myetherwallet got hacked

[haszel88]

Hello,
me and a friend working together in a business which involves crypto currency.
Last week, he told me that all our USDT + ETH got transferred to another wallet which is obv not ours.
We stored USTD + ETH on myetherwallet.
My friend takes care about the tezor but didn't log in on that day.
I asked him to check the balance on the evening and he told me that all wallets are empty and there is an transaction history which shows that all wallets got cleared a couple of hours ago.
He is the only one who has access to the trezor. the recovery seed is in a safe in his apartment in europe where he lives with his family.We are currently not in europe but have private places here too, so we dont use public wifi or something similarÂ
Even tho he didn't connect to MEW on that day(until the balance check) the trezor was connected to the laptop the whole day.
The laptop should be very secure when it comes to anti virus programs etc.
All BTCs are still were still there tho, only USDT+ETH got stolen.
So if someone is able to hack a cold wallet, i dont really understand why he just stole everything on MEW and not the BTCs.
It is the first time that i hear that something like that happened.
Basically someone stole a pretty big amount from a cold wallet without entering the code on the trezor, which is necessary to confirm the transaction, at least as far as i know.
I googled and didn't find anything about a similar situation.
I contacted many friends who work a lot with cryptos, people who work for big exchanger etc..Â
Nobody heard of a similar situation where a cold wallet got cleared while one of the owners is sitting next to it. Most reaction was that people think my friend stole it. I dont really wanna believe that because it wouldn't make sense to me.
Anyone here who has an idea what happened or heard about a similar case?

[xvids]

Hello,
me and a friend working together in a business which involves crypto currency.
Last week, he told me that all our USDT + ETH got transferred to another wallet which is obv not ours.
We stored USTD + ETH on myetherwallet.
My friend takes care about the tezor but didn't log in on that day.
I asked him to check the balance on the evening and he told me that all wallets are empty and there is an transaction history which shows that all wallets got cleared a couple of hours ago.
He is the only one who has access to the trezor. the recovery seed is in a safe in his apartment in europe where he lives with his family.We are currently not in europe but have private places here too, so we dont use public wifi or something similarÂ
Even tho he didn't connect to MEW on that day(until the balance check) the trezor was connected to the laptop the whole day.
The laptop should be very secure when it comes to anti virus programs etc.
All BTCs are still were still there tho, only USDT+ETH got stolen.
So if someone is able to hack a cold wallet, i dont really understand why he just stole everything on MEW and not the BTCs.
It is the first time that i hear that something like that happened.
Basically someone stole a pretty big amount from a cold wallet without entering the code on the trezor, which is necessary to confirm the transaction, at least as far as i know.
I googled and didn't find anything about a similar situation.
I contacted many friends who work a lot with cryptos, people who work for big exchanger etc..Â
Nobody heard of a similar situation where a cold wallet got cleared while one of the owners is sitting next to it. Most reaction was that people think my friend stole it. I dont really wanna believe that because it wouldn't make sense to me.
Anyone here who has an idea what happened or heard about a similar case?

I hate to say this but the clue are all in there .
You've already said it only your friend have the access to the trezor and you've already ask a plenty of people who have knowledge about cold wallet and they don't even know a thing and never heard such thing.
But if you truly believe that your friend is innocent then try to contact Trezor and tell them about your story.
And by the way you should move this to other section of the forum this topic doesn't belong in Bitcoin Discussion.

[livingfree]

If the BTC's are still there, move them asap to a much secure wallet and probably you will be the only one who knows. Crypto is money and the personal interest of other people with other's fund is there.

I don't know on how long you've been together but with the explanation you have that made me think that your friend(business partner) took it. You don't trust your wallet with any person even it's your friend, I would only trust a bit my wallet to my wife or kids and parents.

[mainconcept]

Most reaction was that people think my friend stole it. I dont really wanna believe that because it wouldn't make sense to me.

IMO this is what probably happened, your friend ran with the money.

According to your story
- your friend informed you first that the coins were transfered
- your friend was the only one with access to the private key
- the trezor was connected to his laptop

The other possibility ist that your friend used a MEW phishing site, not the original one.

