YOBIT scam!!! BTC wallet empty

[niemann]

What happened:
On January 8th, I discovered my BTC wallet completely blank. Empty!? I have not done any withdrawals, conversions, trades or anything else for that matter.
I openned a support ticket and by the time I was writting this posted another 7 related messages. So far without a single word from Yobit.

I posted a message in this forum (https://bitcointalk.org/index.php?topic=1481722.msg27827640#msg27827640) and got a reply that gave me some guidance for further investigation of this issue. Now, up until that moment I haven't had any idea what YobiCodes might be. Anyway, what I found out is that on 2018-01-05 at 02:00:47 my BTC were miraculously converted to these YobiCodes and than on 2018-01-05 at 02:00:56 YobiCodes were activated. Within 9 seconds all my earnings were stolen.

Each time I log in, I receive a notification email and there were no notifications that I (or anyone else) was logged in at that particular time at Yobit. At 2AM I was logged out completely. Further more, I use 2FA auth, so I do not see how anyone from the outside could do that.
History, of trading, withdrawals, dice, etc. is normal. Nothing suspicious there. The only position out of order is in the history of YobiCodes, where it stands that at the given time code was created.

Now, I know for sure that I didn't do that. With 2FA there is no way anyone else could do that either. The only conclusion is that someone from within Yobit took all the BTC's from my wallet with them.


Scammers Profile Link: https://yobit.net
Reference Link:  https://yobit.net
Amount Scammed: 0.091749 BTC (aprox. 1.600 USD)
Payment Method: Deposited in my Yobit wallet 1K7ee2WQ399y5YidK8AaGmEYMaPNjYpMeV
Proof of Payment:
- email on login notifications: https://drive.google.com/open?id=1Iz4hdte8uKDgO3VkzGzCAZ3pc6-Ov-h_
- messages to their support: https://drive.google.com/open?id=1Iz4hdte8uKDgO3VkzGzCAZ3pc6-Ov-h_
- history YobiCodes: https://drive.google.com/open?id=17ri9Va5U-E-x8PSAwbtT3U6H4Vci5WLm
- YobiCodes: https://drive.google.com/open?id=1HfbZLRlHKZ_lUQOuv_5SHN27xbBcxyN8


PM/Chat Logs: Transcript of messages posted to Yobits support:
2018-01-11 09:54:36 niemann
Here is what I discovered so far:

1). On January 5th, 2018, at 05:00:47 my BTC wallet was converted to YobiCodes.
    Proof: https://drive.google.com/open?id=17ri9Va5U-E-x8PSAwbtT3U6H4Vci5WLm

2). After 9 seconds, the YobiCode has been used.
    Proof: https://drive.google.com/open?id=1HfbZLRlHKZ_lUQOuv_5SHN27xbBcxyN8

3). I was not logged in at the time, nor is there any notification that would indicate that someone used my credentials and logged in instead of me. With 2FA auth it is impossible.
    Proof: https://drive.google.com/open?id=1woPF_zNODnwivM4lLOEnbfO5xVltc5Wv

----------------
From the above the only conclusion is that Yobit or someone within Yobit did it on their own and stole my money. Having that said, I hold Yobit fully responsable for safeguarding my deposits and therefore demand my wallet to be restored.

If I do not receive any reply in the following couple of days I will have to asume that this teft was done with the approval of Yobit.
2018-01-10 18:24:56 niemann
https://bitcointalk.org/index.php?topic=2708561.msg27856715#msg27856715
2018-01-10 12:53:47 niemann
Here is a link to bitcointalks topic:
https://bitcointalk.org/index.php?topic=1481722.msg27827640#msg27827640
2018-01-10 09:03:00 niemann
Guys this is getting very frustrating. I cannot beleive that I cannot get a single word from you.
I started a discussion on this on Bitcoin talk and I found out that YobiCodes are something like a cheque. WHO and WHY made a conversion of my BTC into these cheques. I need my BTC back to my wallet asap.
As much as it may be insignificant to you, this amount is far more than I can afford to loose. PLEASE HELP and restore my wallet.

2018-01-09 21:05:55 niemann
I would very much appreciate an answer here. What is going on with my BTC wallet and what happened to the sum I had on it? Can I expect a resolution or amI being ripped off? I am getting worried now. Please reply
2018-01-09 12:56:53 niemann
If you need screenshots of history and wallet do let me know.
2018-01-09 10:35:13 niemann
I checked the history if there is anything out of order going on, but everything looks fine, with the exception of the section "YobiCodes". I do not know what this is but there is a creation on January 5th, at 02:00:47 type "Code creation" stating my BTC balance in minus form. What is this? When I click on it it takes me to trading section.

