Someone hacked my 2013 account, anyway to get it back?

[random_australian]

I was on here a lot way back when, I stopped using it for while, went to log in and found my password didn't work, and when I tried a reset it didn't go to my email. Anyway it can be returned to the original email address? I'm guessing not, but thought it was worth asking, especially because I figure the only reason for people to still an old account on a board like this is to use to scam people.

[1714678430]

1714678430

[1714678430]

1714678430

[1714678430]

1714678430

[1714678430]

1714678430

[1714678430]

1714678430

[OmegaStarScream]

Can you provide a signed message from an address you posted prior to the hack? If so, see this: https://bitcointalk.org/index.php?topic=5089777.0

I'm guessing not, but thought it was worth asking, especially because I figure the only reason for people to still an old account on a board like this is to use to scam people.

Can you share the account's username?

[random_australian]

The username is room101 ( Big 1984 fan in 2013 I guess )

My last post was July 2017, in October it switched to all Cyrillic? posts I think, but yeah, it could have been anyone, I stupidly reused a password that is now on haveibeenpwnd It's not a huge deal, just wanted to buy a Casascius on the Collectibles board, and figured a 0 post account would not look as believable as my old one.

Not sure if I posted any addresses, I usually try to avoid doing that just as basic OPSEC, but I'll dig through all the old messages, it's an excellent idea I should of thought of it, thanks!

My apologies for not posting on Meta, I realised as soon as I posted, and tried to ask for someone to move it there, but was foiled by the new account post timing limits. A tiny bit ironic I think.

[Pffrt]

https://bitcointalk.org/index.php?action=profile;u=129815
That's your account? You can try to recover your account by following the above linked thread.

My apologies for not posting on Meta, I realised as soon as I posted, and tried to ask for someone to move it there, but was foiled by the new account post timing limits. A tiny bit ironic I think.

You yourself can move the thread into meta for getting attention. Check below of this thread and you will get the opt to move the thread.

[rhomelmabini]

This really belongs to Meta. I've reported it so that mods will take action.

This link is the last post you posted your own Bitcoin address before I guess it's been hacked https://bitcointalk.org/index.php?topic=1574127.msg15807155#msg15807155 if you can somehow signed a message on that then there's a high chance you'll get your account back. Just follow the link OmegaStarScream just given and do follow also the instructions there.

[Krislaw]

The username is room101 ( Big 1984 fan in 2013 I guess )

My last post was July 2017, in October it switched to all Cyrillic? posts I think, but yeah, it could have been anyone, I stupidly reused a password that is now on haveibeenpwnd It's not a huge deal, just wanted to buy a Casascius on the Collectibles board, and figured a 0 post account would not look as believable as my old one.

Not sure if I posted any addresses, I usually try to avoid doing that just as basic OPSEC, but I'll dig through all the old messages, it's an excellent idea I should of thought of it, thanks!

My apologies for not posting on Meta, I realised as soon as I posted, and tried to ask for someone to move it there, but was foiled by the new account post timing limits. A tiny bit ironic I think.

You should take action now by signing a message from the address here https://bitcointalk.org/index.php?topic=1574127.msg15807155#msg15807155
Archive 1FrvANzkcgWvCuVFyfphbDNHbYUMfysd4K by messaging forum support. If you need more help, follow this topic https://bitcointalk.org/index.php?topic=5089777.0.

[Upgrade00]

Did you include a secret question option when creating your account? You can try to recover the account using that, this action would get the account locked and the hacker would not have access to it while you wait for the recovery process to be completed.
Having a signed message is not a prerequisite for accounts' recoveries, but it will quicken the process and convince users to leave negative ratings warning users not to deal with such accounts.

[Rohan Kotkar]

If you are sure your account was hacked and you were not the recent one handling that account than I fear to say that you have lost your account. In the year 2013, there was a breach and millions of forum accounts were been hacked. Even if you had security question, it might have made it a lot easier for the hacker to get acess to your account. Also, if you had a simple password than the chances would have been way lot higher that your account is hacked as the hacker had the password hashes in sha256script.

All you can do is report the account and try contacting admins with signed message from the address mentioned by @krislaw. Atleast you can lock the account if you are not given acess again because it is important that the account should not be used to scam anyone as you might be the suspect behind happing anything similar.

I suspect your account is hacked by referring this thread posted by theymos: https://bitcointalk.org/index.php?topic=1067985.0

[taufik123]

The account has been inactive for a long time and it's been almost a year on November 26, 2019.

And you said that you last opened it and posted in 2017.

If indeed the account was hacked by someone else and then the email and password were changed, of course it will appear in the Mod Log section in Bpip.

But there is no notification of changes to email and password.

https://bpip.org/profile.aspx?id=129815

Code:

Security/Moderator Log
11/16/2018 4:22:08 AM 	woke up
11/26/2019 9:55:28 AM 	woke up

if you really own the account you must be able to prove ownership with the signed Bitcoin Address message that you have posted and the primary email that the account has. if these conditions cannot be met, then the account will not be able to be opened again.

[acroman08]

The account has been inactive for a long time and it's been almost a year on November 26, 2019.

And you said that you last opened it and posted in 2017.

If indeed the account was hacked by someone else and then the email and password were changed, of course it will appear in the Mod Log section in Bpip.

