Moderator help my bitcointalk account have been hacked

[Piesel Alt]

I noticed an unusual activities on my account Piesel yesterday when i tried to log in, my account password have been charged and the hacker made a post in the football transfer speculation thread in gambling section immediately after he gain access.

The last post i made on the account was when a applied to a campaign at about 03:42:21 pm.

Current number of post (Including this one): 1713
Rank: senior member
TRC20 address: THcySPm9K3e7rGjB6E6eTYTqr6XfyaqCHH

Older wallet usage

Bitcointalk Profile Link: https://bitcointalk.org/index.php?action=profile;u=187601
Current amount of posts:  1415
bech32 BTC address for payouts: bc1q22ssr8r5rxtjh4wqaj8kj8rtvwudngd7p8qq7v

This is my last activity before the hackers took control, please below is a sign message from my wallet used on the account.
New signed messages for those who cant verifythe first posted message.

Code:

 -----BEGIN BITCOIN SIGNED MESSAGE-----
24-01-2024 
Signing this message to prove the ownership of account piesel that was hacked in the last 24-48 hours ago
-----BEGIN BITCOIN SIGNATURE-----
Version: Bitcoin-qt (1.0)
Address: bc1q22ssr8r5rxtjh4wqaj8kj8rtvwudngd7p8qq7v

H4qGrqKStOPB9AZ5YaIUwq6f8yQyfwVbkzEbaklRqgSCPWtatrC7q1vN3YGxLeEwhuLJ3K1GLxGcAagplA0E8ec=
-----END BITCOIN SIGNATURE-----

[sujonali1819]

I noticed an unusual activities on my account Piesel yesterday when i tried to log in, my account password have been charged and the hacker made a post in the football transfer speculation thread in gambling section immediately after he gain access.

I think you should sign a message with your old user account. I can not find any history of this address THcySPm9K3e7rGjB6E6eTYTqr6XfyaqCHH before 22nd January.

It's a matter of a few hours . So How can we understand that you are not that hacker and making drama? (don't mind please)

Meanwhile, I am tagging the account so that the hacker can not do any scams. Let me know once you will get the access back again.

[Piesel Alt]

I noticed an unusual activities on my account Piesel yesterday when i tried to log in, my account password have been charged and the hacker made a post in the football transfer speculation thread in gambling section immediately after he gain access.

I think you should sign a message with your old user account. I can not find any history of this address THcySPm9K3e7rGjB6E6eTYTqr6XfyaqCHH before 22nd January.

The signed message included in the thread is from my old wallet used over a period of time and the wallet mentioned in ops was just to point out my last activity but the campaign is not Bitcoin paid that is why i shared it but the TRC20 wallet is from the same wallet.

Thank you for the tag and i will notify you when everything is resolved, btw have a great day.

[Xal0lex]

Have you contacted the global moderators or administrators directly? I just see that your account is currently banned. I do not know for what reason it is banned, the global moderators or administrators can tell you that.
So you're saying you didn't write this post?

Reportedly Ivan Fresneda, Real Valladolid wonderkid has started to enter the list of names of players targeted by Arsenal. This player is only 18 years old and starting to gain the trust to play in Real Valladolid's main squad, since then he has been able to attract interest from several clubs including Arsenal. Not only Arsenal but even Liverpool had already taken an interest in this young player. Arsenal need a stock of right-backs to back up their main players. And their effort I think is good because it prioritizes young players, it's good because young players like this can be a future asset for a club.

He is too young for having a nice spot on a professional team like that. However, he maybe a good investment for a future purpose. 18 year old is very young compare to other players. I just hope that if he manages to be transfered to arsenal, he will not sit on the bench for the entire season.

[Piesel Alt]

Have you contacted the global moderators or administrators directly? I just see that your account is currently banned. I do not know for what reason it is banned, the global moderators or administrators can tell you that.
So you're saying you didn't write this post?

