Bitcoin Forum

Ok yall, so my Metamask wallet was hacked back in December. I'd used it to buy and connect to some nodes. I now have someone trying to assist me with getting my nodes back and to do so, I have to re-add the Metamask extension to my browser. Nervously, I started the process of connecting it again and it is asking me to enter my seed recovery phrase, which to my understanding is the 12-word phrase I got when I created the wallet, which was done on the mobile app. I went through this same process and this is the exact same thing I did when I was hacked before. Why doesn't Metamask just have it where I can go on a site and enter the login credentials that were created when I created the mobile app? Needless to say, I am terrified of doing this because I keep hearing NEVER INPUT YOUR SEED PHRASE, and right after following these same steps before (setting up the Chrome extension) I got hacked. And the site I was on before and am on now is metamask.io.

I am reaching out to you all for help on what exactly I'm supposed to be doing. I only have a limited time to check on my nodes, but to do so I have to involve this wallet, unfortunately.

In which wallet, you were asked to add the metamask? Can you please share more details?

If you have used this site to download etc., you are on the official site. There's no issue with that but I guess you are either giving credential to 3rd parties by following their command or your device which you are using to access the wallet is affected with malware which passes information.

When you are with cryptocurrency, you are risking everything if you do not have minimum experience of internet browsing. Hackers will exploit your lack of experience and will hack your accounts. For example check this below:

https://talkimg.com/images/2023/05/16/blob373dd3cc64e8ba04.jpeg

It's common sense that this is a phishing attempt. When you are creating a wallet with Metamask you are not providing any email address which means your email address is somehow exposed in the world wide web and whoever sent this message knows that you are with crypto so they took a chance. They are waiting for you to click on this link they gave. In the link they have either keylogger or they will ask to provide details to a from or any other malware attached. You may or may not discover it even if you click on it.

It's safe practice not to click on random URLs unless they are coming from a trusted email or business subscriptions.

You no need to enter yout seed phrase anywhere, if you are seeing a website named Metamask is asking thise details then its probably a clone/fake site which pretends to be original. It seems you are not aware of such things but its really common in the internet but with cryptocurrency it involves more risk because it related to our money.

Who assisting you? make sure the one who assists you is the one who you really trusted.

Those are normally required steps if you want to restore your wallet from seed phrases. As of now, why and how exactly do you think you got hacked?

Make sure you are using and downloading a legitimate Metamask plugin. Is worth noting that your device is also free from malware.

If you have integrated the extension into your browser through metamask.io or installed it on your mobile application, you are safe. However, if you have entered the process of making a transaction or downloading from anywhere outside of this site, you are again exposed to the hacking event. You stated that you got help from someone. How do you know that person won't even attempt to steal your assets? If you have a priviate key or other access keys, you can solve it via metamask. Or you can install the trustwallet application on your phone and perform all your transactions through it.

Who is the man assisting you?
If you can do it yourself, I suggest not asking someone to assist you, too risky for you. Except, it is your family members or your close friends, then I can understand why you ask an assist from him.

By the way, what wallet do you use?
There should be an instruction to add Metamask extension from the official site of your wallet. You just need to follow the instruction, I am sure this process can be done by yourself, no need for an assist from another person.

This happens when you install Metamask on a new device. Do not treat it the same as a centralized platform where you just need to input your password since it's a decentralized wallet.

You are on the correct one so no need to be worried there. The "never input your seed phrase" applies only when you're not on the official site.

People should realize on this one on which this had been the most common scamming method into those criminals lurking in the shadows on where they are really make use of those lack of experience
on certain investors which might easily get fooled into these kind of steps on where they could possibly exposed off their keys easily and this is where hack happens.

There's no point on using a Metamask wallet when the keys had been exposed and never ever input your keys if they asked too thats why always stick out
on legit download sites on apps that you are tending to use.

why don't you contact metamask?  first to help with recovery, it can be a big problem if your assets are completely hacked, that's the most useful in my opinion for the early stages.

