DiThi (OP)
Full Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif) ![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 156
Merit: 100
Firstbits: 1dithi
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 11, 2012, 07:19:37 PM Last edit: December 13, 2012, 09:58:51 PM by DiThi |
|
Someone has logged in from the ip 186.145.27.170 and sent all my coins (76.10 BTC) to 14nKZU5S2BkLXStnmuF9hcaWMZyyUBc4ea. Also requested to buy 44.6 BTC from user miernik (I doubt it's him, I've dealt with him before, has a lot of reviews and it would be silly). I'm from Spain and the ip is from Bogotá, Columbia. I don't know anybody there. I don't use the password anywhere else (>30 characters), I don't use the account from another PC and I use Linux since 2001, so I know my stuff. I suspect the site has a security hole. Please help. It's not a lot of money but it's all I have... http://www.reddit.com/r/Bitcoin/comments/14ofz5/bitcoins_stolen_from_bitcoinde/edit: Also someone accesed from 190.19.179.211 (Argentina, it seems) edit 2: I just noticed the password is saved in my phone's browser. Guys, never do that. Also, I think someone in the Spanish translation of MIUI is probably the thief. edit 3: I overreacted in the MIUI.es forums, but I realized there are too many attack vectors in my phone and I don't have proof. Also, I disabled Flash as it's the software I haven't kept updated in my PC.
|
1DiThiTXZpNmmoGF2dTfSku3EWGsWHCjwt
|
|
|
casascius
Mike Caldwell
VIP
Legendary
Offline
Activity: 1386
Merit: 1140
The Casascius 1oz 10BTC Silver Round (w/ Gold B)
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 11, 2012, 08:01:50 PM |
|
Sorry to hear of your loss.
Thus far, I have never heard of anyone who stored their bitcoins on a paper wallet and had them stolen. Please use paper wallets.
|
Companies claiming they got hacked and lost your coins sounds like fraud so perfect it could be called fashionable. I never believe them. If I ever experience the misfortune of a real intrusion, I declare I have been honest about the way I have managed the keys in Casascius Coins. I maintain no ability to recover or reproduce the keys, not even under limitless duress or total intrusion. Remember that trusting strangers with your coins without any recourse is, as a matter of principle, not a best practice. Don't keep coins online. Use paper or hardware wallets instead.
|
|
|
Stephen Gornick
Legendary
Offline
Activity: 2506
Merit: 1010
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 11, 2012, 08:03:58 PM |
|
It's soo easy to use free password encryption software on your pc or phone (like keepass for example)..
That still doesn't protect against a replay attack. Someone has logged in from the ip 186.145.27.170 and sent all my coins Yup, a lot of that going on. MtGox account got cleared out - http://bitcointalk.org/index.php?topic=85533.0All BTC disappeared from my Mt. Gox account - http://bitcointalk.org/index.php?topic=88368.0Another: - http://bitcointalk.org/index.php?topic=80562.msg941759#msg941759And another: My mtgox account got compromised, what can I do? - http://bitcointalk.org/index.php?topic=84585.0Yet more: MT.Gox account hacked - lost 2k USD - MT.GOX will not explain how. - http://bitcointalk.org/index.php?topic=89142.0And more again: Bitcoins stolen from MtGox - http://www.reddit.com/r/Bitcoin/comments/x8lcv/bitcoins_stolen_from_mtgoxAnd yet more: Stolen from Mt.Gox coins. Help return the coins. - http://bitcointalk.org/index.php?topic=119816.0Or more here: Email from Mt.Gox this morning. - http://www.reddit.com/r/Bitcoin/comments/z0na5/email_from_mtgox_this_morningAnd even more here: I just had $715 stolen out of my Mt. Gox account. - http://www.reddit.com/r/Bitcoin/comments/12j9gi/i_just_had_715_stolen_out_of_my_mt_gox_accountAnd the biggie: Bitcoinica MtGox account compromised - http://bitcointalk.org/index.php?topic=93074.0With more here: Unauthorized Account Activity on my Mt.Gox Account - Account Compromised/Hacked? - http://bitcointalk.org/index.php?topic=94140.0And on other services as well. Here same thing happened to some