I'm an optimist.  I learn from my mistakes and move on.  I don't feel bad about this.

It is confirmed he first enter through myqnapcloud.com.  Then access my NAS.  Yes.  One password was compromised and I should of done a better job securing that.  Regardless its mitigated.

I also filed a complaint with the FBI and have some security guys helping me to do some investigating.  I do have some general idea where the attack came from; but I'll keep it like this for now.  I want the fed to get involved and hopefully they'll.

Status: 152 confirmations
Date: 4/15/20 02:39
To: 3KkktVYUaCR52oZUdZzpuXFMvqpLmYFaqA
Debit: -8.08116106 BTC
Transaction fee: -0.00004310 BTC
Net amount: -8.08120416 BTC
Transaction ID: 668c2e5d00e25f15c23a8f843dfc4502a595343b78ede0e99eb935710f9be726
Transaction total size: 557 bytes
Transaction virtual size: 315 bytes
Output index: 0

After spending a few hours last night. I think I know what happened. <sigh>...  It was a hack.  Through my NAS I believe.  Anyway... Its done deal.

I am wondering if there is a way to flag that address as fraud?  Or some thing I can do about this event?  Any ideas is appreciated.

So someone accessed my computer and cracked the passphrase?  How could that happen? 

Which hardware wallet do you recommend?

Below is the transaction of someone sent my 8.08 coins to an unknown address

4/15/20 02:39 Confirmed (151 confirmations). Sent to (no label) 3KkktVYUaCR52oZUdZzpuXFMvqpLmYFaqA -8.08120416


Below is my debug log. Last shutdown was 4/9.  Then I started on 4/16.  There was no activity on 4/15.


2020-04-09T22:31:01Z UpdateTip: new best=0000000000000000000a7986fbeb212d76c5410f6d1806730e9e5b584cf835f9 height=625191 version=0x208e2000 log2_work=91.84263 tx=519485685 date='2020-04-09T22:30:59Z' progress=1.000000 cache=311.1MiB(3237493txo) warning='67 of last 100 blocks have unexpected version'
2020-04-09T22:43:06Z Pre-allocating up to position 0x5000000 in blk02029.dat
2020-04-09T22:43:06Z UpdateTip: new best=0000000000000000000324a4a9cd4dc2ea23298000d6f2119a51fa99ad36b983 height=625192 version=0x20400000 log2_work=91.842651 tx=519488067 date='2020-04-09T22:42:58Z' progress=1.000000 cache=311.3MiB(3239975txo) warning='68 of last 100 blocks have unexpected version'
2020-04-09T22:49:57Z UpdateTip: new best=0000000000000000000084796852af145b8ddbf758317a509ea514b76800b787 height=625193 version=0x20c00000 log2_work=91.842671 tx=519489269 date='2020-04-09T22:49:40Z' progress=1.000000 cache=311.5MiB(3241244txo) warning='69 of last 100 blocks have unexpected version'
2020-04-09T22:51:31Z UpdateTip: new best=0000000000000000000fed96ca174999768440df83e892325d011cc6bac5bd28 height=625194 version=0x3fffe000 log2_work=91.842692 tx=519489630 date='2020-04-09T22:51:19Z' progress=1.000000 cache=311.5MiB(3241463txo) warning='70 of last 100 blocks have unexpected version'
2020-04-09T23:08:01Z tor: Thread interrupt
2020-04-09T23:08:01Z Shutdown: In progress...
2020-04-09T23:08:01Z addcon thread exit
2020-04-09T23:08:01Z torcontrol thread exit
2020-04-09T23:08:01Z opencon thread exit
2020-04-09T23:08:01Z net thread exit
2020-04-09T23:08:01Z msghand thread exit
2020-04-09T23:08:01Z scheduler thread interrupt
2020-04-09T23:08:01Z Dumped mempool: 0.009077s to copy, 0.090141s to dump
2020-04-09T23:08:02Z [default wallet] Releasing wallet
2020-04-09T23:08:02Z Shutdown: done
2020-04-16T06:48:01Z




