Bitcoin Forum
May 11, 2024, 05:57:28 AM *
News: Latest Bitcoin Core release: 27.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: 1 2 [All]
  Print  
Author Topic: Bittrex Account Hacked - 2FA was active  (Read 2933 times)
Hastura (OP)
Newbie
*
Offline Offline

Activity: 14
Merit: 0


View Profile
August 07, 2017, 09:00:52 AM
Last edit: August 08, 2017, 07:44:18 AM by Hastura
 #1

************************************************************************************
************************************************************************************
UPDATE
Please check this post....problem "solved"
https://bitcointalk.org/index.php?topic=2070757.msg20707281#msg20707281
************************************************************************************
************************************************************************************

Hello

Just saw that this guy (https://bitcointalk.org/index.php?topic=2069938.0) has the same problem
I also got hacked yesterday. I made a ticket 18h ago but i still got no answer from Bittrex.

Here is what happen:

I was already logged in and i was on the wallete page.
I hit the "F5" button to refresh the page and it starts loading and loading and loading...
After 2-3mins it's still loading. So i closed the browser and tryed to login again...

I enter username and password, press enter and then i get the info "security check - checking your browser before accessing bittex - can take up to 5 minutes"
So i wait... Then i get to the next step. Enter the code for the 2FA. I enter the code and i have to wait again "securitx check - checking....ect"
I don't get access cus it takes to long. So i have to try 2-3 times...but no success.

I closed my browser, cleaned the cache, tryed agein...no success.
I closed my browser again, cleaned cache and coockies, tryed again...and yes...access...i'm back in.

So i open my wallet...and there is a "Pending Withdrawal"! - Status of the Withdrawal "Authorized"!
I was like: What the ####!!!!

I hit the cancel-button again and again but it was to late. Transfere had alredy started.
So i mad a printscreen, opend a ticket and send it to the bittrex support. After the transaction went through, i also had the txid. I made a new printscreen and send that also to bittrex support.
Then i checkt the logins on the bittrex page and i see an ip-adress the tha is not mine and made a printscreen.

Next step: ip address lookup....the ip address is from Russia (another printscreen)
And no, i don't live in Russia....

Well, as i said in the begining...i made a ticket 18h ago...and i still got no answer Sad
1715407048
Hero Member
*
Offline Offline

Posts: 1715407048

View Profile Personal Message (Offline)

Ignore
1715407048
Reply with quote  #2

1715407048
Report to moderator
1715407048
Hero Member
*
Offline Offline

Posts: 1715407048

View Profile Personal Message (Offline)

Ignore
1715407048
Reply with quote  #2

1715407048
Report to moderator
The network tries to produce one block per 10 minutes. It does this by automatically adjusting how difficult it is to produce blocks.
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction.
6Asmodeus6
Full Member
***
Offline Offline

Activity: 140
Merit: 100


View Profile
August 07, 2017, 09:09:07 AM
 #2

Bittrex has so many same topics in here and also in different forums.Most people says that they enabled 2FA so either there is problem in Bittrex 2FA or I don't know.I'm sorry to hear that you lost your money but they have a bad  support quality, it will take like 24-48 hours if you are lucky.Even if they answer you ı don't think there is nothing they can do if withdraw is finished.

Good luck , hope you get your things back somehow.
Hastura (OP)
Newbie
*
Offline Offline

Activity: 14
Merit: 0


View Profile
August 07, 2017, 09:55:50 AM
 #3

Hello 6Asmodeus6

Well, i also hope to get all or at least a part of it back.

And i think i could have a chance to get some help.
I mean, if a user on bittrex makes a crosschain (Crosschain - A deposit of one coin to a different coins address is considered a crosschain deposit) then the money is lost.
And this is a user error. But they still help him somehow to get it back: https://support.bittrex.com/hc/en-us/articles/115000961172-Bittrex-s-Crosschain-Recovery-Policy

In my case i did nothing wrong.
My money was on their server, in one of their walltes, protected by their security system and it still got stolen.
So i expect them to help me to get my money back.

We will see...
btcney
Hero Member
*****
Offline Offline

Activity: 588
Merit: 500



View Profile
August 07, 2017, 10:53:58 AM
 #4

Hello

Just saw that this guy (https://bitcointalk.org/index.php?topic=2069938.0) has the same problem
I also got hacked yesterday. I made a ticket 18h ago but i still got no answer from Bittrex.

Here is what happen:

I was already logged in and i was on the wallete page.
I hit the "F5" button to refresh the page and it starts loading and loading and loading...
After 2-3mins it's still loading. So i closed the browser and tryed to login again...

