Bitcoin Forum

I noticed i had issues logging in yesterday, when it kept telling my password was incorrect. I started getting really suspicious when i tried to reset the password, it would not give me an email to reset it.

I checked my gmail mail and found it had been access from The Netherlands... (I'm from Australia)

this happened in less them 24 hours... in that time I sent Mtgox 4 emails desperately trying to get them to suspend my account. But im so freaking angry that i still have not heard back from them. Are my BTC gone forever?

I have a ton of transactions in RUB currency?

I'm just devastated right now...

Why didn't you use two factor authentication to secure your account?

Did you have the same password for both Gmail and Gox?

Likely got phished.  Been through the experience and it wasn't pleasant.  This is still the wild wild west.  Mt Gox is not easily hackable any more after it went through it's own security breached over a year ago or so.  The lesson is to get a Yubi key if that's what they are still using.  I.e. 2-way authentication.

im a noob, who made a noob mistake... very very silly mistake
im still trying to work out how to use the 2 fact auth

I've gone and changed all my passwords now

im looking at the Yubikey and software authenticators now

That really sucks dude! Hope you here from Mt. Gox soon..

Unfortunately a lot of people are phishing these days. They will get you to visit a webpage or download a file that will silently put a worm on your computer that will steal your passwords, information, and even sometimes your wallet.

Always enable two-step verification for all your accounts, and make sure you have notifications turned on. I run a custom firewall on my mining hub laptop, and I have an antivirus as well as I don't visit many webpages with it.

Can someone kindly explain how to do 2 factor authentication?

You'd want a fully offline device for any serious authentication.

Mtgox can't and won't do anything, all they will tell you to do is file a police report.

Im just wondering how they got me... im usually pretty careful with virus and phising scam things.

what you you guys recommend i scan my PC with for possible threats?

I'd say get a new one honestly. All you really need is a RasberryPi and 3 ASICs on a usb cable attached to it. Did you seriously have 60k in an account and it was as secure as your Runescape account 10 years ago /facepalm  Try to be much more careful is the lesson from now on, because MtGox won't do anything.

Wow! Honestly you shouldn't even be holding that much money online. Unless you're a billionaire and won't give two shits if you lose it.

Aww. Its better to hold the coins etc in you pc or Paper man. yes, scan it using antivirus or Format it if possible.

Sick

For big amount of bitcoins I would buy a separate pc, never go online with him and create paper wallets...

Only really secure way...

ouch srry to hear that

Would be just booting Ubuntu live CD to access exchange more secure than windows, or not at all ?

Awful! Im so sorry, I hope they can do something for you!

I am so sorry to hear about this.

Judging by what happened to you I think the best thing for any one holding an amount of currency beyond a few thousand is to transfer it on to their PC/Laptop and make sure it is secure.

This is tragic, to lose $60000 after all the hard work you put in is just so heartbreaking. At least you can file a report with the police and see what happens next.

woah if this is true then youre fucked.

Well, now you know why 2 factor auth is so important

I even dont think SMS as two factor authorization is good enought if your smartphone get compromised as well

Get Avast free edition for live protection, Malwarebytes for strong scanning detection. Both free ;) .

I wonder if its possible that Mt Gox got hacked? Did you ever log on from a computer other than your own?
I hope you hear from them..

I will install these later. because i think i will do a complete format first.

Im even considering running a VMware client and using only VM to trade in the future with 2 factor authentication. then power down the VM everytime im done.




I have only logged in from my home PC and occasionally work PC which should be fairly secure.

I check my google logs and found that the IP address from the suspect locations logging in were all TOR exit routers...

Even though it shows it was in The Netherlands, the hacks maybe Russian because they traded with RUB?

Oh wow, Did you by chance also have a BTC-e account with the same password access?
I do not trust BTC-e at all(I have been posting about them all day today- whatever you do, don't switch to them!)

You should have 2FA enabled, and for 60K USD, you should have store it offline.

What do you guys think of Google Authenticator?

I think creating an altcoin that has real purpose is the best way to bounce back from something like this

sad to hear your loss. you should had put that much money in one place online. Its too risky.

