HELP: Hacked Wallet

[KHamilton]

I set my Metamask wallet up to be a chrome extension on my computer yesterday and someone hacked into it and stole all of my coins/tokens. The thing is, I'd just signed up for a program where you create nodes thru Strongblock and get paid passive income to host that node on the ethereum network, meaning that node is connected/Affiliated with your wallet. There is no reversing it and you have to have the node associated with a wallet. Now that the MM wallet has been hacked, what should I do??

[Oshosondy]

Now that the MM wallet has been hacked, what should I do??

Can you not change the wallet connected to the node? Can't you also use another better wallet that is not a web wallet? Just saying this because one thing j hate about Metamask wallet is that it is vulnerable to hacks because it is a web wallet. There will be a way you can change the wallet or address that can be used.

[Upgrade00]

Did you set up the nodes yourself or did you have someone else do it for you?
Also, did you verify the extension being added, the Strongblock Ponzi or project is becoming quite popular and this is sure to attract scammers who would create fake versions to get into user's wallets.

Now that the MM wallet has been hacked, what should I do??

There's really nothing you can do as the coins are already gone besides checking for the loophole and ensuring it does not affect any other app on your device.

[Findingnemo]

AFAIK, Metamask can't be hacked unless you give Authorization to the site you've connected with, so if you gave the access already then your wallet is already compromised so if you see any balance leftover there better move to a new wallet as soon as possible and never do such kind of mistake again.

[NeuroticFish]

I am not familiar with Metamask, but after finding out how you've got hacked and clean up the system if needed, you should consider the old wallet compromised and create a new clean wallet.
And I keep preaching it: consider buying a hardware wallet.

[bakasabo]

That is right - forget about your wallet address, even if you have crypto there. Once it was hacked, your funds dont belong to you. Hacker might leave some crypto there on purpose, waiting for you to fill the wallet with funds for withdrawal. Once you top it up with funds, the script will move crypto quicker than you would set new address for withdrawal and hit send.

Your steps - forget hacket wallet, create new, dont regret about what happened (your expensive experience), if you have participated in bounties - ask BM to change wallet so hacker wont get more.

[witcher_sense]

I set my Metamask wallet up to be a chrome extension on my computer yesterday and someone hacked into it and stole all of my coins/tokens. The thing is, I'd just signed up for a program where you create nodes thru Strongblock and get paid passive income to host that node on the ethereum network, meaning that node is connected/Affiliated with your wallet. There is no reversing it and you have to have the node associated with a wallet. Now that the MM wallet has been hacked, what should I do??

Unfortunately, there is no way to recover your coins because transactions in the blockchain are generally considered irreversible if several confirmations have already taken place. Regarding the reasons hackers were able to break your wallet, it is not easy to identify the problem and how that exactly happened because you have given us too little information. For example, did you check if strongblock domain was genuine? It may be you have fallen victim to a phishing website that steals sensitive user information or makes you sign fake transactions. How do you store your Metamask seed phrase and password? Do you have them written up on a piece of paper or in Notepad, which is on the same device you installed the wallet?

[DdmrDdmr]

<…>

There are many similar recent cases reported around, such as:

https://www.reddit.com/r/Metamask/comments/ppg78a/was_i_hacked/
https://www.reddit.com/r/strongblock/comments/q0kk9u/if_metamask_gets_hacked_are_your_nodes_safe/
https://www.reddit.com/r/strongblock/comments/qe5qyj/hacked_on_metamask_lost_my_nodes/
https://www.reddit.com/r/strongblock/comments/qhufec/metamask_security/

I’d read through the above, and iterate the search for more cases to get a better oversight on what people are doing. Some of the comments point to it being difficult to associate a new wallet after the events, but other seem to indicate that they managed to through support. Plenty of comments stating that they should have bought a hardware wallet.

The important thing would be to try to suss out the door in your security that allowed this to happen. I’d consider your environment compromised, and would not currently trust anything in your environment. You may have downloaded some software, even different to the one you mentioned, from a malicious installation, that could have piggybacked any kind of keylogger/rat or else during its deployment (see for example https://bitcointalk.org/index.php?topic=5375639.0 on how malware can piggyback around).