I enter username and password, press enter and then i get the info "security check - checking your browser before accessing bittex - can take up to 5 minutes"
So i wait... Then i get to the next step. Enter the code for the 2FA. I enter the code and i have to wait again "securitx check - checking....ect"
I don't get access cus it takes to long. So i have to try 2-3 times...but no success.

I closed my browser, cleaned the cache, tryed agein...no success.
I closed my browser again, cleaned cache and coockies, tryed again...and yes...access...i'm back in.

So i open my wallet...and there is a "Pending Withdrawal"! - Status of the Withdrawal "Authorized"!
I was like: What the ####!!!!

I hit the cancel-button again and again but it was to late. Transfere had alredy started.
So i mad a printscreen, opend a ticket and send it to the bittrex support. After the transaction went through, i also had the txid. I made a new printscreen and send that also to bittrex support.
Then i checkt the logins on the bittrex page and i see an ip-adress the tha is not mine and made a printscreen.

Next step: ip address lookup....the ip address is from Russia (another printscreen)
And no, i don't live in Russia....

Well, as i said in the begining...i made a ticket 18h ago...and i still got no answer Sad

This is weird... How the 'hacker' was able to gain access to your email PLUS your 2fa is pretty much baffling. Plus he was able to withdraw an amount from a foreign IP without letting off any alarms in the bittrex security system which is supposedly one of the most secure in the industry.

I've seen other complaints similar to this one and this definitely isn't an isolated case.

It could well be an insider job, however there is nothing that you can do to prove it. Bittrex will probably think that you are faking all this and trying to get extra money, so they probably won't give you the money even if you are obviously telling the truth because if they set a previous example then everyone will just fake theirs. It's quite easy, a VPN is all you need. I'm not saying that you faked it, though, just to be clear.

Are there any vulnerabilities that could have led to the demise of your account?
TTITA
Full Member
***
Offline Offline

Activity: 378
Merit: 100



View Profile
August 07, 2017, 10:58:14 AM
 #5

Hello

Just saw that this guy (https://bitcointalk.org/index.php?topic=2069938.0) has the same problem
I also got hacked yesterday. I made a ticket 18h ago but i still got no answer from Bittrex.

Here is what happen:

I was already logged in and i was on the wallete page.
I hit the "F5" button to refresh the page and it starts loading and loading and loading...
After 2-3mins it's still loading. So i closed the browser and tryed to login again...

I enter username and password, press enter and then i get the info "security check - checking your browser before accessing bittex - can take up to 5 minutes"
So i wait... Then i get to the next step. Enter the code for the 2FA. I enter the code and i have to wait again "securitx check - checking....ect"
I don't get access cus it takes to long. So i have to try 2-3 times...but no success.

I closed my browser, cleaned the cache, tryed agein...no success.
I closed my browser again, cleaned cache and coockies, tryed again...and yes...access...i'm back in.

So i open my wallet...and there is a "Pending Withdrawal"! - Status of the Withdrawal "Authorized"!
I was like: What the ####!!!!

I hit the cancel-button again and again but it was to late. Transfere had alredy started.
So i mad a printscreen, opend a ticket and send it to the bittrex support. After the transaction went through, i also had the txid. I made a new printscreen and send that also to bittrex support.
Then i checkt the logins on the bittrex page and i see an ip-adress the tha is not mine and made a printscreen.

Next step: ip address lookup....the ip address is from Russia (another printscreen)
And no, i don't live in Russia....

Well, as i said in the begining...i made a ticket 18h ago...and i still got no answer Sad

if you got compromised trhu your computer it could be possibly, but at same time your mobile which linking with 2fa, they have accessing too, seems it weird.
poordeveloper
Hero Member
*****
Offline Offline

Activity: 896
Merit: 527


₿₿₿₿₿₿₿


View Profile WWW
August 07, 2017, 11:09:25 AM
 #6

Check your history. Probably you didn't enter your username, password and 2fa code on Bittrex site but on a site with a very similar address.

How did you get to their site? Searching Google for their name or address? Writing the website address?

🎰 Bitcoin Casinos ⭐⭐⭐⭐⭐
.
🔵 Buy Bitcoin (Visa / Mastercard / SEPA / Bank Transfer / Western Union / MoneyGram / RIA)
Hastura (OP)
Newbie
*
Offline Offline

Activity: 14
Merit: 0


View Profile
August 07, 2017, 11:13:53 AM
 #7

Hello btcney

I'm not aware of any vulnerabilities...

And the thing with the foreign IP is very strange...they should have blockt this.

I mean, this person had time to login (2FA needed), exchange my OMG to BTC (no 2FA needed) and then started a transaction/withdrawal that go authorized (2FA needed).
I could understand somehow that the hacker got my 2FA code once (don't know how, but i think it possible)...but he got a valid code at least 2 times in a few minutes.

