blockchain.com compromised by blcokchain.cm

[M39jd9hf]

I have made all the pictures. I am afraid that the blockchain.com site has been compromised. Yesterday I logged in on my ipad through the official QRcode weblogin from my iphone.
Direct after that I received two 2fa messages on  my iphone although I was already logged in on my ipad. So it seems that when i pushed the link loging with mobile on my ipad a wrong blockchainadress with camera came up. After that my saldo was reduced to zero bitcoin.
What I then saw is that the QRcode had logged in on my ipad on www.blcokchain.cm.
An identical site? Which I cannot enter from a laptop. I have printscreens but don't know how to attach them. 0.004 BTC from my wallet was send to an andress I don’t know. But I also cannot see my profile or my interest accounts anymore. On the interest accounts there were btc and ETH. I can login on blockchain.com but don’t have functionality. I don't see my interestaccounts anymore. My account seems compromised. I already opened a new wallet with the seed in both blockchain.com as electrum but zero BTC is available. I don't see any transactions besides the 0.004 BTC transaction to an unknow account so were are my btc and eth on the interest account?

[1715235741]

1715235741

[1715235741]

1715235741

[bL4nkcode]

You mean you have tried to login your blockchain.com account on blcokchain.cm? I don't know how you access the site, I can't  access it though. If your wallet is now zero balance and there's an unknown transaction, then most probably your account is compromised, not the website itself.

[nc50lc]

-snip- My account seems compromised. I already opened a new wallet with the seed in both blockchain.com as electrum but zero BTC is available. I don't see any transactions besides the 0.004 BTC transaction to an unknow account so were are my btc and eth on the interest account?

Only your normal accounts will be restored to Electrum like "My Bitcoin Wallet", if you have created more accounts (except Trading and Interest), you can change the derivation path's account index in Electrum.
But I believe that it's not the solution to your case.

As for the Interest account, you should try to log-in in the web version using a device safe from malwares or viruses.
You might have a malware that messes with your QR Code reader, browser, etc.

[M39jd9hf]

You mean you have tried to login your blockchain.com account on blcokchain.cm? I don't know how you access the site, I can't  access it though. If your wallet is now zero balance and there's an unknown transaction, then most probably your account is compromised, not the website itself.
[/maybe yes then the device is compromised. But how can an ipad be compromised or my qrcode on my iphone? On my ipad when i click in the history view of visited pages in safari I see the blcokchain.cm website and can click through. But why can't I properly login through an other laptop anymore? I only see some functionality but not my interest account]

[M39jd9hf]

-snip- My account seems compromised. I already opened a new wallet with the seed in both blockchain.com as electrum but zero BTC is available. I don't see any transactions besides the 0.004 BTC transaction to an unknow account so were are my btc and eth on the interest account?

Only your normal accounts will be restored to Electrum like "My Bitcoin Wallet", if you have created more accounts (except Trading and Interest), you can change the derivation path's account index in Electrum.
But I believe that it's not the solution to your case.

As for the Interest account, you should try to log-in in the web version using a device safe from malwares or viruses.
You might have a malware that messes with your QR Code reader, browser, etc.
[/when I try this on a laptop, so other device, the site keeps hanging. not all functionality in the blockchain.com account is visible and the logo keeps turning. when I login in a new account everything works fine. So I can't see preferences of profile or interest accounts]

[nc50lc]

As for the Interest account, you should try to log-in in the web version using a device safe from malwares or viruses.
You might have a malware that messes with your QR Code reader, browser, etc.

when I try this on a laptop, so other device, the site keeps hanging. not all functionality in the blockchain.com account is visible and the logo keeps turning. when I login in a new account everything works fine. So I can't see preferences of profile or interest accounts]

Hmm, if it's their website's issue, it should've happened to more users; eg.: I have no problem logging-in & your new account works.
The hacker might have done something to your account that's why you have trouble logging in to any device.
Contact blockchain's support for help, log-in issues can be solved using their CS.

Or clear your browser cache and try to login again, you may as well try to use a different method to connect to the internet.
Other than that, I have no other idea.

