Bitcoin Forum

I need your help!

I have 2 bitcoin-qt wallets, and yestarday one single transaction happened to both of my wallets and my 90 some BTCs were transferred out of my wallets. I don't know what happened and if it's possible to recover. The blockchain information is as follows:

https://blockchain.info/tx/32d070a547e9d2cc2de4dc453cea27789bf33f1c983ffdc7f28ce3419e70c9d5 (https://blockchain.info/tx/32d070a547e9d2cc2de4dc453cea27789bf33f1c983ffdc7f28ce3419e70c9d5)

On my wallet client software, in the transaction record column, the "address" shows a n/a, and the summary shows a double direction arrow.

How can two wallets be made to transact at the same time with a single transaction? The two addresses are as follows:

1CLn42dHFuXAd7o9bgrsCRmfDvLavRoxTq
1H4esgi6KwhDtVXZXJ12AS7QEwdeQighn4


Is it possible to track down the thief and recover my lost?

Truly,
Philip
hsszzm@mail.sysu.edu.cn

Man that sucks. Sorry to hear that, but like said above, I don't think there's anything you can do here. What security measures did you take?

Use a cold wallet next time.

You should run an antivirus program on your computer and see if you have any keyloggers or malware on your computer. You may not be able to get your coins back but the community can benefit from the knowledge.

The coins are gone. Unless whoever took them sends them back, there's no way to recover them. You should also consider your computer compromised and not input any sensitive information on it anymore until this problem has been fixed.

As for the combining of 2 wallets into a single transaction, this is easy: A wallet is just a set of private keys, which can be exported and then imported to another wallet. It's easy to merge any number of wallets into a single one.

If you kept them on an online wallet then it's your fault for keeping that much money in one place, if I had that much money I would have bought a laptop and stuck it on an offline wallet there and made sure the thing couldn't stay connected to the internet. It sucks that you lost it for sure, don't get me wrong, but I'm getting sick of warning people about online wallets and them never doing anything about it and then coming on here when they finally get it stolen.

I feel like all these stories require further investigation. As much as we all like to talk about backdoors and keyloggers, I have yet to hear ANYONE losing their accounts to keyloggers.

 ::)  Not everybody spends all their time on bitcointalk and sees the same amount of warnings that you do.  Maybe instead of being a prick you could use your obviously advanced mind to advance bitcoin . . . maybe by suggesting how the problem can be solved, since the many warnings on random forums is not working for the public.  Maybe a better approach is to convince the popular wallet services to recommend offline storage for large amounts of BTC.  

I thought a double-direction arrow and "n/a" in the transaction field in Bitcoin-Qt represented a transaction between addresses within the same wallet?

making cold storage easy should be a goal => building a custom linux distro + raspberry PI + printer.


sorry for your loss, but playing law enforcement is not a good idea.

there has actually been some scamming alt coins which has a trojan in their wallet program to steal your btc wallet.dat..

thats why any altcoins i get go to coinex.pw and get converted to btc, and then only store btc long term away from exchanges

Exactly!  Even if people do see warnings online to use an offline wallet (which many do not), that sure as hell doesn't mean they know how to do it correctly.  And I'm sure the rebuttal will be: "well if they can't do that they shouldn't be using bitcoin."  Which is a great response - if you want to repress the expansion of bitcoin.  

I just did and have done several times in the past, you can also find tutorials lying around on how to store your wallet offline, also even doing a simple backup isn't difficult, you just get the wallet up and then go file > backup wallet and then stick the .DAT file in a drive somewhere you hardly use.

What more do you expect us to do exactly? We can't protect people from their own stupidity.

Well, you could contact your dispute-resolution organisation or rights-enforcement agency (http://www.youtube.com/watch?v=jTYkdEU_B4o)... oh wait, we don't live in that kind of society (yet?). ;D

Now I just want to know how the wallet summary can show a double-direction arrow and a n/a address?
Doesn't that obviously indicate that the transaction is invalid and so it should be reversed by the system?

Ouch sorry to hear about your loss.

The sad reality is the coins are gone. If your local police department is tech savy enough I suppose you could contact them and file a report and maybe if these people ever use an exchange with their real name to cash out they could be caught. It's unlikely police are willing or equipped to do such things at this time in the bitcoin economy/world.

As other have suggested, learn from the mistake and in the future try to keep your coins offline.  Also your computer could very well be compromised right now so you shouldn't use it for anything right now that you consider personal or sensitive until you know for certain that your computer is free of malware/viruses.

Armory makes all this so easy is laughable. It even gives you instructions the first time you run it.

Exactly. Don't forget bitcoin is still in beta, which obviously means it's not quite ready for the average user, and we can't stand watch over everyone.

I was thinking this aswell, weird.

What do you mean by a "double-direction arrow"? Bitcoin transactions can't be reversed.

nope, sorry. transaction went through (250 confirms). the arrows are a feature of the wallet, and has nothing to do with the system itself.

And the wallet was not emptied, with more than 100 BTC left not taken, Weird!

Could it be that you just sent the coins to yourself / between two wallets?
Anyway, if you have 100 coins get them off your computer NOW, and investigate later.

I already send out my BTC left. Thank you.

Sorry to hear your loss.

Have your wallets been encrypted?
Have you stored some unencrypted backups somewhere online (emails / dropbox / etc)?

My wallets are all encrypted.

Maybe the password is too simple, or you have a keylogger :(
Sorry I can't help much here...

for anyone else concerned about losing their money I highly recommend the following free way to secure your wallet.

1) Install True Crypt on your PC/laptop and create an encrypted volume that is only mounted manually.
2) Install Virtual Box.
3) Create A Linux virtual machine inside the encrypted volume using a clean install of a popular distro (xubuntu etc)   (I tried ubuntu but its a bitch to get working with Virtual box)
4) Install Armoury, Bitcoin Client, Litecoin etc into the linux virtual machine (whatever trusted wallets you want)
5) Create your encrypted/password protected armory, litecoin and other wallets inside the virtual machine.
6) do not use the virtual machine for anything other than Sending and receiving crypto transactions, do not install anything other than the bare essential tools you need and do not surf the internet with it.

from inside the virtual machine you should also be able to create a paper wallet for cold storage.

