Bitcoin Forum

WWZSOCKI account was hacked

I am able to write from this account thanks to Cryptomania

I see that hacker already used my account and posted scam thread:
https://bitcointalk.org/index.php?topic=5507114.new#new

PLEASE DON'T GET SCAMMED!!!

@Cyrus @Theymos please help with regaining access to my account and what is most important stop hacker from scamming attempts

if anybody can help to resolve that I will really appreciate your input

Can you sign a message with the following address?

---

Indeed password was changed recently:

https://www.talkimg.com/images/2024/08/24/7q02l.png

this is old address but I will try

Maybe one of the following?

According to wwzsocki's trust page (https://bitcointalk.org/index.php?action=trust;u=131333), the user's email address was changed recently.
So, you should have recevied an email at your original email address warning you about the email address change and contaning a link to lock your account.

Lock your account and then go for the account recovery process.

luckily I have access to this wallet only this is blockchain.com wallet and i don't know if I can sign message

any help with that?

But you signed a message with the same address in 2018.
How did you do that? Do the same thing again.


Blockchain.com is a non-custodial wallet and it gives users access to their private keys.
It's the blockchain.com exchange account that doesn't give users access to their private keys, not their wallet.

good question it was so long ago that I can't remember how I did it

luckily I have access and can login to this wallet on blockchain.com

will be enough if I send transaction from this wallet?

PS
most important is to remove this topic ASAP to not let scam anybody
https://bitcointalk.org/index.php?topic=5507114.new#new

Op if you can login and using your email then if someone change your email and password then you would received notification to verify that it was you. And if you have alternative email address that you used as backup then they would send notification to that email too.

And the best option for you now for admin to help you us to sign a message with your Bitcoin address you have used in the forum.

ok I can sign it what shall I write?

no I haven't

but possible that I changed my email some time ago and don't remember to which one

Your message should include your username and the date

shall I lock it?

sorry for burst posting but still am in some kind of shock and afraid how they did it

G5lAbenTIPTrArzHEJo3BXK7Ab++Y7mM1VpLWpxA+KoWHHxjTIlU3L1FeX640ga4FP2QiUl8RW16W4/Gp06Dj74=

is this ok?

https://www.talkimg.com/images/2024/08/24/70Qez.png

https://www.talkimg.com/images/2024/08/24/70MG2.png

Should be best to lock it. The hacker could very well be sending private messages to your contacts and obtaining information that they can use to scam others. Best to lock it and focus on the recovery process by making a thread in Meta.

so this signing message wont help me to recover it fast?

I thought I will be able to get it back right now, if not you are correct I will have to lock it

I don't have nothing in my account they could use and already warned my coworkers

Signature verified.

It usually takes some days before the account is recovered due to different factors I'll think. But making a thread in Meta should get the attention of theymos, a mod or member of the recover team faster.

thank you Upgrade00, Paid2, Hosseinimr93, Mate2237 for input and help, truly appreciate

I have locked WWZSOCKI account and soon will open thread in meta board

I hope you wrote to the account's recovery team but writing to them using the original email of the account makes the recovery process quicker and probably no chance of getting rejected. Perhaps with 1-2 weeks tops

Since the mods are taking long to delete the thread. How about creating a type 1 flag which can be reversed once the account is recovered?

Honestly, I saw the password change a few days ago on the sec log, but I had no idea that it was being hack. Sorry.