Please tell me where are my BTC's.
2018-01-09 08:56:51 niemann
What happened with my BTC balance? I had something over 0,092 BTC in it and now I don't have anything. I made no withdrawalls and no tradings.

Please reply ASAP.


Additional Notes:

[1713878539]

1713878539

[XtreamXTC]

Hi, this has also happened to me, I send 0.2 ETH over and made 1 transaction for some HTML5 I now have nothing in my wallet but it all shows on the yobi code page.

I'm hoping it isn't a scam but something to do with how the site works and I must need to do something with those yobi codes. I haven't figured it out yet though. Hopefully someone on here can help?

If you get a reply from support please let me know, if I find out I'll do the same

[SyGambler]

this is weird actually , with all the past reports about yobit this is the first time I see such a problem
I mean is there anyway to prove that the yobi codes was created by someone else ?? yobit is shady but your case is hard to prove
anyway they already have a  lot of negative reviews , so this won't change a thing sadly

[niemann]

this is weird actually , with all the past reports about yobit this is the first time I see such a problem
I mean is there anyway to prove that the yobi codes was created by someone else ?? yobit is shady but your case is hard to prove
anyway they already have a  lot of negative reviews , so this won't change a thing sadly

You are quite correct. A rather unique situation and the one that could be hard to prove. At this point Yobit is the only one that holds the answer to who and how created these codes and where they went. A simple sweep trough the logs would do the magic. But, apparently we are way beyond the point of expecting them to explain and resolve that. I was kind of hopping they would but to be honest deep down I knew they won't and I took some steps.

For the last couple of days I've been exchanging phone calls with a friend of a friend that works at VTB bank in Moscow, at their information security center. The guy was quite friendly and is willing to help as much as he can. I explained my situation, forwarded what I had and got some replies back. He told me he knows of Yobit and that they already were for a couple of times under the investigation for the similar situations in past. He explained that there are certain legal steps I should consider taking in this matter, which will cost me nothing and will insure a positive resolution. He promised to make some inquiries and give me more details on the following Monday or Tuesday.

So, there you go. One thing is for sure, I will not sit back with my hands crossed and forget about my money. One way or the other, I will have my BTC's back with the interest rate.

Wish me luck and I'll try to keep you posted!

[Aviatorist]

Dear ALL,

I have come accross the same empty wallet case today. Yobit market history shows all of my balance swifted to anywhere that i have no information about. Do you have any information about YobiCodes Code Activation information. My all balance is empty 0,19 btc flown.

I have sent 3 different messages to Yobit Support and have not received any answer yet.

Please give me an advise that how i can bring back the missing balance.

Best Regards,

Aviatorist.   

[niemann]

Dear ALL,

I have come accross the same empty wallet case today. Yobit market history shows all of my balance swifted to anywhere that i have no information about. Do you have any information about YobiCodes Code Activation information. My all balance is empty 0,19 btc flown.

I have sent 3 different messages to Yobit Support and have not received any answer yet.

Please give me an advise that how i can bring back the missing balance.

Best Regards,

Aviatorist.   

So far I count you to be the third one with the same problem.
Yesterday morning, I got a short message from Yobit's support (it appears they are alive after all) explaining absolutely nothing. I was far to aggrivated to type any comment here on that. I still am, so, in short, I still hold YOBIT responsable for missing BTC from my wallet.

Will keep you posted and will see this to the end.

[niemann]

Here is what happened in the meantime.
As I mentioned, I got some kind of a reply from Yobit's support:

2018-01-15 10:09:20 dominikherzog
Yobit have only one channel for support==>SUPPORT page.
 Ignore fake telegram,facebook and email accounts.

you are hacked from fake "support"

where /how you contact ?
via telegram?
via facebook?
via fake email?

Here is my reaction to it:

2018-01-15 11:09:49 niemann
Dominik, the only way I contacted the support is by openning a ticket here as soon as I discovered my BTC wallet to be empty. What you are saying is that I was hacked after my wallet has been wipped clean. This doesn't make sence at all.

I described bellow what I found so far and I'll repeat:
- on 2018-01-05 02:00:47 my BTC's were used to create YobiCodes
- on 2018-01-05 02:00:56 YobiCodes were used.

I uploaded printscreens on my GDrive ... check them.

