Stolen Coins Right After Getting Vanity Address

[desii1]

The sad story....  I generated vanity addresses* (online) for two wallets to easily keep them separate.  Moved them into MultiBit and locked the wallets with a 14 character LastPass generated password. 

I did NOT break from the internet when I combined the vanity secret keys.

The next morning MultiBit showed a transfer out of 5 coins to an unrecognized address, the transfer took place two hours after I left the computer. 

I have all of the normal security, e.g. behind a router, Norton firewall and virus protection.  I did have both Flash and Java on the machine.  They are gone now!

I believe two factor would have been my only protection.  Are there any offline wallets with two factor?  I am installing Armory now.

Until someone writes an easily useable, safe, wallet Bitcoin is going to be held back.  I thought I was being more conservative moving my coins out of Coinbase.  Guess not since they use two factor.

I would love to know how it was done.  There should be a centeralized reporting place to see if there are similar problems with specific websites.

*https://bitcoinvanity.appspot.com/  < the site I used.  I am NOT accusing them!

[guybrushthreepwood]

Blockchain.info has 2 factor auth and a second password to spend funds, so it's pretty secure, but I know a lot of people don't trust keeping coins online, but as you found out storing them on your computer isn't fully safe either.

[Colin Miner]

Store your coins in your own bitcoin-qt wallet with a pass phrase. You can import your vanity addresses into it and you don't rely on others to provide security.

You should do a virus scan with a different virus scanner than you are using, like the Kaspersky rescue cd because it looks like you are infected.

[miners78]

I was about to get a vanity address :S. Guess not now..

[MegaHustlr]

I would never trust vanity addresses, just so dodgy

[jonanon]

Offline storage is the safest way to go 

[Sonny]

Sorry to hear your loss.
You should have downloaded Vanitygen and run it offline instead.

[yatsey87]

I don't trust these vanity address creaters or paper wallets. Do everything like this offline and only start with a small bit of funds being sent.

[Sonny]

I don't trust these vanity address creaters or paper wallets. Do everything like this offline and only start with a small bit of funds being sent.

I am not sure about other programs, but vanitygen is open-source and you can get the source here.
https://github.com/samr7/vanitygen

[Mitchell]

Sorry to hear your loss.
You should have downloaded Vanitygen and run it offline instead.

This. There are ways to safely generate a Vanity address, one being doing it yourself or buying an address from a vanitygen  pool which uses Privkey and Pubkey. However using a vanitygen pool will cost you a bit (click)

I don't trust these vanity address creaters or paper wallets. Do everything like this offline and only start with a small bit of funds being sent.

I am not sure about other programs, but vanitygen is open-source and you can get the source here.
https://github.com/samr7/vanitygen

Vanitygen is safe and has been around for a while now.

[Sonny]

Sorry to hear your loss.
You should have downloaded Vanitygen and run it offline instead.

This. There are ways to safely generate a Vanity address, one being doing it yourself or buying an address from a vanitygen  pool which uses Privkey and Pubkey. However using a vanitygen pool will cost you a bit (click)

I don't trust these vanity address creaters or paper wallets. Do everything like this offline and only start with a small bit of funds being sent.

I am not sure about other programs, but vanitygen is open-source and you can get the source here.
https://github.com/samr7/vanitygen

Vanitygen is safe and has been around for a while now.

Agree with bitcoininformation. 
Oops, it seems like bitcoininformation agrees with me indeed lol 

[yatsey87]

Sorry to hear your loss.
You should have downloaded Vanitygen and run it offline instead.

This. There are ways to safely generate a Vanity address, one being doing it yourself or buying an address from a vanitygen  pool which uses Privkey and Pubkey. However using a vanitygen pool will cost you a bit (click)

I don't trust these vanity address creaters or paper wallets. Do everything like this offline and only start with a small bit of funds being sent.

I am not sure about other programs, but vanitygen is open-source and you can get the source here.
https://github.com/samr7/vanitygen

Vanitygen is safe and has been around for a while now.

I meant like online website ones.

[Mythul]

I feel sorry for the loss. Maybe you had a hidden trojan somewhere on your pc. Be careful what you download of the internet.

[Rawted]

Use the QT. Quit relying on others to provide security for you.

[2double0]

Use the QT. Quit relying on others to provide security for you.

Then you have to be VERY careful about your programs etc. Just use blockchain.info's wallet service.

[Omikifuse]

So far bitcoin-qt is the best. Just use that wallet and nothing else..

[DannyHamilton]

Use the QT. Quit relying on others to provide security for you.

Then you have to be VERY careful about your programs etc. Just use blockchain.info's wallet service.

In which case you STILL have to be VERY careful about your programs etc.

blockchain.info's service is just a wallet that runs in your browser.  Any program that can steal your bitcoins from a wallet running on your computer can steal bitcoins from blockchain.info's service.

[Sonny]

Use the QT. Quit relying on others to provide security for you.

Then you have to be VERY careful about your programs etc. Just use blockchain.info's wallet service.

In which case you STILL have to be VERY careful about your programs etc.

blockchain.info's service is just a wallet that runs in your browser.  Any program that can steal your bitcoins from a wallet running on your computer can steal bitcoins from blockchain.info's service.

Exactly.

If you have a trojan/keylogger on your computer, your bitcoin will be stolen, no matter you are using bitcoin-qt, electrum, multibit, bc.i online wallet, or using exchanges / gambling sites to keep your bitcoin.

That's why you should never download a random file or click a random link, and you should better use a offline wallet to store your bitcoin.

[Banksy]

Just like to bump this, exact same thing happened to me after using https://bitcoinvanity.appspot.com

I imported the new address into blockchain.info and secured with 2FA and email login approval.  7 BTC lost withdrawn to a random address over the past weekend. 

The only conclusion I can come to is that bitcoinvanity.appspot.com has been hacked, I note that nibors last post on 31 Dec 2013 is:

"Currently off-line due to hack - no bets lost though. Will update later."

This is regarding the sister site www.pinballcoin.com

Im pretty sure my mac has not been compromised, only install files from the app store and I have other wallets that are fine, just this one created via bitcoinvanity.

Expensive lesson for me to try and shortcut running the open source myself but hopefully someone else doesn't make the same mistake.

[duhosnyul]

Why need those vanity address. You are just creating another hole to your security. QT is enough and use a new clean install pc with only antivirus on it besides bitcoin and never use it other than storing your bitcoins.