Help! Account Hacked

[Kapz]

Hi Guys,

My account was hacked and im trying to recover it.

I have followed the steps in this thread: https://bitcointalk.org/index.php?topic=497545.0

and tried to get in touch with theymos but he doesn't reply.

Anyone know another admin or someone that can help me?

I can verify everything with signature etc

[OmegaStarScream]

When you contacted him ? It may take sometime he isn't available 24/7 .
Post here a signed message (so we verify it) with an old adress you used and link us to Unedited post where you used that adress  , Pretty sure that once BadBear or Theymos see the thread , you will get your account back . (they check often Meta i guess)

[Kapz]

I contacted him twice a couple of days ago no response but noticed he has been active - must just be really busy

I wont include email address here to reset to for security reasons.


-----BEGIN BITCOIN SIGNED MESSAGE (DONT INCLUDE THIS PART IN MESSAGE) -----

My account Kapz786 has been hacked. The current date is 10th July 2015

My BTC address is 18JGHZdn8D7NthJxjHcWQkENwcJ5NJEfdF it appears in multiple threads linked to the account Kapz786.

-----END BITCOIN SIGNED MESSAGE-----


-----BEGIN SIGNATURE-----

H06sc+xfnrq+QvrSXmLROTb4ES4kBydl3PyCn/nPKQ6rBFyGkL9MEf80ZXizqg5sfDjHBxXKs3uOOuwgE/JXtV4=

-----END SIGNATURE-----



My BTC address is 18JGHZdn8D7NthJxjHcWQkENwcJ5NJEfdF


Here is the unedited posts where I posted that address:

https://bitcointalk.org/index.php?topic=432705.msg4753086#msg4753086

OR

https://bitcointalk.org/index.php?topic=498314.msg5674982#msg5674982

[EcuaMobi]

The signature was verified (by removing some spacing).
I've left a negative trust on the account until you confirm you recovered it or the current owner proves he actually bought it.

You should include at lest a temporary email address you control to make the recovery process easier.

[OmegaStarScream]

I contacted him twice a couple of days ago no response but noticed he has been active - must just be really busy

I wont include email address here to reset to for security reasons.


-----BEGIN BITCOIN SIGNED MESSAGE (DONT INCLUDE THIS PART IN MESSAGE) -----

My account Kapz786 has been hacked. The current date is 10th July 2015

My BTC address is 18JGHZdn8D7NthJxjHcWQkENwcJ5NJEfdF it appears in multiple threads linked to the account Kapz786.

-----END BITCOIN SIGNED MESSAGE-----


-----BEGIN SIGNATURE-----

H06sc+xfnrq+QvrSXmLROTb4ES4kBydl3PyCn/nPKQ6rBFyGkL9MEf80ZXizqg5sfDjHBxXKs3uOOuwgE/JXtV4=

-----END SIGNATURE-----



My BTC address is 18JGHZdn8D7NthJxjHcWQkENwcJ5NJEfdF


Here is the unedited posts where I posted that address:

https://bitcointalk.org/index.php?topic=432705.msg4753086#msg4753086

OR

https://bitcointalk.org/index.php?topic=498314.msg5674982#msg5674982

Verified using Bitcoin COre , now just wait for Theymos or BadBear I guess .

[KWH]

This account was marked as possibly sold. Are you the new owner or the old one trying to take it back?

[Quickseller]

It looks like the last time the account was active prior to the forum hack was April 24, 2015, then the forum got hacked on May 21, 2015, then the account was active again on June 4, 2015.

Unfortunately the password log (the public one) does not go back that far, however there are three recent password changes ~2 weeks ago, one on June 27, one on June 28 and one on June 29, 2015. The first post since the June 4 post was after the last password change on June 29. I would conclude this to mean that the first password change was someone changing the password and giving it to an escrow, the second one was the escrow changing the password again and providing it to the buyer, and the June 29 password change was the buyer changing it from what the escrow provided to his own password.

If the account was really hacked or not is anyone's guess, although the presence of a signed message that the buyer has should be proof that the owner was the one who sold it. Unfortunately many people do not know to ask for a signed message, so even if it was the owner who sold the account, there may not be a signed message confirming the trade.

[jambola2]

It looks like the last time the account was active prior to the forum hack was April 24, 2015, then the forum got hacked on May 21, 2015, then the account was active again on June 4, 2015.

Unfortunately the password log (the public one) does not go back that far, however there are three recent password changes ~2 weeks ago, one on June 27, one on June 28 and one on June 29, 2015. The first post since the June 4 post was after the last password change on June 29. I would conclude this to mean that the first password change was someone changing the password and giving it to an escrow, the second one was the escrow changing the password again and providing it to the buyer, and the June 29 password change was the buyer changing it from what the escrow provided to his own password.

If the account was really hacked or not is anyone's guess, although the presence of a signed message that the buyer has should be proof that the owner was the one who sold it. Unfortunately many people do not know to ask for a signed message, so even if it was the owner who sold the account, there may not be a signed message confirming the trade.

