Bitcoin Forum

site: blockchain.com
screenshot of the transaction history:https://ibb.co/wM9kP1L

I had activated Email and SMS as the authentication, it was still stoled, don't know how the hacker get my sms code.

A hacker does not necessarily need that in order for him to access your wallet.

Your seedphrase or private keys (if it's an imported address) are all a hacker needs to access your funds. The 2FA code won't really help with that.

So the question is... where is your seed stored? is it online? did you share it with someone before? is it well hidden?

Were you SIM swapped by any chance? (You mentioned that but call your phone provider just to be sure). That's a very common way of taking over accounts.

I think the OP exchange account was what got hacked, not the wallet, where the hacker needs to gain access to the private key or phrase of the wallet. 
 
I think all they use is a password and email to login, and the 2FA and SMS verification are just added security, which hackers might be able to bypass. The Op should try checking out his logging history; maybe this has been planned out for a long time, and just having access to the account email and other things might be a bit easier to bypass.

I'm sorry for your loss, did you receive anything suspicious in an SMS or in your email prior to the transaction, such as unsuccessful logins or receiving verification codes to login? Have you downloaded any pirated software in the past, or where your passwords compromised at some point?


P.S Sim swapping has also growing increasingly common as NotATether already mentioned.

I could be wrong, but the screenshot he's showing looks more like the "wallet" than the exchange which seems to have an overall different UI, theme as you can see here:

[1] https://support.blockchain.com/hc/en-us/articles/4417087554068-How-to-withdraw-crypto
[2] https://exchange.blockchain.com/trade

BlockChain.com is a centralized exchange. I remember the website does not provide seedphrase export, only a recovery key for password reset. This happened in 2020 when BTC prices were very low. What has always puzzled me is how they managed to get my SMS code.

Why would you hold BTC on an online wallet like blockchain.com? Since it's online hackers have so many chances to try to hack your account and steal your funds.

I'm sorry for your loss since Bitcoin transactions are reversible you can't do anything.

I hope next time don't use online or web wallets like blockchain.com I heard many users hacked using web wallets like blockchain.com next time use a better wallet like Electrum or hardware wallet.

The address (https://mempool.space/address/13D13pvwiUjoDFxEJuEU7u66R1UCrWwFUA) which received OP's fund has received 5.65 BTC in total and has been reported here (https://www.chainabuse.com/address/13D13pvwiUjoDFxEJuEU7u66R1UCrWwFUA?chain=BTC) too.


No, OmegaStarScream was right.
according to the screenshot shared by OP, the fund was sent out from blockchain.com wallet, not their exchange.


They have a web wallet too.


The recovery key provided by blockchain.com wallet is your seed phrase.

How old is your wallet exactly? Blockchain.com has been generating a seedphrase for their users for many years now.

"The pit" (their exchange) launched back in Q3 2019 but the screenshot clearly shows that it's not the exchange and that you have "sent" and not "withdrawn" funds.

As mentioned above, the "recovery key" should be your seed/recovery phrase. See here: https://support.blockchain.com/hc/en-us/articles/7830201135900-How-do-I-recover-my-account-if-I-lost-my-password

There is a chance your seed words got  exposed on your end, maybe hacker hacked your computer if you kept them in digital form, or you were a victim of phishing attack.
I also don't recommend anyone to use web wallets like Blockchain.com or anything similar, especially not for storing large amount of coins.
If you want better security you should use cold wallets, but seed words should always be kept offline on paper/metal.

There used to be scam attempts with google Ads. So if you searched for your wallet at blockchain.com on google and clicked on the first result, you were redirected to a scam page. This page looked 1:1 exactly like the original and you entered your name and password there. Then the authentication was changed (however) and the bitcoins were stolen. I dont know how it works with SMS today, but maybe this will help. It is very annoying when a coin are stolen, but im sure karma will fix it and they will be punished for it. The last posts here have given good tips, i hope this will help you.

Apparently the 2FA is useless. It looks like it provides security but it just provides pseudo security. It really adds no extra layer of security contrary to what they say it does. Well the OP still has to answer your question and to add to it did he visit the hackers paradise- Telegram and mistakenly revealed his seed phrase?

This means that your seed phrase was stolen or you accidentally revealed it to someone. There are folks who sell their "old wallets" to bounty hunters and forget they did. Blockchain.com wallets seedphrase for ETH is same for BTC. Sure that's not what happened?

I think that this is this is a totally different case from what happened. Since the Op is making use of a web wallet, there is every possibility that the system that he is using might have been infected with him, even knowing that the hacker can gain all the information they need from the Op in order for them to move out of the wallet without the permission of the Op. 
 
And to op with the large amount of BTC that was moved out of the wallet, why did you entrust your holdings to an online wallet? If you still have other holdings on other online wallets, I will advise you, for the main time, if nothing has happened to them, to get them off there, move them to a well-secured open-source wallet, and make sure you protect your private key from the reach of others.

I thought they had fixed this issue on newer phones that no longer have a physical sim card.  Maybe not though.  It makes me wonder if social engineering was involved.  Maybe the OP got a call from a MITM and gave his phone companies verification code to them, allowing for control of the account to be taken over?  Without more details it's hard to say what happened.  I heard a song the other day by some new rapper named Mabu where he has a line talking about how he got rich from sim swapping someone.  Pretty scary to think about.  Glad I only have like $5 in crypto on my phone from some TRON someone sent me once and store nothing important on it.