The 2FA is on my phone and i had it all the time with me.
Hastura (OP)
Newbie
*
Offline Offline

Activity: 14
Merit: 0


View Profile
August 07, 2017, 11:21:11 AM
 #8


if you got compromised trhu your computer it could be possibly, but at same time your mobile which linking with 2fa, they have accessing too, seems it weird.


That's what i don't get. The phone was all the time with me...no idea how thexy got the code...at least twice.
One for the login and then another to authorize the transaction.
Hastura (OP)
Newbie
*
Offline Offline

Activity: 14
Merit: 0


View Profile
August 07, 2017, 11:28:14 AM
 #9

Check your history. Probably you didn't enter your username, password and 2fa code on Bittrex site but on a site with a very similar address.

How did you get to their site? Searching Google for their name or address? Writing the website address?

Hello poordeveloper

Thanks for the info with the similar address...i will check this when im back home from work.

And i got on their site by typing "bittrex" in the address bar of my browser and then i got to the loggin page...as usual since i got that address im my browser history.
2fresh
Hero Member
*****
Offline Offline

Activity: 782
Merit: 500


View Profile
August 07, 2017, 01:46:52 PM
 #10

This seems very fishy... :s. Keep us updated of what's happening.
Did you "lose" a lot?
Hastura (OP)
Newbie
*
Offline Offline

Activity: 14
Merit: 0


View Profile
August 07, 2017, 02:04:05 PM
 #11

This seems very fishy... :s. Keep us updated of what's happening.
Did you "lose" a lot?

Hello 2fresh

Sure, i'll keep you guys updated.
And i lost +/- 2.55 BTC
chiznitz
Hero Member
*****
Offline Offline

Activity: 574
Merit: 500


View Profile WWW
August 07, 2017, 02:15:52 PM
 #12

Check your history. Probably you didn't enter your username, password and 2fa code on Bittrex site but on a site with a very similar address.

How did you get to their site? Searching Google for their name or address? Writing the website address?

Hello poordeveloper

Thanks for the info with the similar address...i will check this when im back home from work.

And i got on their site by typing "bittrex" in the address bar of my browser and then i got to the loggin page...as usual since i got that address im my browser history.

Hey all.  Even with 2FA you need to be careful where you enter your credentials.  Typing bittrex into the URL bar on google will lead you to phishing sites as advertisements. Here is an example of two fake sites showing up on google advertisements.



These sites have you enter your username/password and 2FA code, the hacker then logs into your account.  One of these sites also makes you wait 2 minutes since there is a 2 minute withdrawal freeze after a login. The sites then tell you your login was incorrect even though the hackers have now logged in.  You then enter another 6 digit code as asked by the phishing site and they use this code to withdrawal your funds.

Please make sure to bookmark https://www.bittrex.com and never search for the site. 

Unfortunately, these advertisements cannot be prevented and take some time to take down with official requests.

Looking for the best exchange? -> https://bittrex.com
Hastura (OP)
Newbie
*
Offline Offline

Activity: 14
Merit: 0


View Profile
August 07, 2017, 02:27:27 PM
 #13


These sites have you enter your username/password and 2FA code, the hacker then logs into your account.  One of these sites also makes you wait 2 minutes since there is a 2 minute withdrawal freeze after a login. The sites then tell you your login was incorrect even though the hackers have now logged in.  You then enter another 6 digit code as asked by the phishing site and they use this code to withdrawal your funds.

Please make sure to bookmark https://www.bittrex.com and never search for the site. 

Unfortunately, these advertisements cannot be prevented and take some time to take down with official requests.

Hello chiznitz

Thank you for the info.
I will check my browser history when i'm at home.
not.you
Legendary
*
Offline Offline

Activity: 1726
Merit: 1018


View Profile
August 07, 2017, 05:00:55 PM
 #14

I can think of at least one far out but possible scenario that would explain all of the details.  If your PC was compromised and something on the PC routed your entire browser session through a proxy controlled by the thief then this should be possible.  The 2fa is time based so the exact same code is good for about 30 seconds. If they routed your browser session through their proxy and then hijacked it man-in-the-middle style and then used a script to initiate withdrawals pretty much on the spot, then the same 2fa code would very likely be valid.  That proxy could also explain why you couldn't load the page for a bit after you logged in.
tachypknea
Newbie
*
Offline Offline

Activity: 7
Merit: 0


View Profile
August 07, 2017, 05:19:08 PM
 #15

Hello

Just saw that this guy (https://bitcointalk.org/index.php?topic=2069938.0) has the same problem
I also got hacked yesterday. I made a ticket 18h ago but i still got no answer from Bittrex.

Here is what happen:

I was already logged in and i was on the wallete page.
I hit the "F5" button to refresh the page and it starts loading and loading and loading...
After 2-3mins it's still loading. So i closed the browser and tryed to login again...