NOTE: you will need about 80gb of space if you want to store the entire bitcoin and litecoin blockchains inside a virtual machine.
when you are not using the virtual machine you can pause it (remembering to always Pause when the screen is locked) and dismount the encrypted volume.

if you want to back up all your money all you need to do is copy the encrypted volume to another PC or external HD and  locate the backup far away from your PC (failsafe incase of fire/robbery etc)

this is the most secure way that I have found to protect your Coins while keeping them fairly accessible and safely backed up.

all the tools above are FREE. it only takes your time to learn how to use them properly.

and if you think its too much effort.. I would suggest that its probably not too much effort to secure a few thousand dollars worth of BTC which could be worth 10X that in the coming years.

Also if the address 1H4esgi6KwhDtVXZXJ12AS7QEwdeQighn4 is compromised (or the wallet.dat containing this address) you should reroute regular 0.03 BTC payments (are these mining profits?) this address is receiving somewhere else.

Maybe bad random generator in QT strikes again?

Again?

This is the thief's address:

16CLrCq8c1M8qsCYNP5r21AejMWUgZS7uk

Let's keep hunting!

I agree! The use of Bitcoin must be made foolproof! We can't expect the general public to embrace it if the process of safely storing your money is so damn USER-UNFRIENDLY!

Android qt relied blindly on the java "secure" random function and money was lost. Maybe something similar happened here.

labcoin shareholders have been hunting for 7000 BTC for many months.. its not easy to trace the money if the thief knows what they are doing.

Starting from that address, which has now a balance of 0 BTC, if you follow all the transactions involving the money, you will go through numerous addresses which in turn sent the whole amount (thus remaining with a 0 balance) to the next one. Why is that?

@ OP: why did you wait almost 2 days to report the theft?

The thief kept moving BTC around to avoid being caught?

hacked?

I see. Bitcoin qt never had this problem.

the money is actually going down bcos they are spending it... spent coins are even harder to trace...

theres only 48 BTC left

https://blockchain.info/address/1MWkEYti5YjspJmnWY1r48Tj9kQjgPUtxG

looks like a lot of transactions propagating from a 0 location (this shows up as somewhere in the ocean under ghana on the world map because thats where 0 longitude and 0 latitude are.. ie NO location).. this sometimes means the transaction comes from blockchain.info itself (ie a blockchain.info wallet).. if it is indeed a blockchain.info wallet, you could try to contact blockchain.info and ask them to freeze the wallet if you can prove the money was yours in the first place. I have no idea if they will help you or not but its worth a shot.

First off sorry dude that really sucks. Secondly even if you could find out the person responsible, it's gonna be really tough to get the coins back. I know of several people in here who got scammed out of coins a few months ago. We were able to find out his exact address and identity because he scammed me on eBay too. With that said I reported it to the police but they are not all that excited to jump on a bitcoin case. They did take the report, but I still have yet to see any indication they've even questioned this guy

Whoever helps recover the loss will be rewarded with half of the recovered BTC, that is 45 BTC's, I promise.

The chance of getting back your btc is very slim indeed.
Anyway, good luck OP.

I know, but maybe someone would take the challenge for good.

I don't know if this is related, but I had two very odd transactions in my bitcoin QT wallet (0.8.5), which is encrypted (with a strong password) and locked, when I started my wallet this morning:

I received 2.28702289 BTC with transaction ID 00d5a7f30eb82873ce9d4950c4a084be47d25d5ce39bd0f245c763fb756ca197 at 25.01.2014 21:35. I was not expecting this payment.

I then apparently SENT 2.4700226 BTC to 1LensmQKWbFM5UJjWEokWgZLNWZGZqn4rX with transaction ID 4c10dfc08ea4f7a49a7bf871b1e1dacba56d95e69819bb32eec85fac20e1ef08 at 26.01.2014 12:27

This latter transaction currently has status 5/unconfirmed.

I do not have any malware or key loggers on my PC according to my antivirus software. the wallet software was not even active when the transaction was supposedly executed - I launched it at around 12:45.

Haa, you mean you received BTCs from an unkown payer? Odd indeed.

Hey, I have to say that I have no antivirus nor firewall (using Windows7)...

I've donwloaded at least 10 xxcoin-qt (bitcoin-qt, litecoin-qt, etc...)

All of them have some coins.

Stop believing antivirus.

These attacks comes from a way that all these security suites are not capable to stop ir detect.

There are several ways to bypass these programs.

I'm a developer.

I cant explain here in just a few words how many methods to do this exists.

But there are a lot of different methods that can be used together.

If you want to be your own bank, remember to secure it

ElGrandJefe,
Is this your address?
1NxdocxSrybTnr4ihzHFMwT88aTyCnqcKx

This recently happend to me to , are you sure you haven't been keylogged or anything?

You too? No, I am not sure.

Yes, and a somewhat larger amount was deducted 12 hours later.

Yes, that's me.

So many transactions happened, but you did not do anything?

I started my wallet software for the first time in 5 days, then the two transactions showed up within 5 minutes of each other, as my wallet was updating the block chain. I usually don't keep my wallet software open unless I am making a transfer or expect one. Otherwise I update my block chain around once per week.

There were only two transactions.

I don't agree. If you are unable to secure your own Bitcoins properly, use a 3rd party online wallet and hope they don't get hacked. That is how our entire fiat banking system works, after all.

Bitcoin allows an individual with a modicum of computer skills to store their bitcoins more securely than has ever been possible - far more secure than any online or physical bank. I'm getting pretty sick and tired of people listing this incredibly powerful attribute as something that needs to be fixed for the benefit of all the careless people out there.  There is no push-button security system that will allow you to easily access to your bitcoins and keep them perfectly safe - they are diametrically opposed principles, and balancing between the two requires a deep understanding of how both work.  If you can't be bothered, give your coins to a bank/online wallet you trust. If you can't be bothered and can't trust anyone, tough luck.

And yes, I do believe in banks - security deposit boxes are great for holding encrypted flash drives with backups, just remember to use a keyfile...

For everyone who has had coins stolen from their wallet, what sort of passwords are you using? Are they long/random/lots of characters and numbers?

Currently fiat is backed by armys though.  Bitcoin is new & at best backed by the rich early adopters.

More safe easy hassle free storage is needed if we want retarded sheep public (90%) to embrace it.

Make paper wallets and use them as repositories for large amounts... store them in a safe deposit box and/or encrypt images of the wallets in truecrypt archives, never storing more than 5 BTC in any one wallet.  Sorry about your loss. It's one of the risks of using crypto currencies at this point. Mainstream acceptance is still a ways off given the technical knowledge required to secure large amounts of cash.

