My ledger got hacked

[psycoclan1]

Hi guys,

unfortunately, my ledger hardware got hacked last night and 100% of the funds were transferred into another address. I have no idea how this happened. I have never shared my seed words to any websites. I used the same wallet for over 4 years with no problem. The only thing I can think of is that I connected my laptop yesterday afternoon in a public wifi hotspot at stansted airport, in London. I flew from there later that day, and as soon as i landed, i checked the balance and it was 0!!! Any idea how did this happen, as Im running out of hope!

[1714686948]

1714686948

[1714686948]

1714686948

[1714686948]

1714686948

[mocacinno]

Very hard to say... theoretically you should be able to use your ledger on an infected pc and still not lose your funds...

I can think off a couple very remote scenario's that happened, or were at least discussed in the past:

• You saved your seed in the cloud, and your account got hacked (icloud, dropbox, gmail,...)
• You saved your seed on a physical carrier, and somebody found said carrier
• You entered your seed in a different (vulnerable) wallet
• You were the victim of a clipboard virus (eventough, this would have required you to actually make a transaction)
• You received a device that had been tampered with... either preloaded with a seed, or plain fake
• You were the victim of an evil maid attack (somebody had physical access to your device)

[psycoclan1]

Very hard to say... theoretically you should be able to use your ledger on an infected pc and still not lose your funds...

I can think off a couple very remote scenario's that happened, or were at least discussed in the past:

• You saved your seed in the cloud, and your account got hacked (icloud, dropbox, gmail,...)
• You saved your seed on a physical carrier, and somebody found said carrier
• You entered your seed in a different (vulnerable) wallet
• You were the victim of a clipboard virus (eventough, this would have required you to actually make a transaction)
• You received a device that had been tampered with... either preloaded with a seed, or plain fake
• You were the victim of an evil maid attack (somebody had physical access to your device)

From all of these suggested possibilities, I do admit I saved the seed in my google drive. To access my gmail account though, requires 2FA. Google did not notify me for a remote login etc. I used the same seed since 2017 on the same ledger device.

[mocacinno]

--snip--

From all of these suggested possibilities, I do admit I saved the seed in my google drive. To access my gmail account though, requires 2FA. Google did not notify me for a remote login etc. I used the same seed since 2017 on the same ledger device.

It's very hard to say for sure, especially without knowing you or being able to physically inspect any logs related to you... But saving a seed in your mail is a big red flag... I did see several people in the past that used this method and lost their money... Same for icloud, witch was even worse...
I'm not saying this is the case for you, but i doubt somebody without physical access to your metadata will actually be able to pinpoint the exact problem and cloud leaks are not that uncommon so they're probably the vulnerability with the highest odds in this case.

[passwordnow]

From all of these suggested possibilities, I do admit I saved the seed in my google drive. To access my gmail account though, requires 2FA. Google did not notify me for a remote login etc. I used the same seed since 2017 on the same ledger device.

It's never advisable to store your seeds or private keys into cloud storage such as google drive. That's probably the reason why you've been hacked. I thought about when you've access on the public wifi, maybe there's also something to do with that as it's also never advisable to do that with your laptop that you use to access your funds.

[aoluain]

Very hard to say... theoretically you should be able to use your ledger on an infected pc and still not lose your funds...

I can think off a couple very remote scenario's that happened, or were at least discussed in the past:

• You saved your seed in the cloud, and your account got hacked (icloud, dropbox, gmail,...)
• You saved your seed on a physical carrier, and somebody found said carrier
• You entered your seed in a different (vulnerable) wallet
• You were the victim of a clipboard virus (eventough, this would have required you to actually make a transaction)
• You received a device that had been tampered with... either preloaded with a seed, or plain fake
• You were the victim of an evil maid attack (somebody had physical access to your device)

From all of these suggested possibilities, I do admit I saved the seed in my google drive. To access my gmail account though, requires 2FA. Google did not notify me for a remote login etc. I used the same seed since 2017 on the same ledger device.

