when I saw that the coins were taken they were still Unconfirmed!  It had 0 confirmations still!  I wish there were a way to stop 0 confirmation transactions... but that is not how it works...

Just hope that maybe someone in the community can do something to help... I've sent a small transaction to the address the thief sent the coins to and embedded a statement that the coins were stolen.

Maybe if people keep putting messages on stolen BTC addresses then it may help deter this stuff, so I'm going to watch this and every time the btc moves I will add that tag again.  Who knows what will happen, I'm hoping for the best...


Also in regards to the other posts, thanks for the suggestions, I'll look into the ip address, I just have NO idea how they got into my account so two things, they are a "pro" hacker and the IP is just a proxy or maybe a lucky script kiddy that did not mask their real IP.

Oh, and the thing about looking at my btc address is that it will never show my actual IP because I don't use a BTC client on my computer, it's all brain wallets, paper wallets and I only import them when I need to use them on an online site like blockchain so all IP's will only show the BTC relays.  It was just a stupid mistake that I left the mining address in that wallet.

Thanks so far...

Were the stolen coins in one?

my advice.

take out a loan to cover your mortgage.

follow the money, maybe the thief will spend them on something, or send them to an exchange, this could maybe somehow tie and identity to this address.

were you using this blockchine.info wallet with your mobile device at any point?

please everyone stop doing this!

paper wallets are really easy to print out.

bitaddress.org

Out of curiosity, did you use a 2nd password for transfer authorizations?

could you please explain step by step for a newbie what the best way of protecting there bitcoins are, maybe we should create a permenant thread for how todo do this

How exactly can I make one and how do they work?

There are many ways... here is one way to do it:

Download this website: bitaddress.org

Save it on an USB stick and boot up your computer without internet connection. Then generate addresses and print out.

PS: I must warn you that even an offline computer could steal your addresses if you ever plug it back online. One way to minimize this risk is to use a live OS such as tails (https://tails.boum.org/) or simply use an old computer that will never connect to the web again.

I use a brain wallet to do my mining and when I want to cash out, NORMALLY I would just import the private key into a "throwaway" blockchain wallet, get the BTC then send it over to an exchange then delete all the info from the blockchain wallet, it usually only has anything in it for a few hours.  It also seems that the wallet IDs that are generated are random or use a complex algorithm so it seems to be hard for someone to brute force the wallet AND the password.  Even if they get in it will be pretty much useless as there is no information or btc in there.

This way I don't need a new address every time I "withdraw" the btc and I can keep track of how much I've mined.

It seems that this time that I imported the address to a wallet that SHOULD have been secure and was one that I've set up to "use" for btc-btc transactions.  I imported the brain wallet, moved the btc from the previous mining then forgot to delete the public/private key from it.

I did not realize this until it was too late, I don't know how someone even got the blockchain wallet id and figured out my password.  I would think that blockchain would also have some sort of protection from someone brute forcing the password.  I would think that my other wallets may be compromised if someone hacked my computer... There is a leak somewhere and at this point it looks like blockchain but maybe the private key was compromised and they just imported it into their account and moved the funds.  I'm not sure if you can see that in the transaction log.

I did not have that wallet synced to my phone or anything else, I didn't use 2 factor authentication which was something I should have done.  It's just that that account was not suppose to have that much funds just sitting there anyway as I usually delete any brain wallet private keys that I may have imported into ANY web wallet.

So, it really sucks and I still have no idea how someone got in the Blockchain.info account or figured out my brain wallet, it was a good long phrase with special characters too.

It seems like my other wallets are safe so far but I'm going to re-secure everything.  I really just have no idea how this could have happened... is there some way for someone to figure out what someone's Blockchain's generated wallet address?  

I've opened a ticket with blockchain and see what they say, hopefully something can be done but I doubt it...

Thanks to everyone for the suggestions and information, hopefully at the very least we can lock up those coins so no one will want to use them if they are "marked" stolen on every address that the thief sends them to.

