There was no theft of any private keys. The miners were hit with a man-in-the-middle attack that redirected them to a malicious mining pool where they kept receiving new blocks to work on, but were not paid their share for that work. The technical analysis is here:

http://www.secureworks.com/cyber-threat-intelligence/threats/bgp-hijacking-for-cryptocurrency-profit/

If the thief has malware on your PC they can bypass or hijack any authentication you can perform in order to authorize a different transaction. This has long been a problem for online banking systems that attempt to employ 2-factor. The thief can use malware to change what you see on your screen and change what's happening in memory so you end up authorizing a different transaction than what you intended.

What's really needed is end-to-end transaction integrity verification on a dedicated hardware device. Trezor gets us most of the way there but the transaction is not verified end-to-end, only workstation-to-Trezor. A system like the Cronto banking hardware device is needed for Bitcoin, where a PKI implementation similar to BIP70 could be used to verify the address of the payee all the way to the secure device of the payer.

This one had a few detects in VirusTotal but I think one problem is that there always seem to be a few false-positive detections on all Qt wallets, so people are being trained to ignore VirusTotal results for new altcoins even when they are true-positive.

It's just downright crazy to run a program downloaded from this forum on a machine where your other important files (i.e. wallets) are stored. If you want to beat everyone else to jump on the latest coin or whatever, use a separate VM for each wallet until its code is shown to be trustworthy. And if for some reason it doesn't run in a VM, that's probably a good sign it's malware.

Just verified that the Win32 JunnonCoin-Qt client posted in the thread I linked to above is also the same malware.

Chinese wallet stealer, not Russian. See: https://bitcointalk.org/index.php?topic=512966.msg5669194#msg5669194

The filename isn't Russian, it's a date/time in Chinese. The trojan sends the wallet files to 23.239.111.68 on TCP port 12730. That IP is assigned to a "Wei Cheng":


That IP was also listed as a static node in the QT configuration file for JunnonCoin, a Chinese altcoin:

https://bitcointalk.org/index.php?topic=413045.0

I'm going to go ahead and say this is a Chinese wallet-stealing operation, not Russian.

Until the Javascript on your page is changed by a hacker, and the key is sent back over HTTP instead of being cached.

If the hacker just has your password somehow, 2FA can help. If they have malware on your machine, 2FA won't necessarily stop them. They can just wait for you to log in with your 2FA and then have their way with your account.

There is malware that targets KeePass so even it is not secure unless you keep it on a separate computer that isn't ever connected to a network.

The fake wallet posted using madmartyk’s account is NetWire RAT. It connects to jenny15.no-ip .biz on port 3360.

madmartyk - your account has been used twice before to do this:

https://bitcointalk.org/index.php?topic=459622.msg5344227#msg5344227

https://bitcointalk.org/index.php?topic=475160.msg5320506#msg5320506

If you really aren’t posting these links to fake wallets that turn out to be RATs, I would advise you to check netstat -an and look for suspicious connections on port 3360. If you don't find any, you're probably still infected, but you'll need to look harder. Once you confirm, reformat your machine and reinstall Windows, and change all your passwords everywhere.

You're not hacked. Read up on change addresses.

https://en.bitcoin.it/wiki/Change

The Adwind/UNRECOM RAT in question connects to khaleeel.no-ip.info (currently resolves to 82.205.115.201, a Palestinian IP).

Where was the original file downloaded from? I'd like to analyze it.

Not at first if it's a newly developed family or packer. After a time, you'll get some detection from some of the AV engines used by Virus Total. Of course, the malware author can tweak the file until it's no longer detected, and the game starts all over again.

I'm a little unclear on what vulnerability was exploited to gain access to your wallet. Please keep us updated with details as you uncover them, you never know what might lead to the perp. The notable IP above appears to be a VPN endpoint for perfect-privacy.org, so it's probably not going to be much help.

Here, among other places: https://bitcointalk.org/index.php?topic=25215.msg5034826#msg5034826

Apparently he's from Croatia.

I'm curious, where did you grow up, that stealing is considered "legit"?

Ah, clever. I'll buy one when they are available. Seems like you could use a modified version of this to verify transactions/account changes on an exchange or mining pool.

I don't see a display; how does the user verify the transaction details haven't been modified by malware before signing the transaction?