Massively fraudulent Escrow Transaction!

[BetGalaxyADM]

Hello!

I recently made a post regarding my personal account being compromised.

I have investigated what all took place! It is clear some shenanigans took place and I cant help but see how the escrower himself was not "in" on it.

1) I had a paid escrow deal for some mining hardware with user Burky155.
2) OgNasty was our escrower and he confirmed that he had received the funds (about 0.46~ btc)
3) I provided a shipping address, and my BTC refund address.
4) Burky replied after Og confirmed the payment... and said okay the shipment will be sent in 1-3 days, and he would provide tracking information.
5) This was 3 days ago... No tracking number was provided yet, but I logged in today expecting to likely see that tracking number... since we were at the 3rd day.... But this is when it said my password was incorrect.
6) I went to my email, found the password reset emails that came, and email address changed as well... at 8:36AM mountain time.
7) At 9:16 mountain time, the funds were sent from Og's wallet, to Burky155's wallet.

My questions are this:

1) How the hell did my account get hacked into... It is clear that it was coordinated with someone in the "know" and the guy went into my account, replied and said "All is good, release the funds"... when all was not good... and allowed the funds to be sent TO the original address Burky155 provided... which means that Burky himself had to of been the guy inside my account... or OG/Burky were working together??

2) Why the hell would OG release the funds??? Even if Scott2k messaged and said to release the funds.... without even getting a tracking # to verify it all? It does not make sense to me how a seasoned escrower would not sense something is amiss and wait for a tiny bit more confirmation before simply RELEASING $11,500 in bitcoin.

3) Any path to recovery? Is my evidence clear that Og was likely involved in this, or not? Because I don't understand what logical person would just release funds so quickly without so much as a tracking # even.

Ugh... I am going to quit crypto forever. This wasn't even MY money, it was for a friend who was just wanting to buy a miner.

[1714764983]

1714764983

[1714764983]

1714764983

[1714764983]

1714764983

[1714764983]

1714764983

[1714764983]

1714764983

[jackg]

I can't find the change in the seclog but I'm wondering if that was because the account was a lower rank or something (I'm assuming it's scott2k you referred to in another thread).

I think there should've been more oversight on negotiating terms before now from both sides but it may be weird OG didn't have a window (maybe a day) before releasing the funds after a confirmation from you (also was your only method of communication this forum)?

I doubt they were in on it though and you could probably come to a solution by dmming them and waiting for a response.

[BetGalaxyADM]

I can't find the change in the seclog but I'm wondering if that was because the account was a lower rank or something (I'm assuming it's scott2k you referred to in another thread).

I think there should've been more oversight on negotiating terms before now from both sides but it may be weird OG didn't have a window (maybe a day) before releasing the funds after a confirmation from you (also was your only method of communication this forum)?

I doubt they were in on it though and you could probably come to a solution by dmming them and waiting for a response.

I have DMed Og about it and he said:

"No idea who you are but we’ve never communicated. The proper account authorized release and all policies were followed. If you failed to secure your account that is hardly my fault. The release address was confirmed at the time of escrow and you approved release to it. Not sure how you think I would know your account is compromised."

I replied with

Og, how do you release the funds when no tracking information had even been provided yet!?

I can't find the change in the seclog but I'm wondering if that was because the account was a lower rank or something (I'm assuming it's scott2k you referred to in another thread).

I think there should've been more oversight on negotiating terms before now from both sides but it may be weird OG didn't have a window (maybe a day) before releasing the funds after a confirmation from you (also was your only method of communication this forum)?

I doubt they were in on it though and you could probably come to a solution by dmming them and waiting for a response.

And yes, it is the scott2k account.

I can't find the change in the seclog but I'm wondering if that was because the account was a lower rank or something (I'm assuming it's scott2k you referred to in another thread).