The safest way to use MyEtherWallet is to use it through the trezor interface or use the offline version from github: https://github.com/kvhnuke/etherwallet

Last year there was DNS poisoning attack targeting Trezor users: https://blog.trezor.io/psa-phishing-alert-fake-trezor-wallet-website-3bcfdfc3eced
But I don't think that's what happened to you.

Why didn't you use a multisig wallet / multisig contract?

[haszel88]

Thanks for the input guys and sorry for posting in the wrong section.

If the BTC's are still there, move them asap to a much secure wallet and probably you will be the only one who knows. Crypto is money and the personal interest of other people with other's fund is there.

Yea i directly moved all BTC to a secure wallet.

The other possibility ist that your friend used a MEW phishing site, not the original one.


The safest way to use MyEtherWallet is to use it through the trezor interface or use the offline version from github: https://github.com/kvhnuke/etherwallet

Last year there was DNS poisoning attack targeting Trezor users: https://blog.trezor.io/psa-phishing-alert-fake-trezor-wallet-website-3bcfdfc3eced
But I don't think that's what happened to you.

Why didn't you use a multisig wallet / multisig contract?

I dont think it was a phishing site since there was no reason for a transfer on that day. He saved the right MEW link on chrome.
Even tho it would be a phishing site, he still need to confirm the transaction on Trezor which he didn't(thats what he says).

multis wallet/ contract are def. something for the future. I actually didn't expect that someone can steal money from a cold wallet tbh.
This is also the  reason why i think my friend didn't steal the money because it would be a very stupid scam tho.We share a lotto friends and even the amount was big, i think not big enough to risk a lot friendship and be marked as a scammer

[Lucius]

Hello,
me and a friend working together in a business which involves crypto currency.

This is the wrong approach, 2 people and one wallet for cryptocurrency, you never know what your friend can do with your coins, anytime.

Last week, he told me that all our USDT + ETH got transferred to another wallet which is obv not ours.
We stored USTD + ETH on myetherwallet.

You stored USDT+ETH on MEW, or you use MEW only as user interface? If you use MEW as main wallet, Trezor is not have anything with this hack. Private keys should be in Trezor, and MEW is just UI.

All BTCs are still were still there tho, only USDT+ETH got stolen.
So if someone is able to hack a cold wallet, i dont really understand why he just stole everything on MEW and not the BTCs.

Fact that BTC is still there only confirms that Trezor is not hacked (seed exposed), you keep ETH on MEW, and your friend has probably become victim of phishing. If someone gets your seed, all coins from Trezor would be stolen, and BTC would be first transferred.

[bitmover]

Hello,
me and a friend working together in a business which involves crypto currency.

This is the wrong approach, 2 people and one wallet for cryptocurrency, you never know what your friend can do with your coins, anytime.

This. You were doing it wrong.

Additionally, your friend was responsible for the money. He managed to lost it...

Hardware wallets cannot be hacked. Did he save the privatekeys (24 words) in a Gmail draft , or in any other digital method? This is the only way you could have been hacked.

Imo, there are two options:
-your friend didn't follow basic recommendations from trezor (like saving seed in Gmail)
- your friend stole your money

[Avirunes]

Hello,
me and a friend working together in a business which involves crypto currency.

This is the wrong approach, 2 people and one wallet for cryptocurrency, you never know what your friend can do with your coins, anytime.

Agreed^^. Even if he has a hardware wallet and you don't, don't blindly trust someone with your money to keep. After reading the whole story, I find your friend to be the culprit. There is nothing you can do now to recover them.

[slashz9]

i want to say this but you maybe wont trust it, if you and your friend only have the accest to wallet.
the culprit might be between you two,and involve other people.
people may forget anyhthing if its about money, so from here you need to learn dont trust anybody about your asset, keep it up for yourself.
You still do business but don't put money in the same place.

[Jating]

Trezor getting hacked?

A lot of red flags here, and this is really a bad practice. I'm sorry but you need to find a new set of friends here. But this time don't share the private keys. That trezor is already compromised, if I'm in your shoes, you better get a new one if you wanted to store more coins in the future and sorry for you lost.

