Hacked Blockchain.com Wallet - You should NEVER use online wallets !

[dkbit98]

Reddit user adm8877 reported losing his 2.4 Bitcoins (worth $25.000) from Blockchain.info website:

adm8877:
https://www.reddit.com/r/Bitcoin/comments/d5fjsv/24_btc_hacked_from_blockchain_wallet25000_stolen/

2.4 BTC Hacked from Blockchain Wallet(25.000$ stolen)

Since you guys are experts in this domain, can you please advise what steps I can take to try to get my hard earned 2.4 BTCs back.. My story is :

I used my old iphone 5s to create new apple id new email new everything .. i downloaded the blockchain app and created the blochchain account to wich i transfered the 2.4 bitcoin . I never loged on other device with the blockchain account .


Last transfer i made to the phone was on 26 august 2019 . I closed the phone how i allways did and until today, when i wanted deposit other bitcoin on the account, never opened the iphone, it was closed .

It seems that on 28 august 2019, 2 days after last time i used the iphone someone transfered all my bitcoin out . They made 10 transactions of 0.24 out = 2.4 btc :


What is curious . They again used my blockchain account 3 times more to receive and send out money:


01 September 2019 0.64 BTC

03 September 0.4 BTC ,

10 September 0.39 BTC


So basically after someone stole all my money , it seems they keep using my blockchain.info account to put money in and out .

My question to you guys is what the hell happend ? I know that my bitcoin are lost and i`ll never see them again but who got hacked ? Who did the funds dissapeared ? Was my iphone hacked or was blockchain.info hacked ? How can i ever find out what happend so i can protect myself again .


I repeat . The iphone 5s i used was new reset phone , i make new everything , installed the blockchain app to wich i did not enabled the 2wasy verification . i just created the accout on the app and started using it .

source:
https://www.reddit.com/r/Bitcoin/comments/d5fjsv/24_btc_hacked_from_blockchain_wallet25000_stolen/


Conclusion:

I am not 100% sure who is to blame for this issue,
but I know that we should NEVER use any online wallet,
no matter how safe they claim it is.

[1714914486]

1714914486

[1714914486]

1714914486

[Findingnemo]

Online wallets faced hacks from time to time so if you are still trusting them for storing huge amount like value of $25,000 then you have to bear the consequences.

Anyway OP move this thread to Web Wallets section.

[hugeblack]

If you think this is a loss, there has already been a big bug that would have cost 870 BTC, thanks to @johoe who discovered it and returned the money to its owners. [1]
In short, Blockchain.com is a buggy wallet and with the risk of storage using web wallets make its use risky.

In addition, avoid storing large amounts on any android device and try to use a strong password.

The money has been returned to blockchain.info.  Please write to blockchain support to claim a refund.

[bob123]

I am not 100% sure who is to blame for this issue

In most cases.. the user.

Nevertheless, using a web wallet always is a bad idea.
But since the OP of the reddit post didn't fall for common techniques used to trick users into entering their private data on a phishing site, chances are relatively high that his mobile or another device is/was compromised.
And i believe it would have also happened with any other wallet (except a hardware wallet or cold storage).

While a mistake on the side of blockchain.com definitely could be possible, i believe that there should be more similar reports in such a case.
In most cases the user seems to be at fault. Whether through malware or phishing doesn't matter much IMO.
As long as people don't understand the task of being their own bank and start securing their funds properly, we will always see more and more of such reports of stolen funds.

[dkbit98]

I think this will once and for all end all discussions we saw on this forum
where people claimed that Blockchain wallet is safe like any other offline wallet.

This is just one of the toics, but you can find many more:
https://bitcointalk.org/index.php?topic=5141593.0

[bob123]

I think this will once and for all end alldiscussions we saw on this forum
where people claimed that Blockchain wallet is safe like any other offline wallet.

Where did anyone claim that using blockchain.com is as safe as an offline wallet ?
Anyone claiming such nonsense has obviously zero knowledge regarding this topic at all.

Did you intend to compare blockchain.com to a standard desktop wallet ?
There might be people around claiming this.. but they are simply wrong. Don't listen to them. Webwallets have the same attack surface as desktop wallets plus additional ones which only apply to web-based wallets.

However, no online wallet (whether web-based, desktop- or mobile-) is even close to be as secure as an offline wallet.