I think there should've been more oversight on negotiating terms before now from both sides but it may be weird OG didn't have a window (maybe a day) before releasing the funds after a confirmation from you (also was your only method of communication this forum)?

I doubt they were in on it though and you could probably come to a solution by dmming them and waiting for a response.

While I agree that maybe some more negotiation needed to take place... I never in a million years would expect the seller himself would be able to gain access to my account and call for the release before a tracking # was even provided... I guess I could have been a fortune teller and asked that a tracking # be provided prior to any release.... which I assumed was just standard procedure... if there is no proof provided that a item was shipped how can the transaction take place...?

How the hell does THAT happen though, how did the seller even gain access to my account... what are the odds of that? And if it is something that happens from time to time via some known hack vector or spoof link or whatever... how am I the first person this has happened to, to the point that Og didn't sense something was amiss???


Update:

OG basically just saying:

"It was released by the authorized account... all policies followed.."

And that it is my fault that my account wasn't "secure".

My reply to him:

While it is understandable that it ultimately comes down to my account's security...  I still WENT TO HIM because of his knowledge and expertise and likely ability to spot something that looks "off"... and make sure nothing goes wrong.

Very bad experience. And I will make sure everyone knows to be wary of escrowing with him because of his lack of attention.
And to blame it on my account' security... when escrow is being offered on a platform that DOESNT EVEN HAVE BASIC ACCOUNT SECURITY FEATURES LIKE 2FA!!!!! Which I also will make sure that my following is aware of this as well... escrow shouldn't even be fucking allowed on here without 2fa being integrated first. How the fuck does this website not have 2fa?

That in and of itself is what bothers me the most now after thinking about it. WHY IS ESCROW EVEN ALLOWED HERE WHEN ACCOUNT SECURITY CANNOT BE GUARANTEED!!!!!

Close down the marketplace until 2fa is implemented! Do SOMETHING!

[Darker45]

I actually find it a bit weird that in failing to secure your account, you are blaming your escrow and this forum and everybody else when it is clear that you're the one who failed to make sure that your account is safe.

Your escrow dealt with user scott2k. If user scott2k says everything's good and instructs the escrow to release fund, why should the escrow not do as instructed? You were saying that there wasn't even a tracking number. How would you know? After all, you've got no access to your account anymore. Is it not possible that user Burky155 has already sent a tracking number?

But I think you should settle this with escrow and Burky155 through private messaging.

[LoyceMobile]

There was a similar case where minerjones released 50k dollars after a hacked account said so.
LoyceV post there links.

[BetGalaxyADM]

There was a similar case where minerjones released 50k dollars after a hacked account said so.
LoyceV post there links.

Funny, the seller was only okay with using OgNasty or minerjones.

ONLY THEM.

Doesn’t that imply some sort of coordination?

I actually find it a bit weird that in failing to secure your account, you are blaming your escrow and this forum and everybody else when it is clear that you're the one who failed to make sure that your account is safe.

Your escrow dealt with user scott2k. If user scott2k says everything's good and instructs the escrow to release fund, why should the escrow not do as instructed? You were saying that there wasn't even a tracking number. How would you know? After all, you've got no access to your account anymore. Is it not possible that user Burky155 has already sent a tracking number?

But I think you should settle this with escrow and Burky155 through private messaging.

How can I properly secure my account when this platform doesn’t even have basic (and FREE) services to do so? Like google 2fa.

And the reason the escrower should also have had a red flag was that there’s no physical way the package could have arrived to me that quickly. Not just the fact that he hadn’t given tracking info yet.


What I find interesting, is that the “hacker” first reset my password, and THEN changed my email address.

For those familiar with the emails you receive when those actions are done… only the reset password email has a link to lock the account, but the email change does not have this link.

So I find it curious that he changed the password first, knowing I could instantly lock the account…. And didn’t first change the email so that I wouldn’t get the follow up email that the password was changed (the one with the link to lock account).