2020-04-16T06:48:01Z Bitcoin Core version v0.18.1 (release build)
2020-04-16T06:48:01Z Assuming ancestors of block 0000000000000000000f1c54590ee18d15ec70e68c8cd4cfbadb1b4f11697eee have valid signatures.
2020-04-16T06:48:01Z Setting nMinimumChainWork=0000000000000000000000000000000000000000051dc8b82f450202ecb3d471
2020-04-16T06:48:01Z Using the 'standard,sse41(4way),avx2(8way)' SHA256 implementation
2020-04-16T06:48:01Z Using RdSeed as additional entropy source
2020-04-16T06:48:01Z Using RdRand as an additional entropy source
2020-04-16T06:48:01Z Default data directory /home/cwwang/.bitcoin
2020-04-16T06:48:01Z Using data directory /beast/bitcoin-data
2020-04-16T06:48:01Z Config file: /beast/bitcoin-data/bitcoin.conf
2020-04-16T06:48:01Z Using at most 125 automatic connections (1024 file descriptors available)
2020-04-16T06:48:01Z Using 16 MiB out of 32/2 requested for signature cache, able to store 524288 elements
2020-04-16T06:48:01Z Using 16 MiB out of 32/2 requested for script execution cache, able to store 524288 elements
2020-04-16T06:48:01Z Using 4 threads for script verification
2020-04-16T06:48:01Z scheduler thread start
2020-04-16T06:48:01Z Using wallet directory /beast/bitcoin-data/wallets
2020-04-16T06:48:01Z init message: Verifying wallet(s)...
2020-04-16T06:48:01Z Using BerkeleyDB version Berkeley DB 4.8.30: (April  9, 2010)
2020-04-16T06:48:01Z Using wallet /beast/bitcoin-data/wallets
2020-04-16T06:48:01Z BerkeleyEnvironment::Open: LogDir=/beast/bitcoin-data/wallets/database ErrorFile=/beast/bitcoin-data/wallets/db.log
2020-04-16T06:48:01Z init message: Loading banlist...
2020-04-16T06:48:01Z Cache configuration:
2020-04-16T06:48:01Z * Using 2.0 MiB for block index database
2020-04-16T06:48:01Z * Using 8.0 MiB for chain state database
2020-04-16T06:48:01Z * Using 440.0 MiB for in-memory UTXO set (plus up to 286.1 MiB of unused mempool space)
2020-04-16T06:48:01Z init message: Loading block index...
2020-04-16T06:48:01Z Opening LevelDB in /beast/bitcoin-data/blocks/index
2020-04-16T06:48:02Z Opened LevelDB successfully
2020-04-16T06:48:02Z Using obfuscation key for /beast/bitcoin-data/blocks/index: 0000000000000000
2020-04-16T06:48:07Z LoadBlockIndexDB: last block file = 2029
2020-04-16T06:48:07Z LoadBlockIndexDB: last block file info: CBlockFileInfo(blocks=57, size=69345739, heights=625138...625194, time=2020-04-09...2020-04-09)
2020-04-16T06:48:07Z Checking all blk files are present...
2020-04-16T06:48:08Z Opening LevelDB in /beast/bitcoin-data/chainstate
2020-04-16T06:48:09Z Opened LevelDB successfully
2020-04-16T06:48:09Z Using obfuscation key for /beast/bitcoin-data/chainstate: 6721ed49b14769d0
2020-04-16T06:48:09Z Loaded best chain: hashBestChain=0000000000000000000fed96ca174999768440df83e892325d011cc6bac5bd28 height=625194 date=2020-04-09T22:51:19Z progress=0.996134
2020-04-16T06:48:09Z init message: Rewinding blocks...
2020-04-16T06:48:10Z init message: Verifying blocks...
2020-04-16T06:48:10Z Verifying last 6 blocks at level 3
2020-04-16T06:48:10Z [0%]...[16%]...[33%]...[50%]...[66%]...[83%]...[99%]...[DONE].
2020-04-16T06:49:21Z No coin database inconsistencies in last 6 blocks (8082 transactions)
2020-04-16T06:49:21Z  block index           80075ms