Also people who attack the 'retarded sheep public' thinking themselves somehow enlightened and better than everyone else, I'll never understand that... you are NO better than anyone... get off your high horse.

I would also say to keep any progress made on finding this guy private. When I got scammed the guy was in fact posting on the thread trying to throw people off his trail. It's possible the guy who scammed you has seen this thread and that might motivate them to act more quickly if they think you've got some information on them

Those who invest/contribute/use crypto are fighting the good fight.

Those who know about crypto or similar yet choose fiat vs it dont represent me, i dont care for them, they dont care for me.

I am pretty sure the fact that the system has not reversed the action means it will not do so. Sorry about your loss man, don't do anything irrational.

This only works if you never use the host (hypervisor) for anything but launching virtual machines.
If the host is compromised: so is the virtual machine. Keeping it encrypted is about the same security as keeping your wallet encrypted. If you never spend funds, an attacker can't either (assuming the passphrase is secure).


If all else fails, this can be done manually. Coinjoin transactions (https://bitcointalk.org/index.php?topic=279249.0) take advantage of this.

Hey everyone I just came across this thread because I had all my BTC stolen from me as well, not from my wallet, but from BTC-E. I contacted BCT-E and they basically did the same thing, just give me all the login and logout times and IP address. I came across this:

79   logout   logout use logout button   75.***(My Logout after a while of trying to figure out where my money went)   
25.01.14
23:22
78   logout   logout use logout button   62.***( Someone else's ip logout)   
25.01.14
21:45
77   login   success login   62.***(Someone else's ip that used for another login)   
25.01.14
21:43
76   login   success login   75.***(My IP)   
25.01.14
20:51

I find this very odd only because in between those other IP login's, I had an email sent to me with a withdrawal confirmation at 21:44, that i tried to cancel but there was an error. Is there a way to contact BTC-E again to explain this to them? I have all the proof, withdrawal confirmation email at 21:44, and these different IP addresses that show there was a login twice in a row and then my money was gone.

Sorry but they're gone, that's the nature of bitcoin, it's irreversible.  Next time only store a small portion in your hot wallet, make an offline wallet on a usb stickor maybe a raspberry pi.

I had approximately 180 ltc and 1.7 btc stolen from btc-e directly after I contacted support for another issue.

I can not trust btc-e again.

Never trust an online wallet :(

If tools like BitIodine were public, maybe these cases would have more chances, and thefts would reduce frequency.
http://miki.it/pdf/BitIodine_presentation.pdf
http://miki.it/pdf/thesis.pdf

So you somehow purchased 90 XBT but didn't ever see any warnings regarding properly securing them?  Really?   ::)

Damn... That's a lot of stolen Bitcoins... But it seems that your PrivKeys have been stolen and imported to a client for the transfer...

My recommendation is not to store 90 BTC in an hot wallet - if you are not an active BCE trader. Better store them on secure paperwallets.

That's a mad amount, I'm sorry man.


Just for your info, he used an offline wallet...

that's where you are wrong buddy... if the encrypted volume is unmounted even with ALL your passwords an attacker would have to somehow scrape the entire volume off your PC.... and given that its 80GB or more in size this could take DAYS or even weeks (with most peoples lousy internet) and if your PC was compromised you could turn it off  and open the encrypted volume from a clean PC on different network and move the money before they got to it.

also being inside a virtual machine makes it exponentially more difficult for any malicious trojan to get at your wallet files which would also be encrypted (even if the host is compromised). so for the very brief period that you actually have the encrypted volume OPEN on your PC any attacker would have to scrape your entire VM then OPEN it with your passwords then take the wallets out and OPEN them again with another set of passwords and then spend the money before you noticed.

this is so much more complicated than simply copying your .dat files and logging your keystrokes.

yes any PC that is connected to the internet can still be compromised but if you make the difficulty too hard.. most thieves give up and move on to the next target.

Because making a note is realy going t help.
https://blockchain.info/address/1MVeQqkm5Kr91aAkvsQmB9i2g2VQjr9a1j

It looks like after going on a spending spree, he's currently down to $23k USD. 

https://blockchain.info/address/1JzAB4QkvvWi6iuLgYKe2wZfb5UA7eLmkB

Or he's just mixing the btc...

I was talking about the guy who lost money from btc-e.  But the OP also used an online wallet.  An offline one would be installed onto something with no internet access, so your keys can't get stolen.

Screw off mate. Do you really think anyone has time for that shit? There are so many easier ways to do it this just annoys the hell out of me.

There should be a button to force people back to the newbie area.

There's a possible explanation for that. They stole from an old copy of your wallet. Since then you've sent coins to other people (normal spend transactions) and the change has gone to new addresses (and corresponding private keys) that are not present in the old copy of the wallet that the thief has. So consider where you backed up your wallet in the past.


How did you try to cancel the withdrawal? Don't tell me you clicked on the link in the email?!! If you did that you CONFIRMED the withdrawal instead of canceling it. To cancel the withdrawal you do nothing and ignore the email.

This seems very probable. He hacked into your backup, find it and you'll at least know which machine was compromised.

Why? Because I don't prefer some overly complicated and totally impractical method of "securing" my bitcoin wallets? Is this how you're going to spread bitcoin acceptance? Offering round about solutions to simple problems with much more secure and practical alternatives? Yes yes, I know how to make encrypted partitions, run virtual machines, etc but you're tricking yourself into a false sense of security and spreading bad information if you think these approaches offer extra protection.

Stop. The only newb here is you and anyone who propagates that tinfoil hat nonsense. God forbid an actual newb reads that post and thinks that's the right way to secure his bitcoins.

is this your paper?

Let me ask a simple question:

If I get some bTC in my wallet on my computer, encrypt the wallet to a different password, back up the wallet using the standard method on the wallet client, and put that dat file in a USB or another offline computer, does that constitute a cold-storage?

I mean my main computer will still have the wallet and btc in them.

Let us know.

sorry to heat that... maybe have them stored in blockchain wallet would not be a bad idea.

its not overly complicated its simple and FREE cryptography and security that a 12 year old could use and that anyone should be using to protect not only their money but their personal information (documents etc) as well. if you fail to secure your own money don't come crying back to he community when you lose it.

its ok the be a noob but to be an ignorant noob with large amounts of money kept in a digital form is very dangerous indeed.

