JUST HAD 0.92329 BTC STOLEN - HOW???

[amiryaqot]

I just deposited the above amount to one of electrum wallets. Almost immediately the balance was tramsferred to:

13GrQ46YQ3x3fp1p5eHrPKSsMaxjDY9VwC

tx: https://blockchain.info/tx/c92f9c265f0a7a9b7fec9184a0314545f8d3f2b3d6d53c240eec97a087826a00

Noth of the transaction have any confirmations, it just happen immediately. How is this possible and how can I get my funds back??? I cannot understand how this is possible. FML

My address:

https://blockchain.info/address/15WapDB1AsoKKp4vMTims836Jxn9mJdHJA


Help!!! 

Almost immediately? 

Yes, I have seen the two bitcoin transaction:

- https://blockchain.info/it/tx/5cc872a7dc9bebb03290e9d537d57eba51056e764483a4f4ef4f6bc2bac66e0f  (his transfer to the electrum wallet)     
2015-05-02 10:24:40

- https://blockchain.info/it/tx/c92f9c265f0a7a9b7fec9184a0314545f8d3f2b3d6d53c240eec97a087826a00  (the second tx into the hacker address)   
2015-05-02 10:25:41


~ 1 minuted between the two transaction.

yes that is very strange to see this kind of transaction, sorry to see this one,  
how this hacker was quick in this transaction just delay of 1 minute ?

[1713936723]

1713936723

[1713936723]

1713936723

[bennybong]

Can't find any evidence of an infection. I use VPN on my VM, can't figure this out  

[shadobitz]

Could something be wrong with Electrum?

It's doubtful. It's quite common for hackers to immediately sweep funds out of addressess. This happens very often with weak brainwallets, once the funds are transferred in they are drained within seconds. I suspect the OP may have imported the address into electrum, or may have restored his wallet using a weak seed or such.

i think so really socking to see this one, another transaction made within few seconds..

[bennybong]

I've had much more btc in that wallet in the past. And I only fire up my VM to check my electrum which isn't that often. WHY ME AND why now. This is bullshit!

[redsn0w]

....
yes that is very strange to see this kind of transaction, sorry to see this one,  
how this hacker was quick in this transaction just delay of 1 minute ?

I do not know, it is really strange.

I've had much more btc in that wallet in the past. And I only fire up my VM to check my electrum which isn't that often. WHY ME AND why now. This is bullshit!

Have you downloaded something of strange in the past days/weeks?

[Light]

Can't find any evidence of an infection. I use VPN on my VM, can't figure this out  

What AV software are you using if I may ask? Have you used this specific Electrum wallet before (or any other addresses from the same seed)? Did you access the wallet before the funds were stolen - or were they just taken immediately after an initial deposit?

A VPN wouldn't really help you in terms of security for this kind of thing - more useful for privacy and anonymity.

[Kprawn]

It's too weird to be explained... It's as if it was a automated action. There is about a 1 minute delay between the 2 transactions.

What is the chances of someone sitting and waiting for you to make transactions to steal it immediately?

It's also a single use address... and it would most probably be mixed too.. so you stuffed, if it was not a electrum screw up.  

[S4VV4S]

Sorry to ask but I only use Bitcoin Core.

Is Electrum like Brainwallet?

Because if it is then you should know that there is people constantly running brute force apps and waiting for a transaction to take place, then snatch the coins to their own wallet.

There was a post about this someweher in the forums.

Search for Brainwalet hacking and you will find it.

[roslinpl]

I've had much more btc in that wallet in the past. And I only fire up my VM to check my electrum which isn't that often. WHY ME AND why now. This is bullshit!

There must be a reason why this happens.

I don't know why you and why now, but for some reason your machine was compromised and it's perhaps your fault of not keeping your security at high level.


I am really sorry for your lost. But there is nothing you can do now. But what you need to do is:

-format the drives from the machine where your Electrum was installed and coins were stolen.
-use high standard antimalware, antivirus apps.
-never open suspicious links
-follow other security steps to keep your bitcoins safe.

