Bitcoin Forum

Hey guys my brother was a victim of mail phishing.
He clicked on the zip file which was included in the mail.

It probably took control of the pc and stole all his crypto.

I retraced hacker's transfers and I realized that he swapped all crypto to usdt and transferred all to okx exchange.
Do you think there's a possibility to freeze hackers okx account or something ?

For bitcoin, hacker just transferred to another bitcoin wallet and he holding it and doing nothing of it yet.

The answer is 99,99% no but if someone experienced  or heard something similar I'd be glad to hear.

I work with my brother. We worked very hard to get this money and I am really sad for him.

yrs, contact with exchange asap, and USDT operator. UsdtOp and Exchange can freeze your money


https://x.com/Tether_to/
https://tether.recruitee.com/o/ai-engineer-llm/c/new

Very sorry to hear this OP. This is all too common these days these hackers are getting smarter with social engineering and AI, you’ve got to be very sure of who the links come from. I like to use browserling which is like a browser VM that allows you to check in a safe environment before compromising your own.

It is possible, depending on the situation at hand it may be even likely to have them frozen.  However, this does not mean they can do much about it particularly because this is a situation that Authorities have to work on and not the Exchange itself.  Do not lose hope, but be realistic about the situation.  This is a theft that may or may have not been well planned.  If they did not Withdraw your brothers Cryptocurrencies to their Bank Account or if they did not complete Know Your Customer procedures, chances are dimnished.

I am mind blown how some people do not have at least a Hardware Wallet and prefer to rather hold this much Money on a Computer they do not even properly secure.  I do not want to carve the knife even more against his skin but why?  This was a constantly open invitation for any bad actor to his Wallet!

Whether he gets Authorities to retrieve his Money or not, from this extremely expensive lesson he must learn a thing or two.  Do NOT Trust your Computer and NEVER should you consider it is a safe idea to browse dubious websites or to open Email attachments on the same Computer you have very sensitive information on!  An old Computer can be purchased from about 20 Dollars and above and you can turn it into an Airgapped Device just perfect for storing Cryptocurrencies safely.  Or, just purchase a Hardware Wallet instead.  For 100 THOUSAND Dollars this should be a must!

-----

What does Artificial Intelligence have to do with what happened to OP?  They simply opened an infected attachment.  This is one type of Hacking that has been around for many years.  Long before AI was at the tip of our tongue.

OP, do NOT follow this idea.  NO!  A 'Browser VM' does about NOTHING to protect you from an infection if the Virus is intelligent enough.  If you really feel the need to open unknown Files, DO NOT OPEN THEM ON THE COMPUTER YOU STORE BITCOIN ON.

I have never been infected from Email attachments.  Not even once because I simply do not click what I know is not legitimate or something I should of received!  Is it this difficult?

I have experienced the same thing. However, I don't know what I did so that the hacker could access my Private keys and take everything in it. However, we must always be vigilant, and install a really good antivirus to prevent this. In fact, now I am really careful in clicking on links, because we don't know what the hacker sent us. I am sorry for what happened to you.

Actually the morale is not necessarily to install more software, the morale is to keep his money safe.
There are hardware wallets of all kinds, there is cold storage if one has good technical knowledge, there is even paper wallet that can be easily created and stored (on paper or steel, for example). I find nowadays bigger mistake to keep your coins unprotected than clicking a bad attachment.

Of course, as a secondary step, indeed, making sure next time the brother cannot get into the position to mistakenly infect the computer is something worthy to think on.
But that can usually be done by being much more careful.



PS. Good luck, OP, in getting back your money. I don't think the chances are big, but I tend to think negative. As PrivacyG already said, you should get authorities' help; I don't expect the bigger businesses freeze money only because you ask them nicely (even with the proper proof).


Actually, in some cases it is, especially as many email clients hide the sender address and show only the name, because "let's not be too technical".

Yes I think report the wallet but the chances that you could get your money back was quite impossible. There will be a lot of process for that and verification. Thats why its always advise to take care of your security cause it might compromise you. Theres a lot of malware out there so be careful as always to download file.

you need a good antivirus on your device, my pc once got infected with a virus that would replace my copied crypto address and replace with the hackers wallet address, i lost around 2k,, it was when i found out about it i formatted my whole pc and installed a new os,, after that i'm using an antivirus that is still protecting me from these kinds of viruses.