I didn't use this with my phone as far that I am aware of.

In the end I guess I should have taken more steps to secure the account and that address was not deleted like I usually do... some very expensive mistakes!

It's confirmed, and you're probably not going to get it back.
I heard blockchain.info sometimes pays any stolen funds, but I doubt they can do that without any proof.

I hope that it isn't lost on the readers of the OP that continuing to use a Private Key after it has been stored on any website for any length of time is not a good idea.

In my opinion, online wallets are good for microtransactions only. Anything else and you really want full control over your funds. I operate an inputs.io account but as soon as funds enter that wallet they are immediately moved to my offline wallet that I have fully encrypted. I suggest a similar workflow to others for both mobile and online wallets.

I hope that you can make it on your mortgage with your current funds. I'm guessing you can cash in your mining equipment locally if need-be.

I am sorry to hear about your loss.

Questions so other newbs like myself can learn.  If OP would have had 2 way authenticator activated and second password for spending transactions could this still have happened?

Next I always see these paper wallet suggestions, but is that really necessary if your protect your computer?  Honestly if paper is the only it really makes Bitcoin less useful since once you put your coins on a paper wallet, spending them is a pain in the butt.

If paper wallets are the way to go for higher quantities, what is considered a high quantity?

If I should start a thread on this no problem, just thought maybe it pertained to this thread.

If you read this thread

https://bitcointalk.org/index.php?topic=303795.0

you will see nothing is considered too high or low. Someone must of went through a lot of searching to steal just over 1BTC.

I know that technically using the private key on a website can compromise it but what I figured is that it would be safe because it was only used on blockchain which is suppose to be a very "trustworthy" site.  I've done many transactions with the site with no issue at all and for quite a long time as well.

I have no idea how it was compromised, I don't think I've ever given any one the blockchain wallet id and never used that password on another site.  Also it only seems that just that wallet/btc address was compromised as the first thing I did was checked was some other offline btc accounts and they seemed to be fine.

Even my other wallet on blockchain was not compromised so I really have no idea how someone did this.
 
I'm usually very careful to make sure that if I have a wallet which I may "actively" use to transact with others it and don't keep a lot of funds in it.  The mining address/private key should have never been on that account as I normally NEVER leave it on there after I've moved the coins out, so I screwed up by not deleting that from the wallet and not using a "throwaway" wallet which I always delete all keys and then abandon.  It was a wallet that I used a long time ago in the past for BTC-BTC transactions and must have forgot that the mining address was still there.

This just kills me because I have no clue how the account was compromised.  Basically the only site that ever had the private key was Blockchain which is why I didn't think that I would have to worry about the private key getting stolen from within the blockchain site.  The only thing I can think that happened was that someone somehow figured out my wallet address and password but still have no clue how that was done as I've never given anyone that info...

Maybe blockchain would be able to shed some light on this so that at least I can figure out where I went wrong (other than not deleting the private key of my mining address).

Thanks to all for the tips so far, I hope that maybe if any address the coins get sent to is tagged with a public message on the blockchain that the thief won't be able to use it with out raising some alerts...

HUMM it's interesting that someone else had their wallet hacked today as well... it looks like they didn't get that much but it's likely that person didn't have as much in his account.  I don't know if any other people got their blockchain accounts hacked today or within the last 24 hours but if it is more than just me then it could mean that someone found a way to exploit Blockchain wallets!

This could really answer all the questions of how they got into my account because I don't see how anyone could have done it otherwise...

Maybe when others check their blockchain wallets and find that they were hacked too then it would be up to blockchain to fix these... at least this would give me some hope...

I used to use the blockchain mobile wallet but it was glitching pretty bad for me...did you use a mobile wallet?  Did you use an unsecured network like public Wifi?  Did you happen to use a wireless connection?  Did you manually type in the private key or copy/paste it?  I would say Keylogger or man in the middle attack was the culprit.  Yes 2fa 2fa everytime if you ca

I'm thinking whoever is behind this is getting a lot of people. The address of the other thief has had at least 2 more transactions totaling over 10BTC enter his account since the hack. Is there anybody at blockchain.info that can shed light on the subject, or is that not possible?

