I've just been robbed :-(

[Cdecker]

Well, just to prove that even long time members are not secure from being stupid. My wallet has just been cleared out:

• http://blockchain.info/tx-index/27883052/6f85951bcecbe64999ad192275af087c5be2922ee13937693992c1ddf9ae8ce6
• http://blockchain.info/tx-index/27883028/8e6a2d0b8132d3d9edc1fcffe1b3079de59c10c67522e2abc51c1d84b260fdac

At first I thought maybe it's just an old transaction that has only now been submitted, but I can't find any wallet of mine that owns those keys.

I had my wallet encrypted, but this was apparently an old backup of my wallet that I must have stored somewhere.

Any tips on what to do next? I'm still a bit fuzzy about the details. Can we blacklist those funds somehow?

[1714323131]

1714323131

[1714323131]

1714323131

[1714323131]

1714323131

[1714323131]

1714323131

[1714323131]

1714323131

[eb3full]

You're pretty much screwed. :\

[Cdecker]

You're pretty much screwed. :\

Yep, that much I knew already.

[augustocroppo]

Any tips on what to do next? I'm still a bit fuzzy about the details. Can we blacklist those funds somehow?

Before any further steps to investigate the transactions, you have to prove that you owned the stolen funds.

[wachtwoord]

I feel bad for you

[Severian]

That sucks, bro.

If it's any consolation (probably not), I heard a story on this forum once about a guy that formatted a drive with tens of thousands of coins on it. He said the worst part was his wife knowing about it.

[Cdecker]

Before any further steps to investigate the transactions, you have to prove that you owned the stolen funds.

Well that shouldn't be too hard, I can sign a message with the private key belonging to one of the addresses. But I don't see that doing any good.

[Spekulatius]

Is this incident somehow related to this?:

Well I was wondering how long it would take for people to notice. It's me

And no I am not putting lots of hashing power to the network, notice that it just says "relayed by" and not "mined by". I'm performing some measurements, paper is due in a few weeks.

[BC12345]

It might just be a coincidence and will not improve your situation, but there was a discussion today

https://bitcointalk.org/index.php?topic=113654.40

and then someone found this

http://82.130.102.160/

Probably because of the name "BitThief", people started speculating over the purpose of this program so I posted a link to your members page at the ethz to point out that this program is not related to bitcoins. A few minutes later I replaced the link with the following

http://bitthief.ethz.ch/

This happened about an hour before the transaction of your funds. As I said before, this might be a coincidence but I am really sorry if I have drawn attention to you and your funds.

[flatfly]

Is your computer infected? Did you notice anything unusual?  Did you run a full AV scan?

[jgarzik]

Any tips on what to do next? I'm still a bit fuzzy about the details. Can we blacklist those funds somehow?

Figure out how it happened, gather details, file a police and FBI cybercrimes report.

Make sure the method of theft is not still open.

[apetersson]

was there any connection with the university IP and the wallet?

[caffeinewriter]

It might just be a coincidence and will not improve your situation, but there was a discussion today

https://bitcointalk.org/index.php?topic=113654.40

and then someone found this

http://82.130.102.160/

Probably because of the name "BitThief", people started speculating over the purpose of this program so I posted a link to your members page at the ethz to point out that this programm is not related to bitcoins. A few minutes later I replaced the link with the following

http://bitthief.ethz.ch/

This happened about an hour before the transaction of your funds. As I said before, this might be a coincidence but I am really sorry if I have drawn attention to you and your funds.

Downloaded, ran in a sandbox, no processes spawned except for BitThief itself, which is a purely leeching torrent client. Stupid and pointless, but not a wallet stealer. Running in ANUBIS to see if I missed something locally.

And here's something to cheer you up.

UPDATE:

Yeah, BitThief does jack shit with bitcoins. The only similarity it shares is that it's P2P

[Atlas]

Cry, OP. Just let it all out.

You're not getting a dime back. The FBI won't care.

[markm]

An old backup you stored somewhere?

What does that actually mean?

You gave the staff of some remote file storage site a free unencrypted copy of your wallet yet are surprised they took the coins?

Or what?

-MarkM-

[Gyrsur]

if you have a copy of your unencrypted wallet.dat somewhere and you encrypt it LATER all your private keys are UNSECURED which you had in the wallet until the encryption task happened.

[420]

if you have a copy of your unencrypted wallet.dat somewhere and you encrypt it LATER all your private keys are UNSECURED which you had in the wallet until the encryption task happened.

Would be great to hear him confirm this was the case that he had all that before encryption

[kokojie]

So, you stored your wallet in plaintext at somewhere other people may be able to access, and surprised someone robbed you?

[Gyrsur]

if you have a copy of your unencrypted wallet.dat somewhere and you encrypt it LATER all your private keys are UNSECURED which you had in the wallet until the encryption task happened.

Would be great to hear him confirm this was the case that he had all that before encryption

it doesn't matter how many coins you have, ALL your coins are unsecured which you receive with this private key(s) also the coins you might receive in the future!

[Cdecker]

Nevermind the other Thread, as I already explained it's part of my research, I myself am 82.130.102.160, and yes we developed BitThief, so that's not it.

I think showing up on blockchain.info actually put a huge target on my back. I see a few connection to my notebook from Russian domains and the big surprise: they are able to log in...
They must have somehow gotten my password or

[...few minutes later ...]

sorry had to kill the network connection, whoever it was they were still logged in on my machine...