GLBSE users: - http://bitcointalk.org/index.php?topic=84893.0And elsewhere, BitMarket.eu in this instance: - http://bitcointalk.org/index.php?topic=5441.msg1259168#msg1259168And now on bitcoin.de as well: Bitcoins stolen from bitcoin.de. - http://bitcointalk.org/index.php?topic=130264.0In none of these was the person using multi-factor authentication. Mt. Gox has had Yubikey support for a while. Mt. Gox accounts now support Google Authenticator: - https://mtgox.com/press_release_20120605.htmlIf the exchange you are storing funds with doesn't provide OTP, consider using a different exchange: - http://bitcoin.stackexchange.com/questions/4113/which-two-factor-authentication-methods-are-available-at-which-exchangesIf you are storing funds in an EWallet, consider using a paper wallet. Here is a fantastic guide: How to use 2-factor auth on mtgox, even without a smartphone (from a second device, of course, not from the same computer you log in on). - http://bitcointalk.org/index.php?topic=111943.0
|
|
|
|
|
DiThi (OP)
Full Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif) ![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 156
Merit: 100
Firstbits: 1dithi
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 11, 2012, 08:53:20 PM |
|
That's the only plausible explanation, other than this hole in flash.
|
1DiThiTXZpNmmoGF2dTfSku3EWGsWHCjwt
|
|
|
paraipan
In memoriam
Legendary
Offline
Activity: 924
Merit: 1004
Firstbits: 1pirata
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 11, 2012, 08:55:43 PM |
|
That's the only plausible explanation, other than this hole in flash. Please remove the accusation form OP and reddit
|
BTCitcoin: An Idea Worth Saving - Q&A with bitcoins on rugatu.com - Check my rep
|
|
|
DiThi (OP)
Full Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif) ![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 156
Merit: 100
Firstbits: 1dithi
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 11, 2012, 09:08:39 PM |
|
How you can be so sure that it wasn't a MIUI "cooker"?
|
1DiThiTXZpNmmoGF2dTfSku3EWGsWHCjwt
|
|
|
paraipan
In memoriam
Legendary
Offline
Activity: 924
Merit: 1004
Firstbits: 1pirata
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 11, 2012, 09:12:38 PM |
|
How you can be so sure that it wasn't a MIUI "cooker"?
I was asking you the same question but you didn't answer, how can you acuse a ROM "cooker" to be person that robbed you? You have any proof to back that up? You now say maybe is a Flash issue and continue to have the accusation posted. I don't understand what you're trying to achieve here.
|
BTCitcoin: An Idea Worth Saving - Q&A with bitcoins on rugatu.com - Check my rep
|
|
|
DiThi (OP)
Full Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif) ![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 156
Merit: 100
Firstbits: 1dithi
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 11, 2012, 09:17:29 PM |
|
I don't care if no one believe me, that's my opinion after all. For me is just enough proof to never trust a custom build for something so big (as an entire OS) from a little known source.
|
1DiThiTXZpNmmoGF2dTfSku3EWGsWHCjwt
|
|
|
paraipan
In memoriam
Legendary
Offline
Activity: 924
Merit: 1004
Firstbits: 1pirata
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 11, 2012, 09:20:55 PM |
|
I don't care if no one believe me, that's my opinion after all. For me is just enough proof to never trust a custom build for something so big (as an entire OS) from a little known source.
You keep stirring the shit and avoid answering my question. Again, how did you linked the "robbery" from bitcoin.de and password saving with the Spanish MIUI community?
|
BTCitcoin: An Idea Worth Saving - Q&A with bitcoins on rugatu.com - Check my rep
|
|
|
DiThi (OP)
Full Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif) ![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 156
Merit: 100
Firstbits: 1dithi
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 11, 2012, 09:30:08 PM |
|
- It's the weakest point in all my security. I'm basically trusting all MIUI (and MIUI.es) devs.
