Bitcoin Forum

Hi All

So I've been on this forum for a couple of years now and I've been dabbling in bitcoin, litecoin and a few others. I've seen a lot about people's coins being stolen and exchanges being hacked etc whilst I've been here, but I never thought it would happen to me.

Anyway I'll go ahead and tell you all what happened in the hope that someone could shed a little bit of light on the whole situation. So I've been on holiday this past week and I received an email yesterday from who I think was BTC-e asking if I'd like to confirm or deny a withdrawal of 108.5335 LTC from my account. I immediately hit deny and logged in to check if they were still there. And as you can guess they were gone, along with 600 or so FTC which the "hacker" (not really sure what to call this), converted to BTC, then to LTC and withdrew them as well. I have to say, this isn't a very nice feeling at all. I worked pretty hard trading and mining to make all those Litecoin, which just vanished in the blink of an eye.

I mentioned in the above paragraph an email which I think was from BTC-e. Stupidly, I never checked and just clicked deny straight away and logged right in. In my panic I didn't check to see if this was a phishing site. I know, silly me :(. However I looked through my internet history and it was definitely the BTC-e site so I don't think I've been "hacked" that way. I went back to my emails to check the email I'd been sent and it appears to have mysteriously disappeared. I'm not sure how that's possible but I checked on the server and it's nowhere to be found. Not in inbox, spam, deleted or anywhere else.

I know it's very unlikely that I'll manage to get my coins back, but I'm just wondering if anyone has any ideas on what to do. And before you all tell me I shouldn't store my coins on a trading site...  ;) yes I do know this, however I've been trading with my coins to try and increase the amount I've been holding. Reason I was keeping them on there for the time being was because I didn't want to keep withdrawing and depositing as there are fees. So essentially, I'd just be losing litecoin every time I see a trade opportunity.

Here is the litecoin address that my litecoin has gone to: Lh8Gc1UKR99FsjdWbNEAMmWCo5qUyWZ8Rm
Here is the tx: d797b886dfad5473184517a9bf3eec0cce05ffa59d32910813d14d5d78f68f1b

Any help will be greatly appreciated, and if you want any more info don't hesitate to ask.

Cheers guys
-redmist

The address never appeared before on the forum, maybe try PM BTC-e account? https://bitcointalk.org/index.php?action=profile;u=33012

Actually I do have BTC, very few, I just bought what I can afford to lose if they were ever stolen, hacked or even if the price one night dropped to Zero.

Your story is the reason behind why every single real business out there is not getting involved in this waiting to see what will really end up happening with those crypto-currency.

As I believe this BTC is a very smart thing, I also believe that for the first time in the internet life it created the best chance for hackers to steals billions of dollars! The greatest opportunity ever!

Please please please forum, don't get on me and tell me I am a sucker, or a loser, or BTC can't be hacked but it is the website, I DO UNDERSTAND ALL THIS!

But what I am saying is: before the hacker would work so hard to hack few bucks, those Nigeria scams all for just few bucks, or the best they would hack is an account with 1000 bucks and usually mostly bank account are insured so usually people get their money back!
Or may be the hackers will hack a movie or Windows or office or some software and post it on one of those file sharing like Megaupload or rapidshare ...etc which they may sell for a buck or distributed for free (in the third world)!
This BTC created a great opportunity for hackers to not only hack but also become owner of millions of dollars, one coin worth almost $500!

I have read a lot saying: it will cost a lot of money to hack whatever it is for 10 minutes, well.... for a hacker it is worth it! if someone tell you I sell you a car for $20 when it is worth $20000, will you say no?

Again, I am not against the crypto-currency, but I am against having million of dollars of it. that's the problem usually with majority of humans (including me probably) as they make millions and still: they don't get out they just want more and more thinking that what happened to Josh or Tara or or or... will not happen to them!

I have a read a good quote somewhere in this forum as someone said: if you hold coin that if they get stolen then it ruin your life or scare you then you are holding too much coins!


I am sorry man for your loss, but again this is the idea of BTC, you want anonymity? you want Tax free? you want to deal with drugs and arms? well they all come with a risk which is: you also might lose everything!


I never cared to avoid taxes, I like having police around, I like following the law. My tax pay for the police and the law: they protect me, they protect my rights and they would die in the line of duty to save a mother fucker like me if I get hurt or kidnapped ..etc.
If the gov. says Tax is 10% then I pay it, if the gov. says tax 30% then I pay it too, if the gov. says tax is 50% then pay it too. At the end of the day I know there is police around, I know my bank will not let me down and I know I am FDIC insured!

Again, please don't trash me, I am not against the crypto-currency as I have few myself, but I am saying that: everything comes at risk!


Wish you the best man, I really hope what you lost was only profit and not your base money.
 

One thing I want to ask about this quote "confirm or deny a withdrawal of 108.5335 LTC from my account"
Did you have exactly this amount of LTC in your account? Yes or No, then you can go from there.

Unfortunately the BTC-E support is very slow to react to such incidents. Have you got any reply from them for your support tickets?