Hmm, have you seen any precedent to this?
Do the admins support someone who can prove that they have bought the account over someone who can prove that they originally owned the account?
I know that they are okay with account transfers, but I don't know to what extent they enforce account transfers.
Do you have any experience with admins stepping in and helping an account buyer over the original account owner?

[KWH]

It looks like the last time the account was active prior to the forum hack was April 24, 2015, then the forum got hacked on May 21, 2015, then the account was active again on June 4, 2015.

Unfortunately the password log (the public one) does not go back that far, however there are three recent password changes ~2 weeks ago, one on June 27, one on June 28 and one on June 29, 2015. The first post since the June 4 post was after the last password change on June 29. I would conclude this to mean that the first password change was someone changing the password and giving it to an escrow, the second one was the escrow changing the password again and providing it to the buyer, and the June 29 password change was the buyer changing it from what the escrow provided to his own password.

If the account was really hacked or not is anyone's guess, although the presence of a signed message that the buyer has should be proof that the owner was the one who sold it. Unfortunately many people do not know to ask for a signed message, so even if it was the owner who sold the account, there may not be a signed message confirming the trade.

Hmm, have you seen any precedent to this?
Do the admins support someone who can prove that they have bought the account over someone who can prove that they originally owned the account?
I know that they are okay with account transfers, but I don't know to what extent they enforce account transfers.
Do you have any experience with admins stepping in and helping an account buyer over the original account owner?

I would assume that the escrow could step in for clarification if one was used. Other than that, PM's may be used as proof unless they were deleted.

[Quickseller]

It looks like the last time the account was active prior to the forum hack was April 24, 2015, then the forum got hacked on May 21, 2015, then the account was active again on June 4, 2015.

Unfortunately the password log (the public one) does not go back that far, however there are three recent password changes ~2 weeks ago, one on June 27, one on June 28 and one on June 29, 2015. The first post since the June 4 post was after the last password change on June 29. I would conclude this to mean that the first password change was someone changing the password and giving it to an escrow, the second one was the escrow changing the password again and providing it to the buyer, and the June 29 password change was the buyer changing it from what the escrow provided to his own password.

If the account was really hacked or not is anyone's guess, although the presence of a signed message that the buyer has should be proof that the owner was the one who sold it. Unfortunately many people do not know to ask for a signed message, so even if it was the owner who sold the account, there may not be a signed message confirming the trade.

Hmm, have you seen any precedent to this?
Do the admins support someone who can prove that they have bought the account over someone who can prove that they originally owned the account?
I know that they are okay with account transfers, but I don't know to what extent they enforce account transfers.
Do you have any experience with admins stepping in and helping an account buyer over the original account owner?

There have been several instances where people have claimed their account was hacked, provided proof they at one point owned the account and then their account was not recovered. BadBear/theymos generally do not disclose the reasons why they do not recover accounts, however I suspect one reason would be that there is evidence that it was sold.

The reason why the buyer should get a signed message is because even if the account is not hacked, the owner would possibly be able make it appear that it was hacked in the eyes of BadBear/theymos

[BadBear]

Hmm, have you seen any precedent to this?
Do the admins support someone who can prove that they have bought the account over someone who can prove that they originally owned the account?
I know that they are okay with account transfers, but I don't know to what extent they enforce account transfers.
Do you have any experience with admins stepping in and helping an account buyer over the original account owner?

I think that the account was hacked, though this can never be known for certain.

The IP that posted the loan request from yussuf89's account also posted this:
https://bitcointalk.org/index.php?topic=960603.0
Someone with the same IP was trying to sell another account here, presumably hacked:
https://bitcointalk.org/index.php?topic=925024.0

yussuf89's password wasn't changed/reset recently except for when marcotheminer did it, so the attacker must have somehow gotten his password. Keylogger or phishing, maybe.

Zeki's IP matches yussuf89.

Since ownership of the account is contested, I'm thinking that I should not restore the account and let people give trust ratings depending on what happens. For example, if marcotheminer needs to eat the entire cost of this when he's mostly not at fault, some people might want to give yussuf89 negative feedback.

Me? I'm not solidly in any camp, there are good arguments to be made all around.

[Kapz]

This account was marked as possibly sold. Are you the new owner or the old one trying to take it back?

I never sold the account, I'd be very surprised if you could find a thread etc of me trying to sell it prior to the password change.

It was most likely hacked and sold. I hope this information is enough. Haven't heard from an admin yet.

[Kapz]

Hmm, have you seen any precedent to this?
Do the admins support someone who can prove that they have bought the account over someone who can prove that they originally owned the account?
I know that they are okay with account transfers, but I don't know to what extent they enforce account transfers.
Do you have any experience with admins stepping in and helping an account buyer over the original account owner?

I think that the account was hacked, though this can never be known for certain.

