Bitcoin Forum

My Bitcoin got hacked from my blockchain.com wallet three years ago.  I cannot seem to be able to contact Blockchain.com.  I failed trying to contact them three years ago, but I tried it again today, and this time - still failed.

I’m still able to access the wallet and see that my email address and the phone number for the SMS 2-Step verification are still there.  I was also able to change the password. 

I went to their support.blockchain.com page and tried to post my question, but after I entered the email address and the password for the account, I got an “invalid authenticity token” message and was unable to proceed further.  Does anyone know how to get through them?  I need to get more information on how my bitcoin got hacked.  It was such a mystery on how my account got hacked.  Did the hacker got a hold of my 12-word phrase key and replicated on another device before the coins were sent out?  If so, how did they bypass the SMS verification?  Or did they simply hack into the wallet directly? 

Ever since that incident, I lost confidence in using their wallet.  And as of today, I still cannot get in touch with their support team. 

Could someone help?  Please also share your story if something similar happened to you if you like to share. 

As it happened three years ago, I am over it now, but I still like to know what had happened and how did they hack it.

 :'( :'( :'( :'( :'(

Not sure how Blockchain.com wallet works today because I haven't used it since God knows when, but have you saved your wallet's backup phrase somewhere? Maybe through a .txt file or through an email or something? Because it's either that, whereas a hacker got a hold of your backup phrase through your device, or you probably got phished sometime in the past.


Regardless though, since your funds have already been stolen, the chances of you getting them back is pretty much zero.

Unfortunately, Blockchain wallet is an insecure wallet, this is a web wallet and therefore you do not have the phrase "seed" or "private key" in the first place, you only have the username and password and this can be easily hacked especially if you do not activate two-factor authentication, it is also possible that your email has been hacked So that they can access your account.

I forgot to add this - when the login failed, I also clicked on the “reset my password” link.  I entered my email address and submitted it.  However, I never got the email.  I did this twice.  Does this mean that I am not even a registered user?  But I did register and got the wallet.  Is the Password which I can change in the wallet and the email address appears in the wallet the same login credentials to access the support.blockchain.com site?

Check any suspicious activities that your email went through. It should be possible to trace how the hacker was able to access the account through that since as you said, 2FA was still enabled. Also, the issue of "Invalid authenticity token" seems like it stems from your browser settings or something similar. Try looking it up, it may not be a site-specific error but instead, your browser refuses to or blocks you yourself from entering the forum. As for contacting them, well, you tried and that didn't work. I myself don't know how to tbh, other than through their email or whatever info they have publicly available.

Blockchain.com is ridiculously incompetent and I would steer far away from them.

As you've mentioned, you were hacked 3 years ago, why are you still trying to reach them? You probably won't gain a single clue by asking them anyways, they probably won't keep logs for so long. I doubt that they would compensate you for your loss or anything. Were you using Tor at the time of the hack? Is your computer infected with malware?

I will check if I sent out the phrase via email.  But don’t they need to also my phone as I have the two step verification set up?


It is actually a wallet on my iphone. 


I did have some type of enable cookies note.  I think I clicked on enable, but maybe that is not the right way. 



Thank you all for your replies.

the reality is yes.

If you remember someone or your friend, the family brought your phone? they need a second to bypass it.

You will find a lot of trouble about blockchain.com > https://bitcointalk.org/index.php?board=222.0

they can't resolve your issue of course.

just look at history in account and explorer address. but, as the comment above it won't back your balance into your pocket.


Look like you entered the phishing site. the hacker had your credential and had access to your seed.

---

the point is to use the wallet where only you can access it like bitcoin core, electrum, or buy a hardware wallet in the next time.

I see the most problems in this forum regarding access to blockchain.com wallets.

I have never actually used blockchain.com wallets, however, at least some people have experienced the same problem with you.
Try to read the topic below, at least it can help you recover Bitcoin on blockchain.com wallets.

Topic: Recover blockchain.info wallet password - 0.5 BTC bounty (https://bitcointalk.org/index.php?topic=2306476.20)

Topic: Help me to recover funds from 18 phrases (https://bitcointalk.org/index.php?topic=5186752.0)

If they actually got a hold of your private keys, then no, there would be no need for 2fa verification for them to access your money. 2FA would only apply to the login of your Blockchain.com account.