The date just caught my eye now. From the screenshot and the price I see in that place, the screenshot was taken recently. Maybe the Op was one of those who bought bitcoin back then to hold for a long time, and he just happened to check the wallet recently and notice that his holdings have already been moved out.
 
Such a pity after waiting for so long, and the profit that could have been made as a reward for his patient was all wiped out.

It is very unlikely that someone would buy such a significant amount of Bitcoin, leave it in a web wallet, and not check the balance for nearly four years.  Besides, the OP already mentioned this happened in 2020 and that he has "always" been puzzled about how the coins were stolen.

---

@OP,  just to correct you here: BlockChain.com actually offers both services - a centralized exchange and a non-custodial online wallet. You can easily move your funds between them at any time.

The transaction is dated from october 2020, it was almost 4 years ago bro. Why do you make a topic about it in June 2024, if you have not recent news about the attack? Unfortunately I don't think Blockchain.com and its exchange is very secure since I regularly encounter bugs when I use both of them. So I avoid to leave much money on them. SMS code is not very safe that's why using 2FA app is usually recommended instead.

This is not about the site used because it can occur the same way with any other platforms you may decided to use later after this if you're not getting to know the reason for this, we have to know much about privacy and this is very important when we are having in consideration about the security measures to our crypto portfolio, some don't know how they have left an opening for hackers to take advantage of and use to scam them, this couldn't have happened if there were no vulnerability somewhere else, take this as a lesson and avoid reoccurrence.

Where were you OP all of this time, it has been moved on 2020 and you have just opened your this time?

I'm sorry with your loss, that's a lot of value right now but there's no way that you can recover it but to warn everybody here that never use that wallet anymore.

I've used it before but stopped eventually.

This is possible, I was thinking that he probably might have kept his recovery seed that the hacker has accessed but MITM is also likely, but dating that back 4 years ago, he won't probably remember what his activities were.

I'm not sure how long has this process existed when it comes to resetting 2fa but it appears to be pretty easy once the hacker has gotten ahold of your email account. It's pretty much just sending a request and approving from your email then it's completed instantly, see: https://support.blockchain.com/hc/en-us/articles/360000286426-How-do-I-disable-two-step-verification-2FA

I'm not saying this is what happened though, just stating another possibility. It would be pretty hard to guess what exactly went through with our limited information + multiple other possible attacks at hand as this wallet is considered as one of the poor setups to have.

yes, this happened in 2020. I just joined this forum and remembered this incident, so I decided to share it. Recently, a sudden incident on X showed that a user's funds on OKX were stolen despite having various verifications enabled. How did they manage to obtain the user's SMS verification code?

https://x.com/CryptoApprenti1/status/1799592388379484313

https://x.com/huangshiyuan17/status/1799773009068355971

This user was stolen 5M from his OKX exchange account.

Well you're right, it’s a good approach and a nice state of mind after all. It's always a good thing to report hacks and sophisticated scams to the community because it helps people to protect themselves against that and to prevent much victims to get stolen. Unfortuantely victims are usually ashamed to signal them and to talk about them because they think they've done something wrong and they feel guilty while they are not the actual culprits. A new kind of secure authentication is currently spreading in the crypto and sensitive datas universe with embedded Passkeys, I hope it will help to resolve those security impairments.

It is a horrible decision to store your funds in an exchange, i don't know exactly how this person lost their coins, but if an attacker compromises your device and your exchange account, they can steal your funds. Crazy thing is that is not the only way you can lose your coins if it is on an exchange, the exchange itself can be hacked, or they can confiscate your funds for any reason.

To be safe, store your coins in cold storage, either a hardware or airgapped wallet, and you can add an extra layer of security like extending your seed phrase with a passphrase or you just create a multisig wallet, if you know exactly what you are doing.

SMS is a pretty weak 2fa though compared to others like TOTP for instance.

That's because a telcom employee can port your phone number to the wrong person by falling into social engineering attacks or by being an accomplice with the perpetrators. We've had plenty of these cases you can search on the internet -- keywords: sim hijacking/sim swap attack

yes, you are right, Especially for Chinese users, cryptocurrency is already in a legal gray area and is not protected by law. Currently, playing with cryptocurrency could potentially lead to legal violations. If the exchange itself engages in theft, users really have no recourse, especially with such large amounts of money involved.

OP has quite a lot of browser extensions installed and I can recognize only very few of them. Beware that browser extensions sometimes ask for a lot of permissions and thus can basically access everything that loads in your browser's pages.

Are you sure that every of your browser extensions is fully trustworthy (probably the minority, if any, is open-source and audited)?

This doesn't explain how your coins were stolen, but could be a clue how browser or login data got stolen, if you have some less reputable browser extension that may exfiltrate data silently.

OP, as far as I've read through this topic you haven't answered the question whether you've stored your wallet's recovery details in digital form on your computer. Maybe you took a picture of the details with your mobile phone which syncs pictures to some cloud service?

I wonder why the originating address of wallet is labeled "DeFi Wallet". OP, did you use this wallet for some airdrops or other non-Bitcoin stuff? Could it be that you granted some website overly generous permissions for your online wallet? (Not sure if this is possible with such a blockchain.com wallet as I don't use it.)