|
watertech666 (OP)
|
 |
August 19, 2013, 03:50:58 PM |
|
unfortunately. my 2 wallets were stolen 2 hours ago by same thief. thief's address is 1FeUJVtvchu3NREJnACpWAYG6B1xN4oBKB . he stole 42 btc from 1Mq2Q1BMicK4ECE6GNR6mDTPdkxwxDe3mc and 221.84btc from 1CzAncjXYjtiXNC4CNAw4RoKdQLoi72xn
can any one help me to track this address and catch this thief?
|
|
|
|
|
|
|
|
|
|
|
"Bitcoin: mining our own business since 2009" -- Pieter Wuille
|
|
|
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction.
|
|
|
|
|
|
|
|
peonminer
|
|
August 19, 2013, 04:03:47 PM |
|
Holy fuck. Sorry for the loss. I don't know the link... but there is a data recovery service provided by a company for BTC. First of it's kind.
|
|
|
|
|
|
m19
|
|
August 19, 2013, 04:06:58 PM |
|
Sucks man, looks like he stole alot more than that, that address received alot more BTC today.
|
|
|
|
|
|
impulse
|
|
August 19, 2013, 04:16:05 PM |
|
If you don't mind me asking, how were these coins stored and secured? It might help if you can figure out how they were compromised.
|
|
|
|
|
|
auzaar
|
|
August 19, 2013, 04:17:28 PM |
|
How?
|
|
|
|
|
BurtW
Legendary
 Offline
Activity: 2646
Merit: 1130
All paid signature campaigns should be banned.
|
|
August 19, 2013, 04:22:55 PM |
|
What wallet were you using?
Do you have an android phone?
Do you have a Bitcoin wallet on your android phone? If so which one?
The fact that the thief gave you change is interesting. Why not steal all the BTC?
|
Our family was terrorized by Homeland Security. Read all about it here: http://www.jmwagner.com/ and http://www.burtw.com/ Any donations to help us recover from the $300,000 in legal fees and forced donations to the Federal Asset Forfeiture slush fund are greatly appreciated! |
|
|
Elwar
Legendary
Offline
Activity: 3598
Merit: 2384
Viva Ut Vivas
|
|
August 19, 2013, 04:27:09 PM |
|
IP address shows France but it could just be a hop.
|
First seastead company actually selling sea homes: Ocean Builders https://ocean.builders Of course we accept bitcoin. |
|
|
|
watertech666 (OP)
|
|
August 19, 2013, 04:35:20 PM |
|
What wallet were you using?
Do you have an android phone?
Do you have a Bitcoin wallet on your android phone? If so which one?
The fact that the thief gave you change is interesting. Why not steal all the BTC?
i don't use android phone. i use blockchain.info he stole all btc in these 2 address. |
|
|
|
|
|
|
auzaar
|
|
August 19, 2013, 04:44:34 PM |
|
i don't use android phone. i use blockchain.info
he stole all btc in these 2 address.
... I am looking into it but so far it looks like your are the victim of a known issue, the bad signature bug caused by a faulty secure random number generator. ... News: Due to a serious flaw in Android, all users of Android-based wallets must take immediate action. More info You can find out more there. But he said "i don't use android phone." does this RNG problem affects web wallets too, then whole internet is doomed |
|
|
|
|
|
M4v3R
|
|
August 19, 2013, 04:50:54 PM |
|
@BurtW: Incorrect. The ECDSA signature is the first part of the script, starting with 304…. The last part that you've highlighted is scriptPubKey, which is the same because the Bitcoin address for both transactions you checked was the same. So no, this was not the cause of the theft.
