Moderator help my bitcointalk account have been hacked

[Piesel Alt]

I noticed an unusual activities on my account Piesel yesterday when i tried to log in, my account password have been charged and the hacker made a post in the football transfer speculation thread in gambling section immediately after he gain access.

The last post i made on the account was when a applied to a campaign at about 03:42:21 pm.

Current number of post (Including this one): 1713
Rank: senior member
TRC20 address: THcySPm9K3e7rGjB6E6eTYTqr6XfyaqCHH

Older wallet usage

Bitcointalk Profile Link: https://bitcointalk.org/index.php?action=profile;u=187601
Current amount of posts:  1415
bech32 BTC address for payouts: bc1q22ssr8r5rxtjh4wqaj8kj8rtvwudngd7p8qq7v

This is my last activity before the hackers took control, please below is a sign message from my wallet used on the account.
New signed messages for those who cant verifythe first posted message.

Code:

 -----BEGIN BITCOIN SIGNED MESSAGE-----
24-01-2024 
Signing this message to prove the ownership of account piesel that was hacked in the last 24-48 hours ago
-----BEGIN BITCOIN SIGNATURE-----
Version: Bitcoin-qt (1.0)
Address: bc1q22ssr8r5rxtjh4wqaj8kj8rtvwudngd7p8qq7v

H4qGrqKStOPB9AZ5YaIUwq6f8yQyfwVbkzEbaklRqgSCPWtatrC7q1vN3YGxLeEwhuLJ3K1GLxGcAagplA0E8ec=
-----END BITCOIN SIGNATURE-----

[1714948018]

1714948018

[1714948018]

1714948018

[1714948018]

1714948018

[1714948018]

1714948018

[sujonali1819]

I noticed an unusual activities on my account Piesel yesterday when i tried to log in, my account password have been charged and the hacker made a post in the football transfer speculation thread in gambling section immediately after he gain access.

I think you should sign a message with your old user account. I can not find any history of this address THcySPm9K3e7rGjB6E6eTYTqr6XfyaqCHH before 22nd January.

It's a matter of a few hours . So How can we understand that you are not that hacker and making drama? (don't mind please)

Meanwhile, I am tagging the account so that the hacker can not do any scams. Let me know once you will get the access back again.

[Piesel Alt]

I noticed an unusual activities on my account Piesel yesterday when i tried to log in, my account password have been charged and the hacker made a post in the football transfer speculation thread in gambling section immediately after he gain access.

I think you should sign a message with your old user account. I can not find any history of this address THcySPm9K3e7rGjB6E6eTYTqr6XfyaqCHH before 22nd January.

The signed message included in the thread is from my old wallet used over a period of time and the wallet mentioned in ops was just to point out my last activity but the campaign is not Bitcoin paid that is why i shared it but the TRC20 wallet is from the same wallet.

Thank you for the tag and i will notify you when everything is resolved, btw have a great day.

[Xal0lex]

Have you contacted the global moderators or administrators directly? I just see that your account is currently banned. I do not know for what reason it is banned, the global moderators or administrators can tell you that.
So you're saying you didn't write this post?

Reportedly Ivan Fresneda, Real Valladolid wonderkid has started to enter the list of names of players targeted by Arsenal. This player is only 18 years old and starting to gain the trust to play in Real Valladolid's main squad, since then he has been able to attract interest from several clubs including Arsenal. Not only Arsenal but even Liverpool had already taken an interest in this young player. Arsenal need a stock of right-backs to back up their main players. And their effort I think is good because it prioritizes young players, it's good because young players like this can be a future asset for a club.

He is too young for having a nice spot on a professional team like that. However, he maybe a good investment for a future purpose. 18 year old is very young compare to other players. I just hope that if he manages to be transfered to arsenal, he will not sit on the bench for the entire season.

[Piesel Alt]

Have you contacted the global moderators or administrators directly? I just see that your account is currently banned. I do not know for what reason it is banned, the global moderators or administrators can tell you that.
So you're saying you didn't write this post?

Reportedly Ivan Fresneda, Real Valladolid wonderkid has started to enter the list of names of players targeted by Arsenal. This player is only 18 years old and starting to gain the trust to play in Real Valladolid's main squad, since then he has been able to attract interest from several clubs including Arsenal. Not only Arsenal but even Liverpool had already taken an interest in this young player. Arsenal need a stock of right-backs to back up their main players. And their effort I think is good because it prioritizes young players, it's good because young players like this can be a future asset for a club.

He is too young for having a nice spot on a professional team like that. However, he maybe a good investment for a future purpose. 18 year old is very young compare to other players. I just hope that if he manages to be transfered to arsenal, he will not sit on the bench for the entire season.

That post is not from me, the hacker wrote the post, i have not contacted the global moderator.

I will contact the global moderator right away, i was not aware of the ban i just get a wrong password error each time I try logging in and when I checked the account profile.

I noticed my password was changed recently and a post was made right after that.

[_BlackStar]

i was not aware of the ban i just get a wrong password error each time I try logging in and when I checked the account profile.