The IP that posted the loan request from yussuf89's account also posted this:
https://bitcointalk.org/index.php?topic=960603.0
Someone with the same IP was trying to sell another account here, presumably hacked:
https://bitcointalk.org/index.php?topic=925024.0

yussuf89's password wasn't changed/reset recently except for when marcotheminer did it, so the attacker must have somehow gotten his password. Keylogger or phishing, maybe.

Zeki's IP matches yussuf89.

Since ownership of the account is contested, I'm thinking that I should not restore the account and let people give trust ratings depending on what happens. For example, if marcotheminer needs to eat the entire cost of this when he's mostly not at fault, some people might want to give yussuf89 negative feedback.

Me? I'm not solidly in any camp, there are good arguments to be made all around.

BadBear are you able to help me with this?

[Kapz786]

Hi, I am very sorry for what has happened. But this is the true story and you have to believe me, I will gather further evidence including my private messages and posts on thread with the seller later. So about 2 weeks ago, I saw a thread in the digital goods section selling a senior account by the name of sellingbtctalk. So I contacted him because I was interested, and he did not provide me any signed messages, I wasn't very experienced in how btc account really worked so I bought it anyways. I gave him everything I had in my 2 wallets. I did not realize this account was hacked, so I started joining campaigns and posting on this forum. You guys have to believe me, I will provide evidence for you to believe me. But this seller often sells btctalk accounts on this forum. Please understand me guys, that's all I'm asking from you.  
Here was his thread I saw, and got the account from: https://bitcointalk.org/index.php?topic=1101362.msg11724697#msg11724697

[Kapz]

Hi, I am very sorry for what has happened. But this is the true story and you have to believe me, I will gather further evidence including my private messages and posts on thread with the seller later. So about 2 weeks ago, I saw a thread in the digital goods section selling a senior account by the name of sellingbtctalk. So I contacted him because I was interested, and he did not provide me any signed messages, I wasn't very experienced in how btc account really worked so I bought it anyways. I gave him everything I had in my 2 wallets. I did not realize this account was hacked, so I started joining campaigns and posting on this forum. You guys have to believe me, I will provide evidence for you to believe me. But this seller often sells btctalk accounts on this forum. Please understand me guys, that's all I'm asking from you.  
Here was his thread I saw, and got the account from: https://bitcointalk.org/index.php?topic=1101362.msg11724697#msg11724697

That's a great story - now when can I get my HACKED account back from this thief

The guy you bought the account of joined 2 months ago and his ONLY posts are in regards to the sale of BTCTalk accounts. Pretty obvious to me.

[intrader]

Wonder how they hacked bitcointalk users account,any security tips?

[teddy5145]

Wonder how they hacked bitcointalk users account,any security tips?

Few months back this forum was attacked by hackers, and they managed to get some of the users password
at time Theymos recommend the users to change their password to something more stronger

Security tips?
Use strong password and change your password just in case this forum is hacked again

[intrader]

Wonder how they hacked bitcointalk users account,any security tips?

Few months back this forum was attacked by hackers, and they managed to get some of the users password
at time Theymos recommend the users to change their password to something more stronger

Security tips?
Use strong password and change your password just in case this forum is hacked again

I see,thanks

[Kapz786]

I just realized I haven't posted on the thread the buyer listed in the digital goods section when I saw it. But here is an conversation after he handed me the account and I haven't paid yet. There is more PM he sent me in my actual btc talk account, but I decide to protect that one. Here is picture proof when I actually bought the account from this person and did not hack it. http://postimg.org/image/omt1kgthn/
I didn't pay him everything at once, that's why you can see, he says waiting for the 0.05 btc tonight, that's only the first part of the payment.
Hope this is enough proof for this account. As you even said, the posts Kapz786 was doing before I purchased it, was all on selling this account, so. Hope you can understand me

[EcuaMobi]

I just realized I haven't posted on the thread the buyer listed in the digital goods section when I saw it. But here is an conversation after he handed me the account and I haven't paid yet. There is more PM he sent me in my actual btc talk account, but I decide to protect that one. Here is picture proof when I actually bought the account from this person and did not hack it. http://postimg.org/image/omt1kgthn/
I didn't pay him everything at once, that's why you can see, he says waiting for the 0.05 btc tonight, that's only the first part of the payment.
Hope this is enough proof for this account. As you even said, the posts Kapz786 was doing before I purchased it, was all on selling this account, so. Hope you can understand me

So you confirm you believe this account was stolen? Even if this wasn't hacked by you but by someone else if it was stolen then you shouldn't have it. I wish sellingbtctalk posted too, the fact he doesn't seems to confirm this version.

However one possibility could be that OP sold his account himself and is now trying to recover it. I guess we'll never know, people should really not buy accounts without a signed message as proof of ownership.

OP do you have any idea how your account was hacked? Did it have a very weak password? Do you suspect you got malware?
Clint how much did you pay for the account in total? 0.15BTC as initially asked? Can you post the TX ids?