Now that you have Locked the account then it is time to send and email which you used to register the account to Cyrus to unlock the account for you and immediately change the password and if possible the email address, because I am suspecting that your email address has been compromised. Sorry for that stress.

yes i have done it, sent message from registered on forum email to recoveries...@bitcointalk.org

if email would be compromised then they will remove the message about password change and haven't so I guess this is not that

I had secret question, maybe this is how they did it but I also doubt because as I have seen in the message when tried to recover account using that feature, it can take up to 2 weeks, it happened yesterday and hacker already posted scam thread, so this wasn't my secret question hack I assume

keep checking, changing, adding 2FA to all my important accounts, looking at emails, all looks ok besides Bitcointalk

they tried to login to few of my exchanges accounts like Binance, I see emails with login attempts

no problem mate, thank you for help

I received email about password change yesterday so it couldn't be few days,

maybe it just felt like few days, I also loose my sense of time sometimes, especially when working too long online


sure i will be happy to do it, TBH I never did it, despite i am such old member and DT1

I will wait a bit longer, and if still will be not removed i will try to create flag as suggested

right now we posted there also and warned members, so i assume already nobody should be scammed anymore

Using secret question to recover accounts has also been disabled many years back. If you get the answer right, the best result is you lock the account and will need the admin to recover it. Some people use that feature when their account gets hacked and they don't have the original email, to lock it so the hacker cannot access it.

Scam is not moderated here no matter how obvious it is, do not expect the thread to be deleted by mods.

Luckily it is removed already, mods did great job and reacted fast to reports


I really count on this, never thought how much i need my account, this one day seem already like a week to me

such hack makes you fill like totally vulnerable, this made my eyes open a lot wider to the security topic

While you are trying to recover your account, it will be useful for you and for us to analyze what happened. How could the hacking have happened? Do you use public networks, and are you the only owner of your device? Is it a computer or a phone? What operating system do you use? And do you often surf the Internet from one browser, visiting different sites?

Sometimes we see topics about hacking forum accounts, but if you check the latest cases, people, just like you, are perplexed by what happened. Therefore, if it is not too much trouble, help yourself and users to look for errors so that everyone can check their security again.

Maybe you had an easy password?

In any case, I wish you a speedy recovery and a return to the forum.

After you regain access to your hacked account, it might be a good idea to consider activating 2FA and add an additional security layer to make it harder for something similar to happen to you in the future. Even if someone were to get hold of your password, they would also need the 2FA code to gain access. Check your Account Related Settings in your profile to activate 2FA, and read this thread (https://bitcointalk.org/index.php?topic=5478824.0) for more information if you are interested.

OP you didn't explain how exactly you got your other account hacked? Did you click on some link or what?
Your explanation could help other members to learn how best to protect from this attacks and losing their accounts.

PS
Add 2FA protection instead secret question, like it was suggested in previous post.

If you can't pinpoint what could have happened and gone wrong with your WWZSOCKI account, something similar could happen to this alternative account of yours as well. I would consider the basics first, such as clicking unknown links, using weak passwords, using untrusted software that could have been infected with some malware. I hope you didn't fall for a phishing scheme and entered your password in a Bitcointalk lookalike page somewhere.

Have you received any reply yet, OP?

I see your account hasn't yet been queued for recovery, yet it seems to be a genuine case. I just wish you the best. There was a member who was a victim of a simillar hack, his account ended up getting banned for spreading malware and despite all the appeals, he was never helped.

He got frustrated, gave up and left the forum!

sorry that I am not replying please try to understand

looks like only my Bitcointalk account was hacked, nothing more

my only guess they brute-forced my Bitcointalk password or it leaked somehow and when it comes to that on my end only thing that comes to my mind is:

I downloaded some malicious file exactly 1 day before it happened on laptop that I use when traveling, so nothing important on it, at least I thought so, I missed that there was brave browser synced to my other devices and I haven't unsynced it (big mistake)

If this is true then like this they could bruteforce my password manager password and get aces to Bitcointalk password and account

but if this is true why haven't they also removed email on my Protonmail from Bitcointalk, I was able to suspend that account

only explanation that they where not able to hack brave password manager so logged to my account using synced Brave browser and then changed the password as there was no 2FA (another big mistake i don't know how I missed that)

also I have seen attempts to login to few of my accounts that I haven't initiated lately, still it wasn't successful and i was able to change passwords and add 2FA to them

so is hard to tell what happened exactly

The chronology of how you got hacked is a bit confusing to me - but there must have been some fatal mistake you made that led to your account being hacked. The only thing that is more unfortunate is that you admitted to downloading a malicious file the day before the hack - while ignoring the dire consequences of downloading it.