The fact that he didn’t change email first… tells me he maybe HAD to reset my password first to get into the account at all…

What I want to know is very important and my lawyers will have a way to find out:

1) does OgNasty have any access to any backend systems that allows him to reset a password for a user? Like a support feature.

2) if so, was that backend system accessed by anyone and was my password reset via that…


And Og no longer will reply to me on this account... because "he doesn't even know who I am"

Even though I explained clearly that I am Scott2k and provided confidential info that only Scott2k would know (like the original shipping address).

Just avoiding the issue.

I don't blame him... I'd want to crawl in a hole too.

[Darker45]

Funny, the seller was only okay with using OgNasty or minerjones.

ONLY THEM.

Doesn’t that imply some sort of coordination?

Probably because they're two of the most established and trusted escrows here? That's what you requested, right?

Sending you a DM, interested. Must use trusted escrower here, or Bitrated.

Didn't you make a little research as to the two options provided? How did you come up with Og and not minerjones?

Also, did you not also check the background of the user you're about to do transaction with? I'm asking because burky155 was inactive for more than 3 years before suddenly coming out of nowhere selling something.

How can I properly secure my account when this platform doesn’t even have basic (and FREE) services to do so? Like google 2fa.

A 2FA could indeed be of help. But knowing that it doesn't have this feature, why did you proceed with the transaction? Also, what happened to you could be considered isolated. I mean, it's not everyday that an account involved in a transaction got hacked in the middle of it.

And the reason the escrower should also have had a red flag was that there’s no physical way the package could have arrived to me that quickly. Not just the fact that he hadn’t given tracking info yet.

What was the agreement, by the way? When could the escrow release the fund? Is it when the item has already arrived? Or is it enough that a tracking number is provided? Or could he release the funds upon instruction of the buyer?

1) does OgNasty have any access to any backend systems that allows him to reset a password for a user? Like a support feature.

I don't think so.

Have the three of you been communicating until now? How would you proceed from here? Do you believe that user burky155 really sent the item that you bought? I guess you should communicate with him/her. If he/she indeed sent it, then no problem. If he/she didn't, then it is obvious he/she is scamming you.

[BetGalaxyADM]

1. Yes, sure. But the way my account was reset first, and then email changed... makes me think some fuckery afoot.
2. Yes, and I chose Og because I have used him for other transactions in the past. Those that weren't with a scammer though... smaller transactions as well.
3. Agree maybe I shouldn't have, but this is also one of the only places to really facilitate such trades... The platform should be more secure especially considering how common these trades take place.... and apparently how easy it is to hack a btctalk account... is there even auto-lock on too many failed attempts? Can it be attempted a million times if the guy just changes his IP address and clears cache?
4. The agreement was that after the item was shipped, and after I received it and verified it is a authentic Antminer L7 miner... I would release the funds.
5. I have gotten some replies from Og, but nothing from Burky155. I do not believe Burky155 sent the miner... because the "hacker" told Og to release the funds to Burky.. Clearly a scam took place and there is no mythical Antminer L7 in the mail on it's way to me.

Funny, the seller was only okay with using OgNasty or minerjones.

ONLY THEM.

Doesn’t that imply some sort of coordination?

Probably because they're two of the most established and trusted escrows here? That's what you requested, right?

Sending you a DM, interested. Must use trusted escrower here, or Bitrated.

Didn't you make a little research as to the two options provided? How did you come up with Og and not minerjones?

Also, did you not also check the background of the user you're about to do transaction with? I'm asking because burky155 was inactive for more than 3 years before suddenly coming out of nowhere selling something.

How can I properly secure my account when this platform doesn’t even have basic (and FREE) services to do so? Like google 2fa.

A 2FA could indeed be of help. But knowing that it doesn't have this feature, why did you proceed with the transaction? Also, what happened to you could be considered isolated. I mean, it's not everyday that an account involved in a transaction got hacked in the middle of it.