[jessyj48]

Hello,
me and a friend working together in a business which involves crypto currency.
Last week, he told me that all our USDT + ETH got transferred to another wallet which is obv not ours.
We stored USTD + ETH on myetherwallet.
My friend takes care about the tezor but didn't log in on that day.
I asked him to check the balance on the evening and he told me that all wallets are empty and there is an transaction history which shows that all wallets got cleared a couple of hours ago.
He is the only one who has access to the trezor. the recovery seed is in a safe in his apartment in europe where he lives with his family.We are currently not in europe but have private places here too, so we dont use public wifi or something similarÂ
Even tho he didn't connect to MEW on that day(until the balance check) the trezor was connected to the laptop the whole day.
The laptop should be very secure when it comes to anti virus programs etc.
All BTCs are still were still there tho, only USDT+ETH got stolen.
So if someone is able to hack a cold wallet, i dont really understand why he just stole everything on MEW and not the BTCs.
It is the first time that i hear that something like that happened.
Basically someone stole a pretty big amount from a cold wallet without entering the code on the trezor, which is necessary to confirm the transaction, at least as far as i know.
I googled and didn't find anything about a similar situation.
I contacted many friends who work a lot with cryptos, people who work for big exchanger etc..Â
Nobody heard of a similar situation where a cold wallet got cleared while one of the owners is sitting next to it. Most reaction was that people think my friend stole it. I dont really wanna believe that because it wouldn't make sense to me.
Anyone here who has an idea what happened or heard about a similar case?

Sorry friend but i smell snitches, there is no way your wallet can get hacked unless you are been careless with your recovery seed or private keys, sorry to say but i suspect your friend based on how you explain things on here.
1. Next time never share your wallet keys with even your most trusted friends,unless family, even families do betrays too, wallets are been created for privacy purposes to avoid fund losses
2. There is possibility that your friend was targeted by other who knew he owns coins in the wallet and they find a way to get the keys off him. Who knows? might be possible
But all evidence are pointing to your friend

[masterrex]

Hello,
me and a friend working together in a business which involves crypto currency.
Last week, he told me that all our USDT + ETH got transferred to another wallet which is obv not ours.
We stored USTD + ETH on myetherwallet.
My friend takes care about the tezor but didn't log in on that day.
I asked him to check the balance on the evening and he told me that all wallets are empty and there is an transaction history which shows that all wallets got cleared a couple of hours ago.
He is the only one who has access to the trezor. the recovery seed is in a safe in his apartment in europe where he lives with his family.We are currently not in europe but have private places here too, so we dont use public wifi or something similarÂ
Even tho he didn't connect to MEW on that day(until the balance check) the trezor was connected to the laptop the whole day.
The laptop should be very secure when it comes to anti virus programs etc.
All BTCs are still were still there tho, only USDT+ETH got stolen.
So if someone is able to hack a cold wallet, i dont really understand why he just stole everything on MEW and not the BTCs.
It is the first time that i hear that something like that happened.
Basically someone stole a pretty big amount from a cold wallet without entering the code on the trezor, which is necessary to confirm the transaction, at least as far as i know.
I googled and didn't find anything about a similar situation.
I contacted many friends who work a lot with cryptos, people who work for big exchanger etc..Â
Nobody heard of a similar situation where a cold wallet got cleared while one of the owners is sitting next to it. Most reaction was that people think my friend stole it. I dont really wanna believe that because it wouldn't make sense to me.
Anyone here who has an idea what happened or heard about a similar case?

I think its not a hacking incidents, if i am those hacker i will not leave any single cryptocurrency on that particular wallet. Just ask directly to the one who has access on that wallet as you said, im not surely say if it was a hacking incident or just a plain inside job! I smell something fishy about it. that was my opinion.

[Ucy]

I don't think you should conclude yet that your friend stole it until thorough investigation is carried out. I would advice you to invite the police to help you locate the fund. Don't make it look like you are suspicious of your friend. It would be very unfair if it turns out not to be him.
You should first ask him whether it is a good idea to invite the police... if he accepts then get the police...but if he does not then you have every right to be suspicious of him.