|
|
|
|
|
DeathAndTaxes
Donator
Legendary
Offline
Activity: 1218
Merit: 1079
Gerald Davis
|
|
August 19, 2013, 04:51:42 PM
Last edit: August 19, 2013, 05:35:40 PM by DeathAndTaxes |
|
<snipped incorrect information deleted by BurtW. I left the explanation at it may help others to understand Bitcoin tx better>
304402205713e765e3c010b6d8f7bfee8e574f1423c88fdd9504d4ec0128b8f6f0037e6702204f625cb1772dc54dcc662cabade0a20141b849e5e4b4d80c98876c42bcd5f98f01 04b8c7b27846a1df35a87763f75b421a4f8148d17ca91c2daab6838aa5b04d48e373bba0cc1e081 be696bc626296febcdccab5336a43b8861a91afa57865bbb3f5
and
3046022100ce9509ae9b442f0ad2684b7fd83923b4f6df70c9197f22c616c429a6efac03a3022100da424212a11effccc7eadf8bf532250911706636483376dbd5ef04033f75104201 04b8c7b27846a1df35a87763f75b421a4f8148d17ca91c2daab6838aa5b04d48e373bba0cc1e081 be696bc626296febcdccab5336a43b8861a91afa57865bbb3f5
The signatures are not the same. The bolded portions is the public key and it will remain the same for all tx from the same address.What is commonly (and incorrectly) referred to as the "signature" is actually the "ScriptSig & PubKey". The portion beginning with 0x30 is the actual signature. The portion of the signature that is the unique random number is underlined (thank for correction: M4v3R). The portion beginning with 0x04 is the pubkey. This diagram might help it shows a breakdown of the TxIn structure. https://en.bitcoin.it/w/images/en/e/e1/TxBinaryMap.pngFor secure ECDSA signatures one must use a nonce (number used once) which hasn't already been used in a prior signatures. Although it doesn't need to be random (just unique) large random numbers are normally used to simplify nonce selection. If the nonce is reused then the private key can be reconstructed from the other information. The android flaw is that it duplicated random numbers however the OP indicated he doesn't use an android phone. On edit: r value can be "eyeballed" but it is the portion underlined not the bolded portion. Thanks M4v3R |
|
|
|
|
|
TitanBTC
|
|
August 19, 2013, 04:54:38 PM |
|
Can you contact blockchain to get a record of logins to your account? You may have a key stroke logger program that is installed on your machine and they just collected your login info from that data. If blockchain shows someone logged in as you, at a time that doesn't look familiar to you, they probably used more traditional hacking methods to get access. Let's rule out the easy stuff first.
|
|
|
|
rumbitla
Member
Offline
Activity: 98
Merit: 10
|
|
August 19, 2013, 04:55:47 PM |
|
i don't use android phone. i use blockchain.info
he stole all btc in these 2 address.
Did you have 2 factor authorization activated on blockchain.info? |
|
|
|
|
BurtW
Legendary
Offline
Activity: 2646
Merit: 1130
All paid signature campaigns should be banned.
|
|
August 19, 2013, 04:57:34 PM |
|
@BurtW: Incorrect. The ECDSA signature is the first part of the script, starting with 304…. The last part that you've highlighted is scriptPubKey, which is the same because the Bitcoin address for both transactions you checked was the same. So no, this was not the cause of the theft.
Thanks, deleting my stupid post now. |
Our family was terrorized by Homeland Security. Read all about it here: http://www.jmwagner.com/ and http://www.burtw.com/ Any donations to help us recover from the $300,000 in legal fees and forced donations to the Federal Asset Forfeiture slush fund are greatly appreciated! |
|
|
Chef Ramsay
Legendary
Offline
Activity: 1568
Merit: 1001
|
|
August 19, 2013, 04:57:47 PM |
|
Holy crap!! I sure hope we can get to the bottom of this.  |
|
|
|
|
BurtW
Legendary
Offline
Activity: 2646
Merit: 1130
All paid signature campaigns should be banned.
|
|
August 19, 2013, 05:03:44 PM |
|
Also, thanks to D&T for your great post (as always).
However, let's talk about your password on blockchain.info. How many characters is it? Did you use the same password anywhere else? Was it "strong" and "long"?
|
Our family was terrorized by Homeland Security. Read all about it here: http://www.jmwagner.com/ and http://www.burtw.com/ Any donations to help us recover from the $300,000 in legal fees and forced donations to the Federal Asset Forfeiture slush fund are greatly appreciated! |
|
|
The Bitcoin Catalog
Full Member
Offline
Activity: 238
Merit: 100
The Bitcoin Catalog ---> Get Started!
|
|
August 19, 2013, 05:06:10 PM |
|
|
|
|
|
|
dddbtc
|
|
August 19, 2013, 05:08:02 PM |
|
Oh come on now, don't throw salt in this users wound. If you were driving home from your bank with thousands of dollars in your wallet and armed thieves stole all your cash but one dollar in your front pocket. You'd tell people they stole ALL your money too. |
|
|
|
|
rumbitla
Member
Offline
Activity: 98
Merit: 10
|
|
August 19, 2013, 05:11:39 PM |
|
Holy fuck. Sorry for the loss. I don't know the link... but there is a data recovery service provided by a company for BTC. First of it's kind.
Yeah, but what they can do is limited to: "The company is offering a Bitcoin retrieval service to individuals, companies and businesses around the globe who may need Bitcoin recovered from damaged hard drives, memory cards and mobile phones." http://www.sytech-consultants.com/ |
|
|
|
|
|