I enter username and password, press enter and then i get the info "security check - checking your browser before accessing bittex - can take up to 5 minutes"
So i wait... Then i get to the next step. Enter the code for the 2FA. I enter the code and i have to wait again "securitx check - checking....ect"
I don't get access cus it takes to long. So i have to try 2-3 times...but no success.

I closed my browser, cleaned the cache, tryed agein...no success.
I closed my browser again, cleaned cache and coockies, tryed again...and yes...access...i'm back in.

So i open my wallet...and there is a "Pending Withdrawal"! - Status of the Withdrawal "Authorized"!
I was like: What the ####!!!!

I hit the cancel-button again and again but it was to late. Transfere had alredy started.
So i mad a printscreen, opend a ticket and send it to the bittrex support. After the transaction went through, i also had the txid. I made a new printscreen and send that also to bittrex support.
Then i checkt the logins on the bittrex page and i see an ip-adress the tha is not mine and made a printscreen.

Next step: ip address lookup....the ip address is from Russia (another printscreen)
And no, i don't live in Russia....

Well, as i said in the begining...i made a ticket 18h ago...and i still got no answer Sad

This is weird... How the 'hacker' was able to gain access to your email PLUS your 2fa is pretty much baffling. Plus he was able to withdraw an amount from a foreign IP without letting off any alarms in the bittrex security system which is supposedly one of the most secure in the industry.

I've seen other complaints similar to this one and this definitely isn't an isolated case.

It could well be an insider job, however there is nothing that you can do to prove it. Bittrex will probably think that you are faking all this and trying to get extra money, so they probably won't give you the money even if you are obviously telling the truth because if they set a previous example then everyone will just fake theirs. It's quite easy, a VPN is all you need. I'm not saying that you faked it, though, just to be clear.

Are there any vulnerabilities that could have led to the demise of your account?


I think i got hacked the same way (The IP Address of the hacker was also from Russia), it is weird how Bittrex won't prompt an email confirmation to the user when the IP address is very off  (I also live very far away from Russia)
amacar2
Legendary
*
Offline Offline

Activity: 1120
Merit: 1007

CryptoTalk.Org - Get Paid for every Post!


View Profile
August 07, 2017, 05:36:24 PM
 #16

If you haven't entered your details in one of the fake bittrex site than this issue sound quite serious one. I have also enabled 2fa few months ago on bittrex and trusting them with most of my cryptos so I am quite worried right now after reading your case. Do they really have fault in their 2fa? I don't think 2fa can fail at any point because they are tied with google authentication which is based on time and secret code provided by the site.  Roll Eyes

 
                                . ██████████.
                              .████████████████.
                           .██████████████████████.
                        -█████████████████████████████
                     .██████████████████████████████████.
                  -█████████████████████████████████████████
               -███████████████████████████████████████████████
           .-█████████████████████████████████████████████████████.
        .████████████████████████████████████████████████████████████
       .██████████████████████████████████████████████████████████████.
       .██████████████████████████████████████████████████████████████.
       ..████████████████████████████████████████████████████████████..
       .   .██████████████████████████████████████████████████████.
       .      .████████████████████████████████████████████████.

       .       .██████████████████████████████████████████████
       .    ██████████████████████████████████████████████████████
       .█████████████████████████████████████████████████████████████.
        .███████████████████████████████████████████████████████████
           .█████████████████████████████████████████████████████
              .████████████████████████████████████████████████
                   ████████████████████████████████████████
                      ██████████████████████████████████
                          ██████████████████████████
                             ████████████████████
                               ████████████████
                                   █████████
.YoBit AirDrop $.|.Get 700 YoDollars for Free!.🏆
LeGaulois
Copper Member
Legendary
*
Offline Offline

Activity: 2870
Merit: 4095


Top Crypto Casino


View Profile
August 07, 2017, 05:39:42 PM
 #17

There is something I don't get in the original post. For outgoing transfers, we get an email verification with a link to click to confirm the transaction. Without this process, it's not possible. So how would it be possible without getting access to your own email.
Bittrex usually answer to support ticket in 24 hours average but tracking the IP is worthless because only an idiot village  would use his original IP without masking it