Again, thank you all for your suggestions.  I want to bring up the following facts:

- I was using iPad and iPhone.
- I have not encountered any hack issue from these devices for all these years except the incident three years ago.
- I just found that I did send the recovery phrase to the same email address I was using as a backup.  Not sure if my email account got hack though, as I am still able to access it.
- I have SMS 2-step Verification using my phone numbers.  
- The URL of the site I tried to enter the credentials and to reset password was support.blockchain.com, not a phishing site.
- I have not and will not use their wallet again.  

I don’t expect to get the coin back; I just need to get some answers to help me to avoid the some mistakes again or to patch potential data leak.  

I don’t even know my private key.  Where can I find it from the wallet app?  If they were able to recovery my wallet in their device, then they can just send the money out. 

I meant your recovery phrase, specifically. And since you actually sent your recovery phrase to yourself via an email(which is a HUGE no-no), I think there's a decent chance that that might actually be it:

Since you can't actually enter into your wallet then how did you figured out you got hacked, with the address on any explorer or you just assumed it as?

When blockchain.info converted to blockchain.com there were lot of bugs and previous users can't able to get the login email which was unanswered from the support and it let to funds to be lost forever.

If for instance that you entered your login credentials 3 years ago on a blockchain.com phishing site, I won't be surprised if these hackers did not change your existing email, password and what not. I bet that they even wait for your next deposit for them to steal your bitcoin for the second time.

As far as I know, a "Man-in-the-Middle Attack" is doable to bypass an account with an active 2 Factor Authentication especially if they are using a phishing site.

Once the attackers has the access to your account. They can easily get your seed phrase from Settings --> Security and once they have it, they can access your account to another wallet and then do the transfer without triggering a transfer history on your blokchain.com wallet.

These are just possible scenarios though.

---

Use a non-custodial bitcoin wallet instead and practice using backups to ensure that you won't be experiencing this again.

I am able to access my wallet; I am just not able to send them support ticket using my credentials. 

When did they change from .info to .com?  Now that you mentioned, I think when I registered the account, it was still .info, but now when I clicked the Support menu in the wallet app, it took me to .com.

Not sure if that was absolutely the case, but I should not do that again. 


Didn’t Nano Ledger just get hacked as well?  Is it still safe to use?

They use both.


The device itself is safe to use. It's more of a leak than a hack. User's shipping information were leaked because of their point of sale interface which was breached. The device and it's private keys/seeds are still safe.

The device itself is safe to use since the private key will never leave the device. The database leak on their end have nothing to do with the security of your funds in the Ledger. However, your privacy is at risk and you are prone to receive phishing links via email, random phone calls which might trigger losing your funds if you are not being careful. Or worst, the $5 Wrench Attack (https://cryptosec.info/wrench-attack/) might happen.

SMS 2fa is the worst type of auth it can be easily bypassed. Online wallets are bad decision too. And looks like blockchain.com support are the worst thing in this bad story

Sim swapping was the easiest method on few developing countries but some countries which have strong regulations against data privacy then it is not going to be easy.

Yup, online wallet are too bad to store cryptos. only people realize it after losing their hard earned money.

I've used Blockchain wallet years ago and as far as i remember they gave users access to their private keys.
So if the "hacker" somehow hijacked your session he could've just taken the private keys and just swept them. Never use web-based clients.

Also Blockchain wallet has had several high impacting bugs over the years that has led to their users losing funds, like biased random numbers and re-used r values.
So there are many ways you could've lost your coins. Now even if you found out the mechanism through which they've stolen your coins you could not get them back.
From now on you should own your coins not some third party idiots. Good luck!

Majority been thinking that SMS 2fa is already secured but it isnt and hacking via SMS interception is plausible and can be done.
https://www.theverge.com/2017/9/18/16328172/sms-two-factor-authentication-hack-password-bitcoin

Knowing blockchain.com support, they arent really that responsive ever and this is why im not using anymore this wallet.

Im more confident on using Electrum instead rather than on this one and of course keeping important informations/keys is necessary or most prioritize.

Oh, blockchain.info redirects to blockchain.com since June 2018.

I suggest everyone to not use Blockchain's wallet, it's terrible. I created some wallet (account) on their website and on one account it happened like I was somehow unable to login. Password was correct, was receiving email and verifying it, everything was correct, even there was green message box on blockchain.info but somehow, login was still impossible. I couldn't login, guess it was a bug from their side or idk. Contacted their support multiple times, they are the worst, no attention. Glad my balance was zero on their website.