And the reason the escrower should also have had a red flag was that there’s no physical way the package could have arrived to me that quickly. Not just the fact that he hadn’t given tracking info yet.

What was the agreement, by the way? When could the escrow release the fund? Is it when the item has already arrived? Or is it enough that a tracking number is provided? Or could he release the funds upon instruction of the buyer?

1) does OgNasty have any access to any backend systems that allows him to reset a password for a user? Like a support feature.

I don't think so.

Have the three of you been communicating until now? How would you proceed from here? Do you believe that user burky155 really sent the item that you bought? I guess you should communicate with him/her. If he/she indeed sent it, then no problem. If he/she didn't, then it is obvious he/she is scamming you.

And regarding your last question "How would I proceed from here?"

First and foremost, obviously try to get Burky155 to refund the funds or ACTUALLY send the miner (this won't happen though, we all know that). Second, course of action will be to ask my lawyer to file subpoena requests through the courts to obtain the information I need to proceed with either prosecution, or the file a lawsuit if it is deemed against regulations and/or illegal to facilitate such services without proper security systems in place.

That's where I'm at with this, and I have the resources to go as far as I want with it... and given enough subpoena's to exchanges, this website, etc to find out the true identities of these people... I will eventually get at minimum a lawsuit filed.

While I know ultimately the scammer is "at fault"... I also believe that btctalk may have a legal obligation to have some bare minimum security features if they wish to continue to facilitate marketplace services... I don't know though until I ask my lawyer tomorrow to begin investigating the laws and what I can and cannot go after.

I sure as hell am going to try.

Funny, the seller was only okay with using OgNasty or minerjones.

ONLY THEM.

Doesn’t that imply some sort of coordination?

Probably because they're two of the most established and trusted escrows here? That's what you requested, right?

Sending you a DM, interested. Must use trusted escrower here, or Bitrated.

Didn't you make a little research as to the two options provided? How did you come up with Og and not minerjones?

Also, did you not also check the background of the user you're about to do transaction with? I'm asking because burky155 was inactive for more than 3 years before suddenly coming out of nowhere selling something.

How can I properly secure my account when this platform doesn’t even have basic (and FREE) services to do so? Like google 2fa.

A 2FA could indeed be of help. But knowing that it doesn't have this feature, why did you proceed with the transaction? Also, what happened to you could be considered isolated. I mean, it's not everyday that an account involved in a transaction got hacked in the middle of it.

And the reason the escrower should also have had a red flag was that there’s no physical way the package could have arrived to me that quickly. Not just the fact that he hadn’t given tracking info yet.

What was the agreement, by the way? When could the escrow release the fund? Is it when the item has already arrived? Or is it enough that a tracking number is provided? Or could he release the funds upon instruction of the buyer?

1) does OgNasty have any access to any backend systems that allows him to reset a password for a user? Like a support feature.

I don't think so.

Have the three of you been communicating until now? How would you proceed from here? Do you believe that user burky155 really sent the item that you bought? I guess you should communicate with him/her. If he/she indeed sent it, then no problem. If he/she didn't, then it is obvious he/she is scamming you.

Update:

Og gave me his last dm... he has now blocked me from dming him...

He said the miner could have been overnighted... lol

I tried to remind him that..

In the message with the TXID of my payment, I specifically instructed Burky155 to provide tracking information, to insure it, and signature delivery.

Burky then replied saying okay, and he would ship it in 1-3 days and would LET US KNOW when it was shipped.

That didn't happen... and he STILL released it..


And then he blocks me


Fact of the matter is... yes I screwed up, but so did OgNasty, and his complete lack of taking ANY responsibility for not following the exact guidelines of the deal... and letting a scam take place... is going to bite him.

I am going to release the hounds on this one... I don't appreciate getting a terrible service, being told that IM the one that screwed up SOLELY... and then blocking me from further communication.

