Bitcoin Forum
October 22, 2019, 08:45:41 PM *
News: Latest Bitcoin Core release: 0.18.1 [Torrent]
 
   Home   Help Search Login Register More  
Pages: [1] 2 »  All
  Print  
Author Topic: paper wallet was stolen  (Read 535 times)
jorro-ts
Newbie
*
Offline Offline

Activity: 6
Merit: 3


View Profile
July 09, 2019, 06:23:59 PM
Merited by ETFbitcoin (1), pooya87 (1), LoyceV (1)
 #1

Hello everyone!

More than a Week  ago my single btc from offline paper wallet was stolen

it was created in 12.2018 and never used since that time

I am totally frustrated not only because of loss but also becasue i cant get what do i did wrong!

Also i want to mention that the adress it was moved on, is still untouched and have got just a single transaction(my btc)

u can supervise it here

https://www.blockchain.com/btc/address/1CtmmUkxEbQ8nsa2XFSKy7bo5XmBxYFP5n

what can it be?why it is still untouched? why it happened just in 6 month?
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1571777141
Hero Member
*
Offline Offline

Posts: 1571777141

View Profile Personal Message (Offline)

Ignore
1571777141
Reply with quote  #2

1571777141
Report to moderator
ETFbitcoin
Legendary
*
Offline Offline

Activity: 1792
Merit: 2057

Use SegWit and enjoy lower fees.


View Profile WWW
July 09, 2019, 06:33:20 PM
 #2

Most likely :
1. You create your paper wallet with malicious software/service
2. You create your paper wallet with online website on insecure device/connection
3. Someone found your paper wallet & decide to stole it

But those are educated guess, do you mind tell us how do you create your paper wallet & how do you store it?

LoyceV
Legendary
*
Offline Offline

Activity: 1638
Merit: 4914


Largest Merit Circle on BPIP!


View Profile WWW
July 09, 2019, 06:33:26 PM
Merited by pooya87 (1)
 #3

Some questions:
How did you create the paper wallet? What software did you use?
Did you create it on an offline airgapped system? Did you wipe the computer, or did it go online again afterwards?
Do you still have the paper wallet? Could someone have accessed it?

Could this be the cause: Disclosure: Key generation vulnerability found on WalletGenerator.net—potentially malicious.?

jorro-ts
Newbie
*
Offline Offline

Activity: 6
Merit: 3


View Profile
July 09, 2019, 06:44:16 PM
 #4

Some questions:
How did you create the paper wallet? What software did you use?
Did you create it on an offline airgapped system? Did you wipe the computer, or did it go online again afterwards?
Do you still have the paper wallet? Could someone have accessed it?

Could this be the cause: Disclosure: Key generation vulnerability found on WalletGenerator.net—potentially malicious.?

yes i used WalletGenerator.net, exactly as you described : wipe the computer, and go online again afterwards
no i dont have, it was a single one
jorro-ts
Newbie
*
Offline Offline

Activity: 6
Merit: 3


View Profile
July 09, 2019, 06:52:20 PM
 #5

Most likely :
1. You create your paper wallet with malicious software/service
2. You create your paper wallet with online website on insecure device/connection
3. Someone found your paper wallet & decide to stole it

But those are educated guess, do you mind tell us how do you create your paper wallet & how do you store it?
1)probably
2)probably
3)absolutely not

well i created it offline, and stored it on a <<paper>>
jorro-ts
Newbie
*
Offline Offline

Activity: 6
Merit: 3


View Profile
July 09, 2019, 07:01:15 PM
 #6

but why its still unspent?
do you think its possible to write to every single crypto market to report this adress ?will it work out?
ETFbitcoin
Legendary
*
Offline Offline

Activity: 1792
Merit: 2057

Use SegWit and enjoy lower fees.


View Profile WWW
July 09, 2019, 07:03:33 PM
 #7


yes i used WalletGenerator.net, exactly as you described : wipe the computer, and go online again afterwards
no i dont have, it was a single one

Do you access WalletGenerator.net on your browser / do you download it from GitHub and run it offline?
If you access the website, then most likely it's the cause your Bitcoin was stolen.

but why its still unspent?
do you think its possible to write to every single crypto market to report this adress ?will it work out?