There are several possibilities why your account is currently locked, first; You failed to reset password via secret question. Even if you have done it 2 times on the same day, but I think it has locked you in when you do another failed attempt.



The second possibility; You lock it yourself after you receive forum email. But this possibility is small considering that you are not aware of what has locked your account.

Do a few steps and contact the mod: Recovering hacked/lost accounts

But I can advise you to reset your password immediately via email ^{[if you are owner that acc]} because as far as I know the account you are referring to has not replaced the email. It should work.

[hosseinimr93]

I just see that your account is currently banned.

Banned? Or locked?
The account should be locked, since the user tried to reset the password via secret question.

From Security log:

There are several possibilities why your account is currently locked, first; You failed to reset password via secret question. Even if you have done it 2 times on the same day, but I think it has locked you in when you do another failed attempt.

Your account is automatically locked if you try to reset your password via secret question. That happens even if you answer the secret question correctly.
For more information, visit the topic made by achow101.
PSA: ACCOUNTS WILL BE LOCKED IF THE SECRET QUESTION IS USED TO RECOVER IT

[Piesel Alt]

I just see that your account is currently banned.

Banned? Or locked?
The account should be locked, since the user tried to reset the password via secret question.

There are several possibilities why your account is currently locked, first; You failed to reset password via secret question. Even if you have done it 2 times on the same day, but I think it has locked you in when you do another failed attempt.

Your account is automatically locked if you try to reset your password via secret question. That happens even if you answer the secret question correctly.
For more information, visit the topic made by achow101.
PSA: ACCOUNTS WILL BE LOCKED IF THE SECRET QUESTION IS USED TO RECOVER IT

Note: the hacker have access to my email and my secrete question is saved in my draft on the email.

[hosseinimr93]

Note: the hacker have access to my email and my secrete question is saved in my draft on the email.

The good news is that using the secret question caused the account to be locked and the hacker can't use it now.
You should contact the recovery team. The link to the instruction was shared by _BlackStar above.
You will get access to your account if you can prove that you are the owner of that account.

By the way, I can't verify the message you signed.

[Adbitco]

I just see that your account is currently banned.

Banned? Or locked?
The account should be locked, since the user tried to reset the password via secret question.

There are several possibilities why your account is currently locked, first; You failed to reset password via secret question. Even if you have done it 2 times on the same day, but I think it has locked you in when you do another failed attempt.

Your account is automatically locked if you try to reset your password via secret question. That happens even if you answer the secret question correctly.
For more information, visit the topic made by achow101.
PSA: ACCOUNTS WILL BE LOCKED IF THE SECRET QUESTION IS USED TO RECOVER IT

Note: the hacker have access to my email and my secrete question is saved in my draft on the email.

Then this should be someone close to you, maybe try reach out to your friends who often share same system with you or could be a friend you hand your phone over to. How is that possible for a hacker to have full control over your btt account as same time with your mail.

[hosseinimr93]

How is that possible for a hacker to have full control over your btt account as same time with your mail.

It's possible that the hacker gain access to the email and then used the email address to access the bitcointalk account.
If you check the seclog, you will see that Piesel's password has been reset via email.

[Sandra_hakeem]

The good news is that using the secret question caused the account to be locked and the hacker can't use it now.
You should contact the recovery team. The link to the instruction was shared by _BlackStar above.
You will get access to your account if you can prove that you are the owner of that account.

Sorry, I couldn't get that fact correctly....
Do you mean an account can be hacked using the secret questions and the process gets terminated on the way, due to some inaccuracies? If yes, then how's the OP gonna get 'em back after every claims that he's rightfully the owner of the account ??-- (remember, that's after when the hacker had changed the passcode already?)? This is only possible if the forum has access to people's personal data, Which is curruptible in my opinion...or is there an alternative?

By the way, I can't verify the message you signed.

The same thing I was wondering too.

Sandra 🧑‍🦰

[hosseinimr93]

Do you mean an account can be hacked using the secret questions and the process gets terminated on the way, due to some inaccuracies?

Due to the database leakage in the 2015 hack, theymos doesn't allow people to reset their password via answering the secret question.
For more information about this, you could visit the topic I already shared.

how's the OP gonna get 'em back after every claims that he's rightfully the owner of the account ??-- (remember, that's after when the hacker had changed the passcode already?)? This is only possible if the forum has access to people's personal data, Which is curruptible in my opinion...or is there an alternative?

One way to prove your ownership of your account is to sign a message from an address which you have posted before in the forum and is obviously yours.
The recovery team surely has some other criteria to verify the claims. For example, they can check IP logs.

[Crypto-DesignService]

This happened to me aswell when I tried changing my password via secret question, you're account is safe because there's no way the hacker can use it once locked.
Fastest way to retrieve your account is email the recovery team and provide a signed message, timeframe of unlocking your account is usually 1-3 days after verifying your signed message.