Yup as above cloud storage is fine for photos of your pets and your car but not for
sensitive information. The trouble with free email and storage is its too convenient
to use and a lot of people use it by default rather than spending a bit more time to
make use of a securer alternative.

How does your 2FA work, does it go to a second email account? maybe the hackers
had access to that also over the public wifi?

Sorry to hear this.

[psycoclan1]

To be honest I should have deleted this seed from the cloud. I saved it in June 2017 and I completely forgot about it. This was the very first time I have ever used crypto. I guess it's a way to learn a lesson. The 1 million dollar question is if there is any way to recover. I know it is not possible, just asking...mostly out of desperation

[Ryker1]

To be honest I should have deleted this seed from the cloud. I saved it in June 2017 and I completely forgot about it. This was the very first time I have ever used crypto. I guess it's a way to learn a lesson. The 1 million dollar question is if there is any way to recover. I know it is not possible, just asking...mostly out of desperation

Well so sad to hear about your loss.
Yes, it is your lesson to learn and be careful next time that it won't happen again. How many newbies like you will fall victim first before they will learn?
Most newbies I saw a problem like this which is they can completely be avoided if they know how to avoid on their own. We should always be knowledgeable enough before using bitcoin because that has a value and the transaction is irreversible, once it will send to the hacker's address it will never retrieve. So, therefore, next time you must be careful.

[dothebeats]

Even if you log in to a public wifi, your funds are supposed to stay intact on your ledger, unless of course there are other people knowing your login credentials that is. Or your machine itself is infected by something, but even then the funds should still remain intact.

Have you checked whether there are others around you that know of your crypto activities? They could possibly be the ones who might be behind this.

To be honest I should have deleted this seed from the cloud. I saved it in June 2017 and I completely forgot about it. This was the very first time I have ever used crypto. I guess it's a way to learn a lesson. The 1 million dollar question is if there is any way to recover. I know it is not possible, just asking...mostly out of desperation

Where are you receiving your 2FA notifications? Through your mobile device or some other machine?

As for recovery, I don’t think there is a way for you to get back the funds as it was already sent to another address.

[Fatunad]

To be honest I should have deleted this seed from the cloud. I saved it in June 2017 and I completely forgot about it. This was the very first time I have ever used crypto. I guess it's a way to learn a lesson. The 1 million dollar question is if there is any way to recover. I know it is not possible, just asking...mostly out of desperation

Regret do always come in the end and not from the start.You should have known that it is risk on storing up seeds on the cloud and it would be much better if you do save it offline.
Having those keys or seeds written on a paper is less risky than you had save up your keys on the cloud which its never been advisable.In talks about your question about
recovery then this is something the sad part.There's no way on getting those coins back and sorry for your loss. I know its hard to move on but there no such
thing you could do.

[glascake]

Google 2FA is trash. There are ways to get into the account with for example access to pw and recovery email.

My account got hacked via a malicious browser extension. They had access to everything, took me about 4 months, the police and hours on the phone with unhelpful google employees, to recover access.

If you had your seed in the cloud, that’s 100% how they got it.

DO NOT PUT YOUR SEED ANYWHERE DIGITALLY. (No NAS, no usb, no phone notes)

I have my seed laser engraved in a metal plate (my own personal laser not connected to the internet) and then hidden in the wall in my apartment.  

[psycoclan1]

Even if you log in to a public wifi, your funds are supposed to stay intact on your ledger, unless of course there are other people knowing your login credentials that is. Or your machine itself is infected by something, but even then the funds should still remain intact.

Have you checked whether there are others around you that know of your crypto activities? They could possibly be the ones who might be behind this.

To be honest I should have deleted this seed from the cloud. I saved it in June 2017 and I completely forgot about it. This was the very first time I have ever used crypto. I guess it's a way to learn a lesson. The 1 million dollar question is if there is any way to recover. I know it is not possible, just asking...mostly out of desperation

Where are you receiving your 2FA notifications? Through your mobile device or some other machine?

