Bitcoin Forum

Hello everyone. Yesterday my ether wallet was robbed. They stole tokens worth more than 10k$.

This is my wallet: https://etherscan.io/address/0x8be1370d0b115d19c1e8c14f7cad7bb5385a9c28

All this tokens was stolen:
https://s8.hostingkartinok.com/uploads/images/2018/07/bd3e4b9af0da70be55647fe4f664a84e.png

First, the swindler transferred the ETX for GAS from his personal wallet - 0.3 ETH

His original address: https://etherscan.io/address/0x894cc8fc2c1d4837516ef981309b2fed3a7ddd96

Then he created a new wallet and transferred my tokens there: https://etherscan.io/address/0x10b6ba730c590d48f9e736896589d783da25b545#tokentxns

I need your advice, dear forum members! What should I do? How to get my money back? How to track who stole them?

In advance I want to say that I have no idea how I could be hacked. I always go to the MEW with the bookmarks and always make sure that the site is not fake.

Any help or advice would be helpful.

I think this is not proper section,
Try to move on and learn something from this, like probably your hardware contain malwares or etc.

There's no way you can get your money back, except the hacker/thief send it back to you.

Its pretty hard, you can do with copy and paste that address to google or other search engine, but so far i found nothing about that thief information.

Sorry for your lose.

Sorry buddy but Moderators even Admin can't do anything to get back your tokens. It's an external issue which means losing your tokens from your wallet is not in range of our Forum's responsibility. It's your obligation to take care of your wallet and although we want to help you, there's nothing we can do.

That's a lot of USD worth tokens, I never had even 1000 USD in any of my wallet.

Yes, I realized that I can not get my money back. For me this is not a small amount, unfortunately. But life goes on! Let's think together, how can we protect our money in the future, so that hackers had no chance to steal them? Can there be any wallets?

You can install metamask, which generally offers better protection than MEW:

https://bitcointalk.org/index.php?topic=3754513

but prior to that, you have to make sure that your computer is virus free (either thorough cleaning or brand new OS installation).

Sorry for your loss.I think mods or anyone will be able to help you
may be you are a victim of phishing .Have you clicked on any any link in your email to verify /sign in message of your ether wallet ?
Or may be your computer infected with any malware.Please get your computer checked/formatted

Unless you are able to track down the tokens to an exchange address, ask the exchange for help, and the exchange actually being willing to help  you (which is difficult in itself because of the privacy policies that exchanges have), the chances of you getting your funds back or even tracking down who the hacker is is slim to none.

Can you recall anything suspicious that happened on your computer before all this happened? Did you share your private keys with anyone, including potential phishing websites? Do you live with anyone who could have possibly done this?

For now, definitely don't store any crypto assets on this computer as it is probably unsafe. Run an antivirus, reinstall your OS if needed. finding out the cause of the hack and preventing more damages is much more important than tracking down who did it at this point, as it is quite futile.

A better solution to safely store your ERC 20 tokens would be the Ledger Nano S hardware wallet, it is a hardware wallet that provides a better and tighter security than most crypto-currencies wallet, another way to prevent hackers from accessing your wallet would be to avoid clicking on phishing links and you should also scan your personal devices regularly to detect if there is any malware hidden in it.

I suppose this is your address...
Anyway, I went trough both addy's (0x894cc8fc2c1d4837516ef981309b2fed3a7ddd96 and 0x10b6ba730c590d48f9e736896589d783da25b545), checked several bounty spreadsheets but unfortunately I couldn't find anything.
I'll take deeper look at this later but to be honest you probably won't get your tokens back and I doubt I'll find something.
Who knows, maybe it was keylogger? As Barcode said, small investment in hardware wallet could've saved you this trouble.

I was checking the same thing with AgatioX via PM. Let me quote his PM


TBH I find it hard to believe that you will send tokens worth more than $500 to friend while you can create a new wallet from other device you own.

And BTW, was he hacked as well at some point? and he trusted you to hold his coins?

https://i.imgur.com/r0skDRt.png

and this where you both sent tokens to the same address: https://etherscan.io/address/0x4056e027207b9be48904b20956d307968b37aec1#tokentxns

and on top of that: I believe this comment is made by you on both the addresses which you think are hacker's address


(Source: https://etherscan.io/address/0x894cc8fc2c1d4837516ef981309b2fed3a7ddd96#comments )

(and same comment posted for 0x10b6ba730c590d48f9e736896589d783da25b545 as well : https://etherscan.io/address/0x10b6ba730c590d48f9e736896589d783da25b545#comments)

and @heisenberg88_q is a telegram ID used by polonez (negged by Vod for merit begging) as well


(Archive: http://archive.is/PI82p#selection-5529.13-5529.28)

So thats that which connects you to polonez. Better admit than lying.

---

---

Regarding the hacking case, you won't find anything from 0x10b6ba730c590d48f9e736896589d783da25b545 as its a newly created address to transfer the tokens from the address hacked.

Here is the pattern : He obtains address private key(somehow)> Sends some ETH from 0x894cc8fc2c1d4837516ef981309b2fed3a7ddd96 for gas to transfer tokens from the hacked address> And sends to newly generated address .

For example:

He sends some ETH from 0x894cc8fc2c1d4837516ef981309b2fed3a7ddd96  to the address he hacked: 0xd48544dc6014c336b22e5e16030478565d75d62e

and then moves out tokens from that address with three transfers:
[1] https://etherscan.io/tx/0x04250635c64d4a69b1531dd69b0118bb75017b2f1e517bdc8e6fc05250f0ee08
[2] https://etherscan.io/tx/0x8eaaf68a7374d3dc22688e911fb5d8b9d1668c098e0abdfdc5affc17ad948b90
[3] https://etherscan.io/tx/0x2ca3463f6fc35e7145d44acfe9e2fdb9c0ebc0d9018a4ceaf83fea7d7472b70b

Seems to me like he obtains it through keylogger as marlboroza said or maybe through a phising site.

---

You can contact others who were hacked in the same way for background process running and check if there is a common suspicious process that has been running . There is a possibility you might find the source assuming that they haven't made a fresh installation of OS again.

Otherwise we can find a hit but right now it leads to nothing since only thing that turns out that the address from which he sends ETH is the address he uses for mining at NanoPool and rest of addresses to which he sends are newly generated tokens in which case we can find something if he moves the tokens.