Purse.io HACKED..

[chichidori]

Hope purse.io don`t GOX away with your BTC or Money but its a serious matter that needs to be taken care off quickly.

[aarons6]

unfortunately i still cant log in. it says i need to contact customer support.. i sent them an email but no reply yet.
my bitcoin hasn't moved from the wallet it got sent to, so who knows.

[Phildo]

from Reddit:

We have received word today of unauthorized password reset notification emails. We are aware of the issue and have secured all funds. All user balances are accounted for and upon completing our investigation, service will resume shortly.

All accounted for, even though the transaction ids in the emails appear to be legitimate. Of course.

yeah, i guess we will see.. its good news tho..

That was sarcasm. How can all the coins be accounted for if the transaction of your coins leaving your account i real?

wonder if they say the coins are safe were to those that didnt lose any

They said they have secured all funds, so i think users funds are safe.
I hope they didn't lie about it

This is impossible.

The OP posted the transaction of coins leaving purse to an address that isn't his that matches up with a transaction that matches the amount in his confirmation email (that he never confirmed). those coins can be replaced, but they can not be secured by purse.

[grunt]

My coins are still in my purse wallet. No 2fa on there. I do have 2fa on my email tho.

It could be possible that the coins are still under Purse's control in that they had the accounts set up in multi-sig so the money could not be transferred off-site, only to another wallet under their control. Until we know more we can't say either way what the status of those 'hacked' coins are.

[ajw7989]

Always stick to the cardinal rule never trust any website with your coin. Only keep your coin on the site while using its services never for storage.

[Phildo]

My coins are still in my purse wallet. No 2fa on there. I do have 2fa on my email tho.

It could be possible that the coins are still under Purse's control in that they had the accounts set up in multi-sig so the money could not be transferred off-site, only to another wallet under their control. Until we know more we can't say either way what the status of those 'hacked' coins are.

So they received a withdrawal request, then moved the coins to a wallet they control and sent a notification that the withdrawal was successful? On what planet does that come close to making sense?

[aarons6]

from Reddit:

We have received word today of unauthorized password reset notification emails. We are aware of the issue and have secured all funds. All user balances are accounted for and upon completing our investigation, service will resume shortly.

All accounted for, even though the transaction ids in the emails appear to be legitimate. Of course.

yeah, i guess we will see.. its good news tho..

That was sarcasm. How can all the coins be accounted for if the transaction of your coins leaving your account i real?

wonder if they say the coins are safe were to those that didnt lose any

They said they have secured all funds, so i think users funds are safe.
I hope they didn't lie about it

This is impossible.

The OP posted the transaction of coins leaving purse to an address that isn't his that matches up with a transaction that matches the amount in his confirmation email (that he never confirmed). those coins can be replaced, but they can not be secured by purse.

here is the email



the funds are still there
https://www.blocktrail.com/BTC/address/1fZisbHc6rGRoWmMet7n15Sficng5YWbQ

and i still have NO access to purse. the site wont recognize my username.

i know its not safe to leave funds in an online wallet.. but i had active orders and you have to secure them..
also, i have 2fa enabled.. on both purse AND gmail.

nobody can login my email without having to input a code.

its a good chance i was one of the first ones to contact support in the chat they have to say my funds just left my wallet.. because as soon as he replied we will check it out, the site went offline for "maintenance"

[Phildo]

from Reddit:

We have received word today of unauthorized password reset notification emails. We are aware of the issue and have secured all funds. All user balances are accounted for and upon completing our investigation, service will resume shortly.

All accounted for, even though the transaction ids in the emails appear to be legitimate. Of course.

yeah, i guess we will see.. its good news tho..

That was sarcasm. How can all the coins be accounted for if the transaction of your coins leaving your account i real?

wonder if they say the coins are safe were to those that didnt lose any

They said they have secured all funds, so i think users funds are safe.
I hope they didn't lie about it

This is impossible.

The OP posted the transaction of coins leaving purse to an address that isn't his that matches up with a transaction that matches the amount in his confirmation email (that he never confirmed). those coins can be replaced, but they can not be secured by purse.

here is the email



the funds are still there
https://www.blocktrail.com/BTC/address/1fZisbHc6rGRoWmMet7n15Sficng5YWbQ

and i still have NO access to purse. the site wont recognize my username.

i know its not safe to leave funds in an online wallet.. but i had active orders and you have to secure them..
also, i have 2fa enabled.. on both purse AND gmail.

nobody can login my email without having to input a code.

was 2fa enabled on purse before this incident?

I believe they are completely at fault, but just to be sure, are there any responses in your sent mail folder responding to these messages?

[aarons6]

from Reddit:

We have received word today of unauthorized password reset notification emails. We are aware of the issue and have secured all funds. All user balances are accounted for and upon completing our investigation, service will resume shortly.

All accounted for, even though the transaction ids in the emails appear to be legitimate. Of course.

yeah, i guess we will see.. its good news tho..