- Spanish MIUI users are much fewer than the rest.
- All strange IPs came from spanish speaking countries.
|
1DiThiTXZpNmmoGF2dTfSku3EWGsWHCjwt
|
|
|
paraipan
In memoriam
Legendary
Offline
Activity: 924
Merit: 1004
Firstbits: 1pirata
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 11, 2012, 09:40:12 PM |
|
- It's the weakest point in all my security. I'm basically trusting all MIUI (and MIUI.es) devs.
- Spanish MIUI users are much fewer than the rest.
- All strange IPs came from spanish speaking countries.
So based on your assumption that you did nothing wrong, bitcoin.de owners haven't either and you have the best guarded password in the world the only weak link was your mobile phone, hence the Spanish MIUI dev community. Basically you started throwing shit at whoever you had closer. Now it comes, why did you kept almost 800 EUR on an exchange that doesn't even provide 2fa auth? Your edit on reddit and 15 years working in network security tell me that you know what it is and how it works, so how did you left so much money in there knowing from the beginning it was only guarded by a simple password? Do you have any screenshoots of your bitcoin.de account history?
|
BTCitcoin: An Idea Worth Saving - Q&A with bitcoins on rugatu.com - Check my rep
|
|
|
DiThi (OP)
Full Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif) ![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 156
Merit: 100
Firstbits: 1dithi
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 11, 2012, 09:55:54 PM |
|
I don't "keep" them, I'm trading all the time, I send bitcoins there because I want to sell them (duh!). You should not worry about MIUI reputation, bitcoin.de is the culprit for not having two-factor. https://i.imgur.com/HWniq.pnghttps://i.imgur.com/RmauP.png
|
1DiThiTXZpNmmoGF2dTfSku3EWGsWHCjwt
|
|
|
paraipan
In memoriam
Legendary
Offline
Activity: 924
Merit: 1004
Firstbits: 1pirata
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 11, 2012, 10:19:39 PM |
|
I hope this serves you as a lesson and never leave the bitcoins on the same exchange you bought them.
|
BTCitcoin: An Idea Worth Saving - Q&A with bitcoins on rugatu.com - Check my rep
|
|
|
DiThi (OP)
Full Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif) ![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 156
Merit: 100
Firstbits: 1dithi
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 11, 2012, 10:23:44 PM |
|
I didn't bought them there.
|
1DiThiTXZpNmmoGF2dTfSku3EWGsWHCjwt
|
|
|
paraipan
In memoriam
Legendary
Offline
Activity: 924
Merit: 1004
Firstbits: 1pirata
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 11, 2012, 10:39:34 PM Last edit: December 12, 2012, 01:49:12 AM by paraipan |
|
I didn't bought them there.
Worse, please don't tell you bought them on an exchange that had 2fa auth and you send them for safe keeping on bitcoin.de
|
BTCitcoin: An Idea Worth Saving - Q&A with bitcoins on rugatu.com - Check my rep
|
|
|
DiThi (OP)
Full Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif) ![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 156
Merit: 100
Firstbits: 1dithi
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 12, 2012, 12:27:06 AM |
|
Please stop it. I already said I sent them there to sell them, not for "safe keeping".
|
1DiThiTXZpNmmoGF2dTfSku3EWGsWHCjwt
|
|
|
paraipan
In memoriam
Legendary
Offline
Activity: 924
Merit: 1004
Firstbits: 1pirata
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 13, 2012, 09:02:49 PM |
|
Please stop it. I already said I sent them there to sell them, not for "safe keeping".
Ok, I understand, please remove the baseless accusation from the OP
|
BTCitcoin: An Idea Worth Saving - Q&A with bitcoins on rugatu.com - Check my rep
|
|
|
|