Case against Stocks.exchange. How they stole my coins

[brander]

I have an account on Stocks.Exchange. I was trading there with success. Not having any problems with deposits, trading and withdrawals. Until the 22 of January. My account was locked out. 2FA was enabled on my account and I did not enable it. So I tried to contact support. That was a challenge, since you can’t fill in a support ticked without an account. So after spamming on twitter and on the business email I finally had a response. "Please send an email to support@stocks.exchange" Nice a reaction, so i send an email. What then happened was a bit of fun and unique, that would be the right word.

So here is the story of how "the solving of my account" was going.

22 jan 2018:
I Noticed that my account was enabled with 2FA. On twitter there was a message on how to fix it. No success for me

23 jan 2018:
Just in case i reset my password. I received an email with the link, and i successfully reset my password

29 jan 2018:
First response from the business mail address:

Code:

go to support@stocks.exchange

So I did. Btw could not find that mail address on their website.

29 jan 2018:
And after that i had a reply from sasha:

Code:

Hello, it can enable someone else who had access to your account. If you had enabled 2af before you won't have such problem.

ok.....wauw what a support. Keep calm and reply professional So i ask what can I do to enable my account.

30 jan 2018:
Reply from sasha:

Code:

Ok, please, give answers to these questions:
- what active wallets do you have?
- what approximately amount on it?
- your last orders?

So I replied my information. Couple of coins I could not give the exact amount. But a couple I had in the blockfolio app. And I send the email with my last withdrawal.

30 jan 2018:
Reply from sasha:

Code:

Some information doesn't match. Do you remember your withdrawals?

Hmm that is weird. So I send again my last withdrawal

31 jan 2018:
Reply from sasha:

Code:

hello, I saw your email and you aver that your last withdrawal was 2018-01-06 19:18:36
but after that it was at least 2 more withdrawals. Your 2fa will not be disabled. You can't provide full information.

I thought what the f. How is this possible. Maby I am hacked? I still can access my email, there was no ordinary activity and I did not receive a msg from google that my email was used somewhere else. Strange... so I ask sasha to send me the last withdrawals, ip address that uses my account. I was losing my patience

31 jan 2018:
reply from sasha:

Code:

First of all read TERMS OF USE cause we are not responsible for that!

IP address - no information
Last withdrawals to:
BTLLC -> LPs3VeG5PiBW1vjqWdSB2XXULsoMdvJ2Dt (wallet) 2018-01-29 04:07:34
ITNS -> iz4w8FxBc4r3n1XjX6Xz1SevMoPFKLsvUXEUTrAmRCdMLF4GyYarzphAFjrtHbaMv1TygTcvJWzGN3zNR6PeEYuc1w8QYkNN5 (wallet) 2018-01-23 14:06:05

This was the moment i thought "They stole my coins". These wallets are not mine. So i send this email:

01 feb 2018:

Code:

Hello Sasha,
Don’t you find it weird that there is a transaction on my account when we are in discussion on enabling my account? I give you my balances. They are almost spot on. And you won’t enable my account because of the last withdrawal. I think it is a little bit sketchy. ITNS -> GONE. BTLLC -> GONE. I want my coins back. If you enable my account I will not give you negative credits on forums, twitter etc. If you don’t enable my account then it is your responsible for all the negativity that will come.

* You cannot provide me with IP addresses.
* No email was send to me of my withdrawals.
* You can't give me prove of those emails.
* The first transaction was on the 23 of January. And my account was locked out before the transaction Look at your twitter account and email.
* No email was send to confirm the transaction.

Fill in the dots how this looks like. It is up to you.
 
With kind regards,
 
Burnertje

01 feb 2018:
Reply from sasha:

Code:

You can't confirm your account. Information that you gave does not match. Your were able to enable 2fa when you create account.
It's not your account. Since, 22, Jan all withdrawals need to be confirmed with 2fa code. confirmation link does not come to your email address.
I provide you withdrawal wallets. You are able to investigate.

Best regards

5 feb 2018:
I did a test, reset my password again. That’s weird i received an email. So mail is working.
Long story short i still dont have access to my account. And i made a promise to sasha. Here is the forum post. They stole my coins.

PS: My login, email and twitter account are all the same username.

[1713443809]

1713443809

[1713443809]

1713443809

[1713443809]

1713443809

[RomanoProddi]

Why exchange is guilty in your problem if you were hacked? Use 2FA and sleap well 

[brander]

Why exchange is guilty in your problem if you were hacked? Use 2FA and sleap well 

Well that is the whole problem. I did not get hacked. They dont have proof that I am hacked. They cant profide me with the nessesarry information. I except that i dont use the 2fa. But there  are still some coins on my account. And I want them back. So why not enabble my account. That was the easiest way.