No it doesn't. Cold storage is where the private keys never touch an online computer. Meaning you generate the wallet on an offline computer. The satoshi client makes this hard. You should use something like armory or electrum that offer offline wallets and offline transaction signing.

God this is so aweful sorry to hear this!!

Suppose I do what I said, about encrypting it with hard password that I don't type in, and backing up the wallet in a dat file on a usb or offline driver.

How secure is it?

Lol... did you thought about simply confronting the game face to face and demanding your coins back? even tried maybe to beat him? Why do peopel so often rely on official authority?

its secure but not overly secure...  if a key logger is installed on your PC there is a high probability that there is also a trojan waiting for you to plug in your USB stick so it can copy the wallet and send it across the wire.. if they have your password and your dat file that's all they need to steal your money which is why windows is not a good place to store either of them.

if you must use windows/or mac to store your keys.... make sure most of your money is safely locked away in a paper wallet created form a clean machine (ie cold storage)


EDIT: oh wait.. you said "don't type in"... you mean copy and paste from a file? that could be more dangerous than typing depending on how you store the PW. and by that I mean if you put the password in a text file and give it an obvious name or have some obvious tag like "pass" or "pwd" inside the text file then your just asking for trouble. If however you just have some random file somewhere with no distinguishing marks and your hidden password of random characters is embedded somewhere in that file then that should be OK as long as you DO NOT store the password file and the .dat file in the same location. these are called key files BTW and they are used by truecrypt in tandem with typed passwords (two factor authentication) to make your encryption even more secure.

im not aware of any wallet programs that use two factor authentication that's why I recommend truecrypt as an extra layer of protection.

He better take a piece with him. People tend to be armed these days, so even the odds.

Well actually no, he gots a point, bitcoin isnt making anyone a favour, but anybody could make a favour to bitcoin by adopting it, but it has to be wayyyyy more easier. The more im here the more i dont like the BTC community and i know something about computers.

whats that point exactly? you CBF learning enough about bitcoin to use it wisely? you'd like your money property secured and looked after by someone else? sure there are companies that provide that service for a fee...

I'm not sure why some people are complaining about a free service and free advice, but I'm more than happy to give you a full refund if you are not satisfied...
 ;D

My favorite way for storing long-term Bitcoin savings is an offline Electrum wallet.

1. Download electrum on an offline computer (ideally entirely offline, never-to-go-online-again, I use an old netbook I use as a calculator which I got for $100)

2. Create new wallet.

3. write down or memorize the seed

4. send the bitcoins-to-be-saved to one of the newly-generated addresses

5. Stop worrying about all your BTC being hacked.

I admit this might not be practical for everyone, though. I think that when Bitcoin goes main-stream, there will be hardware-wallets making the whole system a lot easier. After all, all you really need is a tiny processor and a USB to create offline wallets.

Self justice is probably the worst idea I have read here so far. I completely agree that sometimes official authorities don't act on your legitimate interests, but still your proposal is stone age.

I wish you never have a group of dumb gorillas at your door...

Everyone can join the taskforce and hunt down the owner of this address:

16CLrCq8c1M8qsCYNP5r21AejMWUgZS7uk

The thief transferred my 89.5 BTC into this address.
You will be rewarded with half of the recovered BTC.

Philip

It's not going to help

The thief has split the btc up many times already

Offer half of the Bitcoins for the people that help, it's the only way to get help.

It is true that it will very unlucky OP can get back his bitcoin. :(

If you decide to use your old pc, you should have done disk formatting before installing electrum.

Goodluck my friend. Really sorry this had to happen to you. Stay strong and keep trying to track him down.
If you fail, simply do something extra in your life you would never have done before, use it as an opportunity.

Then you can say, well "if I didn't get 90BTC stolen" I wouldn't have had an amazing life changing experience in XYZ/ met XYZ / did XYZ that I always wanted to do.

I'm really sorry that happened to you  :-[

I don't know but I remember reading somewhere that if Bitcoins are obtained illegally, the bitcoin devs can disable those coins, is this true? At least the hacker wouldn't win anything with this.

Anyways good luck friend. Apparently there is no justice in Bitcoin :-\ Every hacker/scammer always runs away with their Bitcoins and they are never punished!

That is wrong and I shall add fortunately. Devs can not disable or return the coins. This is one of the foundations of bitcoin and one of the reasons of its success. If there is a change that will allow devs (or government or law enforcements or mafia or public vote or whatever) to to this, I will migrate to the coin which supports "strong property" and many will do likewise.
Although I sympathize with the OP, Bitcoins are build on the principle: Whoever owns the privkey, owns associated bitcoin balance. This is very important principle.

Your only chance is to find the thief and force HIM (or HER or they) to transfer bitcoins back. No one can do this on behalf on him. In ideal case (thief is known and proofs are clear) police and law should help you to convince him. There are cases scammers were punished.

Can't agree more with you.

Some days ago, I read this thread "List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses". https://bitcointalk.org/index.php?topic=83794.0

It seems to me, most (if not all) of those hackers and scammers are unpunished... :(

this is the nightmare situation....I really feel for you....

have to invest in computer that never goes online and signs transactions.

i followed the highest btc transits on blockchain,
31.9 btc when to 16PcMrZWvkLkQxLDotsSWaYgjVD9GoDspa
then they trans 31.9 btc to 1G5pbFtm7ap95wqe2JsZ9EqEA5YQR3GKiQ
16PcMrZWvkLkQxLDotsSWaYgjVD9GoDspa sends alot btc to 1G5pbFtm7ap95wqe2JsZ9EqEA5YQR3GKiQ
1G5pbFtm7ap95wqe2JsZ9EqEA5YQR3GKiQ then sends 100.5btc to "14S2wx2zzj7aJz4gpJSvAXSAvYr9vyNBYi " owned by known scammer here on the forums as  KRUNIAC https://bitcointalk.org/index.php?topic=229612.0 (https://bitcointalk.org/index.php?topic=229612.0)
then sends 100btc to 1BCjb4BMqLHPdHh1SbeoELQSUfa8NYcacu last stop
https://blockchain.info/tx/cc5ffebb7741a0f6ba77ceba6c6f8bb5a51107439742e421b64e5e982699719c

A kelogger/remote control compromise will bypass this neatly.