File police report first, you may give the HDD to police so they may analyse for malware.

 Sorry for that. Always use 2 factor Authentification.

Damn man, hope you find some way of getting those coins back.

I am so so sorry this happened to you

Hope there is some comfort to be derived from this whole situation

Consider it a lesson learnt......NEVER keep a large amount of value in the wildwest of online wallets....there is a VERY high chance you will loose it.

I guess if you did it once, then you can do it again....unless you invested $60k of your own fiat....then I feel very sorry for you.

Two factor authentication or Storing them in Paper form if not trading. COld Storage ftw.

Hindsight is a bitch though.

I feel bad for you man - especially with it being xmas

why did you leave 60.000 USD on that account in coins (even worse than in dollars).

why didnt you store the coins on a secure wallet?

why is you antivirus program 3 years old? (correct right  ::) ? )

https://en.bitcoin.it/wiki/Securing_your_wallet

 :o

That's crazy man! i'm sorry to here that. SXC just went up wild today!!

I'm really sorry to hear your case... It's sad to learn things in the hard-way.

Do not have a money in an account without 2-factor authentication. Goodluck my friend

Can you see where the coins were withdrew to? I recommend using Ubuntu or mac in future. Damn that sucks! Ask mtgox what the email address was changed to. Then if you get it, message them with something and try and get a reply. You can then get their ip from that message. It's a long shot but perhaps worth a try.

sorry to hear that , ask your lawyer for help.

Oh man, so sorry to hear that.  It won't compare at all, but my btc-e account was just hacked yesterday and I lost $200.  Didn't have 2FA on.  I know the frustration at least.  And I learned a lesson.

It really is the wild west.  You have no idea how secure any of these exchanges are. How many times has Gox been hacked? 
There isn't much you can do about it either.  Good luck though, I hope the police/support helps.

Man, that blows.  I find myself not having the urge to be extremely secure and cautious with the crypto I mine because somehow in my head, it feels like a game and like it's not real money.  I have to constantly pinch myself and tell myself to go overboard with security of my boxes where my wallets are stored, secure authentication (two factor, completely different password for EVERY account), etc.  There's nothing anyone can do for you when your crypto gets stolen.  If you're not doing EVERYTHING you can to secure it, you might as well have $60k in cash sitting on your living room floor with the front door wide open.  As long as it has a lot of value and liquidity, treat it like a giant pile of cash and don't take any chances when protecting it.

*Edit:

Also, don't keep crypto in exchanges or pools for too long.  Keep your money in wallets stored on your own hardware and make damn sure it's hardened and secure.  If possible, build a machine just to store you wallets, lock it down, and make multiple backups, including occasional backups to USB that you keep in your pocket - password protected and encrypted USB by the way.  And encrypt every wallet.

why would a hacker that just stole 60k from you would even open your message on a throwaway mailbox? It is more likely that he'll feel bad and return the money :) i.e., nope, not going to happen, that money is gone.

It wasnt all coin, half fiat have BTC.

it was there because i actively traded it everyday. I was even trading it till the night before the attack. Woke up the next morning and realised i could not log into my MtGox account anymore.

I still have some in an offline secure wallet thankfully

My antivirus definitions update daily, but i think i need a malware  scanner too

2 Factor Authentication is the biggest mistake that i failed to implement. Still hurts but its an expensive lesson learnt.


Futhermore, MtGox support has contact me and advised me that no fiat or BTC withdrawls were ever requested....
This is striking me as odd. they claim that i never had any coin or fiat in my account i last logged in. It makes me so mad when I have 18 pages of transactions that happened in one day in a currency I have never traded in before! looking at the transactions it seems they traded all my coins onto the market at a loss! i dont understand why they have done this!!?  ??? ??? ???

1. show us your gox wallet on the blockchain
2. yes or no- Gox is saying you have zero transactions in your account when you claim to have 18 pages



soemone is lying, and ive got a feeling it isnt gox.

Sounds like Mt Gox needs to start providing people with Authenticator keys, I am surprised they aren't already doing do as one of the largest if not the largest bitcoin exchange to protect themselves and their customers.