Seed phrase is used to get full access to your wallet. And to restore it, of course. So, if you want to restore your Metamask wallet you have to use it - there is no other way, bro. But if you are telling us that your wallet was hacked before - what do you mean? Your previous wallet? Or this one?

The person who is assisting me is an admin of a telegram group that I'm in for Strongblock nodes. That should have said, "I have to re-add the Metamask extension to my BROWSER." The wallet was hacked in December when I created the nodes and I know because they took the ETH and AVAX I had sitting in the wallet. I went to Etherscan and Snowtrace and saw the transfer of the coins out of the wallet and onto theirs, leaving me at less than a dollar of ETH. I went to Metamask.io to reconnect the wallet because that is the wallet connected to the nodes. You can't access the nodes without using the Metamask wallet and I had to use the one that was previously hacked.

Have you ACTUALLY known Metamask to successfully assist with recovering stolen crypto??? It seems to me they don't give a damn about security. They're the only wallet I've seen that doesnt even have a 2nd layer of authentication when logging into the wallet or moving crypto in/out of it. That's why thousands are getting hacked on a daily basis.

As far as I can understand, you generated your Metamask wallet on your phone, and you're wondering why you need to import your seed phrases into your desktop/browser extension. The reason for this is that the metamask secret recovery phrase (seed phrase) is only stored locally on your device, which means the encrypted format of passwords, priv key and seed phrases are only stored to your phone. Thus you'll need to enter your seed phrase again to your desktop in order restore access to your account.

More significantly, if the account you're importing to metamask has previously been compromised, I highly suggest that you should create a new metamask account and make sure you've figured out why your wallet was compromised to avoid making the same mistake.

Metamask link: https://metamask.io/
How to Secure Our Wallet to Prevent Being Hacked! (https://bitcointalk.org/index.php?topic=5333463.0)

This one was hacked. I have not created another Metamask wallet. I used the hacked one when buying nodes (I bought the nodes and was hacked the next day). So, I HAVE to use it to get back into the nodes. There's a fee that has to be paid or I loose all earned crypto that the nodes have been generating. You can only access the nodes through the wallet used to create them, and in this case it's the hacked MM wallet.

@KHamilton

By reading from your previous post (https://bitcointalk.org/index.php?topic=5375904.0). There are only few things that I suspect that caused your device being compromised.

- It could be your device that is infected with malware that permits attack vector to gain access to your wallet.
- Maybe the recent hacking issues you're having are due to the "nodes" you're referring to. Perhaps, the person helping you in setting up nodes has something to do with your wallet getting hacked, and based from your previous post, there are a lot of the same concerns that @DdmrDdmr mentioned. I am not really sure though!.

The only solution I can come up with is to reach to the node's support and request to move your nodes to your fresh MM generated by your HW device. And carefully backup and format your computer to get a clean device and improve your OPSEC (https://www.google.com/url?sa=t&source=web&rct=j&url=https://bitcointalk.org/index.php%3Ftopic%3D5239098.0&ved=2ahUKEwi1vaeQ5eL1AhU2k1YBHZP7AhcQFnoECAYQAQ&usg=AOvVaw1Bx5Wi2uTR8nmjT8WOqyob).

Because meta mask isn't a custodial wallet. It is a non custodial wallet where the keys are controlled by you. Hence you can't register an account with an email and password. All your wallet information are stored locally on your computer. Even the spending password you set is stored locally and for that instance of the wallet only. The 12 word phrase is the most important thing. You should back this up and store it safely. Anyone with that phrase will have full access to your wallet even if you have a spending password set on your wallet.
If "that guy" you are talking about is someone random on the internet, he is here to scam you.

Most likely, the hacking occurred exactly where the connection to the nodes occurred. Therefore, one must be very careful when choosing such sites. When you download the extension, then enter the mnemonic to get into the wallet that belongs to you. And this is done once on the device, and then you log in with a password. And before you click on any link or connect to the site, you need to double-check everything.