[sunsilk]

First thing that you need to do is to remember that aside from signing up through strongblock's node. What are the other applications that you've probably signed up and applications that have downloaded that required you to sign in through metamask.

I've been using metamask for a long time and if there's some unfamiliar websites that are requiring me to sign up and it's forcing me to do so, I'm closing quickly the browser.

Never use that wallet anymore, don't deposit anymore any amount.

[Coin_trader]

Now that the MM wallet has been hacked, what should I do??

Can you not change the wallet connected to the node? Can't you also use another better wallet that is not a web wallet? Just saying this because one thing j hate about Metamask wallet is that it is vulnerable to hacks because it is a web wallet. There will be a way you can change the wallet or address that can be used.

He connects his wallet to a decentralized application for running a node. There's no way to change the receiving address since the wallet itself is the OP account to run that node. I doubt too the website that OP describing for running a node. I believe that is the main reason why his Metamask has been hacked since he allowed it to access his wallet when he connects it there for running a node.

@OP, Can you share the website you use so that we can check and verify the root of your loss. If you didn't connect your wallet to any dapps, Then its 100% sure that you are using a fake node services.

[KHamilton]

Now that the MM wallet has been hacked, what should I do??

Can you not change the wallet connected to the node? Can't you also use another better wallet that is not a web wallet? Just saying this because one thing j hate about Metamask wallet is that it is vulnerable to hacks because it is a web wallet. There will be a way you can change the wallet or address that can be used.

No, according to Strongblock's website, you cannot switch a node to a different wallet address. So, I have no idea what to do when it comes time for the to claim the rewards, because in doing that the rewards are transferred to the wallet. In this case, that's the one that was compromised. See here (the 10th question): https://strongblock.com/faq.html

I am not familiar with Metamask, but after finding out how you've got hacked and clean up the system if needed, you should consider the old wallet compromised and create a new clean wallet.
And I keep preaching it: consider buying a hardware wallet.

I do have a hardware wallet. I was using Metamask because this wallet is required to set up the Strongblock node. There's no way around it. It will only connect to Metawallet and this was actually my 1st time even using this wallet.

First thing that you need to do is to remember that aside from signing up through strongblock's node. What are the other applications that you've probably signed up and applications that have downloaded that required you to sign in through metamask.

I've been using metamask for a long time and if there's some unfamiliar websites that are requiring me to sign up and it's forcing me to do so, I'm closing quickly the browser.

Never use that wallet anymore, don't deposit anymore any amount.

When I set up the Strongblock node, that was my 1st time using Metamask. The app was downloaded on my phone and never used. In setting up the node I downloaded a Chrome extension on my computer. During this process I was only using Strongnode, Metamask, and Traderjoexyz's site.

I set my Metamask wallet up to be a chrome extension on my computer yesterday and someone hacked into it and stole all of my coins/tokens. The thing is, I'd just signed up for a program where you create nodes thru Strongblock and get paid passive income to host that node on the ethereum network, meaning that node is connected/Affiliated with your wallet. There is no reversing it and you have to have the node associated with a wallet. Now that the MM wallet has been hacked, what should I do??

Unfortunately, there is no way to recover your coins because transactions in the blockchain are generally considered irreversible if several confirmations have already taken place. Regarding the reasons hackers were able to break your wallet, it is not easy to identify the problem and how that exactly happened because you have given us too little information. For example, did you check if strongblock domain was genuine? It may be you have fallen victim to a phishing website that steals sensitive user information or makes you sign fake transactions. How do you store your Metamask seed phrase and password? Do you have them written up on a piece of paper or in Notepad, which is on the same device you installed the wallet?

I do understand that I cannot recover my coins. My biggest concern is the possible access to my Strongblock nodes. I bought 3 and they cost me a lot of money. I checked the strongblock site and it appeared to be the same one that all the youtube tutorials I watched on how to set the strongblock node up used. It is strongblock.com.

