Currently dealing with the worst day of my life in crypto

[cheezcarls]

Note: Admins or mods feel free to move this topic in an appropriate section if possible, because I am not sure which section can I post this.

As the title says, yes I am dealing with the worst day of my crypto life. My 3 Metamask wallets have been hacked (maybe because of that fake PDF file I have clicked in which I didn't double or triple check it which is my bad). A total of more than $12k in 3 wallets combined that was drained. This is the very first time that I got hacked on crypto, after a few years. And I certainly believe that the one who reached me out on Telegram was a fake dev (in which I am so blind in checking his real and actual Telegram account) because we were "suppose" to be "collaborating" for a video review that needs me to "sign" the document. But in the end, yes it's a ZIP file that needs to be opened but with docs, images and that "fake-looking" PDF file in which I lately found that it is a "SCREEN SAVER" file).

And yes I fell for it.  

I didn't provide seed phrases online and did some revoking too on all wallets. But these hackers are now very intelligent and always found a backdoor despite that I did my very best to avoid getting hacked.

I should have put all of them in my Ledger before this happened, so my complacency gives me the karma that I deserve. It's very hard for me to move on right now. I only have a little savings left after everything I've worked and sacrificed all these years since the pandemic and now going back to square one, but for now I'll just have to deal with this and keep moving forward despite the difficulties and emotional pain that I am in right now. It's very hard to earn $12k for a guy like me living in a 3rd world country.

So the lesson that I have learned right now is to always triple check the files that I have downloaded and not going to be blind on who I am doing a convo with.  

[1714912591]

1714912591

[1714912591]

1714912591

[1714912591]

1714912591

[cryptoaddictchie]

Mate reading your story makes me wanna think of something hopeless already but there you are sharing your experience which really helpful for all of us. Ive been scammed before, but not hacked so Ive dont know what it feels like and I can sense tremendous downfall possibly if I were in your case. But I believe you could surpass this and overcome in time. You are a good member of this community and been seeing your contributions. I do hope that some learned too on how to secure their asset.

Hoping for your ease cope mate. Sorry for that damn experienced, those hackers should pay their crimes and must be apprehended.

[mk4]

So the lesson that I have learned right now is to always triple check the files that I have downloaded and not going to be blind on who I am doing a convo with.  

..and probably put most of your funds on your Ledger wallet. Because security is the main reason you purchased a hardware wallet, right? So use it. Not to twist the knife here, but yea. Best of luck in rebuilding, OP.

[qwertyup23]

Ahh man, I definitely feel sorry for your loss. Given that the nature of cryptocurrencies can be easily hacked nowadays, it is arguably recommended to triple check all the files being sent to you. Again, as much as I pity for your loss, it is also your responsibility (though you mentioned that you were negligent) to check all the files and to doubt everything being sent to you.

Mistakes like these tend to shape our future decisions. As much as this is very unfortunate, this would actually help newbies to be more careful in selecting and choosing all the files being sent to them.

It also just got me thinking that scammers/hackers nowadays can conveniently create suspicious files that once you opened them, pandora's box will break loose. I really hope that your experience will save thousands of people from this event.

[Rikafip]

And I certainly believe that the one who reached me out on Telegram was a fake dev (in which I am so blind in checking his real and actual Telegram account) because we were "suppose" to be "collaborating" for a video review that needs me to "sign" the document. But in the end, yes it's a ZIP file that needs to be opened but with docs, images and that "fake-looking" PDF file in which I lately found that it is a "SCREEN SAVER" file).

Damn, that's a sneaky way to scam someone and the one that is very easy to fall for if you are doing business on Telegram as there is a lot of stuff going on there all the time. I know its not the mistake that you specifically did, but I would advise everyone to disable the option to automatically download any files as this thing is enabled by default on Telegram and I heard many stories about people getting rekt that way.

It's very hard for me to move on right now. I only have a little savings left after everything I've worked and sacrificed all these years since the pandemic and now going back to square one, but for now I'll just have to deal with this and keep moving forward despite the difficulties and emotional pain that I am in right now

I can completely relate to your feelings right now as back in 2017 I went through something similar: my bitcoin wallet got hacked and I lost 0.1 BTC which was basically all I had at the moment. Even though the amount lost is smaller than yours I also thought about giving up and leaving crypto as it was very disheartening to loose everything. But after few days of mourning I owned my own mistakes and continue the journey, this time being way more careful than before. In the end it proved to be the best decision ever so I suggest you to do the same, no matter how hard it looks now.