All you have to do is to check your wallet that is attached to your passphrase and see if there is a movement of your coin, if there is and you think that you are not the one who did this then it's hacked, but if there's no movement then you are free to enter your passphrase after you log in to your metamask using your passphrase transfer all your coins to a new or your other address because it's already compromised.
You have to take a risk and do it because it's depressing for you.

There are few possibilities here and all are still on probability so don't take any answers too serious, your friend could be the one behind all this pls like I've said don't take comments here to serious I may be wrong too, this happened to me once and since then ive learn to always create wallets by myself with no other presence beside me.

So, let me summarize, you are trying to get out of your funds within the platform of Strongblock, while the account/address of it is already hacked?
There are a few possible scenarios, the one who helps you may somehow isn't the real admin thus you are being deceived by that. So make sure you are verifying that it is indeed the legitimate admin.

Another thing is since you are saying that you are being hacked again, there is also a chance that your current wallet seed phrase or private key is already compromised. And the hacker already setting up a bot into your wallet, and then every movement on your address are being monitored and if you send any coin into it, it will immediately being hacked.

The point is if the related wallet is already hacked in the first place, there is hardly a point in trying to get back the fund that is locked on the platforms.

Hi, yes he is the real admin of the Strongblock group and yes you are correct about what I am trying to do in the 1st sentence. He is asking questions to about me possible recovering my rewards from the nodes without being detected by the hacker but I doubt he IS the hacker. He has not asked me any questions that would enable him to hack my wallet such as seed/recovery phrases, wallet addresses, computer IP address or anything of that nature. He did say I'd have to reconnect the same hacked wallet and that's what's making me nervous. And I did not know or talk with him when the hacking happened in December; Matter of fact, I didnt even join the Strongblock telegram group until days later.

I'm not being hacked "again"; The hacking happened in December. After being hacked I removed the Metamask wallet from my Chrome extension. But my nodes are about to expire meaning I could lose them because I have not paid the monthly fee. To do so, I have to pay in ETH, and all transactions must be done using that same hacked wallet meaning I would have to put ETH into it, then use that eth to pay the node fees on the Strongblock website. I am not 100% sure if there's a sweeper bot in it but I may have to try with a small amount of ETH and see.

---

It may have been infected at the time; I have had my computer cleaned since then and I've also bought a seperate Chromebook to use just for crypto. The person I mentioned didn't help me set up the nodes. I didnt know him when I set them up. He is an admin in the Strongblock Node telegram group that I am in. I contacted him and other admin AFTER I was hacked. I wasn't even in the group when the hack happened. He isn't trying to help me set them up; He is trying to help me save them because they require a monthly fee that if not paid, will cause you to loose them permanently. And my time is about to run out. I do know not to give him or anyone else seed/recovery phrases or anything that would let him in my wallet.

Unfortunately Strongblock does not have the "migration" feature activated yet that would let you move your nodes to a different wallet. Thousands have asked about this and it isn't possible. They're supposed to be working on it, but that feature isnt available now. They even have it in their "FAQ" section. There have been TONS of people hacked the way I have. Some have had no issues.

Okay, sounds like there isn't any suspicious activity from the admin and what he telling you to do is technically correct.

That will be left out to test whether the sweeper bot is on your key or not. With that, in any case, you are able to get into the platform, you should immediately withdraw any funds into a brand new wallet that you have generated securely. Ideally, if you are now having a secure device, attempting to import the pre-hacked wallet into Metamask wouldn't do anything bad to your device.

he has said the correct thing about that. it caused by your hacked wallet was your credential to connect into your account on strong block. You have no choice other than conercting your wallet that's ever got hacked to get your reward and that's why this must be done as fast as you can before the hacker was taking our your reward. Your wallet is an id for the platform to identity if it's you. you will never able to use another wallet to get your reward. this is the only choice.



yeah just try that with small amounts of money. this to make sure if it's not being connected or controlled by the bot but i do believe it's not. as long as you are doing it as fast as you can and you can oay fees for your node. From what i know based on your story if you wanna extend your nodes or take youe reward but you're feeling worry if the hacker was coming again to take it.