Reportedly Ivan Fresneda, Real Valladolid wonderkid has started to enter the list of names of players targeted by Arsenal. This player is only 18 years old and starting to gain the trust to play in Real Valladolid's main squad, since then he has been able to attract interest from several clubs including Arsenal. Not only Arsenal but even Liverpool had already taken an interest in this young player. Arsenal need a stock of right-backs to back up their main players. And their effort I think is good because it prioritizes young players, it's good because young players like this can be a future asset for a club.

He is too young for having a nice spot on a professional team like that. However, he maybe a good investment for a future purpose. 18 year old is very young compare to other players. I just hope that if he manages to be transfered to arsenal, he will not sit on the bench for the entire season.

That post is not from me, the hacker wrote the post, i have not contacted the global moderator.

I will contact the global moderator right away, i was not aware of the ban i just get a wrong password error each time I try logging in and when I checked the account profile.

I noticed my password was changed recently and a post was made right after that.

[_BlackStar]

i was not aware of the ban i just get a wrong password error each time I try logging in and when I checked the account profile.

There are several possibilities why your account is currently locked, first; You failed to reset password via secret question. Even if you have done it 2 times on the same day, but I think it has locked you in when you do another failed attempt.



The second possibility; You lock it yourself after you receive forum email. But this possibility is small considering that you are not aware of what has locked your account.

Do a few steps and contact the mod: Recovering hacked/lost accounts

But I can advise you to reset your password immediately via email ^{[if you are owner that acc]} because as far as I know the account you are referring to has not replaced the email. It should work.

[hosseinimr93]

I just see that your account is currently banned.

Banned? Or locked?
The account should be locked, since the user tried to reset the password via secret question.

From Security log:

There are several possibilities why your account is currently locked, first; You failed to reset password via secret question. Even if you have done it 2 times on the same day, but I think it has locked you in when you do another failed attempt.

Your account is automatically locked if you try to reset your password via secret question. That happens even if you answer the secret question correctly.
For more information, visit the topic made by achow101.
PSA: ACCOUNTS WILL BE LOCKED IF THE SECRET QUESTION IS USED TO RECOVER IT

[Piesel Alt]

I just see that your account is currently banned.

Banned? Or locked?
The account should be locked, since the user tried to reset the password via secret question.

There are several possibilities why your account is currently locked, first; You failed to reset password via secret question. Even if you have done it 2 times on the same day, but I think it has locked you in when you do another failed attempt.

Your account is automatically locked if you try to reset your password via secret question. That happens even if you answer the secret question correctly.
For more information, visit the topic made by achow101.
PSA: ACCOUNTS WILL BE LOCKED IF THE SECRET QUESTION IS USED TO RECOVER IT

Note: the hacker have access to my email and my secrete question is saved in my draft on the email.

[hosseinimr93]

Note: the hacker have access to my email and my secrete question is saved in my draft on the email.

The good news is that using the secret question caused the account to be locked and the hacker can't use it now.
You should contact the recovery team. The link to the instruction was shared by _BlackStar above.
You will get access to your account if you can prove that you are the owner of that account.

By the way, I can't verify the message you signed.

[Adbitco]

I just see that your account is currently banned.

Banned? Or locked?
The account should be locked, since the user tried to reset the password via secret question.

There are several possibilities why your account is currently locked, first; You failed to reset password via secret question. Even if you have done it 2 times on the same day, but I think it has locked you in when you do another failed attempt.

Your account is automatically locked if you try to reset your password via secret question. That happens even if you answer the secret question correctly.
For more information, visit the topic made by achow101.
PSA: ACCOUNTS WILL BE LOCKED IF THE SECRET QUESTION IS USED TO RECOVER IT

Note: the hacker have access to my email and my secrete question is saved in my draft on the email.

Then this should be someone close to you, maybe try reach out to your friends who often share same system with you or could be a friend you hand your phone over to. How is that possible for a hacker to have full control over your btt account as same time with your mail.

[hosseinimr93]

How is that possible for a hacker to have full control over your btt account as same time with your mail.