I have gone back to review one of youtube clips over and over and the difference I am noticing is that when I go to "strongblock.com" it takes me to the home page. When the youtuber is putting in strongblock.com, his home page says "strongblock.com/index.html". When I go to manually put in "strongblock.com/index.html", however, it takes me to the exact same page that strongblock.com is. 

When I downloaded the Metamask Chrome extension it asked me for my seed phrase. Since I'd never downloaded it on my computer before, I figured it was legitimate and that it was trying to authenticate my account. I really think this is where I messed up. Since the URL's of everything appeared to be legitimate I thought it was ok. I've seen one youtuber say it may ask for that during initial set up but that you should never have to enter that info again. My seed phrase was not stored online; I have them written down.

I'm devastated and not sure where to go from here. I can get over the lost eth and avax token they took out of my MM wallet. I'm just concerned about the hefty investment made in the 3 nodes. It would take me at least 4-5 months to recoup that based on the current price of the STRONG token and the amount of reward percentage they're paying out.

In the meanwhile, I have removed the Chrome extension. Is there a suggested method for claiming my rewards when it's time?? I'd planned to claim them once a month as to avoid recurring gas fees. Should I just install the MM when I'm ready to claim them, move the coins, and then off the wallet really fast? I at least want to get my investment back IF the hacker doesn't take that. I figure I have nothing else to loose..If I dont do it the coins are lost...If I try to move the coins really fast at least there's a slight chance of it going unnoticed by the hacker.

Now that the MM wallet has been hacked, what should I do??

Can you not change the wallet connected to the node? Can't you also use another better wallet that is not a web wallet? Just saying this because one thing j hate about Metamask wallet is that it is vulnerable to hacks because it is a web wallet. There will be a way you can change the wallet or address that can be used.

He connects his wallet to a decentralized application for running a node. There's no way to change the receiving address since the wallet itself is the OP account to run that node. I doubt too the website that OP describing for running a node. I believe that is the main reason why his Metamask has been hacked since he allowed it to access his wallet when he connects it there for running a node.

@OP, Can you share the website you use so that we can check and verify the root of your loss. If you didn't connect your wallet to any dapps, Then its 100% sure that you are using a fake node services.

Hi, I used strongblock.com. I did connect my wallet to the Uniswap at app.uniswap.org. I used this to convert the ETH token to the STRONG token, which is used to set up the node.

On another venture I was trying to buy TIME token to stake on the Wonderland site. With that I had to convert AVAX token to TIME and I used the JoeTrader site at https://traderjoexyz.com/#/home.

Both my remaining eth and avax were stolen.

Did you set up the nodes yourself or did you have someone else do it for you?
Also, did you verify the extension being added, the Strongblock Ponzi or project is becoming quite popular and this is sure to attract scammers who would create fake versions to get into user's wallets.

Now that the MM wallet has been hacked, what should I do??

There's really nothing you can do as the coins are already gone besides checking for the loophole and ensuring it does not affect any other app on your device.

How do I ensure nothing else on my device is affected?

[moderator's note: consecutive posts merged]

[Lucius]

@KHamilton, please respect the rules of the forum : "Posting multiple posts in a row (excluding bumps and reserved posts by the thread starter) is not allowed."

I set my Metamask wallet up to be a chrome extension on my computer yesterday and someone hacked into it and stole all of my coins/tokens.

It is inconceivable to me that I would use a wallet that works through a browser and any add-ons/extensions - so it's like Russian roulette that you play every day and you wonder when luck will leave you. I was closest to it when I used the Chrome app for one HW and I’m glad they gave up on it, it’s just the wrong way and should be avoided.

When I downloaded the Metamask Chrome extension it asked me for my seed phrase. Since I'd never downloaded it on my computer before, I figured it was legitimate and that it was trying to authenticate my account. I really think this is where I messed up.

You failed the most important test, because the seed from HW should not be entered anywhere except in HW - or in case you have no other choice in some proven desktop wallet whose files have been previously verified. I'm sorry for your loss, but you confirm what I keep saying - regardless of the type of crypto wallet, the weakest link in the security chain is the people who use them.

