Been stole bitcoins - need help to trace the thief

[Dj911]

Hi all,

Thanks for hearing me out…
Late year, I have owned 8 bitcoins. I have sent my computer to upgrade.
I did not check my wallet for a long time…

And then this few days, I found out my bitcoins are stolen on March 2021!!!
I am devastated. I really need that money…
It is a live or dead moment…

I have run out of idea…

Please help.
Any help…

[Charles-Tim]

How did you know your wallet was stolen March 2012? This is not the same as your coin were transferred into another address on March 2021 by an unknown person.

Since March 2021, you can not even be sure how your wallet was compromised, maybe when you took it for repair, or online hack, or someone that have access to your computer that stole it. Online wallets are not safe even short-term purpose and long-term purpose. So far you do not want to be using a wallet to frequently be transferring funds, you can set up a paper wallet instead, protect your seed phrase, but having 8 bitcoin, there was nothing bad to have gotten yourself a hardware wallet.

Sorry, nothing can be done.

[nc50lc]

-snip- I have sent my computer to upgrade.

Does your computer contain your wallet backups like seed phrase or private keys? Or just the wallet?
Have you stored your wallet's backup online?
And which wallet, Bitcoin Core?

You need to rule-out every possibility of a "hack" and if there's no other way that it got compromised aside from physical access to your computer, then that's your primary suspect (the quoted message)

[mocacinno]

If the transaction moving your funds from your wallet to an unknown wallet is at the exact time your computer was sent away from upgrades (or only days after this fact), odds are very big that it was either an employee of the company upgrading your system or malware (accidentally) installed during the upgrade.

In this case, i'd probably tell you to contact them (maybe even with a lawyer present), and file a police report.

There are tons of attack vectors... Malware, seeds/passwords/wallets/keys saved unencrypted (or with weak encryption) on a vulnerable device or on the cloud, evil maid attacks, phishing,... It's not because your computer was once out of your controll, that this upgrade is automatically to blame!!! I know (first hand) that it's always the person working on a computer that gets the blame for any unrelated problem, even months after an intervention.

[Lucius]

Late year, I have owned 8 bitcoins. I have sent my computer to upgrade.
I did not check my wallet for a long time…

Negligence, ignorance, and completely illogical behavior for someone who had as many as 8 Bitcoins. In most such cases it is an easy job and free money for the average hacker who now enjoys your money on some exotic beach with a cocktail and a lot of pretty girls around him.

If you kept Bitcoins in your desktop wallet and that wallet was not password protected, then you literally delivered your coins to anyone who had access to your computer, whether it was someone who worked on your computer or a friend/family member who had access to that PC. As many times before, it has proved fatal that people do things in reverse order, investing in something first, without even being aware of what it is about.

[Dj911]

Hi all,

Thanks you all. You have gave me a lot of opinions.

Yes I am using Bitcoin Core.
I have rule out all possibilities. I really think the employee of the computer store is the only suspect….

I have informed the police but their seems don’t have the knowledge of crypto currency…

I do have the transaction ID and the address… I don’t know will they help…

I really don’t know what to do…
I need the money for my family…

[o_e_l_e_o]

I do have the transaction ID and the address… I don’t know will they help…

You can try and trace the bitcoin after they left your wallet and see if they end up on an address known to belong to a centralized exchange or other centralized service. I've included a list of sites which might help you do this below. If you can say with some certainty that the bitcoin end up on Binance, for example, then you can hand that information over to law enforcement and they might be able to get Binance to reveal the owner of the account which received those coins.

https://www.walletexplorer.com/
https://oxt.me/
https://www.breadcrumbs.app/
https://ethonym.com/

If your local police are unable to help, then does your country have a financial crime or cyber crime department you can try reporting to?

[bitbollo]

In my opinion, you need a lawyer & a forensic investigator that can help in this issue since it's really hard make a certain accusation without any tangible proof. And pay attention, each accusation need proofs or you are wasting time and assuming risk of spend other money for nothing real at the end.

How you can demonstrate that he was the culprit? and not maybe some other one has make this access on your wallet?