[DdmrDdmr]

<…>

One thing that is not pristine clear to me is how your wallets got hacked, once the malware software was installed. By that, I mean whether they managed to achieve remote access to your environment, keylogged data, or whatever other means. I presume the former. Additionally, to let others know, what counter measures have you taken? (i.e. format your device and start from scratch, etc.).

With regards to not having the crypto protected by the Ledger, I guess that either you didn’t want to incur in fees of some sort, or wanted to avoid the hassle of having to retrieve and use the Ledger device for each TX you performed (which is a core usage), thus leaving it on Metamask.

Best of luck getting back on your toes.

[pakhitheboss]

Phising PDF hack has become a serious issue. When you  open those PDF it activates a malware which in your case might have been attached with the multimedia content. The most common way PDF phising works is by luring an individual to click on a hyperlink, which then take them to a malacious site or activates a malware.

Sorry to hear that you have lost your hard earned money. 12k is a big amount for anyone living in a third world country. I have not been scammed yet, but I have incurred losses due to my own negligence. I hope you take this incident as a lesson and move forward in your life
 

[Marvelman]

My question is similar to DdmrDdmr's. I still don't understand how exactly the OP was hacked. Was it a fake PDF that was basically an executable (screen saver)? What happened after that?
 

Phising PDF hack has become a serious issue. When you just open those PDF it activates a malware which in you case might have been attach with the multimedia content. The most common way to in PDF phising is to lure the individual to click on hyperlink which then take you to a malacious site or activate a malware.

If it was malware attached to a PDF file, what does that have to do with a phishing attack?

[cheezcarls]

Phising PDF hack has become a serious issue. When you just open those PDF it activates a malware which in you case might have been attach with the multimedia content. The most common way to in PDF phising is to lure the individual to click on hyperlink which then take you to a malacious site or activate a malware.

Sorry to hear that you have lost your hard earned money. 12k is a big amount for anyone living in a third world country. I have not been scammed yet but I have incurred losses due to my own negligence. I hope you take this incident as a lesson and move forward in your life
 

It actually looks like a PDF file but when I double clicked it nothing happened. Now that's where I realize that it was indeed a malware. So it's a different kind of file with the end "SCREEN SAVER".

But I am also curious that despite my main Trust Wallet wasn't connected to my Metamask wallet browser, why it was also drained. I have a total of 4 Metamask wallets attached there. But I am surprised that my two remaining wallets weren't touched despite having small decent amounts.

In one of those Metamask wallets being hacked, I am also curious that the hacker didn't pull out the BCMC1 token I have worth almost $900. It was still there to be honest (unless the hacker may go back and strike again), but I have zero ETH now and I cannot transfer it to P2PB2B exchange, so I am stuck and wanted to pull it out but I have no more ETH anymore and depositing from the bank to the exchange has expensive fees.

[Lucius]

First I'll say I'm sorry for your loss

While it may be important now to determine how you were hacked to prevent this from happening to you again and from happening to someone else, I'll just say one thing - Telegram and every browser crypto wallet are a terrible combination. I have never used MetaMask because it is inconceivable for me to use a crypto-wallet as a browser extension, or to store thousands of $ valuable digital assets in this way (or in a mobile application).

What else to say except that you paid dearly for one life lesson, and now you have to keep living no matter what happened to you. As worn out as it may sound, you only lost money - you are still alive, healthy, and have a roof over your head, unlike all those who have lost everything they had in the past months.

[aysg76]

Damn, that's a sneaky way to scam someone and the one that is very easy to fall for if you are doing business on Telegram as there is a lot of stuff going on there all the time. I know its not the mistake that you specifically did, but I would advise everyone to disable the option to automatically download any files as this thing is enabled by default on Telegram and I heard many stories about people getting rekt that way.

