unlocking/restoration of my account

[Mopar Mining]

early this morning, somehow my account was compromised and someone with an IP address in Paris, France (based on email from bitcointalk.org email) and changed my password and email address and also posted for an unsecured loan in this thread https://bitcointalk.org/index.php?topic=3243635.msg51724618#msg51724618 - Luckily I was online when it happened and attempted to first change my password but they had done so and locked me out - I got the email from the forums stating I could lock the account thru the link they sent - So, I did. I have changed my email password and the password for pretty much every other site I use.

I sent an email to  recoveries...@bitcointalk.org as instructed - just waiting to get a response.

anyone able to provide a rough ETA? It has been about 18 hours so far. I would like to get in the account and check https://bitcointalk.org/myips.php to verify the ip address.

I have sent an email to the ISP that provides service to the user of the ip address I got via forum email and they are also "investigating" so they said at least - not sure how far that will go.

I would hate to have to start over on a new account

my original account is: https://bitcointalk.org/index.php?action=profile;u=1478835

I was online and saw something pop up on the "Show new replies to your posts" (I have a 15 second refresh set up on that page in a separate window) - at the point of all of this I had been logged into the forum for over 43 days without logging out) - I clicked it, saw no post by me - went to my "show last posts of this user" and saw that the post was not there, So I posted the:

"not sure why this is has my name --- I never made this post and it does not show in my post history. that address is also not my btc address"

When I went back to my profile to attempt a password change, I was then notified that my password was wrong - when I attempted to reset it, it said my email was not found - I went to my email and saw the two emails from the forums - I used the provided link to lock the account and emailed the provided address referenced in the email.

I believe they derived/obtained my password somehow and were on the account at the same time I was and then changed it while we were both on - it is quite possible to be logged in from multiple locations - I have an active window on at least 2 pcs in my house and one at my job -without ever logging out of the other pcs.

I believe had I not been online at the same time, it would be a completely different situation. They may have tried to post more scams or pulled some other shenanigans.

I did not make the post asking for the loan - it is shown to have a Paris France IP address whereas I am in Florida, USA

I am still unsure how they obtained my password but I am glad I was online when it occurred but I assure @WhyFhy I was not trying to scam anyone and I sure as hell do not need a .05 BTC loan

Email was changed afterwards. This is the rough timeline from what I understand:
1. Stryfe was hacked. Hacker keeps the same information so that Stryfe is unaware of the hack
2. 'Stryfe' posts a loan request
3. I deny the loan request
4. Hacker deletes loan request, trying to hide their tracks
5. Stryfe receives an notification of some sort when I quoted them and comes to this thread wondering what it was about
6. Hacker realizes that Stryfe realizes that the hacker has access to his account and changes the account information
7. Stryfe locks the account

This pretty much hits on the head - if my first description was unclear (note all the edits to that post) it is because I had already been up 18 hours and was also trying to figure out what happened while also changing all the pw's to every account I have.

[1715293964]

1715293964

[WhyFhy]

I know you dont need the loan lol .05??? xD
You need to do a systems check.
look for keyloggers, haveibeenpwned and other resources
I would triple quadruple check your mining securities
2fa on a different device other then active phone ect.
2fa and access code  fort knox it. Primarily seek out where you where penetrated and patch it up asap.

[Mopar Mining]

Moving this over here - as we were starting to flood DarkStar's thread and that was not my intention.

Request For a No Collateral Loan
Required BTC Amount: 0.05
Estimated Loan Duration: 3 weeks
BTC Address: 1LCfBebASQovgECYnSkBvNstkjRV9EnUWx

Code:

-----BEGIN BITCOIN SIGNED MESSAGE-----
Requesting for a 3 weeks 0.05 BTC no collateral loan
Today is July 06 2019
-----BEGIN SIGNATURE-----
H7uiV/lOxpyEsVZoD3nZkygu+TrrwHXgYVNuJRIznZWZYtmzKjjJWP+RwecMBVVMoL/lnOdC6XT9UBsFjRJHYZE=
-----END BITCOIN SIGNED MESSAGE----- 

Denied, sorry.

not sure why this is has my name --- I never made this post and it does not show in my post history. that address is also not my btc address

I definitely saw it from you. Change your passwords - I think your account has been hacked

yes it appears I was hacked - why, I dont freakin know or how.  I did not see the forum email telling me first my pw was changed and that my email address was changed but I saw the email of you quoting me - which is what drew me here. In the email that said my account info was changed - there was a link to lock the account and I then had to email to    recoveries...@bitcointalk.org