I haven't tried that yet, however that will be one of the first things I'm going to do to try and get them back :) I've been busy unpacking and getting back into a normal routine, but I'll start ASAP. :)

I'm not entirely sure what you're getting at here, however I understand it comes with risks. I'm kicking myself for not being more careful, but at the same time I'm thankful that I kept a portion of my other litecoin in a secure wallet. So I haven't lost everything.

I had 103 LTC. 600 FTC.
The "hacker" changed my feathercoin to btc, then bought an extra 5.35 litecoin with the bitcoin. But at the end of all of that I had exactly 108.5335 which is now all gone. So whoever has done it took everything.

Unfortunately I haven't even got round to sending support tickets. But I heard they're pretty slow and a lot of the time don't even reply. We'll see what happens anyway and I'll keep you guys updated. I'm not entirely sure there's anything I can do other than sending BTC-e messages, but if anyone has any other advice I'm be more than grateful to receive it.

This is out of my imagination, how can it have happened?
I am very sorry for your loss, but very strnage that it even bypassed your "deny",
and then email disappeas? unbelieavle..

This happened to me on BTC-E a few months ago too.

Must be very careful with using that exchange. I got the IPs of the people who stole mine and they were baised in ukraine.

I never use BTC-e anymore because of this. Also its pretty funny that after I log into the hacked account. The hackers log into it a few minutes later (probably to check if I deposited more funds) lol Happened twice but stopped now

I know it's very strange. Unless the person who "hacked" my BTC-e account knows the password to my email account as well I can't see how it could have been deleted. I mean, to get it completely off the server you have to delete it, then delete it from "deleted items". I'm at a loss really...

Yeah it's a bit dodgy. They were threatening to remove FTC from trading ages ago, so everyone sold them and the price crashed. Then they mysteriously removed that post and carried on the trading. A ploy for them to buy all the cheap coins I reckon.

May I asked how you managed to do that?

Just a quick update guys. I've PM'd the BTC-e guys on here and I've sent them a support ticket via their site. Hopefully I'll get a reply sooner rather than later.

Okay guys. Got a pretty speedy reply from BTC-e.

This is what they said-- READ FROM THE BOTTOM UP:


Okay, so the block of red is when the "hacker" changed my password so I couldn't log in. Green I guess is them logging in and out to check they have access. Blue is when they logged in, withdrew the coins and then logged out again. And finally, orange is me resetting my password (as they changed it) and logging back in to find all my funds gone.

So from this we've found that the ip 62.4.8.72 is the malicious one. And they are located somewhere in France near Paris. I'm going to contact the owner of the IP range and do some digging. If anyone has any other ideas on what can be done, feel free to PM me or just post on here.

Really sorry, man...

The question which arises always: have you been using the same username and/or password on more than one website?

Most known examples of such "hacks" (known by me from reading the forum) started with compromising a mining pool users/pass database (which sometimes went even unnoticed by pool's admins, since this was not the main target and the stolen user/pass combinations have been tested on all and every exchange/online wallet/btc site).

Edit: I put quotes on "hacks" because you never know if the "hacker" and the "pool's admin/owner" work together or even thay can be the same person...

Sad but it happens.

Edit2: Also have in mind that the French IP could also be hacked (before) only for using it as remote point for attack.
And if hacker cares a bit about covering his tracks, he always uses a number of servers, loggin from one to another to make finding the original IP almost impossible to find.

Of course, he could even use his home computer directly, without worries.... but then if you want to know his personal details, I believe that the event has to be reported to the police (if not, ISPs tend to not reveal any details of their clients).


Sorry for not being so positive though.

Just read your story, on the unfortunate incident.

It seems like you got the email phishing thing going on, but the wtf moment is when you mentioned the email being not in the inbox.

Unless they can delete it from your side, using the same pw if its used for your email account. But thats scary, how all the coins just disappeared like that, esp the converting part kinda ripped me.

I been scammed before, so I know the shitty feeling..  :-\

But, I think when you clicked on the deny part, then login in maybe that recorded some type of keylogging?

I guess your email is hacked. You cannot confirm a withdrawal from btc-e if you cannot open the email address. I guess the hacker confirms the withdrawal and delete the email. I don't think btc-e will refund cases like this.

Send the support tickets as quickly as possible. If it is their fault, then they have to refund you the stolen coins.

BTC-e is a good exchange. And they always recommend to use gmail and 2FA to prevent account hacking and always recommend to be careful with address line in your browser. If You will follow this simple rules, everything will be OK.

sad story and sorry for your loss.. the IP's maybe are not actually the hacker's, possibly a VPN or some sort..
i guess you will no longer get your coins back   :(:'(

I have seen people getting robbed even after enabling the 2FA and email verification. Keyloggers were used in such robberies.

Try to email https://support.btc-e.com/ (https://support.btc-e.com/)  and tweet them https://twitter.com/btcecom (https://twitter.com/btcecom)  in order to find out how it happend. Support page is here https://support.btc-e.com/ (https://support.btc-e.com/).