Do you know the public addresses the coins were store? Post them if you can so that people here may help keep an eye on them. There are few free/paid services that helps people monitor their addresses. You can Google for the service.
The addresses should also be part of evidences to the police

[jrrsparkles]

Don't trust anyone when it comes to crypto currency because we can't trace who did that.IMO your friend stole it and act like someone hacked it.

If BTCs were not hacked means he have mercy on you so just stole part of your crypto holdings.

Believe it or not but there is no hack here,only your friend's greed got it.

[milewilda]

If the BTC's are still there, move them asap to a much secure wallet and probably you will be the only one who knows. Crypto is money and the personal interest of other people with other's fund is there.

I don't know on how long you've been together but with the explanation you have that made me think that your friend(business partner) took it. You don't trust your wallet with any person even it's your friend, I would only trust a bit my wallet to my wife or kids and parents.

Also the thing on my mind too and highly suspect that his friend is the only one who do took those coins and he's too merciful not to get those BTC's or sweep all the balance for it not to be soo obvious but eventually if a hacker or someone do able to access the keys then those coins will be sweep out totally.This is the hard part where you do trust up some people
in regards with money where anytime they would be tempted to stole it out specially if we do talk about big sums on here.We cant really be sure their loyalty anytime.

[pealr12]

Only the two of you have access on the wallet, so who is blame?  Man ,even a good person can be change even your best friend if   large amount of money  is involve,no one can be trusted in this world where money operates all.

[janggernaut]

Once your money got transferred to somewhere else, you can't get it or recover it back unless the culprit send it back to you (which obviously won't be happen).
Since you said it's not about phising site, and other kind of hack things, the one who you must as is your friend.

[shoreno]

Only the two of you have access on the wallet, so who is blame?  Man ,even a good person can be change even your best friend if   large amount of money  is involve,no one can be trusted in this world where money operates all.

i believe on the famous saying called " money is the root of all evil " so yeah you are right and i totally agree on you that every person can change just for the money.  he can become good or he can also became bad but in the case that we have today , the person turned bad because of greed of owning the said funds.   

we cant just blame the op because the scenario can also happen to all of us  . its hard to resist a friend but if he did something obviously wrong we can file a case for investigation.  .

[livingfree]

If the BTC's are still there, move them asap to a much secure wallet and probably you will be the only one who knows. Crypto is money and the personal interest of other people with other's fund is there.

Yea i directly moved all BTC to a secure wallet.

Great! at least you have now secured your bitcoin funds.

-snip-

Also the thing on my mind too and highly suspect that his friend is the only one who do took those coins and he's too merciful not to get those BTC's or sweep all the balance for it not to be soo obvious but eventually if a hacker or someone do able to access the keys then those coins will be sweep out totally.This is the hard part where you do trust up some people
in regards with money where anytime they would be tempted to stole it out specially if we do talk about big sums on here.We cant really be sure their loyalty anytime.

We don't know what's the interest of the robber maybe he did noticed first the USDT and Ethereum before noticing that there was BTC. You are right, if it's a hacker from out of nowhere, he won't have that kind of mercy for the BTC and he will wipe out everything on that wallet.

@haszel88, have you talked to your partner heart to heart regarding this incident?

[The_Wave13]

First of all, Hi. I am the "potential culprit". Since I read this thread, because we're investigeting on all levels.... of course I get that the story as my bro wrote it, might only lead into one direction, but even he admitted he forgot a few things. You have to know that me and my buddy are doing business since longer times on many levels. Very super close. We're going to invest in a few things end of this year and beginning of next year, where the money would be much more valueable then ever. I would never let some shitty money come inbetween trust and loyality I value much more, this was the reason my buddy chose me before longer time. Im far from money problems and my wife is a good earning teacher and the business we do is growing attracts a lot customers where integrity is everything and it was never runnign better than now. Same that I would directly pay a bunch of it back and work my ass of the next few months to give him back his share because I would never let something like this come inbetween us and our future. So why should I do this, and then work for nothing a few months only to be breakeven while he has his money and we lost a huge investment part which is much more valueble. That would be insane. And saying it could be part of the plan, yeah whos leveling himself then. So I beg you please, to come to the part where you guys with a lot experience can help us for real, would be really helpful, so please lets get over this standard friend scam thing. I will post now what I will write Trezor for what I can only imagine is necessary for finding out what happened. As well as a part of the discussion with a sicko from the scene who helped a lot and asked the right questions. If necessary I can even post the whole conversation but its a lot material. I try to include the pics as well.
This is basically what I want to send to Trezor. If someone can help, even if you believe or not, try to think in another direction, I would appreciate this very much.