It's possible that the hacker gain access to the email and then used the email address to access the bitcointalk account.
If you check the seclog, you will see that Piesel's password has been reset via email.

[Sandra_hakeem]

The good news is that using the secret question caused the account to be locked and the hacker can't use it now.
You should contact the recovery team. The link to the instruction was shared by _BlackStar above.
You will get access to your account if you can prove that you are the owner of that account.

Sorry, I couldn't get that fact correctly....
Do you mean an account can be hacked using the secret questions and the process gets terminated on the way, due to some inaccuracies? If yes, then how's the OP gonna get 'em back after every claims that he's rightfully the owner of the account ??-- (remember, that's after when the hacker had changed the passcode already?)? This is only possible if the forum has access to people's personal data, Which is curruptible in my opinion...or is there an alternative?

By the way, I can't verify the message you signed.

The same thing I was wondering too.

Sandra 🧑‍🦰

[hosseinimr93]

Do you mean an account can be hacked using the secret questions and the process gets terminated on the way, due to some inaccuracies?

Due to the database leakage in the 2015 hack, theymos doesn't allow people to reset their password via answering the secret question.
For more information about this, you could visit the topic I already shared.

how's the OP gonna get 'em back after every claims that he's rightfully the owner of the account ??-- (remember, that's after when the hacker had changed the passcode already?)? This is only possible if the forum has access to people's personal data, Which is curruptible in my opinion...or is there an alternative?

One way to prove your ownership of your account is to sign a message from an address which you have posted before in the forum and is obviously yours.
The recovery team surely has some other criteria to verify the claims. For example, they can check IP logs.

[Crypto-DesignService]

This happened to me aswell when I tried changing my password via secret question, you're account is safe because there's no way the hacker can use it once locked.
Fastest way to retrieve your account is email the recovery team and provide a signed message, timeframe of unlocking your account is usually 1-3 days after verifying your signed message.

The answer time at the moment is probably one or two days tops, rarely three if we're very busy. He's emailed us and since we've already started, I'd rather have him go through our process but thanks a lot for your help!

Note: the hacker have access to my email and my secrete question is saved in my draft on the email.

You can message them with a different email as long as you have the signed messaged verified, that won't be a problem. Here's the email they provided to reach them out

Code:

locked(_)2019(_)vuhnu@bitcointalk.org
*remove open and close parenthesis

You may also try reaching out hilariousandco if they did not respond within a day.

[SoYouThinkYouArePiesel]

So you think you are hacked. Or perhaps you bought an hacked accounts then the owner suddenly came back from the death

The oldest address is: 0xc08f62f38998784cEf6803006ff8C4bE50326B3C from https://ninjastic.space/address/0xc08f62f38998784cEf6803006ff8C4bE50326B3C

Here is the sign message from it, I hope that I make it correct:

Code:

-----BEGIN ETHEREUM SIGNED MESSAGE-----
SoYouThinkYouArePiesel is here to claim back his account in 24/01/2023
-----BEGIN ETHEREUM SIGNATURE-----
{
  "address": "0xc08f62f38998784cef6803006ff8c4be50326b3c",
  "msg": "0x536f596f755468696e6b596f7541726550696573656c206973206865726520746f20636c61696d206261636b20686973206163636f756e7420696e2032342f30312f32303233",
  "sig": "4f69b8208c8dfeedfa808e2a39b01fbe84ae84405a5950d5201f30e0797542d81a640488fd96cddeede2e505e52ecaf697570e2b69189b85f4ebb916a3bb7e771c",
  "version": "3",
  "signer": "MEW"
}
-----END ETHEREUM SIGNATURE-----

The below are some of the private messages sent to MY EMAIL

https://i.imgur.com/G2vMZBl.png

I did not even sell it. I also do not have time to check the private message on yesterday when I first made my password change via email. I just hope that the account will be backed to the true owner, in this case, is me

[Crypto-DesignService]

<...>

Signed message verified https://etherscan.io/verifySig/13636

However upon checking your message with the address you provided to quote it, this is what I only gather. A quote of the supposed address, the orignal post is removed.
https://bitcointalk.org/index.php?topic=2416310.msg33170519#msg33170519, will this be viable proof for ownership?

