Bitcoin Forum

 I had a little over 6 bitcoin in my multibit wallet, secured with complicated password...I was going to move my btc to a cold wallet, but got busy and went to bed without even shutting my computer off. When I woke up this morning, my wallet was open and had been nearly emptied in 2 transactions.

Firstly, I've seen these threads before, and figured my security was pretty good, this thief just caught me off gaurd... I'm just confused... how did they do it? where did the money go? Is there any hope of catching these guys? I'm going to delet the bad wallet and start again, hopefully I will find a wallet that is harder to hack....ugh, I'm just sick...

here's the 6btc transaction https://blockchain.info/tx-index/41191061dee39219aad24db41fa6f08f88a4664b75e19d0e7b2e809c4279ee36 (https://blockchain.info/tx-index/41191061dee39219aad24db41fa6f08f88a4664b75e19d0e7b2e809c4279ee36)

and one other 0.476 btc transaction https://blockchain.info/tx-index/16cb9a7b531f61000b935242d8486f6bd128fe64672d6a004b779f773be1f3c8 (https://blockchain.info/tx-index/16cb9a7b531f61000b935242d8486f6bd128fe64672d6a004b779f773be1f3c8)

I'm really upset, and I'm trying to figure out what exactly happened, or where the money went. Can anyone help?

Was it a windows computer? Then it's most likely a virus. Run Sophos Virus Removal Tool and check for yourself.

I would suggest restoring the computers operating system. Just deleting the bad wallet and making a new one is a security risk, it sounds very likely you have contracted a Virus from somewhere. Also, I'm assuming you are using Windows by the sounds of things, You should consider making transactions on a Linux based system, even if it's a hot wallet. Ubuntu is recommended if you are new to Linux systems it's pretty easy to setup and and find your way around.

Also, you need to assume that everything on your comptuter & accounts could be compromised, so quickly restore and reinstall the operating system of your choice and change your passwords and any other sensitive data. That's your number one priority right now.

I also recommend installing a few security extensions on your browser, for some ideas: No script & Http Everywhere.

Don't just create a new wallet, you need to reformat and reinstall your OS at the very least. You should also change all your passwords.

Did you install anything new recently, in particular anything cryptocurrency related?

You could try using tain anyalisis but I don't think you will have much luck. other than that its very unlikely you will find the person who did this and you wont be getting them back anytime soon.

yes i am going to reformat everything. running sophos right now. arrrggggg

do you have Team Viewer on your PC?

did you make a virus scan (update database first) ?


(buy this: http://www.coindesk.com/ledger-launches-usb-bitcoin-wallet-bank-grade-security/ )

Just out curiosity have you checked if your address has been affected by this http://www.coindesk.com/good-samaritan-blockchain-hacker-returned-255-btc-speaks/ (http://www.coindesk.com/good-samaritan-blockchain-hacker-returned-255-btc-speaks/) ?

There is reference to address list but it may be incomplete https://bitcointalk.org/index.php?topic=581411.0 (https://bitcointalk.org/index.php?topic=581411.0)

This was an incident which happened 2 days back and only lasted for 2 hours. The current post looks like a more recent thing.

Someone posted this on the 9th: https://bitcointalk.org/index.php?topic=888137.0 (Multibit phishing, beware!)

So did you get an email like they got?

STOP USING WINDOWS FFS!

Yes, I've noticed... However, if you look at the second link it references  bitcointalk post made last spring. It seems we have been here long before blockchain incident.

P.S  Also something to look at: Someone posted this on the 9th: https://bitcointalk.org/index.php?topic=888137.0 (Multibit phishing, beware!) So did you get an email like they got?

Or using Aviator, it's supposed to be a browser proofed from zero days exploits.

https://www.whitehatsec.com/aviator/index.html

Was never aware of that. Is it also related to blockchain, or is it something totally different?
THanks for the link.

I believe they've linked those to Counterparty... I keep wondering how many more addresses might have been affected and we do not even know about it yet.

most greedy theives do not wait weeks to raid people. so it is normally the case that whatever you installed within the last 2 weeks is the culprit.

so what have you installed recently.
the main culprits are things linked by people that know about bitcoin or where the program in question is crypto currency related.

a few people have stupidly seen a "bitcoin generator" program on youtube and downloaded it, a few others have downloaded altcoin clients, etc.

so tell us what bitcoin related programs you have on your computer so we can narrow down possible culprits and also help warn noobs what not to go near.

stop browsing the internet or even having browsers installed on any device containing your cryptos.