Telegram is risky as well as useful at the same time so we need to be extra careful while dealing with the third person whom we don't know personally as this is pure risk dealing and you need to have all the safety measures.There are number of telegram scam cases like adding you to some fake groups and now this auto download.So for those who don't know how to turn it on here is the procedure for you all

For not being added in any group without your permission:

Telegram>Privacy and security> Groups>Who can add you to group> My contacts

You can add exception to these cases anytime

For turning off the auto download meadia features as sometimes it is by default on in Telegram:

Telegram>Settings>Data and storage> Auto download media turn off on mobile as well wifi network

~snip~

This is sad to hear about that despite being aware about these crypto scams you unintentionally fall victim of it losing your hard earned money worth $12k and know how hard this must be for you at this time.But these scammers are always trying to find an opportunity which they gained in your case with this phishing PDF file and having access to your metamask wallet draining out the funds out of it.

Recently as per reports the number of phising PDF scams have grown drastically over the past two years as scammers are finding out the new ways to make the fool of people.Mostly they are carried out by redirecting you to some fake websites and giving the hackers full control at the backend like installing some keylogger malwares and other virus that can access your files over the system.As per study these scams are classified into various types according to their percentage as follows:



You see they have various ways to make you fool like by verify the captcha and other ways.As you said it was Screen saver scam so the hackers just sent you clickable pdf which was gaining access to your system and funds were withdrawn.

Generally as said they are injected with with malwares that are stringed to hackers backend giving him the access to your wallets as Metamask is usually logged in your system as browser extension so it's easy once they gain access to your system.Here is one reference image explaining how it will redirect you to some fake websites:



You must be thinking what's happening while the bad actor's are draining out your wallets and once you know whats happening and revoke the permission it's too late as happened with you.This is happening nowadays for the NFT's people having on Metamask wallet but you also haved funds over there.This is why you need hardware wallets and keep as low funds you could on these wallets for you safety.

Read this article to check more about such scams in detail and be safe from them in future.

Take it as lesson and be safe i future.

[Daodex]

I'm guessing this happened on a PC, sigh! Its always the PC, there are many ways to fall victim to hackers on a PC than on other devices out there, the PC is just too complicated when it comes to trying to stay safe and out of trouble, my advice is never to use a PC for crypto wallets at all .

[sunsilk]

It's hard to read your story because it's saddening and I've felt your frustration. I'm very sorry for what has happened to you. It's really important to invest in a hardware wallet, whether it's Trezor, safepal, keepkey or a Ledger wallet to secure our crypto life savings.

I'm guessing this happened on a PC, sigh! Its always the PC, there are many ways to fall victim to hackers on a PC than on other devices out there, the PC is just too complicated when it comes to trying to stay safe and out of trouble, my advice is never to use a PC for crypto wallets at all .

Yes, it's happened there whether it's PC or laptop, they're just the same. These hackers have been creative in doing their robberies. So, everyone has to be careful and mind to take care of their funds through a hardware wallet or anything you know as long as it's safe in your opinion.

[Rockstarguy]

Sorry for what has happened to you I understand how it is like losing a huge amount of money like, this that you have worked for all this years. Don't loose hope , I believe your hard work will still give you more . Your experience will guild you from making another mistake like this and it will also help other to learn from it to avoid mistake of this kind .

[Luzin]

$12,000 is a huge amount. It took me a long time to raise that kind of money. It is indeed sad to lose such a lot of money. You can be sad you can regret it but it's already happened you can't turn back the clock. At least this article lets you and I know that PDFs can also carry viruses. Even I just found out today. I as a worker dealing with documents became a little scared.
So far I don't want to experience, but is there a way to detect PDF files followed by viruses like this?  Of course I am very curious. Hopefully, friends here can share the easiest and cheapest way.

[Avnerochi]

Sorry to hear about it my friend, i can't image how you are feeling right now 
It could happen with Metamask wallets but not with ledger ? Thanks for sharing from your experience, it might just save someone one day from getting hacked himself.
Sending positive vibes 

[CryptoATM]

No matter how careful you are you can't always escape every form of scammers trap, there will be few you knew nothing about, scammers always find a less popular ways of scamming people, just move on mate, God is your strength.

[The Cryptovator]

Sorry for your loss, this is a costly lesson for you. This isn't a new hacking method but it's too late for you. The device you are using to store cryptocurrency should keep secure from the unknown file. That's how hackers take access to your wallet and funds. It's better always to store cryptocurrency in a hardware wallet. I always prefer that for good practice. Don't be hopeless, you can earn if you are alive. A few accidents tech is a lot of things. Just start from the beginning and be careful.