I am currently locked out but so should they be. I just hope they didnt cause too much mayhem in their short time on my account. luckily I had not yet gone to bed.

image of the emails I received, showing I still have control of the email account at least.

https://ibb.co/MkM0JLk


edit... this really pisses me off - I have worked hard to get the few merit and trust rating I have. I strive to keep all my posts on the up and up and I detest scammers.


another edit.... how does the post that is quoted above not show in my forum posts list? I dont see any way to delete them - and tbh I dont know if they can nor have I ever tried to delete from this history. I do know that if I post something it has told me it takes 24 hours before I can delete my post if I recall - so I am even more confused...

this image shows my last few posts and the scam post quoted above is not in that list. note: the times are wrong because I have not set up the times in this account yet. Really hoping that I do not have to use this account and that my other one can be unlocked.

https://ibb.co/0qbgh64

another edit... The ip address that did this appears to be a Paris France IP address.

185.94.189.187 IP Address Information
ISP   M247 Ltd
Usage Type   Data Center/Web Hosting/Transit
Domain Name   m247.com
Country   
City   Paris, Ile-de-France

final edit, then I am going to bed and hope to hear from forum staff on getting my account back.

It is my hope that once I get back into original account that I can use https://bitcointalk.org/myips.php and verify that the ip address above is the one that was logged into my account and verify that it was no way at all possibly me.

btw @DarkStar - I hope once I get the account back that you will remove that negative trust - I saw it when viewing the account to check the posts once I got locked out.

I hope you end up getting your account back! You are always allowed to delete your own posts (outside of Auctions), and I don't believe that Lending has the 24 hour wait requirement like some other sections has. Shoot me a PM once you are in control again and I'll delete my negative feedback. Take a look at this thread if you haven't already

As do I! Ahh, if so, I have never seen it but then I have only ever tried to delete once maybe twice and it gave me the 24 hour notice each time - I did follow that link and sent the email - just waiting for a reply.

still waiting to hear back from forum staff on the unlocking/restoring of my account. should be soon its been about 18 hours.

Please understand I was piecing time stamp timeline together.
Stryfe, can you sign a message proving you have control of the account on a previously used public payment address?.
lets go back  say 30 days?possibly post an image or 2 of bct pswd/email change email?
This will put me at ease, I've seen genuine interaction from you and want make sure its the same person.

again DS i appologize and i will delete (or you can)
meanwhile ill poke around on things like 1LCfBebASQovgECYnSkBvNstkjRV9EnUWx and mentioned IP
*edit whenever you get it back stryfe thanks.

I have never done a signed message so I will have to see how to do it,  but I can do so as I have only ever used one BTC address on the forums.

as for the images of the bct pswd/email change emails - that is posted above but here is the link again as well https://ibb.co/MkM0JLk

I cannot figure out how to sign a transaction using the wallet I have used on these forums.

also - no one but

philipma1957

would know this - he owes me like .000002 btc he accidentally shorted me when rounding on our first transaction.

I know you dont need the loan lol .05??? xD
You need to do a systems check.
look for keyloggers, haveibeenpwned and other resources
I would triple quadruple check your mining securities
2fa on a different device other then active phone ect.
2fa and access code  fort knox it. Primarily seek out where you where penetrated and patch it up asap.

the part about a loan was in reference to you saying that something didnt add up - just emphasizing I am not scamming or attempting to scam.

system was checked - my network itself was not affected - I believe I know how it was done - there was a post about a site offering a bonus for signing up (very small amount) I figured it was bullshit but went ahead and signed up to show it as such, and it was - the funds given as a "bonus" were not withdrawable unless you either deposited more funds or played roulette with "bonus" funds and managed to win. I was pretty sure that I signed up with a different password than what I used for the forums but it might be entirely possible that I used the same one, I had been up nearly a full day by that time. The post with the site was removed shortly after I posted the falseness of the OP - but that was mere minutes before my account was compromised.

I went ahead and changed my password for damn near everything that requires one - even though nearly everything other than the forums requires 2FA so even with the password they would not be able to affect those accounts.

Anyways that is my guess at the "how"

I appreciate your advice though and still kick myself for using that password twice and for also not thinking of it until tonight.

well I was going to try and import my wallet into Electrum but it wont accept my private key - I can set wallet up as view only but then I cant sign a transaction. still working on it though.

and @DarkStar_ - I removed my posts from the other thread and moved them into here. Sorry bout flooding it over there.