That's why you should install it on an unused computer or dual boot to a usb drive.

sorry for your lost man  :-[

Interesting! Thank you very much!
You seem to be an expert on this. Then how can we communicate with KRUNIAC?

Gratefully,
Philip

Hello !

Maybe there is a more simple explanation: another person accessed your PC and did this transaction of 90 BTC
No keylogger, no Qt bug, only the human factor  8)

No need, if the machine is offline. It can have trojans up the wazoo but if they can't talk to the controller, then they're useless.

Unless it was really sneaky and inserted its own wallet.dat, so that you sent it your coins.

Ok, fine, that's a point. But just for the sake of counterpoint, the wallet can be derived from the seed. So, if simply check that the seed leads to that private key, you should be fine.

Unfortunatelly "be your own bank" also means taking care of security, because otherwise that "non reversible bitcoin transactions" feature screws you bad.

If I were you I would report it as cyber crime and hope for the best.

Also, since it was a lot of money and you would probably be willing to invest some money in order to get that bastard, think about contacting and paying an investigator.

Sure, but if they insert their own seed...
And then there's the ultrasonic magic communication the NSA does...
Just reformat :)

But then there's the low level bios...

Better to build it from scratch, get a CPU fab shop in your garage :)

Actually, they would be easier to trace.  If, for instance, they spent the coins at Overstock.com, you could subpoena them to find the shipping address.  The police could track the thief pretty quickly at that rate.

You could also subpoena KRUNIAC on the forums here to get IP addresses that he posts from.

Look, all you need is a log-free, virus-free, ultrasonic magic communication-free, SHA calculator, along with hopefully a random number generator (although random numbers can be generated "manually" if need be). That can be an old computer, whatever. I still think in the future there will be dedicated hardware that physically CAN'T get a virus, though.

Yep, that's exactly the Trezor.

Yes, except that one is just a first generation type thing. I think that these chips could be built directly into USBs, Credit Cards, Phones, or even just Computers. There can't be a significant overhead to making a simple SHA2 calculator chip.

lol. I couldn't imagine my little disk formatting suggestion could go this far. :D

This is bitcointalk. Its an unwritten rule that we must take everything anybody posts and take it to the logical extreme.

This money is lost - it went through many addresses:
https://blockchain.info/de/tree/109329398 (https://blockchain.info/de/tree/109329398)

Secondly the root cause seemed to be an old qt wallet that has been password secured later. So that the thief could use an old wallet file with a subest of the private keys to steal the 90 BTC instead of everything.

Thirdly @philipzhai - you may check where you kept your old wallet files. Especially cloud space, forums or email accounts. Maybe you gave an old disc or computer away containing the wallet file.

Finally it should be clear that no wallet is 100% safe. There are many recommendations how to create safe wallets and keep them safe. Eg.
 - create offline paper or brain wallets with btcaddress.org
 - encrypt wallet.dat and keep it offline most of the time
 - use anti malware and anti virus software to detect key loggers
 - ....

From my experience I can say that nothing is finally 100% safe. For one a unencrypted wallet.dat with bitcoin-qt may be safe because it is used in a safe system. For another one even the offline generated paper wallet is not safe because on reuse his smartphone is infected.

This situation is a clear sign that we have to manage system security more carefully because the system use cases are extended into a secure area. Everybody must be aware about the traps and open doors in his systems (computer, smartphone, ...) like everybody keeps care about closing the doors and windows of his house over night. This is a ongoing and demanding task and requires awareness for anybody.

@philipzhai even if I do not think you will ever see your money again (except someone of your near environment was the culprit) I feel pity.

must be malware

No, it's by an Italian guy from Politecnico of Milano.
I looked at it, but I'm writing in pure C a smaller but more specific learning/forensic tool.

did you download dogecoin qt or other bad software  ::) ?

what's wrong with dogecoin?

He likes to plant the seed...  :-\

Oh nice!  That's pretty cool.  Didn't realize you could track it like that.

Sorry to the OP for the loss.  That hurts :(

The only way they can steal anything from any wallet is if they get a hold of the wallet.dat file. There is simply no other way. So at some point you get hacked, you may not even notice this, then when you have enough coins to steal they will sact. I think it makes sense to change your wallets, create a new ones on regular basis and transfer the coins around and always encrypt your wallets with 128bit+ passwords. You may not know when they put a keylogger on your PC if its not properly protected. I wouldn't be surprised if some Pool sites are infected with keylogger scrypts. They dont steal accounts maybe because its easier to just get into your wallet and steal your coins especially if you have weak passwords.

I bet they try to brute force the password, running their little evil scrypts to try to hack your password every day like you are running miner every day. So if password isn't changed like on weekly basis it is eventually hacked. As more often password changed as more complicated is to hack through your wallet as long as you don't have a keylogger. There are also programs out there that would populate the password field for you without you typing anything, in that case keyloggers won't help the hacker.

When you deal with something as open and raw as Internet you need to take 10x times stronger precautions than what you'd do for something like a house or a safe. Use different PCs every month (virtual machines, image, clone etc), transfer your coins around so they don't sit in the same wallet for weeks etc etc. Its hard to catch a log on the river with a strong current.  ;) If you get rich and catch an eye of the hacker they will be tracinh you, hacking you, following your every online move until they get a hold of your wealth. Then they will vanish and you will never find them.

Sorry to hear that OP, but maybe your unfortunate problem can be a reminder for others to watch out, you are on the Internet!

I didn't see anyone answer. I'm pretty sure I have understood this properly:

• The double arrow is shown when a transaction is made that has inputs other than are in the wallet of the QT you are running. It was created by another client that has your privkey and other privkeys that you don't have.
• The n/a address is shown when there are more than one output that is not a change address in your own wallet. In the transaction you are mentioning, none of the outputs are likely a change address, so QT can't know which one to show.

This means that if your wallet file was stolen, the thief imported other addresses before they sent, or they are creating transactions with different software that they importet you privkey and other privkeys to.

-OR-

This kind of transaction is actually most likely to be caused by the real owner after he/she has been exporting and importing addresses and been playing around with wallet files. In this case the coins weren't stolen but just transferred by mistake to another address you own. Coins might not be lost after all!

I agree with this.

Post Snowden, It's seems plausible that there are backdoors keylogger in hardware, eg intel and amd. Aso probally widows software.

I mean why wouldn't there be? The Gov just leans on them to do it.