[PrivacyG]

It should be general knowledge that you do not open an unknown file on the same device you are holding your fortune on.  You either do not open it at all or you use another device or a Virtual Machine in the worst case to see what is up with it.  Particularly when this file is received through Telegram.

Unfortunate, but you fell for it and all you can do now is learn.  Learn to take more care of your valuables.  Do not mix Cryptocurrency wallets with unknown files.

-
Regards,
PrivacyG

[Rengga Jati]

-snip-

First of all, so sorry to hear that, and you share this very valuable experience with us all here,
It is risky enough to click any kind of link moreover given by an unknown or someone else. This actually has been happening several times to some people, getting hacked because of the fake link, phishing, and others.
This is actually a bad experience, but this can really teach us how to be wiser and also more careful.
Once more, this is a worthy lesson for us to be more careful and never click any link, promotion, or others if we are doubtful and don't know enough about the source of the link, better to avoid

[Rikafip]

There are number of telegram scam cases like adding you to some fake groups and now this auto download.So for those who don't know how to turn it on here is the procedure for you all

Yep, the one where they add you to fake groups without your permission is probably the most popular way to get scammed on Telegram, and yet again it happens because that option is enabled by default, same like it is for automatically downloading files. And as we know, new users rarely bother to check apps thoroughly.

These two options being enabled by default never made much sense to me, especially since Telegram is privacy oriented chatting platform (or at least they claim to be) and its the cause of like 90% of the Telegram scams.

[KingsDen]

Put yourself together mate, you will overcome this phase of life. Hacks, thefts and scams are the things we need to deal with continually as far as cryptocurrency is concerned. The scammers become smart as the days progress and we need to be smarter in order to survive.

I have a smart phone where I saved many files. I was robbed of my two laptops same day, so I decided not to get another but uses my phone for all works. I have my wallets, emails, bank apps and so on in the phone.
What I simply did was to buy another device which I use for any online work. I only use the old phone if I want to perform transactions and immediately after that,  it's going offline. That's how I manage my small fund.

[Nitt371]

Man, honestly, that sounds terrible, I’m so sorry I would never wish for anyone to come through that. It’s great though that you’re trying to hold on and rationally think in this situation. You did the right thing posting here, at least you’ll find yourself not alone, phishing is a common problem in the crypto world.

[Kelvinid]

I imagine how smart they are...even a techy person and even we are much careful not to get hacked but now, as technology continues to improve, that was easier for them.

I can't really expect a PDF file may contain malware until @aysg76 post shows the link to how the trick being made. We couldn't be really confident especially when dealing with other people as they can be people with interests, we don't know. Like what happened to you OP, it was unexpected.

Hope you can move on so fast OP and be careful the next time.

[cheezcarls]

And not just that, the hacker didn't stop messing me up. When I was in the bathroom chatting on my Telegram, I noticed that it auto logged out. I went back to my computer quickly and found out that my Telegram was compromised and the hacker was doing mass messaging to my contacts with the attached malware. That same malware who drained my 3 wallets worth $12k combined.

I quickly fought off the hacker from gaining full control of my Telegram account in which I enabled the password and recovery email because mobile phone wasn't enough. And finally yes, I have gained full control again and making the password much more difficult for the hacker to penetrate.

It was a tough and emotional 2 days for me. Yesterday my wallets are drained, today it was my Telegram got compromised (but regained full control now). Also, I made sure all of my social media channels, emails, etc., are now having multiple extra layers of protection just to protect myself from this mess. And it's not just me that was targeted, but there are lots of them too that was being victimized like crazy.

[Bhig Daddy]

I'm sorry for what occurred to you, and I can appreciate how upsetting it must be to lose a sum of money this size that you have spent years earning. Don't lose hope; I am confident that your efforts will continue to pay off. Your knowledge will both prevent you from repeating this error and assist others in learning from it to prevent similar errors.

[PowerGlove]

{...} It was a tough and emotional 2 days for me {...}

I feel for you OP. The theft of $12k (especially when it's hard-won savings) is a very bitter pill to swallow.