_

This is my last activity before the hackers took control, please below is a sign message from my wallet used on the account.

-----BEGIN BITCOIN SIGNED MESSAGE-----
I am piesel
23-01-2023
bc1q22ssr8r5rxtjh4wqaj8kj8rtvwudngd7p8qq7v
-----BEGIN BITCOIN SIGNATURE-----
Version: Bitcoin-qt (1.0)
Address: bc1q22ssr8r5rxtjh4wqaj8kj8rtvwudngd7p8qq7v

HyAw5qtADDo4fkRrZQkqXrUk+Qw+dBADEXlKjzsIs85QFoL36AlxKBWsycJQmfPDnfs9vBFaJUK+44KRpBESe0w=
-----END BITCOIN SIGNATURE-----

OP can you sign another message using this address? I can't verify it using Electrum, you may also sign a message using this address for the other one claiming to be the original owner.

[_BlackStar]

So you think you are hacked. Or perhaps you bought an hacked accounts then the owner suddenly came back from the death

So are we talking with ghosts right now?

I did not even sell it. I also do not have time to check the private message on yesterday when I first made my password change via email. I just hope that the account will be backed to the true owner, in this case, is me

What happens if you sell it yourself and then you try to lock the account because you still have access to everything including email because you don't really want to lose the account? Then who should we believe in each other's claims?

I believe if you are the account owner then you have access to the email address, wallet address and it is very possible to get you signed messages with it. But just one thing, what if it's actually you who sold the account and then you lock the account by resetting the password with a secret question?
IMO, only main users know about secret questions.

[Upgrade00]

I did not even sell it. I also do not have time to check the private message on yesterday when I first made my password change via email. I just hope that the account will be backed to the true owner, in this case, is me

You claim the account was hacked, but you say here you made the password change via email and did not make a complaint of being hacked, despite there being a huge gap from the password reset to the last password change.

will this be viable proof for ownership?

I don't think it does. Besides the reason you pointed out, I believe only Bitcoin signed messages are accepted for account recovery and doesn't include addresses from other networks.

[SoYouThinkYouArePiesel]

What happens if you sell it yourself and then you try to lock the account because you still have access to everything including email because you don't really want to lose the account? Then who should we believe in each other's claims?

I believe if you are the account owner then you have access to the email address, wallet address and it is very possible to get you signed messages with it. But just one thing, what if it's actually you who sold the account and then you lock the account by resetting the password with a secret question?
IMO, only main users know about secret questions.

Then I do accept the consequence that my account will be locked forever or ban or red trust due to selling account. I guess I do not have any proof that I am not selling that account. I just suddenly came back to Bitcointalk and saw my account being used and I want to take it back.

I did not change make any request of secret question. I only changed my password via email

will this be viable proof for ownership?

I don't think it does. Besides the reason you pointed out, I believe only Bitcoin signed messages are accepted for account recovery and doesn't include addresses from other networks.

Let the admin decide which can be used. But that is my only address on the forum.

I did not even sell it. I also do not have time to check the private message on yesterday when I first made my password change via email. I just hope that the account will be backed to the true owner, in this case, is me

You claim the account was hacked, but you say here you made the password change via email and did not make a complaint of being hacked, despite there being a huge gap from the password reset to the last password change.

When I tried to reset via email, I still received the resetting password request so i think that complaining is not necessary when you are able to solve the problem yourself, until right now.

[Upgrade00]

Let the admin decide which can be used. But that is my only address on the forum.

This is what you see on the recovering hacked and lost accounts thread; "Often, you need to prove ownership of the account with a PGP or Bitcoin signature."

Also, it's not the only address which has been posted by the account in question. The first signed message in the op is from a reply made a couple of years ago, which contains a Bitcoin address. And that Bitcoin address has been used multiple times by the account Piesel.