26 BTC Stolen

[morvillz7z]

I confirmed a screenshot with minerjones on telegram

...aaand there you have it!


If OP is telling the truth here's the easiest way for this scam to work:

*OP account is compromised in the days prior (my guess is he clicked on a link and was phished out of his forum password) .
*OP is then contacted via telegram by the scammer and is asked to send a message to minerjones on bitcointalk to confirm.
*minerjones sends op a msg stating that it's not him but because op's account is compromised the scammer has the ability to delete the msg and op does not see it.
*OP is contacted via telegram by the scammer with a shopped screenshot.

@rasengan, you can see your IP logs for the past 30 days here:  https://bitcointalk.org/myips.php

[markinaz]

Not related, but figured I would mention, as this forum may have been where they got my email (it's similar to my name, so someone just reading the forum might figure it out.  I received a "Google Form" to my email:

https://i.postimg.cc/P52JDLXc/SCam.png


Please do not attempt to use the link in the message, I wanted to share for awareness only.   

People obviously follow this forum for nefarious reasons, again, not sure if they put two and two together from here or not.   Obviously I did not fall for this, but again, wanted to share for awareness.

Thanks!
Mark

[Steeley]

So who peeled the Cas 25, you?

I'm calling BS on all of this until you post some evidence. Otherwise, make a scam accusation in the proper section with all the proof you have, so that at least noboby else gets f**ked up the ass, and/or blamed by accident.

https://bitcointalk.org/index.php?board=83.0

Form is here - https://bitcointalk.org/index.php?topic=260073.0

I have a feeling you realized how/what you fucked up shortly after posting this, hence the lack of any real evidence. OFC, I could be wrong, but that's what I'm going to assume until I see something of value here besides you making accusations with zero proof...

BTW, your 25 Cas has been peeled & moved, and is now sitting here... Why?  You can't even answer that FFS

https://blockchair.com/bitcoin/address/bc1q4c9j5zhqj8cg8myslgfmgamyql3rcs7n2pmvrg

 

I've been traveling and just reading this entire thread for the first time. I'm totally confused OP. How did you get scammed exactly? How does the owner of a coin, demanding that the sale would only be in-person, lose 26 BTC exactly? The MJ impersonator seems irrelevant to the degree of difficulty it takes to lose this. You peeled it, sent the funding with no escrow. I'm not trying to kick you while you are down, I just can't quite understand how you actually lost here. Seems hard to believe.

[CoinageMint]

Something just doesn't seem to add up here, smells fishy to me

Never trust, always verify!

[slimzak]

It's possible that the rush of making a quick 40btc clouded his judgement and made him blind to the red flags as he was rushing to close the deal.

[blucepheus]

How did you lose 26 BTC? I thought the deal was for 40.

[owlcatz]

...aaand there you have it!


If OP is telling the truth here's the easiest way for this scam to work:

*OP account is compromised in the days prior (my guess is he clicked on a link and was phished out of his forum password) .
*OP is then contacted via telegram by the scammer and is asked to send a message to minerjones on bitcointalk to confirm.
*minerjones sends op a msg stating that it's not him but because op's account is compromised the scammer has the ability to delete the msg and op does not see it.
*OP is contacted via telegram by the scammer with a shopped screenshot.

@rasengan, you can see your IP logs for the past 30 days here:  https://bitcointalk.org/myips.php

I tend to agree here, unless OP is just avoiding taxes etc ...

Seclog would usually show a password reset by email if it had been hacked - All it shows is he woke up:, so either it's him or his pass was highjacked...

December 16, 2022, 11:10:10 PM - rasengan - woke up

How did you lose 26 BTC? I thought the deal was for 40.

They've both been peeled and funds were combined then split up a bit..

[MoparMiningLLC]

When they get the link via dm and click it - they literally give the “hacker” their pw - so no meed for the “hacker” to change it - the people never realize their is even an issue until after they get screwed - at which time still there is no need for “hacker” to change the pw then.

[TheBeardedBaby]

Possible, but from my experience, it would also state that their password had been recently changed in red letters here:

This is true in the cases where they want to steal your account, but if you are infected with Troyan Horse with keylogger then they know your password and don't want to change it, just steal info.
If that was the ca se and if the hacker is not that smart the OP should check his login history for weird/unknow IP addresses here:

https://bitcointalk.org/myips.php

Just to be on the safe side.

[tread93]

Wow that is really too bad, what an awful way to end the year. Its a good thing that 26 BTC doesn't mean so much to you, as you have made it seem. Hopefully a really great learning lesson for you, you must not deal on here or online in exchanges very often. Keep your head up, and next time be sure to verify exactly who you're dealing with and make sure to take extra caution next time you ship out coins with this kind of magnitude. For me 26 BTC would literally change my life and I would not have taken any chances simply by trusting someone who appeared to be Minerjones on telegram. MJ is on discord anyways, next time you should ask around first before taking any actions.

[krogothmanhattan]

When they get the link via dm and click it - they literally give the “hacker” their pw - so no meed for the “hacker” to change it - the people never realize their is even an issue until after they get screwed - at which time still there is no need for “hacker” to change the pw then.

 This is quite scary....so just by clicking on the link will give the hacker all the info?