[BitMaxz]

This is the reason why I don't want to recommend custodial wallets to newbies they can be phished easily or hacked by a fake website.
Next time don't use custodial wallets or any wallets directly from exchanges if you want to keep your wallet safe always use non-custodial wallets.

I suggest this thread "Custodial vs. Non Custodial Wallets - "Not your keys, not your coin" Explained."


About the issue on the blockchain, I think only blockchain support can help you with this issue they have the option to refresh your account to fix the issue.

If you still don't have responses from Blockchain support try any of these below while waiting for their reply.

Try to reset your browser.


Change your laptop DNS.
You can use these two options below.

Code:

Google DNS
8.8.8.8
8.8.4.4

CloudFlare DNS
1.1.1.1
1.0.0.1

Open CMD and type these.

Code:

ipconfig /release
ipconfig /renew
ipconfig /flushdns

Restart the laptop and try to login again.

[M39jd9hf]

This is the reason why I don't want to recommend custodial wallets to newbies they can be phished easily or hacked by a fake website.
Next time don't use custodial wallets or any wallets directly from exchanges if you want to keep your wallet safe always use non-custodial wallets.

I suggest this thread "Custodial vs. Non Custodial Wallets - "Not your keys, not your coin" Explained."


About the issue on the blockchain, I think only blockchain support can help you with this issue they have the option to refresh your account to fix the issue.

If you still don't have responses from Blockchain support try any of these below while waiting for their reply.

Try to reset your browser.
https://i.imgur.com/qVTQcFC.png

Change your laptop DNS.
You can use these two options below.

Code:

Google DNS
8.8.8.8
8.8.4.4

CloudFlare DNS
1.1.1.1
1.0.0.1

Open CMD and type these.

Code:

ipconfig /release
ipconfig /renew
ipconfig /flushdns

Restart the laptop and try to login again.


[/thank you very much for the advice. although I red and tried lots of things this on practising this is the first time that I have been scammed so it looks like. I ordered already a cold wallet but this one did not arrive yet, so just to late.. It is still very strange that I was logged in the blochchain mobile app on my iphone, used the Qrcode for quick weblogin on my Ipad and then I was rerouted to blcokchain.cm and scince then the problems started. I cannot open on other devices the blcokchain.cm site. But on al other devices my account is not working properly anymore. I even used a complete other laptop which had never logged in into blockchain.com but the screen stays white for the most part, only a couple of functions are working. So it is not my browser on my ipad, it is on all browsers from different devices and users. When I login in an other wallet this is not a problem, functions are working, so It is really a problem with this specific wallet. I don't know for so far if my interest accounts are empty now? I did not see any further transaction so It should be there, but the main saldo says 0. I have sent a report to the customer support , so hope they get back to me. I would like to share the printscreens so that you can see how it looks. It should not happen to others en Blockchain.com should examen this.

[nc50lc]

-snip- I don't know for so far if my interest accounts are empty now? I did not see any further transaction so It should be there, but the main saldo says 0. I have sent a report to the customer support , so hope they get back to me. I would like to share the printscreens so that you can see how it looks. It should not happen to others en Blockchain.com should examen this.

FYI, your Interest and Trading wallets aren't backed-up by the recovery phrase, controlled by blockchain.com and can't be sent to external wallet addresses,
if the hacker successfully logged in your account for some reason, the only option he has is to send it to your "My Bitcoin Wallet" before he can send it to his own wallet.
With that, keep track of your main account's transaction history using the restored wallet in Electrum, any transaction past the last outbound transaction may be your Interest account's balance going in to the main wallet and another one being sent out.

BTW, you won't be able to display images 'till you become a "junior member" (next tier to newbie).
Those will be displayed as links instead.

[Potato Chips]

when I login in a new account everything works fine.

If there are signs that funds from your interest account are still safe there are two methods i could think of to try.

Your Interest Account is associated with your Blockchain.com identity profile. If you lose access to your Blockchain.com Wallet, all you need to do is use your backup phrase to recover your wallet and then get re-verified in your new wallet to recover your Interest Account funds.