[KHamilton]

@KHamilton, please respect the rules of the forum : "Posting multiple posts in a row (excluding bumps and reserved posts by the thread starter) is not allowed."

I set my Metamask wallet up to be a chrome extension on my computer yesterday and someone hacked into it and stole all of my coins/tokens.

It is inconceivable to me that I would use a wallet that works through a browser and any add-ons/extensions - so it's like Russian roulette that you play every day and you wonder when luck will leave you. I was closest to it when I used the Chrome app for one HW and I’m glad they gave up on it, it’s just the wrong way and should be avoided.

When I downloaded the Metamask Chrome extension it asked me for my seed phrase. Since I'd never downloaded it on my computer before, I figured it was legitimate and that it was trying to authenticate my account. I really think this is where I messed up.

You failed the most important test, because the seed from HW should not be entered anywhere except in HW - or in case you have no other choice in some proven desktop wallet whose files have been previously verified. I'm sorry for your loss, but you confirm what I keep saying - regardless of the type of crypto wallet, the weakest link in the security chain is the people who use them.

My apologies, I didn't know that multiple posts were not allowed. I was simply trying to respond to some of the users that commented.

I am aware now that I shouldn't have entered the seed phrase. I thought MM was trying to authenticate my account and I went to the site that is said was the authentic site, which is metamask.io. So, I thought it was legitimate. Please refrain from any condescending comments to anyone going through this. If you've read my previous threads you see that I acknowledge I messed up. Therefore, I really don't need the "I told you so's". I'm already dealing with enough.

[NeuroticFish]

When I downloaded the Metamask Chrome extension it asked me for my seed phrase. Since I'd never downloaded it on my computer before, I figured it was legitimate and that it was trying to authenticate my account. I really think this is where I messed up.

OMG... if you give the seed to any legitimate-looking request, what you think is the use of the hardware wallet, really?!

OK, so since your wallet is now empty, please start with resetting the wallet to a completely new seed, write that down for backup and ever use it again only when your hardware wallet will ever stop working.
Keep the new seed safe (offline!) and remove the old seed from all the places you've stored it (so you don't get confused in 5 years which one was the correct seed).

And from now on, anything you want to do with crypto, do through the hardware wallet. If Metamask cannot handle the hardware wallet, use MEW with the hardware wallet.

And, sorry if it sounds harsh, but learn to ask here when you are not sure before doing something stupid, not after doing that.

My apologies, I didn't know that multiple posts were not allowed. I was simply trying to respond to some of the users that commented.

You can answer to one post, press enter twice for some spacing, scroll down, insert the next quote and answer to the next user.
The problem is not the number of answers, it's the fact they're spread into many consecutive posts.

[KHamilton]

When I downloaded the Metamask Chrome extension it asked me for my seed phrase. Since I'd never downloaded it on my computer before, I figured it was legitimate and that it was trying to authenticate my account. I really think this is where I messed up.

OMG... if you give the seed to any legitimate-looking request, what you think is the use of the hardware wallet, really?!

OK, so since your wallet is now empty, please start with resetting the wallet to a completely new seed, write that down for backup and ever use it again only when your hardware wallet will ever stop working.
Keep the new seed safe (offline!) and remove the old seed from all the places you've stored it (so you don't get confused in 5 years which one was the correct seed).

And from now on, anything you want to do with crypto, do through the hardware wallet. If Metamask cannot handle the hardware wallet, use MEW with the hardware wallet.

And, sorry if it sounds harsh, but learn to ask here when you are not sure before doing something stupid, not after doing that.

My apologies, I didn't know that multiple posts were not allowed. I was simply trying to respond to some of the users that commented.

You can answer to one post, press enter twice for some spacing, scroll down, insert the next quote and answer to the next user.
The problem is not the number of answers, it's the fact they're spread into many consecutive posts.