I'm not sure how easy this is to check in the circuitry of an intel chip, though I think some one would have noticed by now....maybe.

Using a linux o/s offline that signs transactions seems the only safe way.

This is one of the driving reasons I wrote my coinwatcher software. I can load a html web page, and see all my addresses with no login, no private keys, no wallet, no sign in or anything and I can conveniently see what is in my addresses. Though I would use behind TOR so block chains that it queries do not get wise to where your IP.

With all due respect, yall sound absolutely paranoid as all get out.

User error is likely the first main cause of anyone, n00b or seasoned, losing bitcoin or anything else.

I am curious why it's all focused on hackery though. I recognize malware being what it is but it seems logical to me that for anyone to lose 90btc to theft, (what's that again 38 grand?) they were specifically targeted, which doesn't seem like malware which is more random. Malware might scan for it but it has to have a root somewhere to even know TO scan for it. So would a hacker. I could have 90btc right now (I don't, wish like hell I did though!) and who'd know it? How would a hacker have any idea what I have or where I have it or THAT I have anything at all? Seems like random scans are a serious waste of processing power for x number of computers whose users don't even have a clue what bitcoin even is.

That's why it seems like the person was targeted by someone who did know and did know where it was stored and did know what was being used for security. It wasn't a random, wild lucky guess oh hey, this guy has bitcoin, let's take it!

How common is it people get keyloggers - realistically speaking? How do you know if you have one/more? Even the suggestions on the one hand to run all sorts of anti virus/malware scans get opposed by others saying well, you can have them and they're undetectable til it's too late. What the hell are people doing where they end up getting keyloggers?

The exchange the last couple of pages with the one person just digging up every possible FUD gloom scenario is all spooky but how realistic is it the average person will ever encounter all that without some "hacker thief" on the other end expending an ENORMOUS amount of energy, time, and attention to doing all that convoluted shit when he'd make more money just hacking into a regular bank account and swiping it the old fashioned way, or hacking gift cards.

If they're going to this trouble, isn't it more reasonable it'd been a focused specific act of theft?

Can it be positively proven any of these stories of theft are actually theft and not legit transactions - such as the scenario Joe Blow sees "A" transaction of 50btc made and pretends they were "his" all along and tries to get it sent to him instead?

Can any of these tales of theft be proven? Most everything the government and media say about bitcoin is how unsecure it is. If it was THAT risky nobody would be sinking millions of dollars into it. They have way more to lose than some random btc enthusiast with a few bitcoin. Why would any hacker thief in his/her right mind waste a shred of a second going after 90btc when they could go after the people holding hundreds of btc?

Add to that, all these stories (aside from on this forum) all seem to be that hackers hacked the exchange and made off with bitcoin.

Really?

Correct me if I'm mistaken here but exchanges trade fiat currency that is easily spent here and now with digital cryptocurrency that's hardly accepted anywhere. And you mean to tell me a hacker is that much of a screaming dumbass he'd steal virtual currency whose value could be $1 three hours after he steals it instead of fiat he could cash out in a hurry?

These exchanges that popped up - omg we got hacked, *boom* shut down. New one pops up...omg we got hacked too! *boom* shut down. That's the pattern, these new exchanges jump up, claim hackery and bankruptcy and vanish. Sounds to me like someone's full of shit - hackers didn't hack anything, the ones running the exchanges were the real thieves and made off with people's money.

In real life, without being specifically targeted, how common - realistically speaking - is it for bitcoin owners to end up with keyloggers and trojans and malware  specifically programmed to sniff out and steal bitcoin without the user going somewhere specific or downloading something specifically related TO btc in the first place - which would seem rather easy enough to root out.

Sincere questions and observation.

Don't have numbers, but I suspect machine take-over tools may now scan for Bitcoin wallets "just in case". Bitcoin for the first time, allows you to instantly transfer value in an irreversible way: over the Internet. Most online banking involves reversible transactions; and are not nearly as lucrative.

There is also the long-term possibility that trusted giants like Apple, Google, and Microsoft may start installing key loggers for one reason or another (rogue employee, 3-4 letter agency request). The only way to guard against that is to keep the bulk of your funds off-line.

It's not exactly easy to get away with wire transfers as they are processed hours or days later. Bitcoin is probably more convenient to steal.


Agreed.

You should run an antivirus program on your computer to see if there are trojans or malware.

I take the freedom to quote myself because the thread was actually about this question mentioned above. The guy has 2 Bitcoin QT wallets and I think I have solved the puzzle... no hacking invlolved. philipzhai, did you ever find out exactly what happened?

Does not work if your anti-virus provider is pushing the malware updates (or looking the other way (https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal)).

/tinfoil hat

Armory 0.91.2 will def. solve this problem because they have cold-storage wallet. You should scan for viruses daily if you have that much BTC.

Where did you store your 90 BTC? Bitcoin cloud service?

this.

I beleive there is a class of virus software that operates as follows

scan for wallet.dat
if found copy and send off. <hacking starts agianst weak passwords.

waits for the password to be entered.
keylogs and sends password.

it then re-encrypts you local wallet.

A small test amount may be sent.

This allows th hacket to potetinally let you keep filling your wallet with out you realising you have been hacked, unless you were lucky enought to twig the small amount gone.

Then the hacker can elect to clear the wallet, or wait for you to put more in.

It is in hackers interest not to clear the wallet immediately, as that would be obvious and you can't use it at all anymore to withdraw but may keep filling it.

The question is how the hell would a hacker know I had any to begin with?


I realize there are viruses and whatnot but my question on it was how are people targeted. There is a small number of computer users who even know what bitcoin is...how is a keylogging wallet.dat virus going to know who and what to target - meaning how would the right people (bitcoin owners) get infected to begin with and what prevents 300 million non bitcoin users from being infected with no gain to the hacker, instead of a specific target?

It seems to me that a general all purpose destructive sort of virus is fine for random large distribution via social networks and email, etc. (not fine morally, but fine from the hacker's point of view investing time and energy into programming and releasing it at all) making it a numbers game, but there's a missing piece here between the hacker creating this and knowing where to send it to begin with. What's he scanning? Outer space, or the equivalent of the interwebs, kinda like SETI for bitcoin?

Wouldn't that require an enormous amount of processing effort for a small reward? It'd seem they could put their skills to better use and just do mining and get "free" bitcoin that way.