It does say the interest account is tied to your identity profile so maybe even if you verify a freshly made blockchain.com account, funds would still show up? However there is a chance you might trigger their flags and get your funds locked but hey it's better to deal with their support.

or..
Recovering your account thru blockchain.com does gives you a new wallet ID and such so it's pretty much a new shell/account but same wallet, maybe youll be able to access it fine this time. The hard part is because the wallet is already compromised it becomes a race between you and the hacker on which transaction gets to be confirmed first. After you send the bitcoins to your compromised blockchain.com wallet go to electrum and do this (https://bitcoinelectrum.com/how-to-do-a-manual-child-pays-for-parent-transaction/). The higher miner fee you put, the faster it would be to be picked up by a miner. I consider electrum's fee estimation to be reliable, try to set it to "mempool" and target .5MB or less.

This all assuming they won't redirect you to manual verification which could take weeks...

[nc50lc]

Your Interest Account is associated with your Blockchain.com identity profile. If you lose access to your Blockchain.com Wallet, all you need to do is use your backup phrase to recover your wallet and then get re-verified in your new wallet to recover your Interest Account funds.

It does say the interest account is tied to your identity profile so maybe even if you verify a freshly made blockchain.com account, funds would still show up? However there is a chance you might trigger their flags and get your funds locked but hey it's better to deal with their support.

or..
Recovering your account thru blockchain.com does gives you a new wallet ID and such so it's pretty much a new shell/account but same wallet, maybe youll be able to access it fine this time. The hard part is because the wallet is already compromised it becomes a race between you and the hacker on which transaction gets to be confirmed first.

It's the mix of the two: It will create a new "wallet ID" and the the BIP39 supported accounts will be added automatically.
For the custodial accounts: he just need to provide the same "identity" like name, address, etc. and pass verification using the same credentials as the old wallet and his Interest and Trading accounts should be restored to the new wallet.

[M39jd9hf]

Thanks again. So I managed to set up a new wallet on blockchain, import the seed and then I did not see my interest accounts. I verified again and after that the interest accounts were visible. Lucky me I thought.. So I booked some btc to the trading wallet and send to my own adress. That worked. Then I did again move a little portion BTC to my trading wallet. Moved that from my trading wallet to my BTC wallet, but at the exact same time when i look in electrum the BTC was moved to the hackers adress. So I lost again some money. In the blockchain history it shows that on 10.15 pm my btc was moved to the hackersadress BUT my movement between the trading wallet en btc wallet was 10.17. So how is it possible that:
1. the hacker had my btc removed from wallet before I could even see it in my btc wallet?
2. the timing history on blockchain.com is different then in Electrum history.

And the most important questions:
1. I have still some btc to move from interest to trading wallet. How can i be absolutely sure that the hacker is not quicker than me?
2. how can I delete the wallets and remove everything?
3. the first old hacked wallet is still not working. how can i Delete it?

[The Cryptovator]

And the most important questions:
1. I have still some btc to move from interest to trading wallet. How can i be absolutely sure that the hacker is not quicker than me?
2. how can I delete the wallets and remove everything?
3. the first old hacked wallet is still not working. how can i Delete it?

Is it mandatory to move your BTC from interest to a trading wallet? Can't you send BTC to any external wallet address? If so, then send bitcoin directly to another fresh wallet address (of course noncustodial wallet).

You don't need to delete wallet details, just withdraw all of your funds from there and forget about it. Nothing else. If the first hacked wallet isn't working then does it necessary to delete it? Why not just forget about it if there are no funds.

Please make sure your device isn't under attack before creating a new wallet. I will suggest resetting everything on your device, if you are on mobile then format and erase everything. If you are using a PC then "remove everything and reinstall Windows". Make sure you are downloading wallets from original sources and save them in multiple places offline.

