They didn't leak data via a "publicly available API"... it was supposedly "a misconfigured, third-party API key" that allowed unauthorised access. How did this happen?
An attacker gained access to a portion of our e-commerce and marketing database through a third party’s API key, which allowed unauthorized access to our customers’ contact details and order data.
....
Since when does this issue exist?
The third party API key misconfiguration at issue has been running since August 9th, 2018. Based on the evidence and log we have, we believe it was discovered and exploited from April 2020 to June 28th, 2020.
It's not like they just left the data sitting out in the open for anyone to access... Unfortunately, that doesn't change the fact that a lot of private data was stolen and has now been placed in the public domain  Really sucks for the 272,000 who have been affected by this... I don't see Ledger's reputation recovering for a long, long while. |
|
|
|
Yes... very bizarre. I have the NVidia Geforce Experience running... and my Armory+Bitcoin Core installation works "OK".  So, it might be causing the issue on your setup, but it might be completely unrelated... anyway, glad you managed to get it sorted out and recovered your coins  |
|
|
|
Because if you have created your wallet, electrum should automatically open that file.
What happens if you go to File -> Recently opened? Do you see your wallet file?
If you have set a password and left file encryption on (the default setting), then Electrum will open the "Electrum - install wizard" screen when you start up, note the password prompt:  Isn't there a file somewhere in my local macOS that is my wallet and that I can copy to a USB key?
Yes, if you click the "Choose..." button on the screen above, it will open the directory containing all the wallet files that have been created. I saved the seed of the wallet. Is it really the only thing we need to restore a wallet in case of computer failure?
Only with Electrum or does it work with every software or online service?
Yes, the 12 word seed mnemonic is all you need to recover. This 12 word seed is specific to Electrum, it will not work in 99.9% of other wallet software (I believe there are 1 or 2 other wallets that support Electrum seeds, but they are the exception, not the rule). If you have links to tutorials to help me understand how all this works. I would appreciate it because I understand NOT MUCH...... except that I need to keep the seed safe.
Maybe have a read through some of the guides here: https://bitcoinelectrum.com/They might explain some of the questions you have. Alternatively, the electrum docs are here: https://electrum.readthedocs.io/en/latest/I would feel safer storing my BTC on an online service but everyone says it's a bad idea... Right?
Ask the people who have funds stuck in Cryptopia how leaving coins on an online service worked out for them so far: https://bitcointalk.org/index.php?topic=1669443.new#newor the users of Mt. Gox... or the users of the countless other services that got hacked/closed unexpectedly... "Not your keys, NOT your Bitcoin" |
|
|
|
Thank you, I update Armory to 9.6.5. I generated the error log after getting stuck on the 99% Scanning Transaction History https://pastebin.com/HMUTnG6wFirstly, it seems like it is scanning blocks "OK", so your directory paths seem ok... That's a good start How long did you leave it sitting at 99% before stopping it? It can take quite a while to finish the initial syncing and parsing... |
|
|
|
Yeah... that works, although you should probably have linked to that to start with   Having said that, that original post was only made like 3 weeks ago... so anyone looking at this for "confirmation of identity" etc, should take that into account. You're right. Could you please verify this one too ? I already submitted it on 07 of April 2019. Hi Could someone verify this adress for me, please ? -----BEGIN BITCOIN SIGNED MESSAGE-----
Owner of this adress is Groswesh (This message is verified to protect my Bitcointalk Account). Date is 07 of April 2019.
-----BEGIN SIGNATURE-----
1DRpo64mtwuptwS6T5oB8TM7NnurkS1fPc
IIbfDKi+FirT224wxumWPsuYFRk+LczcjcZ8AJZx8bMQYP/24Puo9vqwHv8oDuxPSsIsyAevileGdjcZ1I5BxWU=
-----END BITCOIN SIGNED MESSAGE-----
Quoted Verified and Archivedaddress: 1DRpo64mtwuptwS6T5oB8TM7NnurkS1fPcmessage: I am GrosWesh on the Bitcointalk forum and I assure that I am the source of the change of connection email that has just been made. 22th December 2020.Sig: IAC5xhlkM4SPnZXVPBTrfx8KtYKg6nc987609uP9pE/qXAo74Px0RvyIv/yuBcEvHW76I8LNcp4CAtEv0vi3UY8=Quoted and verifiedEverything seems to check out... addresses/sigs verify and original messages are unedited and verified etc |
|
|
|
Yeah, sadly... people think of their bitcoin "wallet" as being like a physical wallet, holding dollar bills/coins etc... or (even worse) a bank account... This then leads to a number of common misconceptions about the way bitcoin "wallets" actually work, which then leads to the constant stream of "Help! I tried to do X and my wallet did Y!"-type posts. |
|
|
|
Something thoughtfully uploaded all the files to github: https://github.com/xoso9/ledgerhackYou can just download the raw text files (or the .rar archive as it's smaller) and search in a texteditor if you find that website database too annoying to use. Thankfully my details are not in the buyers database... just my email and Gmail spam seems to be taking care of all the ridiculous "Your ledger has been blocked" nonsense emails. Remember folks, don't click on links in emails... and NEVER give your 24 words to anyone... They should only ever be entered directly on the device. Do NOT enter into any application or any website... #staySafe |
|
|
|
I didn't expect it, just take a look what kind of horrible and frightening transaction fees charges in blockchain. It's obvious not as usual and I can relate your feeling. It's my utter priority to get relief from this things and won't never back again in blockchain.