The first thing to do is contact  OKX Immediately so they could freeze the user's account.

It's on their TOS

https://www.okx.com/help/terms-of-service

And you might need to file a police report in your local authrorities about what happened as they might need it as an attachment.

Do not open strange files from the internet on the same device that has your bitcoins on it.

That is the easiest way to protect your money from theft.

It is too late now, but next time when you are in this situation, you should run all files you download through VirusTotal, and make sure that suspicious i.e. important files not only match the checksums posted but are also signed using PGP with a key that you can trust.

A decent antivirus isn't always enough, sometimes if a malware is new, they go undetected and it has happened to me in the past with a fake Chrome extension that was probably installed by itself. Fortunately, I was lucky that time and had minor losses, it took a while till Malwarebytes detected it as a virus, I had to find the file and delete them myself, and of course, I didn't manage to find all the files myself, other browsers were still infected and it took months till I cleaned out the whole infection. Common sense should be exercised, no torrents or downloading random files is a must.

I'm sorry for your loss OP, the chances of recovering your money are quite minimal, you could try contacting the exchange in hopes of freezing the funds, unless he has already withdrew, still though, they have all his personal details and possibly a police report like others mentioned.

I don't think Tether or OKX will respond to individual requests, so you should go to the nearest police station specializing in cybercrime or financial scam and prove that you have been scammed. OKX's cooperation with the local authorities may result in freezing that account or helping you track down the hacker, but don't be too optimistic about getting your money back.

That's a lesson for all of us, don't be too quick to click on anything in our email because it might be a virus - and it's even better to secure the PC we use by using an antivirus, a free version like Avast should be good enough.
And for the loss your brother experienced, he should report it to the police and then make a direct report to OKX exchange, if you have all the evidence they should help you identify the perpetrator, because as far as I know if users want to withdraw from OKX they need to do KYC.

And the victim of the hacker is repeated, I am sorry for what happened to your brother. In the crypto world it is very important to continue to be careful in doing anything on the internet. You must know how to protect yourself from hackers who are very dangerous, they can steal your assets without you realizing it. Please note that in the crypto world which is growing rapidly every day, the threat of fraud and hackers is also increasing. However, if you take the right steps in protecting your assets, you can avoid traps made by hackers like this.

It is very important to always be aware of fraud carried out by hackers in every way to steal your assets, especially those that often occur via email, Wallet connections or messages from Telegram which are very vulnerable to hacking. So the hope in the future if there is something strange or a link that feels strange and you never follow it, never open it carelessly, you must immediately delete it, it is better to block it immediately because fraudsters will try to get personal information through psychological manipulation. They can also disguise themselves as trusted entities, so you have to be observant every time you receive an email.

I hate to sound like I’m victim-blaming right now but you should never click on links you’re unsure of. A friend of mine recently lost all his crypto to a phishing attack. This was the first time I have seen this happen to someone I know personally and it’s not pretty. We didn’t bother to trace the bitcoin transactions because the chances of recovery are very low and we just don’t want to get our hopes up for nothing. In your case, I suggest you report to the authorities and hopefully they have a team that are specialized in investigating these cases.

I guess I consider that case as a loss, you can contract the okx but I guess they will took few days or weeks because its not their negligence related on the account instead its outside their bound, if the funds are still on hold on the account of okx possible they might freeze the account but I don't know if they will send it back to you because it will takes a lot of process to prove that thing, next is if don't for sure you cant do anything right now and just move on. This you must need to secure your account and as possible have a hardware wallet next time.

You obviously had an encounter with clipboard malware that was hidden in something you downloaded from the internet. A good AV will always scan everything you download and warn you of possible danger, and if it detects something dangerous, it will quarantine that file. The "problem" is that most people don't want to pay for a good AV/firewall - and let's say that the victim in this story had something like that on his computer, maybe a hacker wouldn't be able to take over that computer so easily.

All in all, keeping $100k on a computer in a hot wallet while not knowing basic security protocols is a perfect recipe for disaster.

I doubt they will help OP because it is our responsibility to protect our property, they are not responsible for protecting anyone else's property, nor are they the police or law enforcement. In short, they have no responsibility to us and have nothing to do with our assets.