[M39jd9hf]

Hi, it is mandatory to move the btc from the interest account to the trading wallet. Then it is mandatory to move the BTC from the trading wallet to the BTC wallet. And when I did this yesterday at the same moment even before my BTS showed up in the BTC wallet they were already sent to another adress. 2 minutes earlier.
So I have a big risk when moving my BTC from the interest account, because somebody seems watching it.
I work on an other device. I don't think my ipad pro can be compromised but I can reinstall everything if needed.

[nc50lc]

And the most important questions:
1. I have still some btc to move from interest to trading wallet. How can i be absolutely sure that the hacker is not quicker than me?

It'll be troublesome since the hacker already have access to your backup phrase, he must have restored it to a wallet that supports BIP39.
So, every time your main wallet receive a transaction, he can send it right away.

Sending it to your other account that's higher than the 10th index by creating more than 10 Bitcoin wallets in "Settings Icon->Wallets & Addresses" might do but the hacker must be monitoring those too.
So, try to convince the support (explain the situation) to let you send your Interest and Trading account balance to other wallets.

There may be more options because I'm not using the Interest and Trading feature of that wallet.

[Potato Chips]

Was the transaction initiated by the hacker already with confirmation/s when you found it?

The hacker doesn't seem to have an access to your custodial accounts seeing that they can't move the funds themselves. It can't be the holding period either since you were able to withdraw. Waiting on what the support can do for you may be the best for now. Reach out to their other channels too like twitter (https://twitter.com/AskBlockchain).

I'd ask them about the first method i mentioned in my previous post too which is recovering your interest account in a newly created blockchain.com account-- you wont be using the compromised backup phrase.

Your blockchain.com wallet is linked to your custodials so that may pose a problem for you like triggering their suspicious flag if the wallet + identity profile must go as a set.

User Account means (where applicable, in your name) an account kept by Blockchain Access UK LTD for Blockchain.com Exchange, the Airdrop Program, Swap and the Trading Wallet. For the avoidance of doubt, no User Account is associated with a Wallet unless the Wallet is linked to one of the foregoing Services or Blockchain.com’s Interest Account.

[M39jd9hf]

@potatochips, thx again. yes the transaction was confirmed. The strange thing is and that worries that when I sent the btc from the trading wallet to the btc wallet the timing was actually to soon. I sent it to my btc wallet 2 minutes later than the hacker sent it from my wallet to its own adress. this was later visible. When i look at the log in electrum both transactions were done in the exact same minute. So is there a way that I can make sure that I am the one who will sent the BTC to an other adress or to my euro account. that's is also an option. But I don't want that the hacker is again quicker.
I twittered and used the support ticket, but no response. I sent also pictures on twitter with the blcokchain.cm adress in it.

[Bitcoin_Arena]

The strange thing is and that worries that when I sent the btc from the trading wallet to the btc wallet the timing was actually to soon. I sent it to my btc wallet 2 minutes later than the hacker sent it from my wallet to its own adress. this was later visible. When i look at the log in electrum both transactions were done in the exact same minute. So is there a way that I can make sure that I am the one who will sent the BTC to an other adress or to my euro account. that's is also an option. But I don't want that the hacker is again quicker.
I twittered and used the support ticket, but no response. I sent also pictures on twitter with the blcokchain.cm adress in it.

The hacker is probably watching your address or using some sort of script that automatically sends your funds to his address as soon as you try to move your bitcoins from the interest account.

He will always be quicker since you will try to carry out the withdrawal process manually while his is automated. I would wait for a response from the blockchain team before doing anything else. The problem is support of services such as blockchain.com is so slow and annoying

[The Cryptovator]

I twittered and used the support ticket, but no response. I sent also pictures on twitter with the blcokchain.cm adress in it.

I doubt Blockchain will help you, usually their response is quite slow. I am assuming hackers gain your wallet seeds or wallet file somehow. That's why even you change all your wallet credentials in including 2FA. Means hackers would access your wallet from any other software like Electrum. Have you tried to exchange some other coin and withdraw it instead of BTC? If hackers monitoring your BTC address and use the software only for BTC then it would help. Of course, you have to change all your credentials of the account like password and 2FA. I am not sure if it's possible, but you may try if incase there is an opportunity.