Also you can keep an eye on 13GrQ46YQ3x3fp1p5eHrPKSsMaxjDY9VwC - only a little chance that you will be able to track those coins but worth a try.

Best regards.

[boopy265420]

It's too weird to be explained... It's as if it was a automated action. There is about a 1 minute delay between the 2 transactions.

What is the chances of someone sitting and waiting for you to make transactions to steal it immediately?

It's also a single use address... and it would most probably be mixed too.. so you stuffed, if it was not a electrum screw up.  

Sorry for your loss and second yeah this is very strange that all this just happened so quick as someone was waiting but this is not very big amount. This is warning for others to take some extra security measure to keep their funds save. This is good at least others will be more active in future.

[bennybong]

....
yes that is very strange to see this kind of transaction, sorry to see this one,  
how this hacker was quick in this transaction just delay of 1 minute ?

I do not know, it is really strange.

Have you downloaded something of strange in the past days/weeks?

No I download a lot of software and I know a scam/trojan link when I see one

Can't find any evidence of an infection. I use VPN on my VM, can't figure this out  

What AV software are you using if I may ask? Have you used this specific Electrum wallet before (or any other addresses from the same seed)? Did you access the wallet before the funds were stolen - or were they just taken immediately after an initial deposit?

A VPN wouldn't really help you in terms of security for this kind of thing - more useful for privacy and anonymity.

Yes I've used the same electrum wallet before but not much.


Oh and I use Avira, MS essential and Malwarebytes. I keep my Computers in order don't you worry

[dhimasnk]

this is one thing that is feared by users bitcoin, bitcoin loss caused by hackers. Hopefully there are no cases like this again

[redsn0w]

Sorry to ask but I only use Bitcoin Core.

Is Electrum like Brainwallet?

Because if it is then you should know that there is people constantly running brute force apps and waiting for a transaction to take place, then snatch the coins to their own wallet.

There was a post about this someweher in the forums.

Search for Brainwalet hacking and you will find it.

No, electrum is really different from the Brainwallet. The first one uses a seed of 12 words so it is really impossible to bruteforce it, instead the second one use only a password. I am still thinking that it was a computer problem.


OP can you explain again if you have stored the seed in some .txt file on the pc?

[bennybong]

Sorry to ask but I only use Bitcoin Core.

Is Electrum like Brainwallet?

Because if it is then you should know that there is people constantly running brute force apps and waiting for a transaction to take place, then snatch the coins to their own wallet.

There was a post about this someweher in the forums.

Search for Brainwalet hacking and you will find it.

No, electrum is really different from the Brainwallet. The first one uses a seed of 12 words so it is really impossible to bruteforce it, instead the second one use only a password. I am still thinking that it was a computer problem.


OP can you explain again if you have stored the seed in some .txt file on the pc?

I store the seed in a truecrypt vault. In the past I haven't even bothered saving the seed for security reason. I jut backup my Private keys - which are encrypted

And the password on the wallet is not used anywhere else.

[hellyeah]

I am sorry for your loss bro.

Did anyone else have access to your PC?

[Blazr]

What operating system were you running on the VM?

And what software were you using for that?

[Amph]

I've had much more btc in that wallet in the past. And I only fire up my VM to check my electrum which isn't that often. WHY ME AND why now. This is bullshit!

have you downloaded something suspicious yesterday or some time ago?, what is the last thing you downloaded?

[Remember remember the 5th of November]

A VM tries to keep bad stuff in, if the virus had infected your PC, doesn't matter if you were using a VM, however it would have to know and handle the fact that there is a VM.

[Blazr]

A VM tries to keep bad stuff in, if the virus had infected your PC, doesn't matter if you were using a VM, however it would have to know and handle the fact that there is a VM.

There can also be issues with VM's and poor entropy, it's much less secure to put your wallet in a VM in some cases. OP, what operating system did you run in the VM? and what software did you use for it?

[bennybong]

No I don't download anything suspicious. The last thing I downloaded was a new driver for my soundcard - from the official website