█████████████████████████
████▐██▄█████████████████
████▐██████▄▄▄███████████
████▐████▄█████▄▄████████
████▐█████▀▀▀▀▀███▄██████
████▐███▀████████████████
████▐█████████▄█████▌████
████▐██▌█████▀██████▌████
████▐██████████▀████▌████
█████▀███▄█████▄███▀█████
███████▀█████████▀███████
██████████▀███▀██████████
█████████████████████████
.
BC.GAME
▄▄░░░▄▀▀▄████████
▄▄▄
██████████████
█████░░▄▄▄▄████████
▄▄▄▄▄▄▄▄▄██▄██████▄▄▄▄████
▄███▄█▄▄██████████▄████▄████
███████████████████████████▀███
▀████▄██▄██▄░░░░▄████████████
▀▀▀█████▄▄▄███████████▀██
███████████████████▀██
███████████████████▄██
▄███████████████████▄██
█████████████████████▀██
██████████████████████▄
.
..CASINO....SPORTS....RACING..
█░░░░░░█░░░░░░█
▀███▀░░▀███▀░░▀███▀
▀░▀░░░░▀░▀░░░░▀░▀
░░░░░░░░░░░░
▀██████████
░░░░░███░░░░
░░█░░░███▄█░░░
░░██▌░░███░▀░░██▌
░█░██░░███░░░█░██
░█▀▀▀█▌░███░░█▀▀▀█▌
▄█▄░░░██▄███▄█▄░░▄██▄
▄███▄
░░░░▀██▄▀


▄▄████▄▄
▄███▀▀███▄
██████████
▀███▄░▄██▀
▄▄████▄▄░▀█▀▄██▀▄▄████▄▄
▄███▀▀▀████▄▄██▀▄███▀▀███▄
███████▄▄▀▀████▄▄▀▀███████
▀███▄▄███▀░░░▀▀████▄▄▄███▀
▀▀████▀▀████████▀▀████▀▀
Hastura (OP)
Newbie
*
Offline Offline

Activity: 14
Merit: 0


View Profile
August 07, 2017, 06:02:20 PM
 #18

I can think of at least one far out but possible scenario that would explain all of the details.  If your PC was compromised and something on the PC routed your entire browser session through a proxy controlled by the thief then this should be possible.  The 2fa is time based so the exact same code is good for about 30 seconds. If they routed your browser session through their proxy and then hijacked it man-in-the-middle style and then used a script to initiate withdrawals pretty much on the spot, then the same 2fa code would very likely be valid.  That proxy could also explain why you couldn't load the page for a bit after you logged in.

Helllo not.you

Well, this is one possibility of what could happend, but if this is the case i have no way to find out.
Hastura (OP)
Newbie
*
Offline Offline

Activity: 14
Merit: 0


View Profile
August 07, 2017, 06:18:37 PM
 #19


I think i got hacked the same way (The IP Address of the hacker was also from Russia), it is weird how Bittrex won't prompt an email confirmation to the user when the IP address is very off  (I also live very far away from Russia)

Hello tachypknea

I also don't understand that. I always  logged in from the same country, so it's strage that they/the security system did nothing when suddenly in ip from Russia logged in.
Did you already get an answer from the support?
soothaa
Hero Member
*****
Offline Offline

Activity: 1151
Merit: 528



View Profile
August 07, 2017, 06:20:27 PM
 #20

There is something I don't get in the original post. For outgoing transfers, we get an email verification with a link to click to confirm the transaction. Without this process, it's not possible. So how would it be possible without getting access to your own email.
Bittrex usually answer to support ticket in 24 hours average but tracking the IP is worthless because only an idiot village  would use his original IP without masking it
You do? Mine does not function like this at Bittrex - it does for a few other exchanges but not for Bittrex.. I should probably cruise through my settings pages and see if I can enable that. If not it should really be mandatory on the site.. kind of like a 3FA if you will.

I've been pulling my longer term holdings off of all exchanges, I get realllyyy nervous when I see a balance in an exchange over a few thousand $$$.

Want increased coin support within AwesomeMiner? Try my free plugin to add support for nearly any coin! https://bitcointalk.org/index.php?topic=2979494
Want Masternode income stats within AwesomeMiner? Try my free plugin to add support for them! https://bitcointalk.org/index.php?topic=3047367
Hastura (OP)
Newbie
*
Offline Offline

Activity: 14
Merit: 0


View Profile
August 07, 2017, 06:29:31 PM
 #21

If you haven't entered your details in one of the fake bittrex site than this issue sound quite serious one. I have also enabled 2fa few months ago on bittrex and trusting them with most of my cryptos so I am quite worried right now after reading your case. Do they really have fault in their 2fa? I don't think 2fa can fail at any point because they are tied with google authentication which is based on time and secret code provided by the site.  Roll Eyes

Hello amacar2

To be honest, i still don't know if i entered my details in one of the fake bittrex sites or if they did it in some other way.
In a strage way, i'm hopping that it was the thing with the fake bittrex address...so i could say: "S##t...my bad." And this would then also mean, that everything is ok with the 2FA.