I'm not sure what you mean, but here are some screenshots of the rough transactions.

http://i39.tinypic.com/k0hnys.png
http://i43.tinypic.com/fc4dph.png
http://i42.tinypic.com/2a5nqj4.png

Gox claimed nothing was withdrawn, and i check, nothign was. everything in my account was traded as a loss. they bought high and sold low. I have no idea why someone would do this...  ??? :'(

I thought you need to have your account verified with real life documents before you withdraw anything from gox, am I wrong?

Been a while since I traded at gox.

You need to get verified for even btc withdrawal now?

Yeah, they washed the money on the other side of the bid/ask spread. Effectively, earning the spread each time the transaction was conducted.

This leaves no paper trail, or so they think, if you request the transaction history and check who was on the other side of the transaction, you may have a case. In fact it might help if you know Japanese or are connected to someone involved with mtgox. From what it looks like the hacker was on the other side of the transaction.

Otherwise they were giving away free money to random people <<< Very unlikely.

So, Looks like you might be able with a warrant (Japanese Authorities required) to take a look at the data. Take a look into it.

I'm pretty sure RUB/BTC is not traded often on mtgox, so the hacker definitely knows their bitcoin knowledge. The same I've seen with AUD/BTC, which would guarantee that the hacker actually got the money on the other side of the trade if no one else was trading in that currency pair.

But if I have anything to say, I expect the hacker to be in jail within a few months if you follow my methodology.



As you can see the volume is almost always zero.

https://www.mtgox.com/?Currency=RUB

Go for it, you will get your money back, or in a weak case, send the hacker to jail, as they require real information to withdraw from mtgox!!!!

As you can see on December 9th there was a huge rise in volume as the hacker tried to wash the funds.

My guess it's someone who knows their Finance and Information Security. Luckily I love these two areas myself and understand how the hacker has slipped up. He/She will be in jail soon, don't worry about it, but hurry up and get a police report, get translators to help with mtgox paperwork, and get mtgox to block the wire transfer on the other side, otherwise the other person might flee to the Cayman Islands or some non-extradition country.

I mean, I've seen a lot of dumb hackers throughout my life, but this person who stole your money is probably an idiot.

That sounds very strange. I think you need to get your compensation from MT Gox. You need to get Mt Gox to investigate this as it's a security breach that could cost them customers.

I think the OP needs to contact the AFP Cybercrime division.

http://www.afp.gov.au/policing/cybercrime.aspx

Furthermore, if MtGox doesn't co-operate, it could be because they are part of the fraud. However, at the moment, until that happens, you should still take action to find out why someone chose such a sophisticated method of stealing your funds.

pitty
i won't left that much in any market

If they did that then Mt Gox can easily identify them. Can't they? Dumb hackers.

Sorry to hear your loss :(
Mtgox is really bad, and the staff is incompetent :(

Damn shame this is.  I hope something can be done for the recovery of your lost coins.  This always sucks when i hear someone lost a good amount of coins because of a simple mistake.  Let us know if anything good comes out of this situation.

Its also a good idea to store larger amounts of BTC in a paper wallet

I'm sorry for you.

what is a security breach, trading? :)

God bless and I'm sorry this happened.  Heck I get worried when I have like $500 on a site associated with BTC.  It's just too crazy out there right now and it seems like everyone wants to make a profit and they don't think about security (I mean the site owners).

MT Gox should not allow deposits when you are not using two factor authorization.

lindatess,

Thanks you so much for your suggesting, this has been the most helpful so far, I'm currently gathering all the evidence i have and have spoken to my local state police assitance line who will refer me to the Australian Federal Police.

I will keep the thread updated as events develop.

Thank you for all your kind words so far guys, I really hope I can get something back. Or have these criminals put away for a long time to prevent them hacking anyone elses account.

and 2 factors login ????


60k in BTC and dont use ????

LOL

Think everyone needs 2FA for all trading account, plus a secure email address with 2FA.

Gmail seems pretty secure with SMS authentication and if you use it from another IP they will need authentication. I wouldn't use local ISP emails for this.

how do you get bitcoin on a separate pc if you never go online?

Horrible thing to have happened!