I was wondering - has the recovery team responded to your account recovery request so far?

yes Cyrrus answered that I will be contacted so i am waiting patiently

when it comes to download malicious file of course i was also attacked, hacker pretended to be client and want to cooperate

this is why i use empty device to download such files still I missed synced Brave browser, forget to unsync it and this is how they got to my Bitcointalk account - I assume, nothing certain here

Never use a web browser based password manager if you want to improve your password security. At least standalone apps like Bitwarden are much better. There is a security vulnerability I saw about the Chrome browser password manager where someone can still access your login details minus using any password prompt on your Windows OS. Brave browser is also chromium based, so it could also be having the same vulnerability.

That sounds good now - it means your case is in the queue. I wish you good luck in recovering your account.
But, rightg now I started to wonder - why is this account on auto-bann status?
Is it because of the topic the hacker posted or maybe your previous mistake?
I realized that while reading your other thread in the meta section.

Of course - hackers are smart and they have tricks up their sleeves to manipulate anyone by pretending to be them. Your mistake should be a valuable lesson for other users - especially when downloading files. That's why everyone needs to disable the auto-download setting on all social media platforms on their devices. Of course, the goal is to prevent all media sent in messages from being downloaded automatically and users can filter which media they can safely download.

This is because he clicked on the link to block this account, from the email that warned him of the account login changes.

No problem. Everyone makes mistakes, and I'm really glad you figured it out quickly and fixed the situation. The good thing is that the hacker only managed to steal your legendary account on BTT and couldn't scam the members through his scam topic using your account about one of the meme coins. His wallet addreess on Solana Explorer shows that he has 0 SOL. The Mods responded really quickly, and I appreciate their cooperation and efforts for this community.

Anyway, I hope you used a different device, not the infected one, to change the passwords of the accounts that the hacker failed to steal. And I hope that once the ban on your account is lifted, you enable 2FA and review your forum messages in case the hacker noticed any important information. Also, when you open the infected laptop, don't forget to disable the internet, and ASAP create a new system with a format of the C drive, and install a strong security program.

When you lock your account using the link. It doesn't get banned.At least that what I recall when I locked mine after they hacked it. The account gets disabled, but I don't think it's more of a ban. Maybe the mods banned the account on grounds that it has posted some malicious websites immediately after getting hacked.

It's not yet queued.

The link sent to the email is not to automatically ban your account ^{[as far as I know],} but it is only to lock your account so that no one can access it. Automatic ban and locked account are definitely different - meaning you can still log in to your account even though it has been banned, but not when your account is locked.

Tell me if I'm wrong.

Do you have any useful links about it?
If so - please let me know.

You are right.
The link which is sent to the orginal email address when the email address is changed locks the account and as you said account being locked is different from getting banned.
wwzsocki's account was banned on August 23, one day before creation of this thread.


Once the account recovery is queued, it's reported on security log (https://bitcointalk.org/seclog.php) and it's also recorded on BPIP (https://bpip.org/Profile?id=131333).

Thank you mate, really appreciate


No you can't login, account is not accessible anymore after lock,

this is what i have seen with my account after I locked it, when I tried to reach it using my profile link, I have seen message: "account locked"


indeed I am really happy that mods reacted blazing fast to reports and deleted this scam thread posted from my account immediately

That was most important for me and first I did was to comment in this malicious thread to warn everybody, reported and then locked account

If you don't have Brave browser set to delete browsing history each time you close it down than they didn't need to hack anything.
Just opening browser and going through your history and bookmarked pages would be enough for them to access and change your account.
I would suggest stop using browser password managers and switch to something like KeePass, and make transition from wind0ws to Linux OS.