I use 2FA. Each login is notified by an email. Each login from a different device/IP is notified by an email and has to be confirmed. So, how comes I got hacked by a fake support if I don't have anything in my emails. I do not use Facebook since 2009 and I have not joined any Yobit or any similar groups in Telegram.
If you need a comlete list of sent and received emails, I will be happy to provide without any problem. But there are none other than ones confirming login. I already provided a link for the incoming mails earlier (with a filter on Yobit): https://drive.google.com/open?id=1woPF_zNODnwivM4lLOEnbfO5xVltc5Wv

On the account of contacting Yobit support, I openned 3 ticket ONLY over this website so far:
1st: requesting info regarding B2X deposits - never answered,
2nd: regarding InvestBox info - never answered,
3rd: this one, in regards to my BTC wallet being empty.

Other than the a.m., I started a discussion on BITCOINTALK.ORG only after I found this. And that is it. Nothing else.

If I was not logged in at the time, than how comes these YobiCodes were created and used by a hacked account. No notification at all. If you will tell me that I have a malware on the divece(s) I use, at 2 AM none of them were turned on several hours before or after.

I will not settle for your attempted explanation and I still hold YOBIT fully responsable for safeguarding my wallet. Therefore, I expect Yobit to restore my wallet.

The least you can do is make a trace on YobiCodes (I provided printscreen on that as well) in your log. Thay had to go somewhere.

This morning I logged in to see if there is anything going on there and I discovered all the tickets I openned on Yobit gone. Support section lists "No records". Well, ain't that just conveniant. (they reappeared)
I will not settle until I have my wallet restored.

[Lucius]

I have account on YoBit.net from time I was participated in their signature campaign and I also promote my ref link in signature so I get some nice number of referrals which make my some BTC there.I just check and all balance is there,so far I have no problem with them.Before they send me e-mail for log in verification,but this is not the case anymore.

Is it possible that you and some others are victims of phishing or your log in data was exposed in any way?

[potpockets]

Yobit has been having a lot of complaints in the past few weeks, it may be just poor support issues and at worst preparing for bankruptcy.

[niemann]

I have account on YoBit.net from time I was participated in their signature campaign and I also promote my ref link in signature so I get some nice number of referrals which make my some BTC there.I just check and all balance is there,so far I have no problem with them.Before they send me e-mail for log in verification,but this is not the case anymore.

Is it possible that you and some others are victims of phishing or your log in data was exposed in any way?

Thank you for participating and thank you for giving your observation.

To tell you the truth I honestly want to believe that what happened to my wallet was not their intention. But ... No. No way I was hacked. For 13 years I worked as a senior network engineer with an ISP and I take pretty good care of the security of my devices. I'm not saying I'm a God given expert, but something as naive as a phishing attack is out of the question. Fake support and stuff ... c'mon. That even didn't work back in 90's. The suggestion of Yobit's support is not holding the water for a lot of reasons. Why? Well, here is why:

Let us assume for a moment that someone got my uname / pass combination by phishing. Fine. I'm a dumbass and got phished. They still have to go trough the 2FA. OK. Now, let us say further that they bypassed 2FA somehow. Apparently they hacked along the way my smartphone as well, got it turned on at just before 2 AM and used for 2FA, than they turned it back off. Wau! Some cojones. So they did that as well. Then we come to a point where the login attempt from a new IP has to be confirmed trough a unique link sent by an email. In the meantime not a single notification came in. Wait ... That is really a load of assumptions. Wouldn't you agree?

Now, back to me trying to convince myself that Yobit didn't wiped my wallet intentionally. At about that time (even before New Year's eve), Yobit was suffering a large number of massive DDOS attacks. If you will recall, at certain moments it was impossible to reach Yobit and than even if you got trough it was impossible to do anything further. You would wait and wait and nothing would happen. So, I'm thinking wouldn't it be just a bit more feasible scenario that Yobit actually got hacked just about that time? No 2FA, no confirmations, no notifications ... Well, that just might explain a lot. Still, to prove that, you have to have access to the network logs, transaction logs, activity logs, ... and check them. And again that still sits at Yobit's responsability ... not mine. This is actually the only reason why I'm still restraining myself from taking further action... for now.

Someone might say it's a rather small amount to make such a fuzz about it. Well, believe me, at this point it means a lot to me and I really, really, really need my amount back.

I will wait a bit more and see if they have any intention of giving me back my money or not.

[Captain_Planet]

Yobit has so many complaints and I am delighted I moved all my funds from yobit to other exchanges and to my personal wallets.

[suzanne5223]

Yobit has so many complaints and I am delighted I moved all my funds from yobit to other exchanges and to my personal wallets.

You're so lucky but this is outrageous still and I wonder where we're going in the world of crypto currency whereby trusted exchange are accuse of scam. However, bittrex and binance have been accused also and I think the best thing to use private wallet. 

[BeBlockTech]

So sorry to read about your loss...