As for recovery, I don’t think there is a way for you to get back the funds as it was already sent to another address.

Nobody knows my credentials (as far as I know). It was just me and noone else around. I can't really tell how this happened and that confuses me. 2FA in my google authenticator app on the phone. Yeah it's an expensive lesson I guess.

Is there any possibility that anyone could guess the 24 words correctly randomly?

[glascake]

It’s easier to steal the words then to guess them. It’s just not worth it.

[Upgrade00]

Is there any possibility that anyone could guess the 24 words correctly randomly?

Guessing your 24 word recovery phrase randomly is not remotely possible. If it were, the entire network would have collapsed already as anyone lucky enough would be able to guess the recovery phrase of any wallet and steal the coins linked to them.
Any of the suggestions given above by @mocacinno could be the exact scenario that happened, or there was some other source of security leak which you are not yet aware of.

[zanezane]

I don't think you've caught some malware somewhere but not the airport, you connecting to the airport Wi-Fi has nothing to do with you being hacked, the VPN ads lies about that part, I think the abuse has been obsolete because the Wi-Fi tech was changed. Maybe the people behind that hack was biding their time.

[Dave1]

To be honest I should have deleted this seed from the cloud. I saved it in June 2017 and I completely forgot about it. This was the very first time I have ever used crypto. I guess it's a way to learn a lesson. The 1 million dollar question is if there is any way to recover. I know it is not possible, just asking...mostly out of desperation

I'm sorry to burst the bubble for you but there's no way to get back your money. Probably the hackers have been using mixer to obfuscate their foot prints in the blockchain.

Expensive lessons here and I do hope that many members here will learn from the OP experience and not repeat the mistakes of using public wifi or cloud storage to hide your sensitive data.

[Kong Hey Pakboy]

Expensive lessons here and I do hope that many members here will learn from the OP experience and not repeat the mistakes of using public wifi or cloud storage to hide your sensitive data.

You're wrong, it's totally safe to use a public Wi-Fi, I will give you a link about a video regarding the true stuff behind the protection offered by almost any VPNs in the market, it's a short one so it's not that tiring to watch.

https://youtu.be/WVDQEoe6ZWY

[odolvlobo]

AFAIK, there is no way to obtain the seed or the private keys from a Ledger without physically accessing the hardware inside it.

If someone stole your coins, there will be one or more transactions showing it. Please post the transaction IDs.

[hichamito37]

Hi guys,

unfortunately, my ledger hardware got hacked last night and 100% of the funds were transferred into another address. I have no idea how this happened. I have never shared my seed words to any websites. I used the same wallet for over 4 years with no problem. The only thing I can think of is that I connected my laptop yesterday afternoon in a public wifi hotspot at stansted airport, in London. I flew from there later that day, and as soon as i landed, i checked the balance and it was 0!!! Any idea how did this happen, as Im running out of hope!

Condolences to your loss , You need to be extra careful with all of today's sophisticated crypto asset misappropriation , Especially passphrase keys. Your files should be stored in a place do not choose google drive or store documents in your computer , The best advice is to write it down by hand and save it in a journal.

To be honest I should have deleted this seed from the cloud. I saved it in June 2017 and I completely forgot about it. This was the very first time I have ever used crypto. I guess it's a way to learn a lesson. The 1 million dollar question is if there is any way to recover. I know it is not possible, just asking...mostly out of desperation

We all should be careful nowadays there are a lot of hackers and sophisticated acts that infiltrate our computers and all our information , You have learned from this loss I believe you have learned the lesson , My sincere advice is that you should record in the logbook of all manual operations , Then we can safely protect our assets by hackers.

[James Watson]

I had this experience at the beginning. At that time, the whole person didn’t know what happened. After seeing this post, I probably understood the reason, and as a lesson learned, I posted it on the forum to let more novices notice and avoid losses.