Hacked: lost all money on BTC-E. Please help!!

[Sipora]

Hi guys,

On December 15, I logged into my BTC-E account and saw that all my money was gone. Under transaction history, "someone" sold all my NMC to USD, then used that USD to buy all LTC's, then made a withdrawal of all LTC's to this address: LTKeQb8rkHAqudGWwdifjWKPpdsD7jPD3G

I have 2 factor authentication, I wasn't logged in at the time and I didn't receive any confirmation email from BTC-e to confirm the withdrawal. I don't know how the thief bypassed all of that security. Another thing is, under notifications, my last filled order was at 9:00 (which I did), but when the thief made the trades from NMC to USD, USD to LTC at 19:41 (according to the transaction history), these trades didn't show up on my notifications.

If any of you here could please provide any help in tracking down this thief (or BTC-e), I would very appreciate it!

Thanks!

[lukas_krs]

Hi Sipora,

I'm really sorry to hear what you've experienced. I understand it can be depressing since I went though something similar recently.

Anyway, the first thing that I would suggest to do is to contact btc-e and ask them on how it was done (which authentication was used and any changes in the email address)
And don't forget to change your password for the btc-e account and email, since your password might have been comprimised.
Virtual currency is something that's very hard to track, since it's the main purpose of the currency in the first place. But you can track someone who login into your account, by checking it in with the btc e website.

Hope you get to see some light from contacting btc e.

Best wishes,
Lukas

[Sipora]

Hi Lukas,

Thanks for your reply! I contacted BTC-e and all they gave me was login logs and transaction history. They said the withdrawal has been confirmed by my mail but I swear to God that I had no idea how all of this happened. Not even in my dream. I don't even bother changing my password anymore since they took all my money, there's nothing for them to take anymore. Though everytime I log in, I still need to enter the 2 factor authentication code, no idea how the heck they took my money.

I suspect it was a mistake from BTC-e but no idea. I hope the help from community here at bitcointalk.org would help me find a way. I'm almost hopeless now.

[jerelimZ]

The IPs from logs was yours?
Also if somebody have access to your email, he can delete confirmation emails. Try to ask email provider if any email was deleted

[TalkingBit]

Ask btc-e what IP did the withdrawal? Not many ways to go around the 2FA

[Sipora]

Yes the IPs they gave me were all mine. There was a login at 19:24, about 15 mins before the withdrawal happened but I don't think I logged in BTC-e then. Usually I would get a "Successful Authorization" email from btc-e after I log in too but there's no email like that at that time either? I checked all over my email, including trash, spams and there's no a single email from BTC-e. I highly doubt someone could bypass by 2 factor (which needed my iPhone), logged in to my btc-e, did all the trades, made the withdrawal, went to my email, confirmed the withdrawal, then deleted the email without me knowing anything. I use gmail and I check it very often.

I just don't understand if they made the trades from NMC to USD, USD to LTC, why aren't these trades on my notifications. Usually when an order is filled, it shows up on notification right? I still have all notifications from my last trades, but not these at 19:41.

[lukas_krs]

So, the ip login 15 mins before hacking was yours too? And this is really weird. I haven't use btc e before, but I assumed the email might be changed before the transation and then get changed back.

Contact btc e support and ask them if there is any changes was done in your account within the timeframe that person login until when the hacking was done

This should be btc e contacts (if it's still their current one) @btcecom
 Icq - 610112128
 Skype - btc-e.support
 E-mail - support@btc-e.com

[Sipora]

This is what BTC-e gave me:

117 login success login [MY IP]
15.12.13
20:51 -> this is when i logged in and realized all was lost, i have this "successful authorization"
116 login success login [MY IP]
15.12.13
19:25 -> 15 mins before withdrawal, no record of this in my email
115 login success login [MY IP]
15.12.13
08:46 -> i logged in, did some trades and there's a "successful authorization" in my mailbox

[walters]

How much have you lost there?

