Had 165k ETH stolen last night.

[rat03gopoh]

Yes I am referring to Rewind.ai, Screen and audio recordings from Rewind.ai are stored locally and never leave my computer.

This is the first Web3 App I have used in a very long time, and I used connected to it on July 21st for the 1st time. I reached out to them directly to let them know but they blew me off. The only person that has access to my devices is my long time partner who lives with me.

All right, let's slow down.
Everything I'm going to ask and say next is just assumptions and possibilities, I don't mean to accuse anyone. Up to this point, I'm with Pmalek that your privatekey was leaked.

Since when was your rewind application installed? did it also record the screen when you generated the privatekey?
Then about your old partner, is there any chance that s/he can also watch the saved recording?


Anyway, reviews about Rewind.ai that might be worth reading: https://www.lifewire.com/rewind-ai-records-everything-on-your-mac-privacy-nightmare-or-amazing-memory-tool-6826733

[kingjudas]

<Snip>

Maybe your keys leaked with the 26 ETH transaction that you made from Metamask to your Kraken account. After that, someone got the secrets that they needed to steal the remaining coins. I don't know how, though.

My intuition leads me to this conclusion as it appears to be the most logical, but from a technical standpoint, it feels like a stretch.

What about your partner that you said lives with you. Does she use your computer? It doesn't have to be that she stole from you, maybe she used some fake app. Does she play games or use some dubious apps and permissions over social media?

He does not use my computer, and we have our own rooms, he also is good about crypto security.

[kingjudas]

Yes I am referring to Rewind.ai, Screen and audio recordings from Rewind.ai are stored locally and never leave my computer.

This is the first Web3 App I have used in a very long time, and I used connected to it on July 21st for the 1st time. I reached out to them directly to let them know but they blew me off. The only person that has access to my devices is my long time partner who lives with me.

All right, let's slow down.
Everything I'm going to ask and say next is just assumptions and possibilities, I don't mean to accuse anyone. Up to this point, I'm with Pmalek that your privatekey was leaked.

Since when was your rewind application installed? did it also record the screen when you generated the privatekey?
Then about your old partner, is there any chance that s/he can also watch the saved recording?


Anyway, reviews about Rewind.ai that might be worth reading: https://www.lifewire.com/rewind-ai-records-everything-on-your-mac-privacy-nightmare-or-amazing-memory-tool-6826733

I began using Rewind quite early on but my wallet is much older, and it's been a real lifesaver on numerous occasions, helping me recall things I'd forgotten or needed to retrace my steps on. While the article you've linked to does cover both the pros and cons of Rewind AI, the fact that all the data is stored locally mitigates my concerns.

As for my partner, we maintain a high level of transparency and are both keenly aware of crypto-related issues. We share everything, so there's no conceivable motive for him to engage in such behavior.

[rat03gopoh]

We share everything

Including private keys? (pls don't say yes)
I'm not gonna accuse him just for ruining your relationship. But in this case (about a large sum of money), if this were to happen to me, I'd be more realistic and not limit any suspicions. For me that's natural, because "money can blind a person".

But it's up to you, what I quoted actually... never mind

[arabspaceship123]

It's more money than I'll see in my life I'm sorry you've lost $165k ETH it's got to hurt. I'd be broken if it happened to me. I don't want to be unsympathetic but are you able to prove you've lost it? It's hard to believe every thing we're told so can you prove it?

Listen up. I messed up. Seriously. My negligence ended up costing me $165k in Ethereum, and a bit of MATIC. Here's what happened.

Earlier today, I had a significant deposit of ETH enter my digital wallet. Barely 8 minutes later, it was gone. The transaction ID? 0x094f01f9174845200e6324bf18a242e0b19ce7f058a4cb928144d22df8313bcc. Destination? A new wallet, 0x4b9e0ddabad6dff604db3d827f5fa7e1c6952aa8.

I know what you're thinking. "Should've used a hard wallet." And you're correct. I have a Ledger, and it was sitting unused while my ETH was taken. Worth noting, I had about $7k in my wallet all day, untouched. But as soon as the large deposit came in, it was swiped. Clearly, it was a targeted operation.

I'm not avoiding blame here. I failed. Despite being cautious, I wasn't vigilant enough. I'm reeling from it.

So, here's my request: If anyone knows advanced methods to trace this wallet or the transaction, beyond just setting alerts, I'd be grateful for the help. I'm clinging to the slim hope that I might retrieve my lost funds.

To everyone else: learn from my mistake. If you've got substantial crypto, move it to your hard wallet immediately. Don't let overconfidence or negligence jeopardize your assets. It can happen to anyone, myself being a stark case in point.

TL;DR: I lost $165k in ETH from my wallet moments after it was deposited. It went to a new wallet (0x4b9e0ddabad6dff604db3d827f5fa7e1c6952aa8). I didn't use my Ledger, and that's a decision I'm paying for dearly. If you can help trace the transaction or the wallet, please share your advice. Keep your crypto assets secure, folks. It's a hard lesson I've learned firsthand.

[Cricktor]

Question #1:
OP, you say your wallet is older than when you started using Rewind.ai. After you started using that tool, did you ever display your private keys or your mnemonic recovery words of your wallet on screen so that such sensitive details could've been recorded by Rewind.ai?
Think hard and try to remember any possibility for such to happen.

You say Rewind.ai stores recordings only on your local device. Question #2: how are such recordings secured? Any encryption or password necessary to replay such recordings? (I don't know this tool.)

Question #3: have you ever granted someone remote access to your device? Do you have remote access tools installed, like TeamViewer, Anydesk, ...?