But there is no notification of changes to email and password.

https://bpip.org/profile.aspx?id=129815

Code:

Security/Moderator Log
11/16/2018 4:22:08 AM 	woke up
11/26/2019 9:55:28 AM 	woke up

if you really own the account you must be able to prove ownership with the signed Bitcoin Address message that you have posted and the primary email that the account has. if these conditions cannot be met, then the account will not be able to be opened again.

as far as I know, bpip didn't record anything(like password change, email change etc..) before it was launched and the OP said that his last post was July 2017. and his theory is that his account was hacked around October (that same year) since in the post history it shows that the language being used change from English to Cyrillic. the OP's only option to prove that he owns the account is to sign a message using the address provided by krislaw which was found on the OP's post history.

[random_australian]

-----BEGIN BITCOIN SIGNED MESSAGE-----
My account Room101 has been hacked/lost. Please reset the email to ########### ( The original account email I signed up with) The current date is 3rd May 2020
-----BEGIN SIGNATURE-----
1FrvANzkcgWvCuVFyfphbDNHbYUMfysd4K
IGxvg1b3xa6K8LdStR6hG/hoJedNQr9vB+JjXml2GZq3P78EA3BU9znKxG2LY0e6pzNc+peysP2n8Fb98ZA83Cw=
-----END BITCOIN SIGNED MESSAGE-----

Here is the unedited post where I posted that address: https://bitcointalk.org/index.php?topic=1574127.msg15807155#msg15807155

Can someone please check I signed correctly. By some miracle I found the old account.

Thanks everyone for you help. Now to find a nice mint 2011 Casascius!

EDIT: Just wanted to confirm it was OK if I didn't actually put anything in the message field of the above signature. I just used the bitcoin address and signed a blank message. So in Bitcoin Core, you are verifying a blank message against with the above signature against the above address

EDIT2: It just occurred to me unless you specify the date in the message being signed you could just be pasting a signature someone posted years ago. I have sent support a signed message with date and email, I don't want to post it here for obvious reasons, but I'm pretty sure it worked correctly. Thank you so much everyone for all your help, as soon as I get back in I'll send you all some merit, I appreciate you taking the time!

[rhomelmabini]

<....>

I use this tool https://tools.qz.sg/ online since I am on my mobile but somehow it shows the signature is not valid. Can anyone verify it using Electrum or any other tools to prove that it is indeed correct?

I used this too https://reinproject.org/bitcoin-signature-tool/ but it still shows me the same output.

[random_australian]

Yeah bitcoin core seems to verify blank messages OK, the above don't though, and I don't want to post my email. Try this:

-----BEGIN BITCOIN SIGNED MESSAGE-----
random_australian is Room101 3rd May 2020
-----BEGIN SIGNATURE-----
1FrvANzkcgWvCuVFyfphbDNHbYUMfysd4K
HzvmlD4BCm3190RJ/8P0BGxzSHaAGeVbYJLmizj3TZlnVDBWvOI6wnKkurkp+wMn3wjtxZ/zJM3Sp13Ri7nQi2c=
-----END BITCOIN SIGNED MESSAGE-----

[Veleor]

1FrvANzkcgWvCuVFyfphbDNHbYUMfysd4K

Archive

Yeah bitcoin core seems to verify blank messages OK, the above don't though, and I don't want to post my email. Try this:

-----BEGIN BITCOIN SIGNED MESSAGE-----
random_australian is Room101 3rd May 2020
-----BEGIN SIGNATURE-----
1FrvANzkcgWvCuVFyfphbDNHbYUMfysd4K
HzvmlD4BCm3190RJ/8P0BGxzSHaAGeVbYJLmizj3TZlnVDBWvOI6wnKkurkp+wMn3wjtxZ/zJM3Sp13Ri7nQi2c=
-----END BITCOIN SIGNED MESSAGE-----

Verified and Archive


The "Room101" profile, apparently, from October 2017 passed to the farmer who bumping topics using a group of accounts: HappyScamp, miTgiB, evilscoop, Room101, naRky, BongaManollo, hansolo93.
Because all these profiles have changed passwords within 20 minutes and after that they began spamming at the same Russian ANN topic.

Code:

October 10, 2017, 02:02:24 PM - hansolo93 - password changed
October 10, 2017, 01:58:00 PM - BongaManollo - password changed
October 10, 2017, 01:56:34 PM - naRky - password changed
October 10, 2017, 01:53:38 PM - Room101 - password changed
October 10, 2017, 01:50:27 PM - evilscoop - password changed
October 10, 2017, 01:48:19 PM - miTgiB - password changed
October 10, 2017, 01:45:45 PM - HappyScamp - password changed

Archive

[rhomelmabini]

To random_australian I confirmed as well that the address has been verified and I guess sooner or later you may get your account back on you and since you already sent message to support your account now is on queued for recovery.

[random_australian]

Thanks everyone, much appreciated

[Room101]

It's mine again Thanks again everyone, I appreciate it

[nutildah]

You'll probably want to PM veleor and ask him to remove your negative feedback (he noticed your account had changed hands).

[Room101]

You'll probably want to PM veleor and ask him to remove your negative feedback (he noticed your account had changed hands).

Excellent idea, thanks

[rhomelmabini]

Welcome back Room101!