I guess I'm missing something because it just looks like too small and specific of a base to put out random effort, violating minimum effort/maximum gain when a specific targeted attack would make more sense, but to do so, said hacker has to have a channel somewhere that knows where to find said bitcoin users...outside of hacking an exchange.

Know what I mean? ;D

You just lost 40 000$

COngrats

This reminds me of the end of 2013, I think, when people started to randomly get hacked. Good thing you only lost 90BTC. Numerous people lost all of their life savings.

Wow, that really sucks! I feel for you man, my condolences.

the OP should use something like this, when it becomes open sourced.

https://bitcointalk.org/index.php?topic=606238.0

Your coins are pretty much gone. You could try tracking them, but to no avail. Better to count your losses, pick up the pieces and move on.

Ah, only BTC90, no big deal then. ;D

Cold storage is the only truly safe option. Why in the world do people still not secure their coins after so much theft and fraud? 

I'm not being apathetic when I say that. Just saying it could've been worse.

Multiply your lost times nine and you'll be pretty close to what I had stolen from me by davout, staff on this forum, with his infamous InstaWallet "hack", and thanks to creative 'coin washing' the bitcoins now reside in one of his fat bitcoin wallets.

BTW, davout owns Bitcoin-Central, of which is backed by a bank, if you call Lemon Way a bank with having only one entity under their belt - an app. Three days prior to the "hack" Lemon Way asked via Twitter where he could get his hands on some bitcoins. Luckily, Paymium was only walking distance from their back door - literally!

That said, I'm on a crusade to fight for you, moreover, me, via exposing every motherfucker that enters this space that doesn't pass muster. I, personally, won't stop till I'm reunited with my 1,132 BTC that David Francois (François), et al. has stolen from me.

~Bruno Kucinskas

I imagine losing 90 BTC is enough to taint this poor guys thoughts about Bitcoin.
If you do stick with it. Do as others have said and use Cold Storage for large amounts and get Linux as apposed to Windows.

That hurts I am sorry to hear about your loss but those Bitcoins are gone
Cold Storage would have prevented it but you must have downloaded a keylogger that was able to send the Bitcoins somewhere else

That kind of loss might have me on a crusade as well. I hope you get it all back at some point.

Yeah I hate hearing these kinds of stories as well. There are a lot of bad actors in this new economy.

What makes you think that the 90 BTC isn't the vast majority of his wealth?

If the btc were sent to a mixer or exchange, then the exchange could simply be moving them around. But if not, then the lead sounds solid.

However, it is also safe to assume that the thief is reading this thread right now, and by providing the information of where you think the coins are, and provided it's correct, he will know for sure if you are onto him or not.

Addendum: Looks like this thread is rather old, shame I didn't look at the date.

i think your wallet was cloned , then they just made a new 'address' , sent the coins to themself & good luck from there.....

you can continue to trace them through the block chain

even if someone uses a coin mixing service read this paper for some information on how to trace them

http://www.scribd.com/doc/227369807/Bitcoin-Coinjoin-Not-Anonymous-v01

sorry this happened but with that amount of btc you really need high security precautions , which it appears most people in the thread before me posted

ps not sure if mentioned previously , i keep the swap file disabled always , among many other protections

Could be an inside job. Have any "friends" used your computer that know you have bitcoin?

Hate to hear that! But yeah pretty sure they're gone for good.

Looking at the bright side, it's just 90BTC. https://bitcointalk.org/index.php?topic=590090.0

Hearing this makes me sick to my stomach.  Seriously :(   I am really sorry to hear about your loss...

if you have not tried to restore the wallet yet you may find this useful:

I would seek the advice of some others before trying it , but if the btc is gone from that particular wallet i don't see how it can hurt anything.

In your case you would need to get what you are certain is a clean computer to run the bitcoin client on and I will describe how to rebuild your wallet,

1) Back up your entire folder that holds your wallet..  On windows find that in your directory

Users\name\AppData\Roaming\Bitcoin   back it up in a safe place offline if possible

2)  Start the qt wallet and export a log of all your present transactions and id's for safekeeping. From the transactions tab of the wallet click on file , export and save it in a safe place.

3) Click on Help, then debug window and finally the console tab to bring up the command line

4) On the command line type (no quotes) "listaddressgroupings"  Copy and paste all the addresses to a text file. You can do them one at or time or all together. Save that text file but keep it open.

5) For each address (you may have only a few or several) type on the command line of your qt wallet (again no quotes)

'dumpprivkey' and a space then after paste in the address.  The client will then give you a long set of letters and numbers.  Copy and paste this with the address it matches up with in your text file to use later.

6)  Repeat step 5 for each address that you have.  You can copy each individually as you go or you can wait until finished and copy and paste the entire thing to a windows text file.  Don't forget any.  When finished save that text file in a safe place.  If you copied the entire list at once windows may give you an error about saving special characters (should be safe to ignore).

7)  Close the wallet.  Delete anything in the Users\name\AppData\Roaming\BitCoin folder  EXCEPT your conf file (unless you don't have one) and make sure you have everything backed up.  (Not recommended to back up in this folder). 

8) Make sure you have the most up to date version of the bitcoin client qt wallet installed.

9) Use the same method as in step 3 above to open the command line.  Get that text file with the list of addresses and private keys and type on the command line (again no quotes) 'importprivkey' , a space, then paste a private key after it and hit enter. Wait a few seconds for the client to accept the command. Repeat as many times as necessary depending on how many private keys you had. Don't forget any.  If you try to do one twice you should get an error.

10) Close your qt wallet up. It does not matter how much of the blockchain may have downloaded. Now let the entire blockchain download. Do not try any transactions just let it rolll.

11) When the blockchain is complete normally your coins would all be in there where they belong.  If  they were stolen by someone cloning your wallet and using these keys to steal them they will not be there. 

12)  Good practices: Never allow anyone to have access to your private keys.  Keep the swap file disabled on any computer you use. If you own a large amount of bitcoin like this you should keep it in a secured (locked) wallet with a complex passcode which you can also encrypt and store off line


I saw a few other useful posts in this thread earlier for security in general.  Most of it seemed like sound advice.