On the blockchain of litecoin you can find +160 LTC  :o
http://explorer.litecoin.net/address/Lh8Gc1UKR99FsjdWbNEAMmWCo5qUyWZ8Rm

Transcations have never been sent out.

Can you post the detailed email headers?  Email-from address is easy to fake.

You can try to track down the person and googling the address and search for any single location it's mentioned in (other than here) or if you could a real IP...

Sorry to hear your loss. :(


It seems OP already received a reply from btc-e, and the site literally replied "can't refund and return your money". (refer to post #15)

OK.. missed that part. But how was the transaction confirmed by email? Was the email hacked too?


I am not sure whether it is one of the TOR exit nodes. Or might be a proxy.

This one (http://aruljohn.com/track.pl) says that it is a Dedibox (?) connection.

> whois

% Abuse contact for '62.4.0.0 - 62.4.15.255' is 'abuse@proxad.net'

inetnum:        62.4.0.0 - 62.4.15.255
netname:        DEDIBOX-POOL-IPFO
descr:          Pools for Dedibox Customers
country:        FR
admin-c:        DAaT1-RIPE
tech-c:         DAaT1-RIPE
status:         LIR-PARTITIONED PA
mnt-by:         MNT-TISCALIFR-B2B
mnt-by:         ONLINE-NET-MNT
mnt-lower:      DEDIBOX-MNT
source:         RIPE # Filtered
mnt-domains:    ONLINE-NET-MNT

role:           Dedibox Admin and Tech Contact
address:        8, rue de la ville l'eveque
address:        75008 Paris
address:        France
abuse-mailbox:  abuse@dedibox.com
admin-c:        SC14327-RIPE
tech-c:         SC14327-RIPE
nic-hdl:        DAaT1-RIPE
mnt-by:         DEDIBOX-MNT
source:         RIPE # Filtered

% Information related to '62.4.0.0/19AS12876'

route:          62.4.0.0/19
descr:          Online SAS
descr:          Paris, France
origin:         AS12876
mnt-by:         MNT-TISCALIFR
source:         RIPE # Filtered

stay tuned, ill try to find out some more  :)

What is this Dedibox? Tried to Google it. Found nothing.  :(

all money is just sitting in that wallet.  so no transactions to track, other than those incoming.

try to contact his/her service provider:
https://console.online.net/en/assistance/index (https://console.online.net/en/assistance/index)

Opening time: Monday through Friday from 8:00 a.m. to 8:00 p.m. GMT+0100 (CET) at +33 1 84 13 00 01
Currently: 2014-04-09 20:09 UTC +1

the service provider has a forum as well http://forum.online.net/ (http://forum.online.net/)

furthermore you can report abuse:
https://console.online.net/en/account/abuses/search (https://console.online.net/en/account/abuses/search)

Yes, it could be a TOR exit node or a proxy, but until know its uncertain.


dedibox forwards to http://www.online.net/en ; its the service provider I think.  
If you check the address on streetview
you will find an office building.

Of course it could be a spoofed domain, but it doesnt seem so:  PING online.net (62.210.16.2) 56(84) bytes of data.
ip range is near;


oh check this: dedibox
http://www.online.net/img/carousel/dedislide-en.jpg
Its a dedicated server http://www.online.net/en/dedicated-server/dedibox-scg2  they have various different ones.

If you are lucky they connected directly to the dedibox with their direct ip-address, so online.net would know;

^^^ May be it will be better, if we seek help from some of the French members of this forum.

I have been hacked as well.. and all my litecoin went to the same damn address Lh8Gc1UKR99FsjdWbNEAMmWCo5qUyWZ8Rm
http://bitinfocharts.com/litecoin/address/Lh8Gc1UKR99FsjdWbNEAMmWCo5qUyWZ8Rm

And btc-e told me that I have confirmed the withdrawal from my email but I've never once have seen anything from
btc-e.  I just bought bunch of alt coins including ltc with my btc.

I almost think that this could be an inhouse-job? I never had anything to do with confirming a withdrawal.  And
here's the response I've got.

Hello! We are sorry but your money was transferred out from BTC-E. Withdrawal has been confirmed with your mail. #401267130 -166.95923176 LTC Withdrawal LTC to address Lh8Gc1UKR99FsjdWbNEAMmWCo5qUyWZ8Rm 14.03.14 04:05:50 yes We can't refund and return your money. We recommend you change your password, e-mail and set 2fa protection. We can provide you IP logs of potential hacker: success login 108.171.80.246 14.03.14 04:02

maybe he just deleted the withdrawal email

Sounds like your email account has been hacked as well.
Do you use the same password, and do you see any suspicious login on your email account?

Fuckin sucks dude, I had about $1,000 worth of btc stolen from me last Christmas  >:(  Felt sick for first few days, hope you manage to get your coin back

Nowadays 2fa is a must, unless you can make sure that your password is only used on BTC-E and no where else.

I've had SEPA withdrawals go missing for months with BTC-e  :-\ but they did refund me in the end..

Sorry for your loss OP  :-[