Cus, just try to imagine what would happend if the really hacked the 2FA system Shocked
Hastura (OP)
Newbie
*
Offline Offline

Activity: 14
Merit: 0


View Profile
August 07, 2017, 06:37:45 PM
 #22

There is something I don't get in the original post. For outgoing transfers, we get an email verification with a link to click to confirm the transaction. Without this process, it's not possible. So how would it be possible without getting access to your own email.
Bittrex usually answer to support ticket in 24 hours average but tracking the IP is worthless because only an idiot village  would use his original IP without masking it
You do? Mine does not function like this at Bittrex - it does for a few other exchanges but not for Bittrex.. I should probably cruise through my settings pages and see if I can enable that. If not it should really be mandatory on the site.. kind of like a 3FA if you will.

I've been pulling my longer term holdings off of all exchanges, I get realllyyy nervous when I see a balance in an exchange over a few thousand $$$.

Hella soothaa and hello LeGaulois

I was going to say basically the same thing soothaa wrote.

You only get an email verification with a link when you're NOT using 2FA.
When you activate 2FA for your Bittrex account, you only need to enter the 2FA verification code to authorize the transaction...and you don't get an extra mail with a verification link.

tachypknea
Newbie
*
Offline Offline

Activity: 7
Merit: 0


View Profile
August 07, 2017, 08:05:58 PM
 #23


I think i got hacked the same way (The IP Address of the hacker was also from Russia), it is weird how Bittrex won't prompt an email confirmation to the user when the IP address is very off  (I also live very far away from Russia)

Hello tachypknea

I also don't understand that. I always  logged in from the same country, so it's strage that they/the security system did nothing when suddenly in ip from Russia logged in.
Did you already get an answer from the support?

Hello Hastura,

They ignored my question, they sent me an automated message of how to re-activate your account...... From the looks of it they haven't looked into the situation at all. I tried following up, but no reply in the last 30 hours.

Yeah, it's weird how they will freeze your account when a weird IP accesses your account (if it's dormant), but won't do the same when the account is active.. It's also weird how they won't allow users who enable 2FA to have email address confirmation as well. I know other websites that would prompt me to confirm with my email when a new IP or device is used for the account, it's not new technology or anything..

My biggest concern is that it's an issue on their end with the 2FA, in which I won't feel safe holding my money on the exchange anymore.

Thank you for your help everyone.
figmentofmyass
Legendary
*
Offline Offline

Activity: 1652
Merit: 1483



View Profile
August 07, 2017, 08:47:55 PM
 #24

Check your history. Probably you didn't enter your username, password and 2fa code on Bittrex site but on a site with a very similar address.

How did you get to their site? Searching Google for their name or address? Writing the website address?

i really hope that this is the culprit. it sucks that the OP lost money, but if the exchange had its TOTP token database compromised, there will be big losses coming for other customers.

i haven't heard any other complaints like this yet today, so i'm guessing he just got fooled into clicking on a fake site / phishing link.

pinkflower
Sr. Member
****
Offline Offline

Activity: 868
Merit: 259



View Profile
August 08, 2017, 05:33:23 AM
 #25

Please post all necessary screen shots and show everyone that you were really hacked and got your coins stolen. When a newbie account starts to claim that they were hacked, we should be skeptical. It could be he lost some BTC in trading some altcoin and is now starting to blame the exchange for his losses.
Hastura (OP)
Newbie
*
Offline Offline

Activity: 14
Merit: 0


View Profile
August 08, 2017, 07:37:01 AM
 #26


I think i got hacked the same way (The IP Address of the hacker was also from Russia), it is weird how Bittrex won't prompt an email confirmation to the user when the IP address is very off  (I also live very far away from Russia)

Hello tachypknea

I also don't understand that. I always  logged in from the same country, so it's strage that they/the security system did nothing when suddenly in ip from Russia logged in.
Did you already get an answer from the support?

Hello Hastura,

They ignored my question, they sent me an automated message of how to re-activate your account...... From the looks of it they haven't looked into the situation at all. I tried following up, but no reply in the last 30 hours.

Yeah, it's weird how they will freeze your account when a weird IP accesses your account (if it's dormant), but won't do the same when the account is active.. It's also weird how they won't allow users who enable 2FA to have email address confirmation as well. I know other websites that would prompt me to confirm with my email when a new IP or device is used for the account, it's not new technology or anything..

My biggest concern is that it's an issue on their end with the 2FA, in which I won't feel safe holding my money on the exchange anymore.

Thank you for your help everyone.

Hello tachypknea

I think i got the exact same answer from the support and they set the ticket from "open" to "solved".
They say that i got on phishing site and that is how they got access to my account...well s##t!

And you know what? That's exactly what happend  Sad
Yesterday i checked all the site i visited that day...and it took me over 1h. And then i found it...
In my case i really landed on a fake site...it's sad but its my fault.