[pinkman12345]

I think you were Phished, I am a reputed member of ethereum stack exchange. I have helped too many people there. The site is stack exchange not stock exchange.
Its bad that people are using such a great community name to smash the scam.

[brander]

I think you were Phished, I am a reputed member of ethereum stack exchange. I have helped too many people there. The site is stack exchange not stock exchange.
Its bad that people are using such a great community name to smash the scam.

Hello, Good that you are a reputed member. But you are a little bit wrong.

here is the exchange website

https://stocks.exchange/

It is kinda different then stack exchange. Did you google it?

[JiravitTM]

Stocks.exchange have twitter you can post on twitter comment too i think more people and support maybe see.

[brander]

Stocks.exchange have twitter you can post on twitter comment too i think more people and support maybe see.

Posted it on twitter. Support is not doing anything. They have stole now all my coins. It is a shame.

[brander]

A little update:

They enabled my account  . But it's empty.

2018-01-23 13:23:50   10561.07069805 BTLLC   0.003 BTLLC   LPs3VeG5PiBW1vjqWdSB2XXULsoMdvJ2Dt   Finished   
fd218ce4db77e7aa32624d990506b58866b173dc112ebe58521e555114658c2c
2018-01-23 13:22:34   7892.84327488 ITNS   0.01 ITNS   iz4w8FxBc4r3n1XjX6Xz1SevMoPFKLsvUXEUTrAmRCdMLF4GyYarzphAFjrtHbaMv1TygTcvJWzGN3z NR6PeEYuc1w8QYkNN5   Finished   
7c69f07b1308416c3180def8f1064ae9761a05a590728bc607783d88fd324aeb
2018-01-23 13:21:23   46424.16570968 BCN   0.01 BCN   2AWeT6K1q2sMSQgeinByAhHdoJyFwHDv5PaNN6QZD3wFh3mLdwMEnoydJexY9qhsdCF3vnzxSAETbbf 9ZsYHGQbrGsupmCc   Finished   
96523f41b503794a33686e6f1b45a950b5b6f76f636b1637e8ffdc4dc98d1715

They emptied my account. Kinda weird that they now enabled my account. There was no change after they stole my coins. I think it is sketchy

[Patatas]

I think you were Phished, I am a reputed member of ethereum stack exchange. I have helped too many people there. The site is stack exchange not stock exchange.
Its bad that people are using such a great community name to smash the scam.

Dude you serious ? lol You're a solidity developer and you didn't recognise the difference between https://stocks.exchange/login and https://ethereum.stackexchange.com/ ? One is an exchange ,later is a sub-division of stack-overflow community.
Moreover,if you think of it,how would one get scammed on stack-exchange ? 

OP - When people suggest to not store coins on exchanges,you don't follow it.Start following.

[tonedepear]

Interesting. I've had a s.e account for a few moths, never any balance left in, then over the easter weekend I left 5 dero in there (because dero withdrawls are suspended) and lo, I try to log in this morning and find that 2fa has suddenly been enabled (I had never enabled it nor had trouble logging in before).

Trying to disable it again eventually worked after a few hours, and would you believe it, in the time I had not had access to the account, the 5 dero had been spirited away via BTC conversion and then to DOGE and withdrawn.

Now, anyone arguing it's my own fault for not enabling 2fa is well within their rights, but I am *quite* confident I haven't been hacked or phished and it's a strange coincidence indeed that this never happened until suddenly I had some balance sat there for a couple of days.

I have now enabled 2fa, but still. Would suggest anyone using S.E for anything at all, even tiny amounts like myself, to use 2fa from the start or risk anything that dwells in the account disappearing.

FWIW the DOGE address my dero ended up in ended ...TM2j6Q.

[StelioKontos]

Stocks.exchange have twitter you can post on twitter comment too i think more people and support maybe see.

Posted it on twitter. Support is not doing anything. They have stole now all my coins. It is a shame.

You probably have been really stolen your account and "they" - some hackers - stolen your funds. Not "they" as the stocks exchange admins.

Did you use same email/password on other websites? If yes the hacker having access to that email/password combination may have tried on other services and used to login in your place.

Always use a different password for every website. It's a bit more difficult to manage and rememeber - I use a password manager for this - but it's more secure.

[coinwizard_]

The answer is in your first paragraph. 2FA was enabled and you didn't enable it. When you join an exchange, especially a low volume new exchange, you must enable 2FA otherwise you may as well just airdrop your own coins away