Those exchanges know something we don't! With this crash that we are now encountering, the BitConnect scenario, the Bitfinex/Tether scam and so on... It wouldn't amaze me that they are all about to close their doors because it's very likely that regulations are on their way.

Cex.io that have their assets in a war zone, which doesn't make any sense https://imgur.com/HkmCOAl and customers waiting for over a month for their withdraws https://www.reddit.com/r/btc/comments/7qsndd/update_on_my_missing_usd_34000_with_cexio/ I think this is really a concern.

If I was you, I would head up to Reddit and make a post about your losses, that way, we can all upvote your post for visibility and you can make anyone aware of it.

I hope this gets resolved fast enough.

[potpockets]

Yobit is raising a large red flag. It can be a passing problem or a beginning of disappearance.

[warningsigns]

Best advice and solution is to stop using this exchange once and for all. Guys, stop sending and storing coins in an exchange with a super notorious reputation in the crypto world. Using Yobit is like playing with fire. You should treat coins you send to their hot wallets as potentially a donation to them. You might get them back IF you know the right people in Russia. Right as in powerful but of course they will want their share of whatever it is you are after.

Best thing to do is to give Yobit a wide berth.

[niemann]

So sorry to read about your loss...

Those exchanges know something we don't! With this crash that we are now encountering, the BitConnect scenario, the Bitfinex/Tether scam and so on... It wouldn't amaze me that they are all about to close their doors because it's very likely that regulations are on their way.

Cex.io that have their assets in a war zone, which doesn't make any sense https://imgur.com/HkmCOAl and customers waiting for over a month for their withdraws https://www.reddit.com/r/btc/comments/7qsndd/update_on_my_missing_usd_34000_with_cexio/ I think this is really a concern.

If I was you, I would head up to Reddit and make a post about your losses, that way, we can all upvote your post for visibility and you can make anyone aware of it.

I hope this gets resolved fast enough.

Tnx for the tip. I'll make a post on Reddit and will post a link here, so do support me.

Thank you again and thanks to everyone else for sharing the comments!

Best advice and solution is to stop using this exchange once and for all. Guys, stop sending and storing coins in an exchange with a super notorious reputation in the crypto world. Using Yobit is like playing with fire. You should treat coins you send to their hot wallets as potentially a donation to them. You might get them back IF you know the right people in Russia. Right as in powerful but of course they will want their share of whatever it is you are after.

Best thing to do is to give Yobit a wide berth.

Well, you do not have to be a Russian to raise the criminal charges. As I mentioned earlier, I've been exchanging phone calls with a friend from VTP Bank in Moscow. He already gave me some guidelines and a link to the Moscow Police with a form for reporting criminal activities. It actually makes no difference if you are Russian or not in doing so.
However, I am still kind of fooling myself that I will not have to go that far.  

[timerland]

Not sure how the hacker has done it without

1) 2FA being enabled on your account
2) Email verification on yobit's side
3) Login notification not being sent to your email

The only explanation i can think of is that all of your accounts have been compromised, your email, google authenticator, etc. Or it was one of your family members doing it that has physical access to your computer and mobile phone.

Just a heads up though, in these scenarios yobit can't do anything. Even if you contact support they won't be able to resolve the issue, the only trail the hacker has left is the yobicode. You may be able to ask the support to verify which account redeemed the yobicodes(even though it's probably a throaway).

[BitMaxz]

Not sure how the hacker has done it without

1) 2FA being enabled on your account
2) Email verification on yobit's side
3) Login notification not being sent to your email

The only explanation i can think of is that all of your accounts have been compromised, your email, google authenticator, etc. Or it was one of your family members doing it that has physical access to your computer and mobile phone.

Just a heads up though, in these scenarios yobit can't do anything. Even if you contact support they won't be able to resolve the issue, the only trail the hacker has left is the yobicode. You may be able to ask the support to verify which account redeemed the yobicodes(even though it's probably a throaway).

I think not only hacker is suspected here that honestly hard to think if how the hacker got the 2fa of his account unless if he is not adding 2fa authenticator.. I never heard this issue before in yobit but the other suspected here is the yobit because no one couldn't know the 2fa code except for yobit.
Or maybe the other way is someone install teamviewer in his computer to remotely use the google authenticator..
There are lots of ways honestly but if you didn't receive any notification that someone logging to your account (If the ip changes in my case before i receive notification) you should receive notification unless if you are using the same computer and ip..
Better to keep trying to contact yobit and ask for the ip and time listed in their system logs so that you can review this problem. .