There are few website for it such as https://www.bitcoinabuse.com/, but i doubt you will get your bitcoin back. At most, the thief can't sell/use Bitcoin on exchange/service which follow regulation.

LoyceV
Legendary
*
Offline Offline

Activity: 1638
Merit: 4914


Largest Merit Circle on BPIP!


View Profile WWW
July 09, 2019, 07:05:03 PM
 #8

but why its still unspent?
"Unspent" means nothing more than "the funds are on that address". It's like having $1000 in the attacker's wallet, it's unspent until he spends it.

Quote
do you think its possible to write to every single crypto market to report this adress ?will it work out?
No. See much longer answer.

jorro-ts
Newbie
*
Offline Offline

Activity: 6
Merit: 3


View Profile
July 09, 2019, 07:10:23 PM
 #9

but why its still unspent?
"Unspent" means nothing more than "the funds are on that address". It's like having $1000 in the attacker's wallet, it's unspent until he spends it.

Quote
do you think its possible to write to every single crypto market to report this adress ?will it work out?
No. See much longer answer.

thank you for your attention!
seems like its 100% lost. good lesson. expensive one.
magdaniewczas
Newbie
*
Offline Offline

Activity: 3
Merit: 0


View Profile
July 10, 2019, 02:45:32 PM
 #10

Hello everyone!

More than a Week  ago my single btc from offline paper wallet was stolen

it was created in 12.2018 and never used since that time

I am totally frustrated not only because of loss but also becasue i cant get what do i did wrong!

Also i want to mention that the adress it was moved on, is still untouched and have got just a single transaction(my btc)

u can supervise it here

https://www.blockchain.com/btc/address/1CtmmUkxEbQ8nsa2XFSKy7bo5XmBxYFP5n

what can it be?why it is still untouched? why it happened just in 6 month?

You should contact the police
bitmover
Hero Member
*****
Offline Offline

Activity: 630
Merit: 1068



View Profile
July 10, 2019, 05:16:45 PM
 #11

yes i used WalletGenerator.net, exactly as you described : wipe the computer, and go online again afterwards
no i dont have, it was a single one

Sorry for your loss.

This is a common subject here often these days (like this https://bitcointalk.org/index.php?topic=5161786.0), about paper wallet security.
Most of people think it is easy and simple to make a paper wallet, but it is not.

Generating a paper wallet is risky. You shouldn't have put your computer back online afterwards... In my opinion, the best is to invest in a hardware wallet, which is safer BECAUSE it is easier to use.

I believe the attacker got your private keys few days after you put your computer back online. He was probably monitoring your address, waiting for you to put more money there.

LoyceV
Legendary
*
Offline Offline

Activity: 1638
Merit: 4914


Largest Merit Circle on BPIP!


View Profile WWW
July 10, 2019, 05:29:18 PM
Merited by Chris! (2)
 #12

I believe the attacker got your private keys few days after you put your computer back online. He was probably monitoring your address, waiting for you to put more money there.
OP wiped his computer, that should be enough to remove all traces of private keys. I still prefer a Linux LIVE DVD though, running from memory to ensure nothing ever ends up on a hard drive.

nc50lc
Hero Member
*****
Offline Offline

Activity: 742
Merit: 639


Self-proclaimed Genius ㊙️


View Profile WWW
July 13, 2019, 03:57:04 AM
 #13

I believe the attacker got your private keys few days after you put your computer back online. He was probably monitoring your address, waiting for you to put more money there.
OP wiped his computer, that should be enough to remove all traces of private keys. I still prefer a Linux LIVE DVD though, running from memory to ensure nothing ever ends up on a hard drive.
..And less hassle of zero-fill~ing the disk for paranoids Cheesy (+ reinstalling OS and drivers takes time).

He must have browsed to the webpage then cut down the connection.
His supposedly randomly generated private key wasn't random at all but pre-generated key from an image file and can be reproduced by the culprit.
So even if he's offline the whole time (after loading the page), they can regenerate the possible key based from the malicious page's provided image.

This wont happen if he used the original code from Github.

Lucius
Legendary
*
Offline Offline

Activity: 1568
Merit: 1357


Fortis Fortuna Adiuvat


View Profile WWW
July 13, 2019, 12:13:37 PM
 #14

jorro-ts, I'm sorry for your loss, it is big amount of money and I think you should report to police and to every crypto exchange to make this hacker life a little more difficult. Most victims do nothing, and hackers count on that - it is easy money for them.