Well, thanks everyone for the help and have a nice day.
LeGaulois
Copper Member
Legendary
*
Offline Offline

Activity: 2870
Merit: 4095


Top Crypto Casino


View Profile
August 08, 2017, 12:29:38 PM
 #27

There is something I don't get in the original post. For outgoing transfers, we get an email verification with a link to click to confirm the transaction. Without this process, it's not possible. So how would it be possible without getting access to your own email.
Bittrex usually answer to support ticket in 24 hours average but tracking the IP is worthless because only an idiot village  would use his original IP without masking it
You do? Mine does not function like this at Bittrex - it does for a few other exchanges but not for Bittrex.. I should probably cruise through my settings pages and see if I can enable that. If not it should really be mandatory on the site.. kind of like a 3FA if you will.

I've been pulling my longer term holdings off of all exchanges, I get realllyyy nervous when I see a balance in an exchange over a few thousand $$$.

Yes, it's how it works for me. For every transfer outside Bittrex I receive an email for verification purpose and I need to click the link inside to allow the transfer otherwise it is not possible. It is a setting set by default so you shall have it enabled as well.
Also, you can use the "IP address whitelisting" so you can only place orders or withdraw funds from the IP listed.
And the "Withdrawal address whitelisting"  so you can only withdraw a specified crypto to the specified addresses you set

Edit: after checking quickly I have not found where it is possible to disable the email verification process. :/

█████████████████████████
████▐██▄█████████████████
████▐██████▄▄▄███████████
████▐████▄█████▄▄████████
████▐█████▀▀▀▀▀███▄██████
████▐███▀████████████████
████▐█████████▄█████▌████
████▐██▌█████▀██████▌████
████▐██████████▀████▌████
█████▀███▄█████▄███▀█████
███████▀█████████▀███████
██████████▀███▀██████████
█████████████████████████
.
BC.GAME
▄▄░░░▄▀▀▄████████
▄▄▄
██████████████
█████░░▄▄▄▄████████
▄▄▄▄▄▄▄▄▄██▄██████▄▄▄▄████
▄███▄█▄▄██████████▄████▄████
███████████████████████████▀███
▀████▄██▄██▄░░░░▄████████████
▀▀▀█████▄▄▄███████████▀██
███████████████████▀██
███████████████████▄██
▄███████████████████▄██
█████████████████████▀██
██████████████████████▄
.
..CASINO....SPORTS....RACING..
█░░░░░░█░░░░░░█
▀███▀░░▀███▀░░▀███▀
▀░▀░░░░▀░▀░░░░▀░▀
░░░░░░░░░░░░
▀██████████
░░░░░███░░░░
░░█░░░███▄█░░░
░░██▌░░███░▀░░██▌
░█░██░░███░░░█░██
░█▀▀▀█▌░███░░█▀▀▀█▌
▄█▄░░░██▄███▄█▄░░▄██▄
▄███▄
░░░░▀██▄▀


▄▄████▄▄
▄███▀▀███▄
██████████
▀███▄░▄██▀
▄▄████▄▄░▀█▀▄██▀▄▄████▄▄
▄███▀▀▀████▄▄██▀▄███▀▀███▄
███████▄▄▀▀████▄▄▀▀███████
▀███▄▄███▀░░░▀▀████▄▄▄███▀
▀▀████▀▀████████▀▀████▀▀
carlisle1
Hero Member
*****
Offline Offline

Activity: 2744
Merit: 541

Campaign Management?"Hhampuz" is the Man


View Profile
August 08, 2017, 12:37:18 PM
 #28

There is something I don't get in the original post. For outgoing transfers, we get an email verification with a link to click to confirm the transaction. Without this process, it's not possible. So how would it be possible without getting access to your own email.
Bittrex usually answer to support ticket in 24 hours average but tracking the IP is worthless because only an idiot village  would use his original IP without masking it
You do? Mine does not function like this at Bittrex - it does for a few other exchanges but not for Bittrex.. I should probably cruise through my settings pages and see if I can enable that. If not it should really be mandatory on the site.. kind of like a 3FA if you will.

I've been pulling my longer term holdings off of all exchanges, I get realllyyy nervous when I see a balance in an exchange over a few thousand $$$.