[niemann]

Not sure how the hacker has done it without

1) 2FA being enabled on your account
2) Email verification on yobit's side
3) Login notification not being sent to your email

The only explanation i can think of is that all of your accounts have been compromised, your email, google authenticator, etc. Or it was one of your family members doing it that has physical access to your computer and mobile phone.

Just a heads up though, in these scenarios yobit can't do anything. Even if you contact support they won't be able to resolve the issue, the only trail the hacker has left is the yobicode. You may be able to ask the support to verify which account redeemed the yobicodes(even though it's probably a throaway).

I think not only hacker is suspected here that honestly hard to think if how the hacker got the 2fa of his account unless if he is not adding 2fa authenticator.. I never heard this issue before in yobit but the other suspected here is the yobit because no one couldn't know the 2fa code except for yobit.
Or maybe the other way is someone install teamviewer in his computer to remotely use the google authenticator..
There are lots of ways honestly but if you didn't receive any notification that someone logging to your account (If the ip changes in my case before i receive notification) you should receive notification unless if you are using the same computer and ip..
Better to keep trying to contact yobit and ask for the ip and time listed in their system logs so that you can review this problem. .

I checked the Google account activities and activities history. No unusual reports on account history. As for the activities history, the last one on January 4th was at 22:06 related to activities in this forum. On January 5th, the first one was at 8:37 related to reading the news. So, no one used my devices or credential to access Yobit at the time the theft occurred. I ran a sweep on all my devices to see if there is hijacker or a malware of any kind there ... and nothing. Clean. I purposely run 2FA on a separate device (smartphone). I have auto on/off set on my phone: it turns off at 23:00 and back on at 05:30. I have fingerprint unlocking on it. No way in a hell I was hacked and no way any of my devices were used to authenticate, login, create and use these codes at Yobit.

As far as I see it, there are two possibilities:
1). Yobit got hacked during the massive DDOS attacks
2). Yobit or someone at Yobit ripped me off

In either case, Yobit holds the full responsibiliy for restoring my wallet.
I contacted their suppor numerius times now and, other than the above shaddy reply, I got nothing.

[timerland]

Not sure how the hacker has done it without

1) 2FA being enabled on your account
2) Email verification on yobit's side
3) Login notification not being sent to your email

The only explanation i can think of is that all of your accounts have been compromised, your email, google authenticator, etc. Or it was one of your family members doing it that has physical access to your computer and mobile phone.

Just a heads up though, in these scenarios yobit can't do anything. Even if you contact support they won't be able to resolve the issue, the only trail the hacker has left is the yobicode. You may be able to ask the support to verify which account redeemed the yobicodes(even though it's probably a throaway).

I think not only hacker is suspected here that honestly hard to think if how the hacker got the 2fa of his account unless if he is not adding 2fa authenticator.. I never heard this issue before in yobit but the other suspected here is the yobit because no one couldn't know the 2fa code except for yobit.
Or maybe the other way is someone install teamviewer in his computer to remotely use the google authenticator..
There are lots of ways honestly but if you didn't receive any notification that someone logging to your account (If the ip changes in my case before i receive notification) you should receive notification unless if you are using the same computer and ip..
Better to keep trying to contact yobit and ask for the ip and time listed in their system logs so that you can review this problem. .

I checked the Google account activities and activities history. No unusual reports on account history. As for the activities history, the last one on January 4th was at 22:06 related to activities in this forum. On January 5th, the first one was at 8:37 related to reading the news. So, no one used my devices or credential to access Yobit at the time the theft occurred. I ran a sweep on all my devices to see if there is hijacker or a malware of any kind there ... and nothing. Clean. I purposely run 2FA on a separate device (smartphone). I have auto on/off set on my phone: it turns off at 23:00 and back on at 05:30. I have fingerprint unlocking on it. No way in a hell I was hacked and no way any of my devices were used to authenticate, login, create and use these codes at Yobit.

As far as I see it, there are two possibilities:
1). Yobit got hacked during the massive DDOS attacks
2). Yobit or someone at Yobit ripped me off

In either case, Yobit holds the full responsibiliy for restoring my wallet.
I contacted their suppor numerius times now and, other than the above shaddy reply, I got nothing.

You'd think that they have full responsibility, and i believe you. But if you think about it who else will be able to believe you? And will yobit even care about this? They've seen so many cases of this that they're probably not even going to reply to you let alone compensate you.

You simply have no proof other than what you wrote above, anhd that is definitely not conclusive evidence that yobit had an insider job done or got DDos'd.

Even if it is an insider job, don't you think that the support is on the "inside" as well?

Just think of it as buying a lesson, man. Don't store money you don't wanna lose on exchanges.