2020-04-16T06:49:22Z init message: Loading wallet...
2020-04-16T06:49:22Z BerkeleyEnvironment::Open: LogDir=/beast/bitcoin-data/wallets/database ErrorFile=/beast/bitcoin-data/wallets/db.log
2020-04-16T06:49:22Z [default wallet] nFileVersion = 180100
2020-04-16T06:49:22Z [default wallet] Keys: 0 plaintext, 4004 encrypted, 4004 w/ metadata, 4004 total. Unknown wallet records: 0
2020-04-16T06:49:22Z [default wallet] Wallet completed loading in             166ms
2020-04-16T06:49:22Z [default wallet] setKeyPool.size() = 1997
2020-04-16T06:49:22Z [default wallet] mapWallet.size() = 4
2020-04-16T06:49:22Z [default wallet] mapAddressBook.size() = 4
2020-04-16T06:49:22Z mapBlockIndex.size() = 625195
2020-04-16T06:49:22Z nBestHeight = 625194
2020-04-16T06:49:22Z AddLocal([2600:8802:1102:5f00:15ff:b85c:29b4:d2fd]:8333,1)
2020-04-16T06:49:22Z Discover: IPv6 wlp3s0: 2600:8802:1102:5f00:15ff:b85c:29b4:d2fd
2020-04-16T06:49:22Z AddLocal([2600:8802:1102:5f00:139e:86c9:7b79:b787]:8333,1)
2020-04-16T06:49:22Z Discover: IPv6 wlp3s0: 2600:8802:1102:5f00:139e:86c9:7b79:b787
2020-04-16T06:49:22Z Bound to [::]:8333
2020-04-16T06:49:22Z Bound to 0.0.0.0:8333
2020-04-16T06:49:22Z init message: Loading P2P addresses...
2020-04-16T06:49:22Z torcontrol thread start
2020-04-16T06:49:22Z Loaded 64616 addresses from peers.dat  662ms
2020-04-16T06:49:22Z init message: Starting network threads...
2020-04-16T06:49:22Z net thread start
2020-04-16T06:49:22Z opencon thread start
2020-04-16T06:49:22Z init message: Done loading
2020-04-16T06:49:22Z dnsseed thread start
2020-04-16T06:49:22Z msghand thread start
2020-04-16T06:49:22Z addcon thread start
2020-04-16T06:49:22Z GUI: Platform customization: "other"
2020-04-16T06:49:22Z GUI: PaymentServer::LoadRootCAs: Loaded  126  root certificates
2020-04-16T06:49:29Z New outbound peer connected: version: 70015, blocks=626227, peer=0
2020-04-16T06:49:33Z Loading addresses from DNS seeds (could take a while)
2020-04-16T06:49:35Z 282 addresses found from DNS seeds
2020-04-16T06:49:35Z dnsseed thread exit
2020-04-16T06:49:43Z UpdateTip: new best=0000000000000000000acdba38bcbd8e80f03b321ec453f9f4e3fcce5ed4cc48 height=625195 version=0x20000000 log2_work=91.842712 tx=519492624 date='2020-04-09T23:22:21Z' progress=0.996147 cache=1.2MiB(12886txo)
2020-04-16T06:50:25Z UpdateTip: new best=000000000000000000045ca57680cf9225d23b616cf008a28de8b1b302bc3e1e height=625196 version=0x20400000 log2_work=91.842733 tx=519494722 date='2020-04-09T23:22:53Z' progress=0.996147 cache=2.0MiB(20931txo)
2020-04-16T06:51:10Z

I've been pretty save. Passphrase is pretty long random characters.  Very strange.  Someone hacked into my BInance account.  maybe my computer is compromised?  I don't get it.

I checked the debug.log on my bitcoin-data directory.  Apparently the transaction was done on 4/15/20 02:39 local time.  But during that time the bitcoin-qt is not running.  What gives?

Today I just noticed someone moved all of my btc from my private wallet to another address.  Strange thing is my bitcoin-qt is not running during that time.  How can this happen?  I just lost all those coins!

Any ideas on what could cause this? Or how can someone pull this off?