Having to start again from (almost) scratch is very demoralizing. Don't get despondent, you've saved up this much before and you can do it again. Besides, adversity has its benefits: “A smooth sea never made a skillful mariner.” [1]

Take this time to internalize what you've learned and then keep on hustling!

[1] Author unknown, a variation was attributed to Franklin D. Roosevelt but (as I understand it) it's an old english proverb.

[Outhue]

Sigh! 12k is a lot I am sorry this happened to you, I as a person have come to realize that we need to put aside a crypto wallet for storing assets only, have another for trying out new things that you aren't used to before, airdrops and other links clicking related, those hackers will never stop.

[alik111]

Thats why we must be aware and be secured in crypto market. It's a lesson to all new and old users that you guys should put your private keys offline and should have knowledge about how hackers are behaving in the crypto market. We all have learnt how hackers can destroy anyone.

[leverageguy]

Mate, I understand your pain right now. Honestly, I would be devastated if I were in your position. Next time, remember to put your funds in a wallet and double check the users you are talking to, even though I am sure that you don’t need reminding after this.

[Cryptomultiplier]

The discomfort you must be feeling inside maybe left unexplained because words will be quite exhausted to explain it. A strong lesson indeed is to learn how to prevent a recurrence. Your story also is one that others can learn from because everyone has experienced or have close persons who have fallen victim to these scammers somehow and wondered how it happened.
I however employ you to not relent in further efforts to use Bitcoin, but instead apply caution when making trade with unknown persons and also using a 2fA is much advised.

[Lucius]

Mate, I understand your pain right now. Honestly, I would be devastated if I were in your position. Next time, remember to put your funds in a wallet and double check the users you are talking to, even though I am sure that you don’t need reminding after this.

Pay attention to the dates, because I'm pretty sure that the OP accepted his situation after 5 months - so even though it's not easy to lose money that means a lot in your life, it's still not the most valuable thing that every person has. Every day is a new opportunity to earn something, and I'm sure that the OP didn't give up and is now much more careful than before.

[Wakate]

This is very pain dude ama I feel your pains right now because I had been hacked before but I only lost little of my little savings then in crypto and I know how it felt like losing a total crypto portfolio. You need to be strong op because right now you just need to be strong and move on because that has already happened and show be a lesson to everyone of us that are clicking on unsecure files that we are not sure about.

I could also remember losing my entire crypto portfolio 2nd day of January few years back which was one of the most things that had ever happened to me in my life but I took courage to stay strong and focus and keep moving.

[taufik123]

And not just that, the hacker didn't stop messing me up. When I was in the bathroom chatting on my Telegram, I noticed that it auto logged out. I went back to my computer quickly and found out that my Telegram was compromised and the hacker was doing mass messaging to my contacts with the attached malware. That same malware who drained my 3 wallets worth $12k combined.

I quickly fought off the hacker from gaining full control of my Telegram account in which I enabled the password and recovery email because mobile phone wasn't enough. And finally yes, I have gained full control again and making the password much more difficult for the hacker to penetrate.

It was a tough and emotional 2 days for me. Yesterday my wallets are drained, today it was my Telegram got compromised (but regained full control now). Also, I made sure all of my social media channels, emails, etc., are now having multiple extra layers of protection just to protect myself from this mess. And it's not just me that was targeted, but there are lots of them too that was being victimized like crazy.

This incident is a strong warning for you to increase security on some accounts and devices that you use. A few years ago I also experienced the same thing, where the device I was using was infected with malware that locked my files so that some files could not be opened. to decrypt it had to pay in bitcoin at the time worth $500. But I didn't pay for it and chose to give up some of my encrypted files and reinstall the OS used. it serves as a reminder to continue to improve security on all the devices and accounts I use. Currently, I even use 2 antiviruses for my computer device, namely Windows Defender (default windows) and Kaspersky Premium for double security. So every incoming file will be scanned and any suspicious files will be detected.


The telegram account that I use has never experienced a hacking incident.
but what happened to you made me re-upgrade my telegram account security.

Losing $12k in assets is certainly very hard because it is not easy to collect that many assets.
But of course, many people lose their assets more than you.
Don't feel hopeless because life goes on and you still have a lot to do.