People blindy trust to paper wallets, but they are not aware how important it is to secure a safe environment for making such wallets. If you ever again decide to invest in bitcoin, maybe you should need to consider hardware wallet - it cost some $70, but it can save you from such risks.


Chris!
Legendary
*
Offline Offline

Activity: 1302
Merit: 1072



View Profile
July 13, 2019, 07:34:38 PM
 #15

@OP I can teach you how to properly secure your funds. We can do it here or if you'd like you can PM me.

Paper wallets can be the absolute best option for long term storage if you do it right. Hardware wallets, however, constantly have vulnerabilities found out. Don't believe me. Go ahead and Google "hardware wallet vulnerability". You'll notice that the vulnerabilities have come out over many years and fresh ones have just been found out. They're obviously not properly tested, other than of course the general public buying them and reporting vulnerabilities.

Don't blindly trust third parties (hardware wallet manufacturers) because of this mishap. Learn from it, change your method accordingly and sleep easy knowing you'll never have to worry about your funds being stolen again.
Lucius
Legendary
*
Offline Offline

Activity: 1568
Merit: 1357


Fortis Fortuna Adiuvat


View Profile WWW
July 14, 2019, 10:58:08 AM
Merited by bitmover (1)
 #16

@OP I can teach you how to properly secure your funds. We can do it here or if you'd like you can PM me.

Paper wallets can be the absolute best option for long term storage if you do it right. Hardware wallets, however, constantly have vulnerabilities found out. Don't believe me. Go ahead and Google "hardware wallet vulnerability". You'll notice that the vulnerabilities have come out over many years and fresh ones have just been found out. They're obviously not properly tested, other than of course the general public buying them and reporting vulnerabilities.

Don't blindly trust third parties (hardware wallet manufacturers) because of this mishap. Learn from it, change your method accordingly and sleep easy knowing you'll never have to worry about your funds being stolen again.

Show me one example where the user lost funds due to any detected vulnerability in any hardware wallet? Most of these vulnerabilities required physical access to user device and a superior level of technical knowledge.

For some reason you are against hardware wallets, but if OP is using one we would not have this thread and he would still have 1 BTC. Your ideas about insecurity of HW are not groundless, they are not 100% safe - but most of vulnerabilities you are talking about are fixed before they became known to the public.

dende93
Member
**
Offline Offline

Activity: 94
Merit: 26


View Profile
July 19, 2019, 08:30:27 AM
 #17

Really sorry for your loss. Just one question for you, have you encrypted it with bip38?
Would he have avoided theft by doing so?

“War is Mass Murder, Conscription is Slavery, Taxation is Robbery.” Murray N. Rothbard
LoyceV
Legendary
*
Offline Offline

Activity: 1638
Merit: 4914


Largest Merit Circle on BPIP!


View Profile WWW
July 19, 2019, 08:33:08 AM
 #18

Would he have avoided theft by doing so?
Encryption doesn't help if the thief knows the private key already.

dende93
Member
**
Offline Offline

Activity: 94
Merit: 26


View Profile
July 19, 2019, 09:00:51 AM
 #19

Would he have avoided theft by doing so?
Encryption doesn't help if the thief knows the private key already.

yeah that's what I thought, it's obvious. I made some paper wallet too but not on walletgenerator.net, with the intention of keeping them 10 years. I would not bear such a loss easily.
Perhaps it would be useful to set a time lock to prevent someone from spending your coins before you want. Could the attacker come to know it and get around this obstacle?

“War is Mass Murder, Conscription is Slavery, Taxation is Robbery.” Murray N. Rothbard
AdolfinWolf
Legendary
*
Offline Offline

Activity: 1190
Merit: 1066


people run from rain but sit in bathtubs of water


View Profile
July 19, 2019, 10:22:35 AM
 #20

Perhaps it would be useful to set a time lock to prevent someone from spending your coins before you want. Could the attacker come to know it and get around this obstacle?
If he has the private key, he can simply sign another transaction without locktime and broadcast that one instead.. ?

I don't know of any wallets that lock "adresses" or private keys rather, from spending funds, as that's just not possible, AFAIK.
(Since the attacker could simply export the private key into his own wallet & broadcast.)


Pages: [1] 2 »  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!