[CounterEntropy]

If you think this is a loss, there has already been a big bug that would have cost 870 BTC, thanks to @johoe who discovered it and returned the money to its owners. [1]
In short, Blockchain.com is a buggy wallet and with the risk of storage using web wallets make its use risky.

In addition, avoid storing large amounts on any android device and try to use a strong password.

The money has been returned to blockchain.info.  Please write to blockchain support to claim a refund.

As pointed out by GMaxwell, this issue was not specific to Blockchain.com. But, being one of the largest web wallet provider, their user base suffered the most.

[Kyraishi]

In most cases of theft, and loss of funds are usually on the user to blame, and often happens when a device gets compromised via a virus, there are even terms and conditions that most online crypto wallets and other financial products (Skrill, Paypal)  have in their terms and conditions to protect them from reinbursing their users.

Yeah, it's pretty scummy, but it's not illegal and there's usually nothing you can do about it, unless you can prove that is it their platform that is at fault here and it wasn't your problem, but since it's an isolated case, I just don't see that happening (you'd likely to see like a bunch of accounts hacked before you can get your money back).

Now, that we've found out that you've likely lost all your money - let's prevent it from happening again.There's a simple answer to this issue: buy a ledger or trezor, or use electrum and be careful with your computer. Personally, I don't think carrying thousands of dollars in your pocket every day is the best day, but good mobile wallets like samourai exist.

This situation is very confusing though... The hacks are normal (sending out numerous transactions to keep one safe). But why would he use the account to recieve and send money again...?

I'd like to look more into this, do you have screenshots of these transactions?

[jhongzjhong]

Mobile phones are prone to compromise and there is possibly infected with a virus, why the victims used those kinds of wallet instead of purchasing a hardware wallet. Blockchain.com app wallet is not advisable to use when it is outdated it also become compromise and easy to leak by hackers. Another reason that possible the victim downloaded a wrong apps wallet. The one who could blame is the victim because he did not purchase a good wallet for his huge amount and store to the weak wallet. I used blockchain.info web wallet for how many years and luckily I did not encounter such problem but I did not try to use a version of app wallet in blockchain.info.

[sunsilk]

I think this will once and for all end all discussions we saw on this forum
where people claimed that Blockchain wallet is safe like any other offline wallet.

Nope. Blockchain.com as a wallet isn't really strong as other offline wallets. It's an online wallet and many bugs has been found with this wallet, I'm not surprised that many still use them because of the domain name that it took.

I've used them for smaller amounts but such amounts like adm8877 has, it should be placed to a safer vault such as hardware wallet. (Ledger nano S/X or Trezor).

[Lucius]

I think in this case problem was not in blockchain.com, but in Apple blockchain app which is reported many times as the main culprit for hacks. A few months ago, one user reported that he and some other users lost over 400 BTC by "using iPhones and official blockchain app".

At the moment we are a group of several victims of the company Block chain dot com and we entrusted our funds to Block chain Luxembourg and lost over 400 bitcoins, this amount is worth today about 4.5 million American dollars.
We are sure we didn't do anything what could influence to the security of our wallets which were used at blockchain  com (generating paper wallets, storing passphrase, etc). In most cases we were using Apple environment (mainly newest iPhones and official blockchain app).

I still have blockchain.com wallet, just for some small amounts ($50-$100), and I never had a problem with hacks or anything related to using them. Most of people who get hacked by using online wallets are the victim of phishing, and in some cases, they lost coins because service gets hacked.

In this particular case, someone is exploiting vulnerability in Apple blockchain app to hack users.

[fudster]

I think in this case problem was not in blockchain.com, but in Apple blockchain app which is reported many times as the main culprit for hacks. A few months ago, one user reported that he and some other users lost over 400 BTC by "using iPhones and official blockchain app".

At the moment we are a group of several victims of the company Block chain dot com and we entrusted our funds to Block chain Luxembourg and lost over 400 bitcoins, this amount is worth today about 4.5 million American dollars.
We are sure we didn't do anything what could influence to the security of our wallets which were used at blockchain  com (generating paper wallets, storing passphrase, etc). In most cases we were using Apple environment (mainly newest iPhones and official blockchain app).

I still have blockchain.com wallet, just for some small amounts ($50-$100), and I never had a problem with hacks or anything related to using them. Most of people who get hacked by using online wallets are the victim of phishing, and in some cases, they lost coins because service gets hacked.

In this particular case, someone is exploiting vulnerability in Apple blockchain app to hack users.