Yes, it's how it works for me. For every transfer outside Bittrex I receive an email for verification purpose and I need to click the link inside to allow the transfer otherwise it is not possible. It is a setting set by default so you shall have it enabled as well.
Also, you can use the "IP address whitelisting" so you can only place orders or withdraw funds from the IP listed.
And the "Withdrawal address whitelisting"  so you can only withdraw a specified crypto to the specified addresses you set

Edit: after checking quickly I have not found where it is possible to disable the email verification process. :/
after I read this post I quickly checked those setting and I wonder why I didn't pay attention on it, I think its still our obligation to secure
everything  and its weird how 2fa can be hacked if that's really happen to OP.
poordeveloper
Hero Member
*****
Offline Offline

Activity: 896
Merit: 527


₿₿₿₿₿₿₿


View Profile WWW
August 08, 2017, 01:34:15 PM
 #29

There is something I don't get in the original post. For outgoing transfers, we get an email verification with a link to click to confirm the transaction. Without this process, it's not possible. So how would it be possible without getting access to your own email.
Bittrex usually answer to support ticket in 24 hours average but tracking the IP is worthless because only an idiot village  would use his original IP without masking it
You do? Mine does not function like this at Bittrex - it does for a few other exchanges but not for Bittrex.. I should probably cruise through my settings pages and see if I can enable that. If not it should really be mandatory on the site.. kind of like a 3FA if you will.

I've been pulling my longer term holdings off of all exchanges, I get realllyyy nervous when I see a balance in an exchange over a few thousand $$$.

Yes, it's how it works for me. For every transfer outside Bittrex I receive an email for verification purpose and I need to click the link inside to allow the transfer otherwise it is not possible. It is a setting set by default so you shall have it enabled as well.
Also, you can use the "IP address whitelisting" so you can only place orders or withdraw funds from the IP listed.
And the "Withdrawal address whitelisting"  so you can only withdraw a specified crypto to the specified addresses you set

Edit: after checking quickly I have not found where it is possible to disable the email verification process. :/
IP address whitelisting it's only a viable option if you have a static IP. For most people, using this option will only lock yourself out of your account.

🎰 Bitcoin Casinos ⭐⭐⭐⭐⭐
.
🔵 Buy Bitcoin (Visa / Mastercard / SEPA / Bank Transfer / Western Union / MoneyGram / RIA)
POSITRON333
Newbie
*
Offline Offline

Activity: 32
Merit: 0


View Profile
August 28, 2017, 06:22:55 PM
Last edit: August 28, 2017, 06:39:43 PM by POSITRON333
 #30

HI today when triying to log in bitrex I got a message that said is new ip address and I need check a email they sended  and log in to bitrex from a link in that email?Huh

I of course don't do that but now every time I try to log on bitrex after I enter my 2fa they tell me I need to check my email and log on from email they sended???  is that bitrex new security way  or is a hack try?

don't know how to put photos here.  so I can post a photo of the email contents I got  from "bitrex"


I checked the email direccion of the sender and is the same when i got login confirmation.

i will copy and paste part of the email i got  supposedly from bitrex:
(the xxxxxxx are mine for don't show what i think important info)


"
Bittrex IP Verification


Dear xxxx@xxxx,

This is to notify you that we have detected a login from an IP address or device that has not been used by this account before. In order to allow this device to access your account, you will need to login again from the same device using the link below.


CLICK HERE TO ENABLE THIS DEVICE and logon to your account.

Login Time: 08/28/2017 18:08 UTC
IP Address: xxxxxxx
User Agent: xxxxxxx

You can check your current IP address here: https://bittrex.com/home/whatismyip

Always use unique, strong passwords for your Bittrex account and never use the same password twice. Do not reuse your passwords on other accounts, such as your personal email account. The Bittrex staff will never ask you for your password.

Best regards,
Bittrex Team


If you did not initiate this login, there is a chance your account credentials have been stolen.

Please change your password and disable your account if you are worried the account has been compromised.
"



thanks for help.






updated:    now I can enter to bitrex using other browser,  but with microsofte edget don't let me in, only said I need to log in from a email they senede that validate new ip address,   but I am login from the same pc as always (but sometime my internet provider changes my ip)  but I think is same ip I am using lately
Chol_gol
Member
**
Offline Offline

Activity: 136
Merit: 10


View Profile
December 02, 2017, 07:55:56 AM
 #31

I have launched a telegram group. I want all those whose account has been disabled to join to this group. and if we needed to file a lawsuit against them we can do it collectively for better results.
everybody is welcome
here is group:
https://t.me/joinchat/BjmOlA2Ir-_l5XhBATHoTg
lerbatax
Newbie
*
Offline Offline

Activity: 1
Merit: 0


View Profile
May 13, 2019, 12:47:49 PM
 #32

You all want to know the truth about the 13/08/2017 theft of the peoples wallets it was an inside job made from employee from bittrex and we shall take bittrex to court because that day that employer become millionaire yes millionaire from 3000 accounts of peoples bittrex funds  that bustard got away with it cause bittrex since they wasnt their funds they didn't initiate any investigations intact they didn't admit accounts misuse or that inside job was carried out  they 8nfact blocked all accounts of those who had money stolen so they dint hear from them what a nasty thing to do after someone got his hard earned cash taken away from him..... yes it was an inside job for sure
Pages: 1 2 [All]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!