I'm writing here because something happend which no one can explain. I want to post this online and maybe find answers, maybe others that happened the same. I'm forced to deal with a situation I never wish anyone to deal with. I need to tell you guys at first that you have to believe me about the details I say and about me. I dont want to cover anything or make up a story.

I have IT background. I worked as an admin and I have somewhat clue about how to treat internet stuff. I'm normally the one telling others to tighten up security and check internet behaviour. I have a good running business which involves a lot cryptos.

At the 12th of September evening asia time I logged into my myetherwallet account to check the balance of my USDT and saw that my whole account was cleared. From 3 different adresses that belong to me, everything gone. Everything has been withdrawn to this adress:

0xe80196d56ab6158b6dbfe6df5a143e04419fecb4

From most valueable to some smaller coins, at least eth so everything had gas. It can be seen in the chain explorer.


 

I didn't log into my MEW account for more than one and a half day. I only sent some USDT from binance to my MEW at the 12th lunch or so. The whole day at the 12th I was connected to my trezor 1 and doing btc business via chrome and had the tab still open to my wallet. When I connect to my trezor I need 6 digit pin. For MEW I dont use any addon, only the URL and then follow usual steps login to trezor with the pin and export key.

I treat my laptop correct. I dont open spammails, I dont surf on shitty sites nor watch porn with it. Its my working laptop and I have a high responsebility about what I do and I'm aware of it. I use another zonealarm firewall, avira antivir, malwarebytes, realtime protection enabled. Have ublock origin as addon.

I scanned my laptop with all updated tools and even downloaded more. No virus, trojan, not even harmful malware was found.

No comes the part where I'm lucky that my best friends trust in me. WHILE the funds where withdrawn, I was standing infront of the computer and chatting with a customer on skype. The whole time. I checked all time stemps if MEW maybe has a different server time or so, I was standing infront of my computer. logged into my btc wallet, not into my MEW wallet and I didnt confirm any transactions for the USDT and Ethereum stuff.

How can this be. Thats whats everyone asks. I realised that If I log into my MEW account and then enter the btc part later and the browser is still open with another page, that I dont need a pin to access my BTC wallet. The otherway around from BTC to MEW I have to type in the pin, chose the wallet etc etc

Of course me and my friends we spoke about all scenarios. Here in my room, no one was alone with my laptop. I checked the antivir part if maybe stuff is installed and hidden in the settings to not scan it, and it wasnt.

Which things happened, I changed, I never did before, that maybe let to an security breach. I had to use a few times Teamviewer last days to acces and install stuff for customers. But this should only work in one direction and I was always using a VPN when connecting and the last time was 2 days before the accounts where emptied.

The most curious part happened a few days before the “hack”. Before a few days 6th of september I was in vietnam. I stayed in a hotel and had to send some funds to a customer from MEW. I was connected to my VPN but in the hotel Wifi. Something unusal happened. I wanted to send funds and the process circled around 30 min then broke up. We thought its the network having probs. The ETH network. I copied all details again and sent the funds to my customer. And It sent the money TWICE. At the same time. But I show you screens how the first one failed. It send 8k at once, so 2 times same time 4k but I only wanted to send 4k.


https://s17.directupload.net/images/190919/7jvjj5b7.jpg

https://s17.directupload.net/images/190919/v7rl546m.jpg
None of the scenarios we think about makes sense. If my computer has been compromised, why sending the headfuck ETH stuff where you normally have to click a million times to get the transaction done. Why not sending the BTCs where the tab was open. Why not sending everything.