If OP lives in a country where bitcoin is legal and he complies with government regulations. What he should do is report to the police and provide them with full evidence of the stolen property. The police are the ones who can help OP and only they have the authority to contact OKX or tether. On the contrary, if he lives in a country where bitcoin is illegal , I think he should accept the reality and consider it the most expensive lesson .

By the way , OP, my condolences to your brother because this loss is a huge amount of money .

If the hacker is fast and immediately withdrawn the money they hack from your brother I guess there's slim chance that he can do something with it. But by the time he notice that he compromised then immediately contact the support of Okx maybe they can do something on those hack amount and you seek help from authority so that they can ask Okx to freeze that funds. But looking at the situation its like the hacker outsmart your brother and for sure that the criminal is already happy to cashout the money of your brother.

Another hard lesson to learn. Hopefully next time your brother will not click any unknown links since he already experience the worst scenario that might happen to curious people. Although its hard to move on if we loss such huge amount of money, but I guess he don't have a choice but to do it.

@OP be careful if someone DM-ed you and offer recovery services or something like that, it must be scam.

I think you can't do much in this case, you can report to the police, but they might don't understand what you mean and they might charge you some money. You can also contact the exchange, but they might ignore your request and you will get replied by bots.

Take this as your lesson, keep grinding to reach $100K again.

Advice on safeguarding your assets can come later. For now, your priority should be recovering the $100k you lost. Since you’ve identified the exchange where the funds were sent, your best move is to immediately contact that exchange and explain the situation.

While requesting an exchange to freeze funds often has a low success rate, it's still worth trying since it’s your best option. Just hope they’ll cooperate, and remember that as a registered business, they will require proper documentation before taking any action. Make sure to comply with all their requirements if they show willingness to assist.

He can try but I think it's just a waste of time because exchanges only address complaints if he is a customer and is using their services. Otherwise, they won't believe what he says or care about his problem because catching criminals is not their job. I think instead of trying to contact OKX exchange directly and not getting any viable results. Instead, why didn't he go directly to the local police to report his case? Catching thieves is police work but this will depend on the country OP is living in, whether bitcoin is legal there or not.

Honestly, other than reporting this to the police, I don't think OP has any way to get the property back. But so far it seems he hasn't done that, which means bitcoin is not legal in his country and bitcoin investors are not protected either.

This is a bad experience that can happen to any one and this happens to people because they have no idea something like this can happen. People just need to be careful with site they login and also needs to be careful with important details that can be useful to strangers. When it comes to the internet, people needs to be very vigilant because anything can happen,  most people who falls victim to scam they never believed something like this can happen. Being vigilant and careful helps a lot.

It is important for beginners to try to get more understanding on how scammer works because it will help in preventing being victim to scam.

Relying solely on antivirus software is an inadequate strategy in my opinion.  It resembles wearing a seatbelt while refusing to drive carefully - the seatbelt may assist if an accident occurs, but it won't prevent them.  Similarly, antivirus programs may catch some threats, but they can't shield against everything, particularly if you're not practicing safe online habits.

A multi-layered approach is much more effective in protecting your digital assets. Antivirus has a role but should function as just one component of your OpSec, not the only line of defense.

Antivirus helps only from not encrypted foles, all trojans obfuscate first, so antivirus will not protect to 100% , especially from 1 hour agoo jast obfuscated files. Old trojans after obfuscations, will be not known for antiviruses trojans. and I agree, what if in your pc a lot of money, this pc mast be offline all time then you not make needed transactions.

What he needs is a good hardware wallet because in that case his crypto would be safe even in the case of downloading a malware.


Yep, I was about the write the same thing when I read replies of people l telling him to contact exchange asap. What he needs to do is to contact police asap and let them do their job as they are the only ones who can make exchange to freeze someone else's account.

Having said that, what kind of hacker sends stolen crypto to centralized exchanges? Doesn't make much sense to me but then again, keeping so much money in a hot wallet doesn't make much sesne either.

Even if the unfortunate happens and the Computer is infected, it would produce much less damage if Cryptocurrency Wallets are separated from it.  Browsing the Web, opening Attachments et cetera on the same computer I have my Bitcoin Wallet on is ridiculous.  And this is the most basic preventive measure somebody can adopt.