Is your 0.014+ BTC balance made up of a lot of small value receive amounts? If so, that would explain the ridiculous fee being suggested by blockchain.com... people just don't seem to understand, that the fee is calculated from the data size of their transaction... not the monetary or BTC value. Data Size * Fee Rate selected == Total Fee used. If you have a lot of inputs into your transaction (because you received 10s or 100s of tiny amounts from mining or faucets etc) then the data size of your transaction increases significantly (regardless of the amount of BTC being transacted). It should be obvious from the mathematical equation above that if you significantly increase the Data Size (or the Fee Rate), that your total fee is going to also be significantly larger. It also doesn't help that the network has been extremely busy as of late, so fee rates increased as well. This is the problem that wallet developers face... - err on the side of "high fees" to try and get quick confirmation times - users complain about high fees - err on the side of "low fees" to try and keep user costs down - users complain their transactions are stuck because wallet selected too low fees  |
|
|
|
so if I could get these 14% back, that would be a nice amount for Christmas. Nobody has any idea ?
About getting your funds back? I can tell you with 100% certainty that you won't be getting anything back this Christmas... There is no way for you to access your coins. GT now control all the keys. You play by their rules or you get nothing. Whether there will actually be anything left to recover after their ridiculous fees is another story. |
|
|
|
Yeah... that works, although you should probably have linked to that to start with Having said that, that original post was only made like 3 weeks ago... so anyone looking at this for "confirmation of identity" etc, should take that into account. |
|
|
|
I called my mom and she burned down all papers that included the 24 word seeds.
So, you no longer have a backup of your 24 word seed?  Or it's just the copies at your parents place that have been destroyed and you have a copy with you? If it's the former, you need to move your coins sooner rather than later in case the device breaks or is lost/stolen. Without a backup, your coins are at genuine risk of being "lost" forever. If it's the latter, then my advice still stands, you don't need to move the coins... the coins are safe in the device. |
|
|
|
Honestly, the best solution is a full node... attempting to "workaround" Electrum's limitations with regards to large volumes of transactions/addresses etc is only going to end in tears You'll either create a solution that doesn't scale well or becomes a nightmare to manage. Note that the limitations of "large volume" aren't necessarily a "client" issue, so much as a "server" bandwidth imposed limit. The most common server (ElectrumX) has some "default" limits that will be triggered by a client requesting large amounts of data (ie. when trying to sync a wallet with 1000s of addresses/transactions etc). When that happens, the client is throttled/timed out and it appears as though "syncing" is stuck or broken. If you run your own Electrum server, these limits can easily be modified to workaround this limitation... However this leads to this: As far as I know you can run your own Electrum server and make all your wallets connect to that particular server only. However, it could become a single point of failure. Of course you can also run your own Bitcoin node if this is a critical business requirement. But in the end (IMO) we always have to rely on a third-party provider at some point.
You'll find that all Electrum servers require access to a Bitcoin Node anyway... so we're back to the solution of: "just run a Bitcoin Node"  So... in summary, I can see 3 options: 1. Find a friendly Electrum Server admin who would be willing to setup a server for you with modified limits or 2. Setup your own Bitcoin Node + Electrum Server setup with modified limits or 3. Setup your own Bitcoin Node + BTCPayServer Personally, I'd probably go with #3... it's the least "hacky" solution using tools designed specifically for the job you appear to be trying to accomplish. |
|
|
|
The screenshot that OP provided would appear to show the "Advanced Preview"... AFTER the "finalize" button has been selected... PRIOR to "finalize" being clicked the RBF checkbox and locktime boxes are still available for editing:  AFTER "finalize" is clicked, then the RBF and locktime values are set like the OPs screenshot:  Unfortunately i can't sign or broadcast. these options are greyed out. also there is no transaction ID , and i am sending them to a wallet address.