The method I described above is normally what would be used if you had lost coins from a paper wallet or if your wallet.dat file was corrupt for some reason and would not properly load or 'show' your coins.  Just make sure that in this case you are performing this on an entirely clean system since you have not tracked down the method the thief used.  I would even take the precaution to connect to the web to get the blockchain from a friends home or alternate source in case your local network is owned and the thief has control depending on your experience with these things.

correct he has sent them to the same wallet or used an online wallet
there is still no proof that any btc has been stolen from a private wallet

I was tracing address and found this one. https://blockchain.info/address/19j4FchgymsbQDmFdx4VdC4vjzfX5fCh4K
9.09$ transaction  (https://blockchain.info/address/13YFV8ci44svtjfSQ7XzN3m6SNS3ksHW8m)


someone posted it here  http://www.reddit.com/r/Bitcoin/comments/1zjqgg/dangers_of_using_blockchaininfo_receive_api_they/

You should ask from this guy http://www.reddit.com/user/DeftNerd  that who owns 19j4 address maybe you can find a clue about your coins.

It's gone. You won't be able to do much about this unfortunately. You'll have to take the loss.

The BTC is gone for good (almost certainly)

One thing that I noticed is that a small amount of BTC was sent to BTC addresses associated with the theft and then were sent to another BTC address, however you included a message saying the funds were stolen when the coins were transferred out of the address, not into the address. I would presume that the person who signed the transaction to send the coins out of the address was able to include a message saying the coins were stolen.

I'm a little skeptical. philipzhai appears to be a newbie, but take a look at the addresses he claims the coins were stolen from:

1CLn42dHFuXAd7o9bgrsCRmfDvLavRoxTq is over a year old and there are 121 transactions for a total of 5,657 BTC. In the first transaction, it received nearly 900 BTC.
1H4esgi6KwhDtVXZXJ12AS7QEwdeQighn4 has been receiving mining income for almost 2 years.

Do you believe that the original post was written by someone that has been mining for nearly 2 years and has more than 100 transactions worth 5657 BTC?

OP, I realize it is probably to late now, but did you ever try using the debug console (on both wallets) to dump the private key to that address?

Open debug Window
Then type:
dumprivkey<1CLn42dHFuXAd7o9bgrsCRmfDvLavRoxTq>
and then try:
dumpprivkey<1H4esgi6KwhDtVXZXJ12AS7QEwdeQighn4>

Just curious.

That is very interesting. I think you may be on to something here.
However, if it is true, sorry about your loss OP. I hope you have recovered from this.

It is hard to get away with deceit here. I have no reason to doubt the original poster and hope he gets his coins back.

If the dude isn't looking for donations, why would he lie ?
I am all for thinking the worst in people, but come on guys :)

OP could you address this? It's a valid point.

How is that remotely a valid point ? Just because he has a newbie tag, it means he's a newbie ?! Seriously.... Come on! Think !

I'd rather know what OS he is running, what wallet he was using to hold his coins and what steps he had taken to protect them.

A lot of people use bitcoin but write on bitcointalk only when they need help.

Wow very sorry to hear that. I wish you the best of luck getting your BTC back!

Using Windows? It's full of malware and keyloggers. Switch to Linux, it's serious OS.

Windows antivirus softwares are not complete protection against malware. I've seen so many cases when antivirus software just can't see malware and block it. I administer around 500 computers, know what I'm talkig about.

Linux is the only way for fairly secure computing.

Anti-virus is only a 'fishing net' so to say, it may catch most of the spyware and viruses but not all. This is because, at the time a virus scanner is developed, several new viruses could be made - or they could come out after the virus scanner is released.
Linux is not the only way, I think you should be good with systems like FreeBSD also.

http://unrecom.net/features.html   Works on Windows,Mac, Linux and android via Java
I keep getting it in phishing/fake emails.

Jesus man! I'm so sorry for your loss ((((

I'd be even more extreme : the people that matters in the bitcoin world rarely post on bitcointalk, there are on irc. I think there is a hierarchy within the bitcoin communty : reddit<bitcointalk<public irc channel<private irc channel

The higher you are in the hierarchy the sooner you have access to information.

This sucks, man! i hope you will be able to restore them!

So whats the conclusion out of this? What is the best way to prevent stealing?

I think the best way is cold storage. You can get virus/malware anywhere, but using the official repositories you can avoid them to a large extend;

file your lawsuit.  Fight for what is yours!!  god da mmit!!

I wish we could know what was on alot of these computers. It is quite baffling something coins end up leaving QT...I guess at the end of the day our only option is to have a offline device for btc only...

so many :( i want have 30 please

lesson learnt...use a relatively cold storage device such as an old, not used often laptop OR only fire up your regular PC wallet when you want top conduct a transaction

Yes. The risk you run is that anti virus software had to be updated and this only happens after the threat is identified and analyzed. Meanwhile the virus is spreading unimpeded.

look man.  I *welcome* Key Loggers installed on my computer.  Just gives me more proof God is always watching.

I sympathize with you, but I'm sorry, I'm incapable of action.

Hence why I have been really picky on what I download and run.

Most of the time I don't download or install anything.

Probably all gone.

Cold storage is the best.

Any leads on this? 

Tell us more about the incident.

Who are you?
How you collect the coins?
How long have you had these coins?
Any friend use the computer around the stealing time?

I think it is not possible to get it back now, I am so sorry for you.

please stop blaming OSs for security...

the USER is the problem...

I use Windows 7 x64 with MS. Security only as protection and many QT wallets...

no virus

I hate to see anyone lose their coins but you are essentially correct. 90 coins is a lot to leave in any computer. Bit coin is really easy to protect with just a little effort.

I love windows ;D

i don't think so it's gonna back, difficult to track the system
every OS has different security level, linux is the best

After getting a Mac I will never go back to windows. After I installed linux on another computer I am using the Mac less and less as well.

Yikes, that sucks...

I hope you find it back.

Too much difficult.. it's very hard that you can recover your BTC.

Good Luck bro, I hope that you'll recover it.  >:(

It's very hard to track the user down unless his wallet has been posted online before, if not you're pretty much screwed.

Damn it dude...90? I cant but feel bad about it....but still, i kinda blame it partially on you..that much BTC should have been in cold storage, no questions asked.

Sorry to hear that, learn from this and move on

omg dude, that is nasty. I can really imagine how shit you must feel now :( BUT you should learn from this and never keep it in an online wallet ever again.

Oh men sorry to hear that, Bitcoin is great but, there is a very high risk of lose, too much bad people  :-[

I think you can't get it back but eh, money comes and goes, posts like this cause all bitcoin holders to be more careful...

This.