Its usually the case. When paypal were becoming popular since 2006, there were also lots of phishing attempts to its users, there were victims of course. ITs the same thing with online wallets. When users get some emails regarding the wallets they were registered, they lick the links and login to it. It redirects to the real one but also collected the data they input to login. So who is to blame?

[Mahanton]

There are two possible reasons for such loss of BTC's which is either Blockchain bug or simply on users error.
Sometimes there are really things which we can say that we are indeed sure that we didnt done something that do compromise our own wallets but
we arent even aware that we have already done sort of things that already exposes out those important informations regarding into your wallet
like being phished, exposed or stolen keys etc. and we do took all the blame into the wallet we've been using.Second possibilities is on the wallet provider itself
this is why i dont trust too much web-wallet when it comes on storing up huge amounts of bitcoin because i do feel unsafe yet these places are honeypots for scammers.
On small hole or bug then your funds will be swept away.

[leowonderful]

This is also a good reason why you should be investing in a better storage solution such as an airgapped computer or potentially a hardware wallet for keeping coins for longer periods of time- I too use the Blockchain.com wallet from time to time, and though one of my wallets was actually compromised a few years ago due to some sort of security vulnerability as well, it's fine for keeping coins for short periods of time and is relatively convenient as well. You're the one responsible for holding your funds at the end of the day, though, and if you're keeping significant amounts of Bitcoin, investing in a secure storage solution is a no-brainer.

[dunfida]

This is also a good reason why you should be investing in a better storage solution such as an airgapped computer or potentially a hardware wallet for keeping coins for longer periods of time- I too use the Blockchain.com wallet from time to time, and though one of my wallets was actually compromised a few years ago due to some sort of security vulnerability as well, it's fine for keeping coins for short periods of time and is relatively convenient as well. You're the one responsible for holding your funds at the end of the day, though, and if you're keeping significant amounts of Bitcoin, investing in a secure storage solution is a no-brainer.

A basic thing but majority of people do neglect about where hardware wallets do only cost a hundred+ dollars and minding that they are holding huge amounts
but they dont care or give out top post priority with their holding.They will only act if they do lost up money.

Security of funds will always vary on users side and if you are way too careless on your credentials or important info then you are at high risk but there were
web wallets which are prone to attacks and exploits this is why its never been ideal to consider on using for long term storage.

[ReiMomo]

I rarely visit this web wallet thread but now I saw there are a bunch of posts regarding blockchain.com website complaints. I never use this wallet since then because I did not feel safe and I feel doubt that probably gets compromised account.
When I visited right now the website of blockchain.info why my anti-virus blocking this site and says unsafe links. It is really strange to me.
Did anyone experience this?

[bL4nkcode]

When I visited right now the website of blockchain.info why my anti-virus blocking this site and says unsafe links. It is really strange to me.
Did anyone experience this?

Probably, a false positive alarm, not unless you access a phishing site, and at the moment it's impossible to access the .INFO domain of blockchain because you will be redirected to its .COM website.

[Rodeo02]

I dont really understabd  but the day i know bitcoin ill never use this wallet before, maybe because there are more negative feedback i heard about this wallet.i prefer electrum or mycelium than this online wallet.

I also ask wallet suggestions from all my friend and this blockchain wallet is not one of it.

[erikalui]

I don't understand how blockchain.info gets hacked even though they send authentication mails when anyone logs in but when my wallet got hacked, I got no mail and lost 0.05 BTC. Like in my case, I had installed a phishing software, sure the user must have done the same or used a phishing app which is why he lost his bitcoins. Blockchain.info is itself the worse wallet to use as they don't send authentication mails and just say they use 2FA.

[ReiMomo]

When I visited right now the website of blockchain.info why my anti-virus blocking this site and says unsafe links. It is really strange to me.
Did anyone experience this?

Probably, a false positive alarm, not unless you access a phishing site, and at the moment it's impossible to access the .INFO domain of blockchain because you will be redirected to its .COM website.

Thank for this I can access now the site, I was wondering yesterday why I can't access to them. It is now blockchain.com.

I dont really understabd  but the day i know bitcoin ill never use this wallet before, maybe because there are more negative feedback i heard about this wallet.i prefer electrum or mycelium than this online wallet.

You are right web wallet is not safe at all, but before I used this for almost 2 years and so far I did not encounter any big troubles on this web wallet but now I have Electrum and Coinomi wallet which is a multi-wallet.