[Marvell1]

~~

This incident is a strong warning for you to increase security on some accounts and devices that you use. A few years ago I also experienced the same thing, where the device I was using was infected with malware that locked my files so that some files could not be opened. to decrypt it had to pay in bitcoin at the time worth $500. But I didn't pay for it and chose to give up some of my encrypted files and reinstall the OS used. it serves as a reminder to continue to improve security on all the devices and accounts I use. Currently, I even use 2 antiviruses for my computer device, namely Windows Defender (default windows) and Kaspersky Premium for double security. So every incoming file will be scanned and any suspicious files will be detected.


The telegram account that I use has never experienced a hacking incident.
but what happened to you made me re-upgrade my telegram account security.

Losing $12k in assets is certainly very hard because it is not easy to collect that many assets.
But of course, many people lose their assets more than you.
Don't feel hopeless because life goes on and you still have a lot to do.

Coincidentally, I'm not a computer expert either so security seems to be very difficult for me. Nowadays, I have witnessed many cases of loss of crypto assets for which no one can explain the cause. But most of the cases lose money like that, people will blame the owner for exposing the private key or having been hacked by a hacker without his knowledge.

Currently, I also use 2 anti-virus software like you and another thing is that I use 2 separate computers. One is used for crypto-related activities like trading, where install a wallet that stores assets and never downloads or clicks on a strange link or file, the other one I will use for daily tasks. I still can't say it will be 100% secure, but it's the best I can do.

[Frankolala]

You just have to move on with life its a pity that you became a victim to these hackers in this time of inflation and hardship everywhere. That is a huge sum of money in my country. I feel for you mate

  aysg76 has given a proper information on how this hackers lure you into their trap and also how not to give them access thorough your settings. This is a lesson for everyone who always store their savings on software wallet instead of a hardware wallet,there should be no reason for not doing so as it is one of the best security measures in crypto. In crypto we are our bank ourselves so we need to secure our coins properly.

[Daniel91]

OP, I'm very sorry about what happened to you.
Crypto is not exactly the most pleasant place in the world and there are a lot of scammers who want to take advantage of other crypto users.
A similar thing happened to a friend of mine recently.
He was very excited about crypto and opened a wallet on Blockchain.
He got some btc in that wallet and the next day he ran out of everything.
Most likely, he opened a fake login link of the site, gave his real login information and the scammer took everything from him.
After such an experience it is very difficult to move on but my friend did not give up, after that he became very careful about internet security and is currently doing very well with crypto trading.

[taufik123]

-snip- I still can't say it will be 100% secure, but it's the best I can do.

No system is safe 100%, all have the possibility to be hacked. But as a security developer, you also need to continue to develop your security system because hackers are always looking for new loopholes. and the most important point is how as a user to use the security properly and not be careless in everything even if it's a small thing. Sometimes the system used is quite secure, but the user does not personally apply this security and can fall into the traps that have been prepared by scammers. Being a smart user will save your data and assets.

[Franctoshi]

I so much feel your pain right now, This is one of the challenges faced with storing cryptos when one is not taking appropriate measures in securing their funds, just one single mistake could get you back to square 1. However move on mate and never walk in this part of laxity again, be brave because it has happened, it has happened. Therefore focus on rebuilding for things are once again gonna be fine with you, so far there's life there's hope.

[Mpamaegbu]

$12,000 is a huge amount of cash OP, whether one is from a third world country or from the developed world. It is a substantial amount of cash. Sorry for your loss. By the way, thanks for sharing your sad experience in order to warn the rest of us.

I'm guessing this happened on a PC, sigh! Its always the PC, there are many ways to fall victim to hackers on a PC than on other devices out there, the PC is just too complicated when it comes to trying to stay safe and out of trouble, my advice is never to use a PC for crypto wallets at all .

Honestly, this makes me paranoid whenever I think of it. PCs that are supposed to make browsing very accessible are now hack prone more than phones. This is going to be discouraging for a great number of people, especially those who want to drop their mobile phones for PCs and laptops.

[AakZaki]

Rechecking the file to be downloaded is very important to do, because it becomes the main gateway for malware to enter and infect your device. You of course also have to provide security on the device in the form of an antivirus and that will be an antidote to malware that tries to enter. it really hurts when we lose the money we saved for years and lost because of the mistakes we made. this can be a valuable lesson for you to pay more attention to every security detail and to be aware of all files that will enter your device.