Almost lost all of my coins in an exchange last week

[Rengga Jati]

Wow, this can be a very rewarding experience and makes us more alert. In fact, when we are careful and try to secure our data, hackers are smarter and they can bypass the security. Really glad that you still can own your assets and move it.

On the other hand, this might be an additional lesson for us at least to check email regularly for emails and notifications from exchanges and monitor them.
Indeed, in this crypto world, nothing is perfect. Of course, there will be a downside and this is what hackers use to steal our assets.

[xSkylarx]

Else, how can the hacker by passing the email code verification and the Google Authentication process?

Do you remember something or anyone that saw your Google Authentication recovery key? I've been using it for 6 years and I've not yet experienced nor heard a news that their google auth 2fa was compromised. Nevertheless, this would remind to the members of this forum to take extra caution on their private accounts. Secure them properly and make sure you are the only one that knows it. If possible prevent other people from borrowing your device if you think they are capable of stealing your private accounts.

[Bitcoin Guy]

Hoping next time you can name that exchange so that we can also avoid using that.

I don't want to mention the name directly, but it has been mentioned in this thread by others.  You will need to look for it.

Do you remember something or anyone that saw your Google Authentication recovery key? I've been using it for 6 years and I've not yet experienced nor heard a news that their google auth 2fa was compromised. Nevertheless, this would remind to the members of this forum to take extra caution on their private accounts. Secure them properly and make sure you are the only one that knows it. If possible prevent other people from borrowing your device if you think they are capable of stealing your private accounts.

I did not keep the recovery key.  At the time of setting it up, I did not even know that we should keep our recovery key. 

Something just clicked.  I am wondering, why did the hacker change the password instead of just transfer the coins out.  Unless they did not really have the code which was sent to my email and the Google Authentication code.  Besides, the phone with Google Authentication installed was not turned on.  Because these codes are also needed to transfer coins each time.

After I pull out my last coin (which is a very small portion relative to the original amount), I will try to contact them using VPN as ask them to investigate.  It is for their own good that they do investigate.  If they don't, it will be their own loss.

[maculeth]

for the account problem linked to the email, I think it's difficult to hack because it has to go through verification. and this happens to me when I forget the password on my exchange account, then I have to verify it via email, while my email that I used has been a long time ago and I used a cellphone number that I no longer use, so I can't pass verification. There's about $ 366 in there, can it be saved?

[Sithara007]

No emails from them that are in the spam box.  I have no problem receiving their support email before they stopped responding.  
Don’t know how they can hack a phone which has the Google Authenticator that is not even turned on.

If you are 100% sure that your email/mobile is not compromised, then it is the fault of the exchange. I guess the hacker has made use of some vulnerability within the website, which would allow passwords to be reset even without the email confirmation. Or it can be an inside job (but the chances are even lower). I can see that you have already got the funds moved from the exchange wallet. So it may be good, if you post the details about the exchange. Let them respond to it, and explain how this issue has occurred.

[ralle14]

Long time ago I also experienced the same scenario where my account received a request for password reset but good thing is that I haven't made any transactions with the exchange.

and this happens to me when I forget the password on my exchange account, then I have to verify it via email, while my email that I used has been a long time ago and I used a cellphone number that I no longer use, so I can't pass verification. There's about $ 366 in there, can it be saved?

I think it's unlikely you'll recover your account but still possible if the exchange is willing to cooperate and if you can show some proof of ownership like signing a message from one of the transactions you used to deposit on your account. I know it's possible for them to disable 2fa but not all of them are willing to do so since it's only inconvenience for them unless there's a fee.

[finaleshot2016]

Most of my coins also were already traded because the price has been already increased, there's no sense if I'll still hodl those coins on the highest peak. It's a good welcome for me in the year 2021 so I didn't hesitate to trade my coins and sell all of them since those are potential coins. I won't hodl my coins in any exchange since there are still risks that our account might still get hacked or all of our assets will be gone because of mistakes.

[Kelvinid]

Wow, this can be a very rewarding experience and makes us more alert. In fact, when we are careful and try to secure our data, hackers are smarter and they can bypass the security. Really glad that you still can own your assets and move it.

OP isn't yet unlucky as he is in the perfect timing where he Login and read all the notification. Because in some cases, upon Login you will just surprise that the password is already changed. Good thing that there is an email message that saves OP otherwise, he definitely lost all of his assets/coins.

On the other hand, this might be an additional lesson for us at least to check email regularly for emails and notifications from exchanges and monitor them.
Indeed, in this crypto world, nothing is perfect. Of course, there will be a downside and this is what hackers use to steal our assets.

A simple mistake will lead these hackers to take all our coins. This what I worried about before and that it makes me decide not to leave a huge amount of tokens/coins in any exchanger for long days, once deposited I have to trade it ASAP. This is not a practice of many, but what happened to OP will give some hints to the others.

[Bitcoin Guy]

No emails from them that are in the spam box.  I have no problem receiving their support email before they stopped responding.  
Don’t know how they can hack a phone which has the Google Authenticator that is not even turned on.