Question #4: I assume your MacBook wasn't ever in any repair shop or Apple repair while there's still your data on it and since you have your wallet active? (Just to exclude the most obvious things.)

My brainstorming is about how could your wallet's sensitive data leaked. You didn't say or answer anything about browser extensions. Is this Bitcasino only a website or did you install some software from them on your device?

Pmalek's idea that the stealing transaction could be somehow related to your transfer to Kraken is a path worth to explore but frankly I don't have an idea how this could lead to a leak of data allowing a malicious party to transfer your funds.

Problem is also that is not going to be easy to determine if your device is clean or infected with something malicious.

[arabspaceship123]

If the OP doesn't know how it happened he's at risk of it happening twice. It's process by elimination so a malware program's needed. OP didn't prove it's his cryptocurrencies so it isn't easy accepting what he's saying but I'm feeling sad if he's lost $165k.

Problem is also that is not going to be easy to determine if your device is clean or infected with something malicious.

[Pmalek]

The little research I did on that Rewind.io app says that it can remember and view everything you have seen, written, or said on your device. This information can cause massive problems in the wrong hands. Another source I found says that the backups aren't "fully" encrypted, and there exists a possibility of stealing someone's data. I have no idea what they consider as "fully encrypted". It either is or isn't. The encryption could be weak or strong, not sure what fully or semi encrypted is supposed to mean. Some data is encrypted while the rest isn't? Who knows.

So Rewind.io was installed on your Mac after your Metamask wallet. The wallet is older. Did you make any outgoing transactions from your wallet during the time that Rewind.io was installed? More precisely, did you make any outgoing transactions prior to the 26 ETH one that you moved to Kraken?

[kingjudas]

If the OP doesn't know how it happened he's at risk of it happening twice. It's process by elimination so a malware program's needed. OP didn't prove it's his cryptocurrencies so it isn't easy accepting what he's saying but I'm feeling sad if he's lost $165k.

Problem is also that is not going to be easy to determine if your device is clean or infected with something malicious.

I don't know how to prove that I own that wallet or that I lost the funds. However I did receive a voicemail from law enforcement today, I am certain I will be speaking with them tomorrow. So not sure how much more I should share. However I'd be glad to prove it's my wallet.

[arabspaceship123]

You've said you've lost 88 ETH $165k from the address you own 0xbed5681AB526863c4CCee75e394db537A75DA761. Etherscan's added Fake_Phishing185501 warnings about the receiving address. If you're holding private keys you should sign a message Signing a Message on Ethereum or else we can't know if you're telling the truth.

I don't know how to prove that I own that wallet or that I lost the funds. However I did receive a voicemail from law enforcement today, I am certain I will be speaking with them tomorrow. So not sure how much more I should share. However I'd be glad to prove it's my wallet.

Earlier today, I had a significant deposit of ETH enter my digital wallet. Barely 8 minutes later, it was gone. The transaction ID? 0x094f01f9174845200e6324bf18a242e0b19ce7f058a4cb928144d22df8313bcc. Destination? A new wallet, 0x4b9e0ddabad6dff604db3d827f5fa7e1c6952aa8.

[coin-investor]

If the OP doesn't know how it happened he's at risk of it happening twice. It's process by elimination so a malware program's needed. OP didn't prove it's his cryptocurrencies so it isn't easy accepting what he's saying but I'm feeling sad if he's lost $165k.

Problem is also that is not going to be easy to determine if your device is clean or infected with something malicious.

I don't know how to prove that I own that wallet or that I lost the funds. However I did receive a voicemail from law enforcement today, I am certain I will be speaking with them tomorrow. So not sure how much more I should share. However I'd be glad to prove it's my wallet.

It's good to know that you are moving forward, You will need a lawyer who knows about cybersecurity to help you with your case, I'm sure the funds from that wallet will move so can get ready to have communication with exchanges if ever hacker moves it to these exchanges.
Checking the address it is now marked as phishing.

[khaled0111]

If you're holding private keys you should sign a message Signing a Message on Ethereum or else we can't know if you're telling the truth.

Honestly, I don't see any reason why he needs to do that. There is no reason to doubt his story, so far. It's not like he came up with this story to ask for donations or anything like that. He just want help to figure out what happened.

OP, I see that you reported the address to etherscan.io and posted a comment there. Be careful of those who replied to you pretending they can help you recover your lost money. They are scammers, do not trust them!

[dansus021]

damn I know a similar case like this it happen to my brother wallet, so the story was one of my brother's friend sent him around ~0.3 Eth but after receiving it took a couple of hours for that money transferred from my brother wallet to scammer wallet.

and then I ask him about the current private key but he told me never shared the private key and never approved any smart contract but the money is long gone

[kingjudas]

If you're holding private keys you should sign a message Signing a Message on Ethereum or else we can't know if you're telling the truth.

Honestly, I don't see any reason why he needs to do that. There is no reason to doubt his story, so far. It's not like he came up with this story to ask for donations or anything like that. He just want help to figure out what happened.

OP, I see that you reported the address to etherscan.io and posted a comment there. Be careful of those who replied to you pretending they can help you recover your lost money. They are scammers, do not trust them!

Thank you for the advice about signing a message to verify my ownership. However, as khaled0111 pointed out, the intent of my post was not to ask for donations or mislead anyone, but to understand what happened and seek help. That said, in an effort to address any lingering doubts, I have followed the advice and signed a message which you can find here: https://etherscan.io/verifySig/22663.

I'm well aware of the various scams circulating and want to reassure everyone that I'm approaching this with a high degree of caution.

I sincerely appreciate the support and guidance from this community during this incredibly stressful and challenging time