Very helpful - thanks, @hosseinimr93.


Of course - when you lock your account via the email you received, then no one ^{[including you and the hacker]} can log in to that account anymore. But trust me - if your account is not locked but your account is only banned, then you can still log in with some restrictions including sending PMs and make post.

Consider for example, this account: Dancil (https://bitcointalk.org/index.php?action=profile;u=968121)
Status: Profile has been Autobanned at 6/6/2019 9:22:10 AM - Last Active: August 28, 2024, 06:48:13 AM

What do you think about giving some confirmation about the account with Altcoinstalks that is connected to your account here? There, too, a topic was started (https://www.altcoinstalks.com/index.php?topic=323942.0) to possibly warn more people, but some things are still unclear. Especially after the statement that someone got hold of your password stored in Brave browser.

"someone get hold of my password stored in brave?" where you found such info?

ONLY my bitcointalk account was hacked and even i don't know how for sure, all my other accounts are of course ok

Perhaps you talked out your Brave browser being in sync or something like that as seen in this post (https://bitcointalk.org/index.php?topic=5507214.msg64477085#msg64477085). So what he is saying is based on that.
But in general the whole Idea of browser based password managers is just bad news. Avoid them at all costs if you can.

I saw this post (https://www.altcoinstalks.com/index.php?topic=323942.msg1618518#msg1618518), and later read what JeromeTash mentioned and also explained. Maybe you should clarify everything somewhere so that there is no confusion.

this is also why i wasn't so happy to explain how I think they got into my account and waited as long possible
i knew that there will be many unneeded questions and despite i have written that I think they wasn't able to breach my password manager password (because is truly strong 16 signs with special once) only login to Bitcointalk account using synced brave browser, browsing history and autofill passwords (only my assumption)

stated few times that only my Bitcointalk account was stolen - nothing else


sure you are correct and this is why all important or $$$ valuable accounts are always with 2FA anyways

somehow I missed Bitcointalk account but all of this is rather secondary topic right now

dashlane, keeper and others are also not the best idea despite better then generic browser password manager i know, there is no good solution for that and i think that 2FA saved my day


I already commented there on OP request in DM, other ways I wont comment there at all

but after reading it now I have replied there again, thank you for letting me know

looks like some members like to be visible in such threads and create kind of unneeded drama

@paid2 @Lafu @tranthidung - please remove red trust from my account as it is already back in my hands

I am still banned after recovery, can't post and this is why i continue from this account

shall I send email to banappeals...@bitcointalk.org and again wait for help or maybe moderators can help me after reading this?

https://www.talkimg.com/images/2024/09/11/Bvx9f.png

I appreciate any help, thank you in advance

Done :)
It's cool that you were able to recover your account!

thank you

What you are posting in the screenshot is strange. How can you be banned for plagiarism after you had successfully obtained the account from a security lock? Unless the offense happened before the hack (i.e. around the time this thread was created), shouldn't that be nullified too as it was effectively another person who had done it on your account?

yes exactly, I am also surprised to see it being still banned after recovery,

no I had no problems with my account prior to the hack

as mentioned first I reported scam thread that hacker posted from my account and asked mods to remove it, luckily it was done blazing fast, so nobody was scammed but now account is still banned because of this I assume

let's wait for moderators/admins to look at this


EDIT
changed this thread title to: WWZSOCKI account recovered succesfully but still banned

maybe it will help to get moderators or admins to look at this

Glad to hear the good news - your account has finally been recovered.

Regarding your account status still being banned - I think you need to create an appeal thread on meta. You need to take a different approach than account recovery - obviously it takes longer in my opinion. But anyway - good luck with this stage.

I AM BAAAAAACK!!!

don't know if it was released from ban on auto or somebody from forum admins lifted it

so big THANKS to forum staff and all members that helped me in last few days

THANK YOU!