Keeping 100k in hot wallet is already ridiculous imho. From that point on you can only do more/bigger (security) mistakes with that computer.
That's why I "advertise" hardware wallets. Security is not for everybody and people can make mistakes. Some more easily than others. A HW heavily decreases the chances the mistakes empty your pockets.

These people are seem to prioritize convenience over security despite having the means to invest and buy in better protection on their funds. You can call them "security minimalists" or just "desktop wallet advocates" lol. I can't sleep properly knowing i'm using my desktop everyday yet my 100k is sitting there all day.

If it is PC the problem will likely still persists, because computer is too complex for average users, we think we know it all but yet we get malware on our PC, if this is possible then it is possible to lose the crypto assets you are keeping on your PC.

I can't be confidence enough keeping my crypto assets on a PC, I am too familiar with ways that malware's get into my PC even with antivirus, the problem is Windows PC is the most targetted OS of them all, hackers will always find a way.

The second problem is you will always connect your PC to the internet, this makes it a big failure for keeping crypto assets, if you like do not accept this fact, I will keep saying it again and again, that PC is a bad place to keep crypto assets.

Get a goddamn offline crypto hardware wallet.

Exactly my thoughts too. I can't allow that kind of mistake to happen. This is the reason why there's the cold wallet where everything is completely in a local directory. We cannot allow our assets go down drain like that. It is best to always disconnect such wallet from any online access and only move certain amount of the funds to the hot wallet where you can make your payments or transactions. We must avoid any risk factor or chances associated with the digital assets.

Sorry for the lose bro, I believe this incident have serves as a lesson to learn from and never to open any mail that we don't expect to receive. Like others have said, if the thief have not moved the USDT out from the exchange or convert it to fiat into their bank account, then you can use the help of the exchange support to freeze the account but if he already move the asset out, he wouldn't bother to use the exchange again.

You cannot contact exchange support to freeze funds of another user, they will sure never grant that request, you can only report to your local authority, and if you are lucky that they take interest in your case, then you can present them with all the proof you have and they will make the request to the exchange. I don't know how a scammer can send stolen funds to a centralized exchange, did they open the exchange account through identity theft? That's the only thing that makes sense to me.

I also think that the chance of getting he money back is slim.  The transferred fund could have been converted to another cryptocurrency and transferred it outside the initial exchange where the fund is set or probably it is already been cashed out.  The exchange won't easily block the address or freeze the account without valid documents and I think on the time between the request, producing evidence and presenting it to exchange, and exchange reviewing and validating the documentes and its decision, the fund could have been liquidated already.


Same here I choose ignore mail that have attachment files in it.  It is very dangerous thing even if the file is from a trusted email of a friend because we never know if the file is actually from him or forwarded from someone else.

This is pretty new to me, Are you sure you can be infected by just clicking the attachment .zip file from email?
What I think is you can only be infected from any package files, like .rar or .zip, if you open or extract them.

Isn't that the PC of your friend doesn't have a built-in antivirus? Because why your friend can be easily infected unless he disabled the AV?

Anyway, if you can provide evidence that your friends crypto was converted to USDT and exchanged in OKX, why not report it immediately?
If you want to get response immediately, you can try to contact them through phone call 1-888-201-8380 or email them through support@okx.com

Don't use their social media accounts on Discord or on Telegram; they have lots of impostors. Be careful.

A police report may not be useful, but court orders or subpoenas are usually very effective. So if OP wants to pursue the scammer, they are going to involve some lawyers and the court in their Jurisdiction. OKX will oblige.

---

Not that Linux is immune to such attacks, but over 90% is the times, the malicious apps created are only executable on Windows OS. if such an executable file was opened in Linux, nothing would happen, or it wouldn't even be able to execute. That is why I prefer Linux

I hope this is a lesson learned from your brother that he shouldn't just click any link or open any email that your brother received on his inbox. I hope this would also made you realize that scammers and hackers always find different ways to steal crypto from their victims. I'm sorry to hear about your brother's situation. Anyway, did the hacker take control of the PC and your brother can't control the pc?. Anyway, did you guys try turning off the pc and the internet before it was able to send the btc?.