This is exactly what is holding back Bitcoin.  I now have to have a separate computer for all bitcoin transactions.  And that is unreasonable for the typical sixpack joe.

  The average consumer will just say "heck no, I will just use Visa".

Tough break man...

Took a look at tx, helluva lot of rabbit trails as might be expected, only thing I'm getting, impressions rather than objective, is the smell of Russians.

A solution could be a custom ASIC hardware key, wherein the private key is not accessible; it would interface with your (optionally deterministic hierarchical) wallet via USB but you would be require to press a physical button to release signatures.

Wallets would warn when balances are large enough that a hardware key is warranted.

Price could be reduced to a few $ over time.

Is there something like this already available?

I think there are setups for Rasberry Pi for this, but this needs to come down to the consumer level price and plug-and-play simplicity.

OP

I can do chain analysis if you want... from what I can tell so far...

check this https://bitcointalk.org/index.php?topic=99497.23060;wap2

I believe your coins are now here: https://blockchain.info/address/1Bi24CRuXX1irhaQmEVqbMos62iH43FtYJ

I could do more research but it is super time consuming and maybe you can help

Wait... now I am confused...  Multibit?  You must enter your pw for any multibit send.  When you click transactions on that wallet in multibit does it show it?  When you say u had a good password do you mean like 16+ characters using all combos?  Or 6 character 15yo3x?

Somewhere in this over my head analysis is the answer to the security problem.   And someone a lot smarter than I will get rich.  And God bless 'em.

A super-app some day will address this need.

This is what I am wondering, how does hackers steal the passwords, do they have some sort of key loggers, if the wallet and keys were encrypted there's no way to steal those without knowing the password.

Yeah, it's my own damn fault for leaving those coins in the hot wallet. I guess I let my gaurd down.

My password was 16 characters, numbers and made up words... Not sure how they got past that? My btc in cold storage is untouched, I download a lot of music, and occasionally a movie, however I have been visiting viooz which is a bootleg streaming movie sight from Russia... So I dont know about that...

That's great you found the address but I'm not sure where to go with it? The "security issue" with btc sure won't help with the universal acceptance. I just lost almost 3k$ and I'm fairly careful, no expert, but fairly proficient... If I can get robbed than I would say over 80% of the general population is at far greater risk.
I'm buying a ledger wallet.

Yeah, I think this might be where you may have gone wrong, but thats just a guess.

Yeah, impossible if it is a good password.  Wondering how this happened

Well then you should stop everything you are doing... you have a key logger on your system

I as well have a Multibit wallet set-up on my P.C. but for some odd reason felt placing money(BTC) in this particlar wallet wasn't right.  Just for hearing of this I will no doubt dispose of it!
Who knows maybe Multibit took advantage from you leaving your account open and took your coins knowing there was no way of finding out???

Face it You got Goxed!

Goodluck trying to get the average joes in bitcoin then

from the op it looks like your PC was left on and online. I think it must be from some malware gettinginto your PC. if there is a program to view system network logs, u might be able to know exactly what happened. it also best to use Linux with your bitcoin wallets

Use an other computer with an antivirus when you want to create a new wallet. Paper wallet are saef to hold  bigger amounts of bitcoins.

 :) good choice. its the first cheap device for a mass market. we need more of these and they will be developed in the next 1-2 years.

and buy a good antivirus-programm like Kaspersky  ;)

I ran Sophos and it detected one item and deleted it. I don't think it was a key logger because I haven't sent any coins in weeks so no password was keyed in recently. It's just very weird that multibit opened up without me clicking it. All I can think is they cracked the pass with some super duper program or there is a flaw in multibit that allows the pass to be bypassed. I've cold storage for my savings, and they're fine, but ~6 btc is a big loss and I really don't understand IT enough to be 100% sure what I'm doing, like Linux or Ubuntu seem kind of daunting. I'm going to get a hardware wallet and I am never leaving more than 0.5 btc in my hot wallet ever again.
This experience has damaged my faith in btc. Not the tech itself, but the actuality of any regular joe ever trusting it. If btc is so easy to steal the banks will never have to worry.

What was the virus called? also run malwarebytes

It may be the thief got the wallet long back and spent the time till now trying to crack the password.

Its scary how a veteran member gets robbed.

You should obviously change anything else that uses that password and never use it again. Out of curiosity, what was the password? A randomly generated 16char password made up of upper & lower case letters numbers and symbols is around 104bits of entropy which is pretty much impossible to crack, it would definitely cost a hell of a lot more than 6BTC worth of computing power to crack, so I'm curious to see how strong your password really was, if it really is that strong the hacker must have keylogged you when you last entered your password and only just got around to stealing the funds.