If you are 100% sure that your email/mobile is not compromised, then it is the fault of the exchange. I guess the hacker has made use of some vulnerability within the website, which would allow passwords to be reset even without the email confirmation. Or it can be an inside job (but the chances are even lower). I can see that you have already got the funds moved from the exchange wallet. So it may be good, if you post the details about the exchange. Let them respond to it, and explain how this issue has occurred.

You mean if I mentioned their name in the thread they would respond?  I just added some information to my original thread.  If my email were compromised, why didn't the hack redirect my emails to the junk box so that I won't see them?  Also, how did they by passing my Google Authenticator while the iPhone was turned off and that I had never saved the recovery code (unintentionally) for anyone to recovery it?

By the way, does anyone know how to effectively reach out to them - maybe through FB, Reddit, or other social media sites?

[Koadharber]

(I hesitated to mention the name of the exchange in order to protect my existing account still in there.)

I started to use this exchange almost 4 years ago.  There were no any issues till recently.  Last Dec I logged into my account (which I haven't done it for a while) and the first page showed up saying that they will discontinue my services in 14 days and asked me to move my coins out to their US counterpart because I am a US customer.  I was thinking to myself, it I had not logged in, I would never know about this because they did not contact me at all on this matter. So I contacted the US exchange and found that they do not serve customers in my state.  So during all these times, I was researching for way(s) to relocate my coins.  I contacted the foreign  exchange and told them the challenges that I am facing in finding a place to put them.  They just told me to move the coins out before I lose them and then no reply to my follow up email since.  

Last week, I got three automated emails from them at the same time.  
First email: request to reset password from [IP which is not mine] (and a 6-digit code was included for verification).
Second email: Successful password reset from that same IP.
Third email: Successful login from new IP..... to protect your account withdraw is disabled for the next 24 hours.
                   (Thanks God for this function with the 24-hour disable withdraw.)

This happening really got my attention.  I immediately tried to log into my account.  I entered my password 4 times (one time away from my account being locked) without successful as it had been changed.  Thankfully, I did not try the 5th time knowing that my account would be locked and I would not be able to get any help from the exchange.  I sent an email using an old email thread to them reporting the situation, but got a reply saying that my IP is from an unsupported country which they cannot service.

However, thankfully, I was able to go through the process by clicking on the Forgot Password link and reset my password.  During that process, they sent me an email similar to the first email received before with the verification code.  And by using the code along with my Google Authentication code, I reset my password.  During the next several days, I did my best to get as much information as possible on how and where to move my coins to.  By using a VPN tool (first time), a desktop wallet, a hard wallet, and a  coin wallet that works with the hard wallet I was able to withdraw most of my coins out.  Before I moved my coins out, my heart was so heavy and troublesome because I did not know when the hacker would attack again.  

Now that I got most of the assets out from there I am more comfortable to talk about it and to share my story.  Would this be an inside job given that they knew the US customers are vulnerable and helpless (since they cannot use their customer services anymore)?  Else, how can the hacker by passing the email code verification and the Google Authentication process?  This is still very unsettling to me.  


Added on Feb 4, 2021
Thank you for your feedback and suggestions.  I added the following information as many people had asked related questions on them.
-   The exchange name has been mentioned by others in this thread.  Please spent sometimes to look for it.  
-   After I pulled my last coins out from the exchange, I will try to contact them and present the incident to them so that they can investigate and, hopefully as a result, to improve their services.
-   In order to reset my password, I need to enter the passcode which was sent to my email + the Google Authentication code.
-   The old iPhone which has the Google Authenticator installed was not turned on at the time when the hack occurred (and it is not usually turned on in order to extend its usage life as the battery is no good).  And I had not kept the recovery key for the authenticator anywhere – I did not save it.  So there is no one, including me can recovery it.  I got the authenticator for years.
-   This is a question for myself (just thought of it last night) – why did the hacker change the password (which triggered the no-withdrawal-in-24-hour rule) instead of withdrawing the coins out right away?  To withdrawal any coins, both the passcode sent to my email and the Google Authenticator code are needed (same as the reset password requirement).
-   I really don’t believe that my email address was compromised.  It that were true, the hacker could redirect the 3 emails that were sent to me to junk folder when the password got changed and account was accessed from a new IP address.  Without receiving these emails, my coins would be done for.
-   By the way, I have no ill attitude toward the exchange.  I really like the exchange as it supports many altcoins that are not supported in many other exchanges.  The way they required both the security code from email and Google Authenticator to withdrawal added a strong security layer to the accounts (in addition to login with username and password).  Also, the no-withdrawal-in-24-hour rule after password changed was a saver.  
-   They provided good customer support services before they shut me down by sending an automated email saying that my IP was identified as from a country that they don’t support when I tried to reach out to them again.  So if you are an US customer and your account got hacked, there is no way for you to seek any help from them – at least within a short amount of time (24 hours?) – before your assets got moved out.