So, just don't use blockchain.com's wallet for long term or for storing your coins. Or then get a prescription for calm meds.

I've used blockchain as my wallet since 2015/2016 until now and never faced any problem. I've secured my wallet with email login and also 2FA, so i disagree with your opinion based from my own experience.

3 years ago happened but now you just ask us, OP?

This is a good service, they'll give you the keys and everything if you know how to navigate it.

With that being said, I've also had numerous phishing attempts,some even sent from spoofed identical domains, just shady redirects.
Believe it or not this wallet probally wasnt hacked.


Verify anything and everything.

I just came back to the crypto space because of the hype recently.  Before, it was too depressed to follow it due to low price activities and to think about the hack.  The value of the lost bitcoin in that wallet has increased by 15 folds after I put the fund in there.  Fortunately, the amount I placed in the wallet was only about 2 days of salary for someone who is flipping burgers at McDonald’s and not my life saving.  (But due to appreciation, the lost amount is worth over a month of their salary based on the current price.)

I will try again using a computer.  So far I have been using my iPad trying to reach them.  From what I heard on this thread, it seems like they don't respond even if one is able to submit the question. I will keep you guys posted.

Yes, this web wallet has horrible support, they will barely respond or will never respond to their customers ' concerned.  Just try and try re-submitting your ticket, it might you get lucky and they will soon reply.  There are a ton of complaints against them and almost the same problem, I don't think they are worth it to store your Bitcoin.

If they won't respond, there's nothing you can do is to accept the fact and move on, but next time, never use that wallet.  Instead of using a web wallet, just use an open-source wallet that you hold a private key like Electrum.

I already moved on.   :D

But I’m still going to write them.

I am still wondering why they are still in the business when clearly this is the websites fault. 2FA can still be bypassed as far as I know, one way that I know of and AFAIK is the most popular is impersonating the person to try to get the system remove the 2FA and have an easy access without the hassle of sending an authentication from the real owner. If you want to protect your emails from getting hacked then try to go to some websites that checks whether your email has been breached or already available for the public to use. To the OP, I feel sorry for you but you have some fault in the matter too, and it is that you have trusted your coins to a web wallet.

I think the reason why they are still around is because they are not regulated like an exchange and also they do provide useful blockchain information on their site which increase their popularity and people’s truth. 

Do you know what you say now? Something like this: If I haven't seen cheetah then it doesn't exist.

I have been using blockchain from 2016 and have an account on this website but as I already mentioned, later I created another one. After some months, I wanted to log in into that second account: Password was correct, was receiving verification on email and even verification was approved when I was clicking it but somehow I was still unable to log in (cookies/cache has nothing to do here, I am not a newbie). Seems it was a very strange technical error on my account and if I am not wrong, one guy had the same problem here years ago. After that accident, I personally don't give a recommendation to their wallet and services (First of all, customer support experience was terrible, very, very late replies and blatant answers).

This is a small matter of risk versus reward for some people. They do not want to risk their information and personal details thru KYC so they go for an unregulated exchange that they then risk have poor security measures.

To be fair,,, not necessarily does a regulated exchange have good security measures. Wild, wild jungle of crypto and we can get unlucky if we are not careful!

Basically, it is a trade off.  I did it experimentally as I already have coins on an exchange.  I felt that it is cool to have a crypto wallet with some coins in it at the time for spending purpose.

It is absolutely foolish in 2021, to still be using SMS based 2FA to protect your digital assets/cryptocurrency. YubiKey costs nothing compared to what you stand to lose becoming victim to a simple and easily achieved SIM swap attack by some teenagers.

I can't remember getting 12 words phrase from blockchain.info except some wallet ID that was sent to my mails long time ago, which I used it to access my funds.
However, your data might have be leaked to those hackers and if your funds was stolen, why can't you use those 12 words passphrase to import your funds on another non-custodial Bitcoin wallets to confirm if your funds weren't fully synchronised, well, to complain now after three years incidence isn't appropriate either.
Better you've moved on, if actually the customer support gets you the informations on how your funds left your wallet, please do not hesitate to let us know, but next time never use their wallet again.

Yes, I like to contact them and will keep your guys posted, but currently I got other issues to solve which is unrelated to them.

 

Yeah, you know how they solve that? First world countries still pay garbage hourly rates to work at these places and SIM swappers just find easy staff to bribe for access or to do the SIM swapping for them, or they have a friend who works there...