That was sarcasm. How can all the coins be accounted for if the transaction of your coins leaving your account i real?

wonder if they say the coins are safe were to those that didnt lose any

They said they have secured all funds, so i think users funds are safe.
I hope they didn't lie about it

This is impossible.

The OP posted the transaction of coins leaving purse to an address that isn't his that matches up with a transaction that matches the amount in his confirmation email (that he never confirmed). those coins can be replaced, but they can not be secured by purse.

here is the email



the funds are still there
https://www.blocktrail.com/BTC/address/1fZisbHc6rGRoWmMet7n15Sficng5YWbQ

and i still have NO access to purse. the site wont recognize my username.

i know its not safe to leave funds in an online wallet.. but i had active orders and you have to secure them..
also, i have 2fa enabled.. on both purse AND gmail.

nobody can login my email without having to input a code.

was 2fa enabled on purse before this incident?

I believe they are completely at fault, but just to be sure, are there any responses in your sent mail folder responding to these messages?

yeah i strictly believe in 2fa.. i love it and i wish everyone had at least the text option.

the only email i got from them so far was the canned response they probably sent everyone.

ive contacted support but its the weekend.. i might just make a new account and start over with a fresh email.

i like the site.. its a great idea.. i saved tons of money i would have spent otherwise.

im sure they will send me back the bitcoin.. eventually..

[Phildo]

yeah i strictly believe in 2fa.. i love it and i wish everyone had at least the text option.

the only email i got from them so far was the canned response they probably sent everyone.

ive contacted support but its the weekend.. i might just make a new account and start over with a fresh email.

i like the site.. its a great idea.. i saved tons of money i would have spent otherwise.

im sure they will send me back the bitcoin.. eventually..

I've never used the site because it doesn't make sense, so forgive me for all the questions. You have your coins on there, and then send them to people who are willing to send you an amount of stuff worth more than the bitcoins are worth off of an amazon wishlist? Can't you just keep the coins yourself until there is a person willing to make a purchase for you?

It seemed to me like people buying coins would be the people with coins on the site, it did not occur to me that people looking to sell coins would leave them there.

[aarons6]

I've never used the site because it doesn't make sense, so forgive me for all the questions. You have your coins on there, and then send them to people who are willing to send you an amount of stuff worth more than the bitcoins are worth off of an amazon wishlist? Can't you just keep the coins yourself until there is a person willing to make a purchase for you?

It seemed to me like people buying coins would be the people with coins on the site, it did not occur to me that people looking to sell coins would leave them there.

how it works is i want something on amazon i make a wishlist for it.
then i put the wishlist on that site and put up an offer based on how much i want to spend basically. i can choose up to 50% off the retail price altho you probably wont ever actually complete that order.
then you fill the order with how many bitcoins you wanted to spend. i usually chose 30% off...

so then someone wants to buy your order they accept the offer and buy your items. then they give the site the tracking info and you wait till it arrives.
then you push the button on the site that says you received items and the system sends them your bitcoins.

it seemed all automated..

your items come with a full warranty, and you get a card in the box with a buy order number that amazon accepts so you can even return them.. altho probably not for cash back.. maybe credit?
ive only had to warranty out one item i got so far and it went smoothly.. i contacted amazon they contacted the supplier and he sent me out a new one.. even got to keep the broken one.

[nrd525]

Still locked out of my account and waiting to hear from Purse.

[aarons6]

Still locked out of my account and waiting to hear from Purse.

me too.. altho i did get an automated email saying possibly tomorrow they will send out a form or something to reply to get your account unlocked..

also the bitcoin is still here
https://www.blocktrail.com/BTC/address/1fZisbHc6rGRoWmMet7n15Sficng5YWbQ

which i dont think is a purse wallet.. as they use wallets that start with 3

[LouisVuitton]

Aww man that sucks to hear. I've been using Purse and haven't had a problem

[~Bitcoin~]

I doubt the coins are in the safe side as they say. If their support email is hacked than there is lots of chances the hacker may have got panel to send bitcoin. Lets see what happen after their mainatainance period.

[Cereberus]

Haven't had a problem with them either. What a shame 

[aarons6]

it seems everything is back to normal with my account.. the funds are back in my wallet.. it shows up as a refund.. so they were withdrawn..
they are still sitting in the wallet they went to..





 i give them props for a quick and speedy recovery.. i hope they didnt lose too many bitcoins and i hope they fixed whatever issue they had.

[bitcoin revo]

it seems everything is back to normal with my account.. the funds are back in my wallet.. it shows up as a refund.. so they were withdrawn..
they are still sitting in the wallet they went to..





 i give them props for a quick and speedy recovery.. i hope they didnt lose too many bitcoins and i hope they fixed whatever issue they had.

Yeah. Their Reddit account (PurseIO) updated that they successfully reimbursed everyone and fixed the issue.

https://www.reddit.com/r/Bitcoin/comments/3oex4p/purseio_denies_bitcoin_theft_despite_compromise/cvx2nzj