  Is it possible this user was using LastPass manager that was just hacked?

   https://www.komando.com/security-privacy/password-manager-hacked/871018/

   DOnt understand why people use these at all!

   Just write and store on a piece of paper or booklet....treat a password just like a private key IMO...never store on a browser or any program period.

[DaveF]

When they get the link via dm and click it - they literally give the “hacker” their pw - so no meed for the “hacker” to change it - the people never realize their is even an issue until after they get screwed - at which time still there is no need for “hacker” to change the pw then.

 This is quite scary....so just by clicking on the link will give the hacker all the info?

  Is it possible this user was using LastPass manager that was just hacked?

   https://www.komando.com/security-privacy/password-manager-hacked/871018/

   DOnt understand why people use these at all!

   Just write and store on a piece of paper or booklet....treat a password just like a private key IMO...never store on a browser or any program period.

Putting words in MMs mouth but no, the link redirects to a fraud site that looks correct asking you to login. You put in your credentials and then it forwards you to the correct site so you think you have logged in but they now have your username & password.
It's really just phishing at work. BUT, when you have your info here tagged to your Twitter / Instagram / Discord / Telegram and so on it makes you a slightly easier target since someone now knows what services you use.

Which is why I have "I DO NOT TRADE on Telegram or Skype or Discord." Right there as my personal text.

-Dave

[saxydev]

So basically what minerjones confirmed to the scammer, the scammer confirmed with the victim and here is the missunderstanding. It happens very often on most forums, the OP is the only one at fault here, he just went blindly trusting minerjones, even it is not his fault.

[minerjones]

So basically what minerjones confirmed to the scammer, the scammer confirmed with the victim and here is the missunderstanding. It happens very often on most forums, the OP is the only one at fault here, he just went blindly trusting minerjones, even it is not his fault.

I didn't confirm anything to the scammer... just the OP
OP did not trust me... they trusted the scammer...

[owlcatz]

Then let's just let this thread die in 🔥🔥...

🤷‍♂️

No evidence equals no proof, which equals no scam IMO.

[Mpamaegbu]

I personally can't help but got help myself (alot less) from user here that somehow could track the BTC to exchange where I had a friend that got the funds locked.

I'm completely at a loss as to what your statement meant. The ambiguity therein has make us not understand what is been said, whether to you or to another different person. Would you mind explaining it again?

Wow that’s horrible.

Saying horrible is even putting it mildly. 26 BTC isn't a mean amount. That's a substantial amount of cash to lose, even in today's world, it's huge.

[JanEmil]

Would you mind explaining it again?

Don’t think the story can be solved before OP write more.

Thought it was the payment for the coins that was stolen. Later I could see it was the coins. And then they was claimed.

[Pmalek]

minerjones telegram is "minerjones" the problem with telegram is that there can be many accounts where the display name is "minerjones" you have to look at the profile to see if it is actually the "@minerjones" username.

The Telegram usernames are unique and scammers can't copy and use the same usernames as someone else. That's why they will attempt to use a similar username that the victim won't notice and use the person's real username in the BIO field. Those who aren't familiar with Telegram won't know the difference and will misinterpret the BIO for a username.
Can the admins recover and find the content of deleted PMs? I know they get the PM's content if a PM is reported, but I wonder if theymos can see something more... If something like that was possible, it would be easy to prove if a PM was sent, from, and to which account.

[NeuroticFish]

Don’t think the story can be solved before OP write more.

This pretty much sums it up. However, while I do trust MJ, he may want to clear this up beyond doubt and only theymos can do that. Hence I support Pmalek point/request.
But it's really up to MJ, I think that he should ask theymos, if he considers it necessary.
Again, for me it's clear. The lack of proof of identity (i.e. signed message) was the root for disaster (if there was indeed a disaster).

[minerjones]

minerjones telegram is "minerjones" the problem with telegram is that there can be many accounts where the display name is "minerjones" you have to look at the profile to see if it is actually the "@minerjones" username.

The Telegram usernames are unique and scammers can't copy and use the same usernames as someone else. That's why they will attempt to use a similar username that the victim won't notice and use the person's real username in the BIO field. Those who aren't familiar with Telegram won't know the difference and will misinterpret the BIO for a username.
Can the admins recover and find the content of deleted PMs? I know they get the PM's content if a PM is reported, but I wonder if theymos can see something more... If something like that was possible, it would be easy to prove if a PM was sent, from, and to which account.

There are no deleted PMs.. this has nothing to do with on forum activity.
The OP was scammed on Telegram... PMs/messages/chats were deleted there

Still has not provided any txid, shipping, etc...  Still guessing they peeled themselves or had the scammer get them to peel them and send them the funds... Pretty convenient that they were swept almost the same time they made this tread

Don’t think the story can be solved before OP write more.

This pretty much sums it up. However, while I do trust MJ, he may want to clear this up beyond doubt and only theymos can do that. Hence I support Pmalek point/request.
But it's really up to MJ, I think that he should ask theymos, if he considers it necessary.
Again, for me it's clear. The lack of proof of identity (i.e. signed message) was the root for disaster (if there was indeed a disaster).

Correct.. there has been no proof or evidence they were sent a PGP signed message from me (or the scammer)
And even if it was PGP signed by the scammer, it would not check against my key