No empathy. No offer of refund of his fee (measly $150, who cares anyway)... Pure assholery and smart ass responses that just lead me further to imply that he possibly is "in" on it.

I am going to utilize all of my resources to find that out, and also all of them to make sure people know to not use his escrow services, and to generally not use escrow services on a platform that has horseshit security.

[OgNasty]

I held the funds for 3 days.  That's plenty of time for shipping to have occurred, especially considering they were discussing this deal for days before BTC was sent.  When they asked me to release funds I even made the buyer double confirm that everything was ok and to release funds.  It's not my place to hold onto someone's funds when they tell me twice to release them to the seller.  The release approval was from the right account.  It was being released to the prior agreed upon address.  

Keeping your account secure is important. 

[BetGalaxyADM]

I held the funds for 3 days.  That's plenty of time for shipping to have occurred, especially considering they were discussing this deal for days before BTC was sent.  When they asked me to release funds I even made the buyer double confirm that everything was ok and to release funds.  It's not my place to hold onto someone's funds when they tell me twice to release them to the seller.  The release approval was from the right account.  It was being released to the prior agreed upon address.  

Keeping your account secure is important. 

Yeah, and I still don't even know how my account was hacked.

I also would love to know how to keep any account secure when there is no 2FA option available.

Yes, you had the funds for nearly 3 full days... but he specifically stated it would take him UP TO 3 days just to SHIP IT... and he would LET US KNOW once shipped...

Which he never did...

I get it, you can't hold funds ransom, but you have to know that something could have gone wrong... the fact that it never appeared to have even been shipped yet...

and to release the funds to him within 40 mins of him requesting it from MY account... so fast... like cmon...

In the future, I would recommend REQUIRING a tracking # be confirmed to be provided... AND at least 2 days thereafter before any release can happen.

Because I am obviously not the only person who has had their account broken into.


And additionally, use whatever pull you have if you have any, and get the btctalk devs to add fkn 2fa... its 2022 for Christ's sake.

[LoyceV]

Here's my topic on Best practices for Bitcointalk escrow providers, with links to the case where $50k was scammed.

@OP: any chance you entered your password on a phishing site? Chances are you got a link by PM before your account got hacked.

This is what I would have expected:

• Buyer and seller provide payment and shipping details to escrow.
• If all agree on all terms, buyer pays escrow and seller sends product to escrow.
• Escrow verifies product.
• Escrow releases product and payment only if everything is okay.

Without this, escrow provides false security. It can go wrong on so many levels if one of the parties is an innocent Newbie and the other an advanced scammer.

[lovesmayfamilis]

Here's my topic on Best practices for Bitcointalk escrow providers, with links to the case where $50k was scammed.

@OP: any chance you entered your password on a phishing site? Chances are you got a link by PM before your account got hacked.

This is the most likely case.
OP, look at the accounts your opponent owns.

5 Accounts Connected
Accounts Connected: (Note: Banned shown in red / Inactive in Blue)

1.burky156      August 23, 2017, 12:27:02 AM   
2.burky155        August 23, 2017, 12:20:12 AM
3.OpenTalkLab   
4.etsonarrantes
5.igotbanned2018

One has already been charged with fraud.
https://bitcointalk.org/index.php?action=trust;u=663730


This person most likely hacked you, OP, because his reputation suggests a dishonest person. Check all links sent by this account.
At the same time, it is not surprising that you were contacted by an account that has been in a dream for three years, although its second account lives safely on the forum.

[Lucius]

@BetGalaxyADM, please read the forum rules, because that will help you not to break them.

32. Posting multiple posts in a row (excluding bumps and reserved posts by the thread starter) is not allowed.

And to blame it on my account' security... when escrow is being offered on a platform that DOESNT EVEN HAVE BASIC ACCOUNT SECURITY FEATURES LIKE 2FA!!!!! Which I also will make sure that my following is aware of this as well... escrow shouldn't even be fucking allowed on here without 2fa being integrated first. How the fuck does this website not have 2fa?