[DarkStar_]

What wallet are you using?

[Mopar Mining]

What wallet are you using?

Bitpay - I use that for the forums and for mining rewards from Kano.is pool

I use a ledger for everything else so that is not useful here as I need to sign transaction from the bitpay address.

I tried to add my private key to Electrum from Bitpay but it wont take it. Note that Electrum does accept private key from ledger

I am not sure if it is because bitpay uses BIP44 not BIP32?

I have done mining for years and have used many wallets but have never used or found myself in need of signing a transaction so I apologize for my ignorance in this matter.

[DarkStar_]

What wallet are you using?

Bitpay - I use that for the forums and for mining rewards from Kano.is pool

I use a ledger for everything else so that is not useful here as I need to sign transaction from the bitpay address.

I tried to add my private key to Electrum from Bitpay but it wont take it. Note that Electrum does accept private key from ledger

I am not sure if it is because bitpay uses BIP44 not BIP32?

I have done mining for years and have used many wallets but have never used or found myself in need of signing a transaction so I apologize for my ignorance in this matter.

Try using iancoleman.io/bip39 (download and use offline for security) with your seed and see if you get get a private key through that.

[Mopar Mining]

What wallet are you using?

Bitpay - I use that for the forums and for mining rewards from Kano.is pool

I use a ledger for everything else so that is not useful here as I need to sign transaction from the bitpay address.

I tried to add my private key to Electrum from Bitpay but it wont take it. Note that Electrum does accept private key from ledger

I am not sure if it is because bitpay uses BIP44 not BIP32?

I have done mining for years and have used many wallets but have never used or found myself in need of signing a transaction so I apologize for my ignorance in this matter.

Try using iancoleman.io/bip39 (download and use offline for security) with your seed and see if you get get a private key through that.

Oh I got my private key from Bitpay but Electrum wont accept it. I will try your method above though - tried it, it asked for my phrase which I provided and it kicked out the same private key I already have and electrum still will not accept it. So, is my account hinged on the single aspect of signing a transaction?? I understand the usefulness of this aspect but my current wallet does not allow for signing and my knowledge about importing private keys to another wallet is obviously lacking.

[Steamtyme]

Sorry to hear about your account that sucks. I'm just perusing and haven't caught up on everything. I'm guessing you've been going back and forth with cryptios or someone.

You can always create an electrum wallet - sign a message with that wallet. Then send a small predetermined payment from the wallet you can't sign a message from to your new wallet then send it back.

This at the very least shows you are in control of that particular wallet - much the same as signing a message - just costs some TX fees.

Good luck

[bL4nkcode]

Oh I got my private key from Bitpay but Electrum wont accept it. I will try your method above though - tried it, it asked for my phrase which I provided and it kicked out the same private key I already have and electrum still will not accept it. So, is my account hinged on the single aspect of signing a transaction?? I understand the usefulness of this aspect but my current wallet does not allow for signing and my knowledge about importing private keys to another wallet is obviously lacking.

You can follow this instruction on how to import private keys to electrum, please use the latest version of electrum 3.3.7 for your safety.

As long that you succesfully imported the private key, you can sign message with the address assigned on the private key.

[Mopar Mining]

Oh I got my private key from Bitpay but Electrum wont accept it. I will try your method above though - tried it, it asked for my phrase which I provided and it kicked out the same private key I already have and electrum still will not accept it. So, is my account hinged on the single aspect of signing a transaction?? I understand the usefulness of this aspect but my current wallet does not allow for signing and my knowledge about importing private keys to another wallet is obviously lacking.

You can follow this instruction on how to import private keys to electrum, please use the latest version of electrum 3.3.7 for your safety.

As long that you succesfully imported the private key, you can sign message with the address assigned on the private key.

Thank you but I already did that as you can read above Electrum is not accepting my private key that Bitpay is providing.

Sorry to hear about your account that sucks. I'm just perusing and haven't caught up on everything. I'm guessing you've been going back and forth with cryptios or someone.

You can always create an electrum wallet - sign a message with that wallet. Then send a small predetermined payment from the wallet you can't sign a message from to your new wallet then send it back.

This at the very least shows you are in control of that particular wallet - much the same as signing a message - just costs some TX fees.