I wouldn't be surprised if there is an exploit somewhere along the line.

I hope my blockchain.info coins are safe. I will have to check later.

It makes me worried to click any link now. I thought they had to download something on my computer to infect it. Now they say all I have to do is load a page with java and it's over with.

Any tech savvy guys give me some pointers on how to keep my PC protected?

Sorry to hear about this.

Why do you guys use web wallets ?

Why cant you install bitcoin-qt in your system and use thats way much safer than blockchain.info

If you used mobile to access the website this might have happened

The phone app stores your primary password in plain text, relying on the sandboxing mechanism of the phone OS. And it doesn't support 2-factor. Your secondary characters password could be cracked.

My guess: You have a rooted phone disabling whatever sandboxing protections Android has, and another app on your phone grabbed the cached encrypted wallet on your phone along with the primary password and sent it to the attacker. The attacker then bruteforced the secondary password.

If you think i have helped you donate some coins to me address can be found in my sign

and its very difficult to give them all proof that you all bitcoins stolen so now you have to manage some other ways to pay your all dues and no one going to help you with this position

They are probably still there, but aren't what I would call "safe." Just move them to a new wallet (PLEASE use a new private key) on a hard drive.

How could anyone help you?

I am sorry for your loss, but btc transactions can not be cancelled.
Your money is gone. Forever.

I've scanned my computer, the public key was never exposed to an open or an unsecured wireless network.  I'm pretty careful when using web wallets but I think I just figured out how my coins were stolen... It was very likely someone who brute force cracked my brain wallet and waited until my account filed up then hit me...

I thought it was a very secure brain wallet as it had a 7 word phrase with a special character as well but I guess it was not secure enough.  Too many regular words and not enough special characters etc...

On another note, I had created a Blockchain.info wallet and made an alias with the account, at that time the site allowed me to use a 4 character account alias and I most likely saved the actual address or recovery words but it was made so long ago that I think that file was lost with a hard drive crash.  Does anyone know how I would be able to regain access to the account?  I did not know that blockchain had changed the security of the site and did not allow short aliases, now I can't open that wallet even though I have the password too.  If I can open that wallet I may be able to have something to pay, so maybe they won't evict me...

Thanks all...

PS.  I have "secured" my brain wallet so that it would be almost impossible to hack.  Funny, I though the brainwallet was going to be safe given it was 7 words and a special character but I was wrong and it actually seems so obvious looking back at the mistake (FACE PALM).

PPS. If you or someone you know "took" my coins and they are returned to me I will still offer the 5btc reward with no questions asked, that way I won't continue to tag each time the coins are moved with the message that the coins were stolen.  Just send them here 1LTLDiacwf3Kt6aVDbT1jd3KhGwv9arhhu minus the 5btc and no questions will be asked... I need these btc that badly, I'm not sure if Starbucks will let me use their store's power and internet connections to mine bitcoins when I'm homeless... ;(

@timmah
Was you browser open to your blockchain.info wallet at the time when the theft occured? If so, it is possible that either a browser plugin or the website in another open tab stole the coins.

Yeah, I understand that but who knows maybe at some point it can be traced back to whoever took them as they do have to send them to be used and I plan to watch the transfers and tag each one with a public message by just sending a few cents to that address with a public message.  Maybe when the thief tries to spend them the other party will reject their coins... at least I hope that there are still honest people who would do that...  If others want to add a tag I would think that would help as well, just in case I didn't see when it was moved and tag it myself first.  Also, I would think that if there are a lot of tags saying the coins are stolen it would get more attention and it only takes a few cents to "tag" their address with a public message.

Thanks for the comment though.