NeuroticFish, if you would take the time to read the previous comments, it is stated that a hardware wallet could not be used with the sites I was on and the processes I was doing. For example, to set up/purchase STRONGBLOCK NODES, you MUST use a Metamask Wallet. This is why the MM wallet was introduced into the process of me purchasing nodes and as well as attempting to stake coins on Wonderland. I have a hard wallet and use it, but it was irrelevant in this situation. Some processes cannot be done through a hard wallet such as purchasing/maintaining nodes, staking on Wonderland and other DAOs, etc. The seed phrase for the Metamask wallet was stored offline. I entered it because I thought that the site was trying to authenticate my wallet since it was my 1st time installing Metamask as a Chrome Extension (which has now been deleted)...

And again, please refrain from your condescending comments to me and others that make this mistake. The loss of the money is hard enough. If you can't exercise any more self control than that, please don't even comment.

[NeuroticFish]

NeuroticFish, if you would take the time to read the previous comments, it is stated that a hardware wallet could not be used with the sites I was on and the processes I was doing. For example, to set up/purchase STRONGBLOCK NODES, you MUST use a Metamask Wallet. This is why the MM wallet was introduced into the process of me purchasing nodes and as well as attempting to stake coins on Wonderland.

Well, this calls then for a complete new wallet, unrelated to the HW. But now you know that, I guess.

And again, please refrain from your condescending comments to me and others that make this mistake. The loss of the money is hard enough. If you can't exercise any more self control than that, please don't even comment.

I'm sorry for your loss. But actually that's why I am so angry and harsh too. You can skip the harsh part and just take note of the useful part. Most probably you'll find that you know most of those things, but.. let's make sure you do... I mean that the mistake you've done is the result of missing some steps in understanding the hardware wallets and I don't know which one.
As said, you cannot do much more than learn all you can from the expensive lesson. From your last post I am sure you'll be more careful in the future, so yeah, whenever you're not sure, ask.

[DdmrDdmr]

The references to a hardware wallet being made here are not incompatible with using Metamask. The hardware device will be the one that actually signs your TXs, and will physically need to be connected to do so, thus mitigating the chances of certain hacks taking place. Ledger & Trezor should work for sure.

See: https://www.ledger.com/academy/security/the-safest-way-to-use-metamask

[Lucius]

Please refrain from any condescending comments to anyone going through this. If you've read my previous threads you see that I acknowledge I messed up. Therefore, I really don't need the "I told you so's". I'm already dealing with enough.

I expressed regret for your loss, I don't know what else I could do to help you in the situation you are in. Unfortunately, no one here can help you get things back to square one, you messed up and this will be a very expensive life lesson for you. Good luck with the nodes, I hope someone will give you the right advice.

[KHamilton]

The references to a hardware wallet being made here are not incompatible with using Metamask. The hardware device will be the one that actually signs your TXs, and will physically need to be connected to do so, thus mitigating the chances of certain hacks taking place. Ledger & Trezor should work for sure.

See: https://www.ledger.com/academy/security/the-safest-way-to-use-metamask

Thanks; I'll need to read up how to integrate MM with my Trezor. I didn't know that could be done. The site where you set up the nodes prompts you to download the Metamask extension. I've known several people to do it successfully and thought I was doing it right. I still cannot figure out the site I went to was a phishing site because the URL is the same "metamask.io". If I cannot figure it out, I'll be terrified about visiting ANY crypto/wallet/exchange type site. I just need to understand.

[DdmrDdmr]

<...>

I believe the topoligical ideal there is to use Metamask, as seemingly required in your case, but using a set-up that uses the hardware wallet instead for key management.


There are often phising sites that use a very closely related name to the original site, and that are promoted through different social media channels, web links, or simply come up high in search engine results (sometimes even as paid Ads, giving them a priority position in the search results).

Out of curiosity, take a look at the results from DNS Twister for Metamask:
https://dnstwister.report/search?ed=6d6574616d61736b2e696f

You’ll see that there are plenty of existing domains with a similar name, and any of them can, at a given point in time, be used for a phishing expedition (they are not all currently phishing sites – perhaps some- but they are at last latent potentials).

Even here you need to take some precautions (i.e. this is not https://metamask.io/).