...
I really think the employee of the computer store is the only suspect….
I have informed the police but their seems don’t have the knowledge of crypto currency…
...

[Pmalek]

Do you still have access to the Bitcoin Core wallet that used to hold the coins?
Is the wallet.dat file still on your computer? Make several backups of both so that you don't lose it.  

If you decide to involve law enforcement in the matter, you need proof that you had and still have access to the address that was hacked. Do you have a receipt from the computer shop that proves that your machine was there for servicing?  

@royalfestus
He wrote that he used Bitcoin Core.

[LoyceV]

Yes I am using Bitcoin Core.
I have rule out all possibilities. I really think the employee of the computer store is the only suspect….

Did you have a password on Bitcoin Core? If so: was it a strong password?
How many days passed between bringing your computer to the shop and your funds disappearing?

If you decide to involve law enforcement in the matter, you need proof that you had and still have access to the address that was hacked. Do you have a receipt from the computer shop that proves that your machine was there for servicing?  

Unless the computer shop (employee) installed malware that can be traced back to them (for instance a key logger that emails the Bitcoin Core password to someone), it will be virtually impossible to prove they did it. Without evidence, OP could just as well have moved his own coins, or someone else could have gained access to his computer.
Maybe a sudden lifestyle change of one of the computer shop's employees can be used as circumstantial evidence.

[Pmalek]

Unless the computer shop (employee) installed malware that can be traced back to them (for instance a key logger that emails the Bitcoin Core password to someone), it will be virtually impossible to prove they did it. Without evidence, OP could just as well have moved his own coins, or someone else could have gained access to his computer.

Of course. It's going to depend on where the coins went after they left OPs address. If they were transferred to an address that is connected to an exchange where KYC was performed, and the account is owned by the same person who worked at the computer shop where the PC was serviced, it's one decent step forward. But again, theft needs to be proven. What if OP sold the coins to the person and has now created this sob story to get those coins back and deceive the buyer. Proving theft is not going to be easy.

[mocacinno]

Unless the computer shop (employee) installed malware that can be traced back to them (for instance a key logger that emails the Bitcoin Core password to someone), it will be virtually impossible to prove they did it. Without evidence, OP could just as well have moved his own coins, or someone else could have gained access to his computer.
Maybe a sudden lifestyle change of one of the computer shop's employees can be used as circumstantial evidence.

Or, unless the employee made a habit out of robbing clients... One case means nothing, but if a couple dozen people claim to have been robbed by the same store in the same timeframe, it might force law enforcement to take a closer look....

For all the OP knows, maybe the shop owner already caught an employee stealing from other clients and terminated him, or reported him to the police (theft happened almost a year ago, so if there were other cases, odds are they already came foreward to either the police or the shop owner). Maybe he goes to the shop and the shop owner immediately tells him which police department is handling the case... Stealing employees are not good for a shop's reputation, so (unless it's a one-man shop, or the thief is the owner) odds are that once the owner had several complaints, he himself would have dealt with the stealing employee.
Ofcourse, these are a lot of 'ifs and buts', but still, it's worth filing a police report and going to the shop to ask them if they know anything about this (without accusing them directly, i'd personally take a lawyer with me if i was planning on making big accusations).

[DaveF]

So you had hundreds of thousands of dollars worth of BTC sitting on your PC and did not check it for close to a year?
And with that amount of money you didn't use any form of security?

10 years, even 5 years ago that might have been acceptable.

You say they were stolen March of last year, when was the PC in the shop you never answered that?
You should also post the txid, if the BTC went to a known exchange address it's a place to start.

-Dave

[Pmalek]

Assuming it's true (hopefully it's not), it's likely the buyer have history of communication (could be email, SMS or any social media) which contain proof of sending fiat and receiving BTC and can be used as proof he didn't steal it.

The history of communication could also have been Telegram considering how popular it is among people interested in crypto. Telegram allows both parties to delete private conversation for both sides, effectively removing any proof or written evidence in the process. Since he was face to face with the shop employee, the handover could have also been done in cash. I find it unlikely considering the amount in question, but still possible.