Hi,

No the wallet was not open, I just was checking my balance on blockchain without logging in and saw it was empty, that's when I just about had a heart attack.  I then logged into any and all of my wallets that I may have used and noticed that one of my wallets still had the mining public/private key in there so I assumed that it was a Blockchain hack but the more I look at it, it may not be the case.

Looking into some of other people that had their wallets emptied it was revealed that it was the "Brain wallet" itself that was hacked, as I used dictionary words it would just be a matter of time until someone just brute force hack the address until it matched then they would also have the private key, hind sight is 20/20, I think it would be a lot easier to just hack the btc address offline than trying to crack blockchain.  Then you have all the time in the world to run any brute force hacking without "alerting" someone.

So, I think this is the new or "more recent" way that people are stealing coins "magically' as many people use brain wallets with just dictionary words and maybe a special character or 2 but that is still possible to crack, especially these days with powerful CPUs.  Don't make my mistake!  If you make a brain wallet make sure that it has something else other than just dictionary words, etc.

Lame, over 2 months of mining gone and that is after waiting over a year for my BFL miners which don't pay much anymore.  I'll be lucky to cover power...

Thanks for the comment though.

Sorry for your loss man, hope someone can track him down for you.

Your not getting the funds back make other plans

There is a slight possibility that you were hit by the bci RNG bug. There is an even smaller chance that you could get compensated for this:

https://bitcointalk.org/index.php?topic=277595.msg2970668#msg2970668

Note the offer was made a month ago. It might not be available today.

Thanks for the link but it looks like my address was not part of that, hopefully I'll be able to figure out how this happened... My other wallet was completely fine.  Does anyone know if you can tell if the thief actually used MY blockchain account to take the funds or if they found the privaete key somehow (or by brute force) and used their own account to move the btc out of my mining address?

It would really help if I knew that so that I could at least not make the same mistake.

My guess is that you either have a keylogger on your computer or you were MITM'd with a keylogger on the page. If you have had malware, it is probably still on your computer. Antivirus scans are not good enough.

What version of Java do you have?

I'm using Java 7 update 25.  I've opened other wallets on that computer as well but those were not emptied.  Maybe the hacker is just waiting for me to put more btc in or something.  Along with a MITM attack I would think they would get to my other accounts like my bank, credit cards, etc... but just my btc was stolen...

This sucks...

Yeah I will have to do that soon. Do you know any easy ways to spend BTC on a cold wallet without using an offline PC, fresh OS install etc?

No one can help you to recover your money, dude

Actually there is. You could've just tried double spending it by simply sending out another transaction using the same funds with a higher fee. If it confirmed first, you would've gotten your funds back.

When I followed the trail,the result came up with this: 16hyuu6MQQ1hFcs13Aqow9VKL9ecvJabcc  I'm not sure if this'll help or not but I felt that it was important to tell people and hopefully help out the OP.

The taint analysis comes up with this:https://blockchain.info/taint/16hyuu6MQQ1hFcs13Aqow9VKL9ecvJabcc The two BTC addresses seem to be used more often so maybe start tracking the addressed with '2' in the branch column to find the culprit.

Since my andorid phone is the sole means of accessing my blockchain wallet,how secure is this and should I be worried or not in terms of how safe are my coins on there?

Thanks. :)

Aww damn it!  Although the thing is that I would not be allowed to do a double spend on the blockchain wallet so I figure that it would have to be somehow done manually, perhaps with the actual bitcoin-qt client but I usually move my coins around web wallets and paper/brain/offline wallets so even if I had started my btc client (which is how I would think I would be able to actually do a double spend) it would have been weeks or months behind in the block chain so by the time I would be synced with the block chain the coins would probably have been confirmed...

Although for future reference how would I do a double spend?  It seems like it would have to be done manually and if this happens and I'm lucky enough to see it in time then I could try to stop it... It was just a fluke that I saw the coins being stolen as I'm sure most people don't notice until it would be way to late...

Thanks

Not really sure which clients allow it. Maybe Bitcoind and maybe Bitcoin-qt with some adjustments. Anyone got any other wallets?