I hope that this happened to you taught you a lesson about centralization. That this centralized exchange even reputable ones, can control our assets in their platform! I mean, I am not generalizing but the fact they it is a website and the custodial liability is in their part, they can do whatever they want. I personally hold certain percentage of my asset and hold it in exchange - for the purpose of day trading, short term trading only. If I decide to hold a token/ coin for a long period of time, I will withdraw that back to my offline wallet. I still have trusted exchanges like Binance but its just that be better than sorry. Government can do anything as long as they want.

[pawanjain]

Damn, that's quite an experience. Personally I haven't faced such a situation in crypto. I have faced it on Social media though (getting a social media account hacked and then successfully retrieving it back).

There are a few things to talk about here. Reading the comments I got to know that the exchange you are talking about is Binance.
It's a well reputed exchange with a lot of fake phishing websites. May be you clicked some phishing website which you don't even remember.
It happens with the best of us. May be it was an insider job(though the probability is low, it can still happen)
May be someone had access to your devices which were earlier used to login to binance.
May be someone who knows you had planned to hack you

The reason might be anything. Unless you are an active trader it is always advised to store your coins in a custodial wallet rather than an exchange.

[Serious475]

Glad you were able to get most of them out of there, this is the main reason why I like to have control of all my private keys and don't use exchanges for storage

It is really good if you are sure with every thing you need on your account and wallet because if the wallet you are using has a good system, you can recover the bitcoin you lost or sent on a wrong address. If you already knew that your email or contact is not on you anymore, you should change it because it might only give you a head ache when you lose all your money suddenly. We should also be careful on typing bitcoin address because it may be the reason why we lose all of our money and we cannot always rely on the features that your wallet has. Even if we have that feature for free, still don't let your guard down because sometimes features like that can have a problem or maintenance. Also the disadvantage of this is anyone who knows your email and password can easily take your money even if you already sent it into another wallet since it is recoverable.

[taufik123]

Most of my coins also were already traded because the price has been already increased, there's no sense if I'll still hodl those coins on the highest peak. It's a good welcome for me in the year 2021 so I didn't hesitate to trade my coins and sell all of them since those are potential coins. I won't hodl my coins in any exchange since there are still risks that our account might still get hacked or all of our assets will be gone because of mistakes.

and the error is on the individual each account owner. I still have some coins on the exchange and it's still safe. The most important thing is that you have activated all the recommended security methods such as 2FA security, verification of phone numbers and e-mails. All of this will be very useful for the security of the main exchange account created as a trade. It is true that the risk of being hacked still exists, but we have done our best and remain vigilant. Some of my assets are stored in my personal wallet and it has better security.

[blackened515]

<...>

You should mention the name of exchange to make others aware of it and don't lose their funds if they have account their.
There is also a possibility that your mentioning your problem here will catch the attention of exchange support and they help you.

[Twentyonepaylots]

That is really iffy and scary at the same time. I also wanted to know why it took you that long of a time to even get back on your precious investments. I know sometimes people go hodl hibernation to relieve them of the worry but it seems as though you forgot you even had them in the first place. Nevertheless I am really glad that you got your coins back, now just be vigilant as hackers are becoming more and more intelligent in taking advantage of unsuspecting investors.

[John Cryp]

the bypassing of the google authenticator is pretty worrysome

[Bitcoin Guy]

That is really iffy and scary at the same time. I also wanted to know why it took you that long of a time to even get back on your precious investments. I know sometimes people go hodl hibernation to relieve them of the worry but it seems as though you forgot you even had them in the first place. Nevertheless I am really glad that you got your coins back, now just be vigilant as hackers are becoming more and more intelligent in taking advantage of unsuspecting investors.

If your coins lose 80% to 90% of their original value, would you want to check your account often?

[dezoel]

But how can you keep your asset stored on an exchange and you’re not checking it steady to know what’s up with them? That’s some kind of risk you took there, you really have to be very careful, because exchanges are not really that safe and if you are not careful you can lose your money or they can get hacked and your money is gone. You supposed to be storing in hardware and offline wallets as you’re doing now.

As for the question you asked about  the hacker not moving the funds immediately, I guess maybe he thought he has gotten full access to the account and felt he should keep it for now and withdraw the money later, since prices are going up? I’m just guessing though, but it’s good that you got your money out before stories that touch.

[iTradeChips]

I am relived that you were able to fix the issue on your own. That is a very disturbing experience, what you have experienced there. I am glad that you were able to get all of your cryptos out of that exchange. From the looks of it, somebody is trying to get your coins through illegal means. Only thing I can think of is that it might be a compromised account that was being acessed by someone who know some of your credentials. Of course we cannot say it might be inside job but who knows?

[DoublerHunter]

If your coins lose 80% to 90% of their original value, would you want to check your account often?

^ I did this before when I was very active in trading back then. I regularly check my balance on the exchange where I left my money as an investment to ensure that there is progress on my investment or something plan how can I recover those losses. Sometimes there are gains but mostly it turns out losses. However, I never withdraw my investment on the exchange if my profit was not there, once I am invested as capital in trading, why not just risk my money for potential ROI. Nevertheless, good to hear about your fund back.