In my position from my friends, everyone knows I wouldnt do it. It doesn’t even make sense because we’re going to invest the most share of it and its way more valuable there. I am trustful and loyal. There was money from one of my best friends as well involved. Everyone we ask says, it's not possible. But then how. I was here in front of my laptop not clicking anything to accept a transaction. I wasnt even logged into MEW. The times of the btc transactions and the ETH later are different. ETH was way later. I was thinking if maybe a script can use my accept on the hardware wallet to send something else as well. But theres 1.5h inbetween when sending my latest btc transaction and when ETH stuff was sent.

Can a sniffer in a hotel room read data from MEW? Is it possible to clone and hack when I login to MEW and get my seeds, not even I have ever seen from the ETH part. Is MEW saving data which they shouldn't. what definitely happened is, there have been transactions from my Trezor (if it really happened from my trezor) whithout the need of me to accept it. Can a tool when the 30 mins failed transaction was going on and failing encrypting a key or getting information about it which they can encrypt later? I realized that after I setup new windows on the laptop to clear out if the computer is a tunnel and then connecting to MEW that one step came I didn’t have to do before. That “allow MEW to read public key on trezor [] remember the device checkbox wasn’t there before but now back again. If this option is enabled. What infos are gonna stored where?

Of course we searched for similar stories. If someone has this hacking skills there might be more people involved. We can't find anything which is obvlsy not looking good for me.
Do you guys know any about this? What was that perfect with me that this could happen. Why aren't others posting about lost funds on ETH without a third party involved or someone who gave away logins or seeds or whatever, so the obvious scam reasons. I feel horrible. Something I cant explain happened. I don’t see that some pishing site got the infos and I anyway check the wallet address again when doing transactions on my trezor. And even then coming back to that transactions happened without me accepting it on the trezor and the btc part wasnt gone, only MEW ETH things. I had a long discussion with a high talented crypto guy and whale and programmer whos long in the scene.
Parts of the conversation where like this:

Me, [17.09.19 22:36]
Can you describe how the process maybe went after getting my key after whatever Method?

Him, [17.09.19 22:39]
One possibility is that they derived your private key through the data they gathered on mew

Him, [17.09.19 22:39]
It shouldn’t be able to

Him, [17.09.19 22:40]
But if so. It’s a flaw that trezor should be aware of

Me, [17.09.19 22:40]
But somehow it seems possible?

Him, [17.09.19 23:04]
I don’t think you exported your private key

Him, [17.09.19 23:05]
Either (A) mew allowed your private key to be exported. Or.

Him, [17.09.19 23:06]
(B) by allowing mew to keep reading your public key, they could have repeatedly asked for all your pub key addresses derived from your master key.

Him, [17.09.19 23:07]
And perhaps that allows for a weakness for them to work out your eth key

Me, [17.09.19 23:13]
Yes this was where I was searching for unusual things. Which happened in the hotel in Vietnam
 
 
Me, [17.09.19 23:13]
But that was my transaction to a customer

Me, [17.09.19 23:13]
It was processing 32 min

Me, [17.09.19 23:13]
Then broke up

Me, [17.09.19 23:13]
Next time I sent money it sent both same time

Me, [17.09.19 23:13]
The Customer sent me 4k usdt back cause he recieved 8

Me, [17.09.19 23:14]
And I was like: WHAT. THE. FUCK.


Him, [17.09.19 23:18]
I suspect something might have happened then... the hacker was just waiting for you to log in again

Me, [17.09.19 23:43]
Just one thing. All others say after the story, a transfer from a coldwallet without accepting the transactions is not possible. And you say it is right?

Me, [17.09.19 23:44]
With the idea of, they key got stolen, cloned etc

Me, [17.09.19 23:45]
That the transactions have been made from our wallet without me accepting it on the trezor

Him, [17.09.19 23:46]
By design it shouldn’t be possible

Him, [17.09.19 23:47]
It’s highly unlikely

Him, [17.09.19 23:47]
And if that is the case. They would have taken your BTC first

Me, [17.09.19 23:49]
So conclusion?


Me, [17.09.19 23:49]
It’s more likely that they somehow extracted the eth private key

Me, [17.09.19 23:49]
Yes, thx.