The security features provided by the forum could definitely be better, but don't blame the lack of 2FA for what happened to you. Ask yourself how it is possible that you exposed your password in some way, and that regardless of the fact that you used a respectable escrow, you did not additionally secure the whole deal with a signed message of your BTC address.

In that case, you would have additional insurance even in case your BTT account is hacked, because the escrow would not release the funds without you confirming it with a new signed message. The chances of someone hacking your crypto wallet and stealing your private key are still negligible, right?

[Little Mouse]

Ugh... I am going to quit crypto forever. This wasn't even MY money, it was for a friend who was just wanting to buy a miner.

Very sad to hear that but that's something childish. Crypto has nothing to do with this case. It's your fault of course.

It was being released to the prior agreed upon address.   

If the amount was released to the agreed address and there was a confirmation from your account, I don't think you can blame on OgNasty for this though OgNasty could have done some more investigation as an experienced escrow service provider, you can't blame him at all. It's your responsibility to secure your account.

[PowerGlove]

Why is the consensus (maybe not in this thread, but on the forum as a whole) that 2FA is unnecessary? OP's password could have been typed into a phishing site (as LoyceV suggested) or lifted by some clipboard malware or copied by a keylogger. Even a basic implementation of 2FA and lazy (single device) usage would have prevented any of those attack vectors from working...

I've (naively, I should know better by now) made a topic about this here: The forum needs 2FA

[Rizzrack]

1) I had a paid escrow deal for some mining hardware with user Burky155.
2) OgNasty was our escrower and he confirmed that he had received the funds (about 0.46~ btc)
...
7) At 9:16 mountain time, the funds were sent from Og's wallet, to Burky155's wallet.

When they asked me to release funds I even made the buyer double confirm that everything was ok and to release funds... The release approval was from the right account

A signed message from the buyer's used address or the refund one (if different) should be a MUST for any confirmation to release funds to the seller IMO. Did not use any escrow service (yet) and don't know first hand the whole process but seems to be a necessary practice if it's not already a requirement.

Waiting to see what/if Burky155 replies in this thread...

[LoyceV]

For what it's worth, I think this applies:

He should have the police contact me and I'll give them the scammer's IP logs.

[dkbit98]

Yeah, and I still don't even know how my account was hacked.

Maybe you exchanged some personal messages with him, and you clicked on some link he sent you.
Scammers often use this tactics to steal login information from their victims, by opening phishing page and entering login details in fake login page.

I also would love to know how to keep any account secure when there is no 2FA option available.

Even 2FA is not perfect protection, but you could improve security by adding 2FA (not sms related) to your email address.
In forum profile settings you can modify it by visiting Account Related Settings, and enabling option to Limit IP retention, BUT there are some risks when doing this and you can lock your profile.
You can also sign a bitcoin message in forum to prove ownership of your account.
I think it's a good idea to move private conversation from forum PM to more private conversation with encrypted conversation, maybe email or other alternative.

[owlcatz]

I was going to stay out of this until I remembered this.... SO.... I'll just leave it here, and you can all decide for yourselves who is the scammiest escrow around?

https://bitcointalk.org/index.php?topic=3160695.0;all

[shahzadafzal]

Interesting but not new it happens often, when you are “online” anything can be compromised. What if it’s not BTT but your email was compromised or may be your laptop is infected with a virus? Or may be someone known to “you” who knew your password?

Og is right how would he know if it’s “you”? Once your password is compromised means scammer now have access your message too so proving a shipping address proves nothing.

Your whole point revolves around not getting any tracking number, but this too can be framed very easily. What if scammer mailed you an empty box or may be a “brick” with a valid tracking id and when it’s delivered, funds released.

I’m just trying to show you that even a tracking id would have saved you.

In short in this case you can’t blame OgNasty. You should have been vigilant before transacting such big amount.