[hyphenated]

This sounds moderately scary, but you want to consider the obvious, too.

Firstly - what is the *physical* security around your computer?  Is your two factor password generator on your phone?  Are you in a shared house or dorm?

In other words, could someone have walked into your room, found your computer logged in (or used auto login) and your phone next to it, and spent two minutes cleaning you out?

Is it hacking or straight theft (or hopefully a practical joke)?

[Sipora]

I personally don't understand how this all happened, really. I live in a highly secured apartment building, by myself, plus it was on Sunday so I was at home. My computer is finger print protected (Thinkpad X1 Carbon). 2 factor authentication is on my iPhone.

My theory is BTC-e accidentally let someone in my account and that person cleared out everything. I've been hammering BTC-e support site but only got 2 responses from them so far, both of them are obviously useless.

[TalkingBit]

Sorry but looks like you're out of BTC. Looks like BTC-E did everything right, either someone physically jumped on your computer when you stepped out for a sec. Or you have a trojan on your PC.

[Sipora]

I added Skype "btc-e.support" as suggested above and the guys said he could do a rollback service for 3 btc's. Is this a scam?
Again, there's no one that could have entered my computer. Maybe a trojan but I think btc-e is at fault too, all of this happened without a trace, how is it possible? We might need to question their security.

[choose_username]

I added Skype "btc-e.support" as suggested above and the guys said he could do a rollback service for 3 btc's. Is this a scam?
Again, there's no one that could have entered my computer. Maybe a trojan but I think btc-e is at fault too, all of this happened without a trace, how is it possible? We might need to question their security.

As long as you don't pay him to do the 'rollback' and you don't provide them with any login credentials to accounts that still hold fiat and or BTC there is nothing they can scam you off (as long as you don't give them any password you use on other sites). If they ask you for money to do this it is definitely a scam. Otherwise you have nothing to loose.

[hyphenated]

Rollback?

BTC-e executed a rollback of trades after their master password was compromised in mid 2012 - this boiled down to an exchange resetting the trading floor and covering the losses out of reserves.  However, I've never heard of an account rollback, nor do I believe it to be possible, so unless it passes the sniff test and is paid for with money recovered, I would stay well away.

[Sipora]

Hello all, I just want to follow up on this post to see if any of you would be able to help me out. I think the reason must be BTC-e withdrawing money from the wrong account. How is it that I didn't receive any successful authorization email for the login 15 mins before the withdrawal but I received that email for EVERY other login? How is it that I did not receive any confirmation email to confirm the withdrawal? AND I did have 2 factor authentication too!

Do you guys think BTC-e should be liable for my loss?

[Omikifuse]

This is what BTC-e gave me:

117 login success login [MY IP]
15.12.13
20:51 -> this is when i logged in and realized all was lost, i have this "successful authorization"
116 login success login [MY IP]
15.12.13
19:25 -> 15 mins before withdrawal, no record of this in my email
115 login success login [MY IP]
15.12.13
08:46 -> i logged in, did some trades and there's a "successful authorization" in my mailbox

Anybody staying with you?

[Sipora]

Not at all. I have my own apt in a secured building.

[Newar]

Don't trust btc-e.support on skype. There's a number of fishy conversations posted with that account (disgruntled former employee?). It is no longer listed as a contact on the site either. The only way seems http://hdbtce.kayako.com/

Dropbox' implementation of 2FA has been hacked last year. Why not btc-e's?

What's confusing me is the missing login alert email. Since a hacker would have needed to login to turn it off.

[Sipora]

Don't trust btc-e.support on skype. There's a number of fishy conversations posted with that account (disgruntled former employee?). It is no longer listed as a contact on the site either. The only way seems http://hdbtce.kayako.com/

Dropbox' implementation of 2FA has been hacked last year. Why not btc-e's?

What's confusing me is the missing login alert email. Since a hacker would have needed to login to turn it off.

I have no idea how someone could bypass all the security. that's why I think it might be an insider's job. Sigh* really hopeless now