Good luck

This I can do! but I will wait until Cryptios or someone gets back to me - it has already been about two days and no response as of yet - maybe tomorrow. Luckily this is the only account that was affected - btw If I get this other T17 I am bidding on eBay for, I will catch up to you on kano.is oh wait, no I wont - I just checked you are a 100 th/s ahead of me, I need 3 more T17's lol

[bL4nkcode]

Editing the link as I paste the wrong one. //

Thank you but I already did that as you can read above Electrum is not accepting my private key that Bitpay is providing.

Upon reading this article, bitpay wallet should be compatible to electrum wallet.
What character your private key start with? Is it 5, L or xprv it should work for those start on these characters. Also this article will help for that.

[Mopar Mining]

Editing the link as I paste the wrong one. //

Thank you but I already did that as you can read above Electrum is not accepting my private key that Bitpay is providing.

Upon reading this article, bitpay wallet should be compatible to electrum wallet.
What character your private key start with? Is it 5, L or xprv it should work for those start on these characters. Also this article will help for that.

starts with xprv and when entered on the Import Bitcoin addresses or private keys screen on Electrum the "Next" button is grayed out.

the links from bitpay explaining how to get the private key are unnecessary as the app has a simple button to export the private key so there is no need to do that long drawn out process - that being said - I did it yesterday anyways and it just provided me the same private key that the app does. Again, I believe I stated this above.

[TryNinja]

starts with xprv and when entered on the Import Bitcoin addresses or private keys screen on Electrum the "Next" button is grayed out.

the links from bitpay explaining how to get the private key are unnecessary as the app has a simple button to export the private key so there is no need to do that long drawn out process - that being said - I did it yesterday anyways and it just provided me the same private key that the app does. Again, I believe I stated this above.

If it starts with xprv, then that's basically your wallet's master private-key. You need to select Standard Wallet -> Use a master key; then paste it in there and click Next. That should work.

[Mopar Mining]

starts with xprv and when entered on the Import Bitcoin addresses or private keys screen on Electrum the "Next" button is grayed out.

the links from bitpay explaining how to get the private key are unnecessary as the app has a simple button to export the private key so there is no need to do that long drawn out process - that being said - I did it yesterday anyways and it just provided me the same private key that the app does. Again, I believe I stated this above.

If it starts with xprv, then that's basically your wallet's master private-key. You need to select Standard Wallet -> Use a master key; then paste it in there and click Next. That should work.

ok this allowed me to enter my private key but it shows zero balance which is incorrect. It provided a receiving btc address that is not the one I use. I tried to do a sweep and it wont take the master key there though.

[TryNinja]

ok this allowed me to enter my private key but it shows zero balance which is incorrect. It provided a receiving btc address that is not the one I use. I tried to do a sweep and it wont take the master key there though.

What is the first character for your addresses in both bitpay and the wallet you just got on Electrum? (3, 1 or btc1?)

[Mopar Mining]

ok this allowed me to enter my private key but it shows zero balance which is incorrect. It provided a receiving btc address that is not the one I use. I tried to do a sweep and it wont take the master key there though.

What is the first character for your addresses in both bitpay and the wallet you just got on Electrum? (3, 1 or btc1?)

the bitpay address is 1LD6V8VNXfCTNzRyV6bj2vBhNg6VLTA2Ps

the one Electrum gave me when I added the private key is different, it is 18RevLMXf5hvzrCVQKj7Koc4CR16fAqhjJ

I tried to do a sweep of the priv key but that option wont work.

if I do a add the wallet using the bitpay wallet address, I can see the transactions however, they are view only. So, I do not think I can then sign them because that would make zero sense if anyone could just add a wallet address.

[alanst]

Account has been queued for recovery. Thread can be closed now. Thanks!

[Mopar Mining]

Account has been queued for recovery. Thread can be closed now. Thanks!

thank you Alanst

[Mopar Mining]

Account has been queued for recovery. Thread can be closed now. Thanks!

just out of curiosity - how long does the typical unlocking take? It has been two days and per the email I received it stated I had to do the "forgot password" process to recover my original account - however, when I do so, it tells me the account is still locked if I use my Forum name and tells me the account is not found if I use my email address.

Do not get me wrong, I am happy it is unlocked and restored to me, I just don't want to waste time to keep checking back every few hours if it takes days. I also had a potential purchase of close to 15k which most likely has now fallen thru due to me not responding for almost a week now.

[suchmoon]

just out of curiosity - how long does the typical unlocking take?

7 days. Check back ~ July 16.