MtGox hacked? I am locked out of my account

[Derechef]

There is one new reason to stop using MtGox.

When I woke up on Wednesday morning there were emails from MtGox in my inbox: emails saying there had been trades on my account (I had no open orders), emails saying that there had been withdrawals, non-BTC redeemable codes deprecation notices and one last email saying that my password had been reset.

My password was very secure, I NEVER told anyone my password, I was not using this password on any other website, I have never been on a phishing website or on websites like mtgox-chat, there is no key-logger on my computer, my OS is Linux, etc.
I am quite security-aware and I never had a problem with any of my account being hacked. I also checked the activity on my Gmail account and there were no suspicious connection.
I could not understand what happened the issue is almost certainly on MtGox side.

So I tried the password recovery procedure and it was not working. I then sent an email to the support explaining everything. I also sent a message on Twitter.

I had not a single answer for two days nor could I connect to my account. These were two very painful days. This morning I finally received a message from the support saying they cannot do anything and I will not be refunded.

I am not familiar with non-BTC redeemable codes but it means the hacker is transferring some funds to an other MtGox account, right? I cannot understand why they are saying they cannot do anything. Beside the password recovery procedure is still NOT working. I still do not know if there is anything left on my account.

I had been selling Bitcoins for a couple of weeks and there were around 20,000€ and 63 bitcoins on my account. I received 6 withdrawals emails and 4 non-BTC redeemable codes deprecation notices.
According to the emails, the hacker bought 100 BTC then sold 70 BTC then bought 70 BTC. The trades were done at around 180€ per Bitcoin.
My account had a "Verified" status. Anyone know what are the withdrawal limits? I hope there is something left on my account...

Of course I sent an other message to the support but they are so slow to answer. I will keep you updated...

In the meantime be very careful with your MtGox accounts. If you do not have a Yubikey you should move your money NOW.

[1713973246]

1713973246

[1713973246]

1713973246

[shibaji]

Wow! Very sorry to hear that.

[Kluge]

GoxUSD can be redeemed in places other than Gox, and is indeed considered currency in OTC trades for PPUSD, WU, BTC, etc.

There have been no other account compromises I'm aware of in the past few days.

Did you have 2FA enabled? If so, it's likely an indication this might not be isolated. Maybe you used a service like LastPass?

[Kluge]

Maybe not isolated. https://bitcointalk.org/index.php?topic=174556.0;topicseen

[Derechef]

GoxUSD can be redeemed in places other than Gox, and is indeed considered currency in OTC trades for PPUSD, WU, BTC, etc.

 

Did you have 2FA enabled? If so, it's likely an indication this might not be isolated. Maybe you used a service like LastPass?

No I don't use services like LastPass. And unfortunately I did not had 2FA enabled. I was not using my MtGox account until very recently when I began selling my Bitcoins.

[Crazy]

Maybe you used a service like LastPass?

What's this about LastPass? Was there a security breach I'm not aware of?

[Kluge]

Maybe you used a service like LastPass?

What's this about LastPass? Was there a security breach I'm not aware of?

Not that I know of. In the event of an account breach anywhere, it's standard procedure for the clever ones to try those passwords on password management services and, of course, email accounts. Account breaches somewhere else should always be considered when wondering how credentials were taken -- that's all I was getting at. 

[EuroTrash]

Maybe you used a service like LastPass?

What's this about LastPass? Was there a security breach I'm not aware of?

Not that I know of. In the event of an account breach anywhere, it's standard procedure for the clever ones to try those passwords on password management services and, of course, email accounts. Account breaches somewhere else should always be considered when wondering how credentials were taken -- that's all I was getting at. 

Derechef, sorry for your loss.
Was your MtGox password used only on Gox?

[edd]

I could not understand what happened the issue is almost certainly on MtGox side.

If you don't understand what happened, why are you so certain the issue is with Mt. Gox?

You don't know what happened so I would suggest looking for some evidence before suggesting that Mt. Gox was hacked and, for some reason, your account was the only one targeted.

Maybe not isolated. https://bitcointalk.org/index.php?topic=174556.0;topicseen

How is that related? Stereotype claims to now have more BTC than when he started and had no trouble accessing his account.

[Distribution]

There is one new reason to stop using MtGox.

When I woke up on Wednesday morning there were emails from MtGox in my inbox: emails saying there had been trades on my account (I had no open orders), emails saying that there had been withdrawals, non-BTC redeemable codes deprecation notices and one last email saying that my password had been reset.

My password was very secure, I NEVER told anyone my password, I was not using this password on any other website, I have never been on a phishing website or on websites like mtgox-chat, there is no key-logger on my computer, my OS is Linux, etc.
I am quite security-aware and I never had a problem with any of my account being hacked. I also checked the activity on my Gmail account and there were no suspicious connection.
I could not understand what happened the issue is almost certainly on MtGox side.

So I tried the password recovery procedure and it was not working. I then sent an email to the support explaining everything. I also sent a message on Twitter.

I had not a single answer for two days nor could I connect to my account. These were two very painful days. This morning I finally received a message from the support saying they cannot do anything and I will not be refunded.

I am not familiar with non-BTC redeemable codes but it means the hacker is transferring some funds to an other MtGox account, right? I cannot understand why they are saying they cannot do anything. Beside the password recovery procedure is still NOT working. I still do not know if there is anything left on my account.

I had been selling Bitcoins for a couple of weeks and there were around 20,000€ and 63 bitcoins on my account. I received 6 withdrawals emails and 4 non-BTC redeemable codes deprecation notices.
According to the emails, the hacker bought 100 BTC then sold 70 BTC then bought 70 BTC. The trades were done at around 180€ per Bitcoin.
My account had a "Verified" status. Anyone know what are the withdrawal limits? I hope there is something left on my account...

Of course I sent an other message to the support but they are so slow to answer. I will keep you updated...

In the meantime be very careful with your MtGox accounts. If you do not have a Yubikey you should move your money NOW.

I just had a similar situation. I'm locked out waiting for them to reply. Weird thing is, I never got an email saying my password was changed nor that my email was changed. I never got emails saying that there trades either. And yes, my password sounds like it was as secure as yours. There could be a few things going on here. But in any case, I'm waiting to get into my account to see if everything's gone. I really hope that the account got frozen. But I'm not going to hold my breath. If it works out, I'm going to get the 2fa like you said. If not, I'm done with exchanges.