The only instance I can find where the "sign" and "broadcast" buttons are greyed out is when you have a "watching only" wallet... @OP, if you see "watching only" in the title bar of your wallet like this:  Then, unfortunately, you do not have the private keys in this wallet to be able to spend the coins... |
|
|
|
... in both BTC Armory 9.6.0 and 9.6.3.99 (the two I had on my PC), but those options are greyed out.
You might also want to make sure you have the most current release of Armory as well... the older versions don't play very nicely with versions of Bitcoin Core after about 0.17 (from memory)... Download and install 0.96.5 from here: https://btcarmory.com/0.96.5-release/(NOTE: DO NOT use bitcoinarmory.com - it's old and outdated) |
|
|
|
|
In my opinion, they're effectively as secure as any "gift card" (ie. where the "secrets" were generated by someone else and you have no way to know if that data has been retained or secured correctly)... I'd recommend treating them as such and using them for similar values and/or similar purposes.
|
|
|
|
Ledger Live will only add a "Legacy" account, if it finds "history" on the Legacy account. It does not allow you to create a new Legacy account (it only allows new Segwit or Native Segwit accounts). If it is not finding your Legacy account, then either: 1. The 24 word seed is not the correct seed for your Legacy wallet (and/or "the 25th word" if any) or 2. You did something weird like selected a receive address from the dropdown list in the Chrome App instead of using the "Receive" tab to get an address. If you did this, there is a chance that the address you selected from the Chrome App was either outside the "gap limit" of Ledger Live (and also Electrum)... - If the problem is caused by #1, you're going to really struggle to recover your funds unless you can find the correct 24 words (+ 25th word if any) - If the problem is caused by #2, you can try following the solution here to raise the gap limit in Ledger Live: https://support.ledger.com/hc/en-us/articles/360010892360-Address-gap-limitTry using a ridiculous number for the gap limit like 100. It might take a long time for it search them all when you try to add accounts... but it should find any Legacy history. I am fairly sure that the Chrome App didn't pre-generate more than 100 addresses. |
|
|
|
Thanks ETFbitcoin, would I be correct in saying if I was to develop a branded clone of Copay that I would also have to make that open source?
The details are usually in the license... The MIT license is described as: A short and simple permissive license with conditions only requiring preservation of copyright and license notices. Licensed works, modifications, and larger works may be distributed under different terms and without source code.
So, it seems you can basically do whatever you like and don't have to provide source-code... providing you adhere to the license conditions... which for CoPay are: ...
Copyright (c) 2014-2016 BitPay, Inc.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
...
|
|
|
|
What happens to our coins if Ledger goes bankrupt due to the hac and nobody trust them anymore? Should I move my coins somewhere else from the ledger? I dont trust paper wallets either anymore.
No, that is quite possibly the worst knee-jerk reaction you could make... leave your coins exactly where they are. This data leak does not, in any way, affect the security of your ledger device. It is a leak of around ~1,000,000 email addresses and personal data like name/address/phone etc for ~272,000 unlucky individuals (that we currently know of). Your private keys and your 24 word seed mnemonic are perfectly safe... as long as you don't give them to anyone!!!NEVER enter your 24 word seed anywhere other than on the Ledger device... DO NOT put it into any "Ledger Live" app that asks for it... or any website that asks for it. If you follow the standard rules for securing your 24 word seed, your coins are "safe". |
|
|
|
It "might"... it's impossible to tell with these fork coins what is causing issues because of the mods that have been made... I haven't looked at mine in weeks and from memory, I had issues with it if I left it offline for a day or two, it would cause issues with getting it going and mining/syncing again I can't even go and try to test my setup, as it appears that due to resource constraints, I deleted all the forkcoin stuff I had in my VMs |
|
|
|
Blockchain wallet may not allow for easy CPFP payments... but you could import your wallet into Electrum using your 12 word backup phrase from Blockchain.com and by using the "BIP39 Seed" option when creating the wallet in Electrum ("Standard Wallet" -> "I already have a seed" -> click "Options" button, tick "BIP39 Seed") This would allow you to use the coin-control features to spend the change from your transaction and create a "Child Pays For Parent" (CPFP) transaction that might be able to get your transaction confirmed sooner. The issue is that the fees have spiked to quite a high level again (100+ sats/vbyte)... so it's going to be a costly exercise. |
|
|
|
|
Show Posts