Maybe the hacker got a backup of your wallet that wasn't encrypted?

I would not assume that antivirus can detect all forms of trojans that can intercept when you type your password. Some keyloggers may intercept keys at the system level and be detected, others may be application specific (e.g. if Multibit is an application or runs in the browser, then a trojan that infects the application or browser) and thus variable and not detected.

The only safe option would be hardware isolation, for hardware microcode that can't be reprogrammed dynamically, i.e. an ASIC not a CPU, since these have reprogrammable microcode (even though only Intel and the NSA are supposed to have the ability to reprogram these, a hacker might figure out how).



Ah good to see the market is already providing hardware wallets.

Are you describing a Trezor? https://bitcointalk.org/index.php?topic=122438.0

As these Russian hackers become more and more proficient and more numerous (their economy is collapsing and is owned by oligarchs so they need a vocation like hacking), how does this impact the integration of Bitcoin with sites that normally promise their users repudiation, e.g. Paypal??

Thus I suspect we will see Paypal integrate with a hardware wallet soon?


A quick glance and that appears to be what I was suggesting.

Such projects can be crowd financed these days with Kickstarter.

yep, for the average joe we need bulletproof devices. its still a long way to go.

good that you hold your savings in cold storage and only leave pocket change in your hotwallet.

I am using Malwarebytes Premium and COMODO Firewall and Antivirus plus try to only use trustable software (official qt wallet) and not try browing shady websites. For unknown software I use Sandbox first. For Passwords ENPASS.

Posted From bitcointalk.org Android App

By those terms, a big precentage of bitcoin users are average joes and could be robbed easily. I'm pretty sure OP wasn't even close to being a bitcoin average joe since he was using secure passwords and had seperated his hotwallet from his vault. I don't think that many people follow such safety lines. I'm pretty sure that most of those 40% of the total bitcoins sitting in addresses with less than 10 coins in each don't even follow the basic security rules. I find the fact that he lost faith to bitcoin completely rational. Everyone knows bitcoin is secure as a network, the tools to securely store bitcoins are already out there too and there are convinient ways to use them as well. But we get more stuff like weusecoins promotional material rather than actual educational pieces.

Who's gonna educate dem average joes? Besides that I don't think real average joes even know what bitcoin is right now.

I think he mentioned that he had a long tough password. Its usually impossible that it would be cracked by bruteforcing.

If the economy-of-scale is sufficient (i.e. 100s of millions of users, not the paltry 1 - 2 million Bitcoin has after 6 years (https://bitcointalk.org/index.php?topic=888883.msg9801356#msg9801356)) the necessary hardware will be integrated into the smart phones. Then it will simply work plug-and-play for n00bs.

This is why I (formerly AnonyMint, TheFascistMind, UnunoctiumTesticles, etc) wrote about the adoption rate of Bitcoin (https://bitcointalk.org/index.php?topic=557732.0) slowing and of Monero (https://bitcointalk.org/index.php?topic=400235.msg9823278#msg9823278). Note I clarified why (https://bitcointalk.org/index.php?topic=365141.msg9438334#msg9438334) adoption rate slows as large entities aggregate users and capital (https://bitcointalk.org/index.php?topic=400235.msg9813604#msg9813604).

Readers would be wise to click every link above and learn. Sorry this is not boasting. It is fact.

This was an interesting read though, learned something about Bitcoin that I didn't before
Thanks for sharing and I hope the OP is able to get his bitcoins back also check if it disabled any settings in your virusscanner like a rootkit scanner in malwarebytes as an example.

i dont want this happen to me... does anyone know how to setup a cold wallet very easily?

Create a paper wallet on a computer that is not connected to the internet. After creating the paper wallet, employ a software that wipes the hard drive overwriting deleted file sectors with random data, reformat the hard drive of that computer and reinstall the operating system. Don't plug it into the internet or plug in any devices or USB until after you wipe and reformat.

Then spend your BTC to the public address of that paper wallet.

Store multiple copies in multiple secure, secret locations of that printed paper wallet in fireproof and weather proof storage.

No one can get that private key electronically, so no one can steal those BTC electronically. It is up to your preparations to insure the printed private key(s) can't be stolen physically.

is there any actual physical wallets out there, that acts like a cold wallet?

6 btc is a fuk ton of money.

i didnt even know people can access the back up copy and just steal the balance.. thank god im on a mac? but still, this same scenario can happen to me as well right.

It certainly can, however windows are more prone to it.
In this case, we don't know what exactly cause the issue. So if the password was crackd some other way, it could happen on a mac as well.