The answer time at the moment is probably one or two days tops, rarely three if we're very busy. He's emailed us and since we've already started, I'd rather have him go through our process but thanks a lot for your help!

Note: the hacker have access to my email and my secrete question is saved in my draft on the email.

You can message them with a different email as long as you have the signed messaged verified, that won't be a problem. Here's the email they provided to reach them out

Code:

locked(_)2019(_)vuhnu@bitcointalk.org
*remove open and close parenthesis

You may also try reaching out hilariousandco if they did not respond within a day.

[SoYouThinkYouArePiesel]

So you think you are hacked. Or perhaps you bought an hacked accounts then the owner suddenly came back from the death

The oldest address is: 0xc08f62f38998784cEf6803006ff8C4bE50326B3C from https://ninjastic.space/address/0xc08f62f38998784cEf6803006ff8C4bE50326B3C

Here is the sign message from it, I hope that I make it correct:

Code:

-----BEGIN ETHEREUM SIGNED MESSAGE-----
SoYouThinkYouArePiesel is here to claim back his account in 24/01/2023
-----BEGIN ETHEREUM SIGNATURE-----
{
  "address": "0xc08f62f38998784cef6803006ff8c4be50326b3c",
  "msg": "0x536f596f755468696e6b596f7541726550696573656c206973206865726520746f20636c61696d206261636b20686973206163636f756e7420696e2032342f30312f32303233",
  "sig": "4f69b8208c8dfeedfa808e2a39b01fbe84ae84405a5950d5201f30e0797542d81a640488fd96cddeede2e505e52ecaf697570e2b69189b85f4ebb916a3bb7e771c",
  "version": "3",
  "signer": "MEW"
}
-----END ETHEREUM SIGNATURE-----

The below are some of the private messages sent to MY EMAIL

https://i.imgur.com/G2vMZBl.png

I did not even sell it. I also do not have time to check the private message on yesterday when I first made my password change via email. I just hope that the account will be backed to the true owner, in this case, is me

[Crypto-DesignService]

<...>

Signed message verified https://etherscan.io/verifySig/13636

However upon checking your message with the address you provided to quote it, this is what I only gather. A quote of the supposed address, the orignal post is removed.
https://bitcointalk.org/index.php?topic=2416310.msg33170519#msg33170519, will this be viable proof for ownership?

_

This is my last activity before the hackers took control, please below is a sign message from my wallet used on the account.

-----BEGIN BITCOIN SIGNED MESSAGE-----
I am piesel
23-01-2023
bc1q22ssr8r5rxtjh4wqaj8kj8rtvwudngd7p8qq7v
-----BEGIN BITCOIN SIGNATURE-----
Version: Bitcoin-qt (1.0)
Address: bc1q22ssr8r5rxtjh4wqaj8kj8rtvwudngd7p8qq7v

HyAw5qtADDo4fkRrZQkqXrUk+Qw+dBADEXlKjzsIs85QFoL36AlxKBWsycJQmfPDnfs9vBFaJUK+44KRpBESe0w=
-----END BITCOIN SIGNATURE-----

OP can you sign another message using this address? I can't verify it using Electrum, you may also sign a message using this address for the other one claiming to be the original owner.

[_BlackStar]

So you think you are hacked. Or perhaps you bought an hacked accounts then the owner suddenly came back from the death

So are we talking with ghosts right now?

I did not even sell it. I also do not have time to check the private message on yesterday when I first made my password change via email. I just hope that the account will be backed to the true owner, in this case, is me

What happens if you sell it yourself and then you try to lock the account because you still have access to everything including email because you don't really want to lose the account? Then who should we believe in each other's claims?

I believe if you are the account owner then you have access to the email address, wallet address and it is very possible to get you signed messages with it. But just one thing, what if it's actually you who sold the account and then you lock the account by resetting the password with a secret question?
IMO, only main users know about secret questions.

[Upgrade00]

I did not even sell it. I also do not have time to check the private message on yesterday when I first made my password change via email. I just hope that the account will be backed to the true owner, in this case, is me

You claim the account was hacked, but you say here you made the password change via email and did not make a complaint of being hacked, despite there being a huge gap from the password reset to the last password change.

will this be viable proof for ownership?

I don't think it does. Besides the reason you pointed out, I believe only Bitcoin signed messages are accepted for account recovery and doesn't include addresses from other networks.

[SoYouThinkYouArePiesel]

What happens if you sell it yourself and then you try to lock the account because you still have access to everything including email because you don't really want to lose the account? Then who should we believe in each other's claims?

I believe if you are the account owner then you have access to the email address, wallet address and it is very possible to get you signed messages with it. But just one thing, what if it's actually you who sold the account and then you lock the account by resetting the password with a secret question?
IMO, only main users know about secret questions.

Then I do accept the consequence that my account will be locked forever or ban or red trust due to selling account. I guess I do not have any proof that I am not selling that account. I just suddenly came back to Bitcointalk and saw my account being used and I want to take it back.

I did not change make any request of secret question. I only changed my password via email

will this be viable proof for ownership?

I don't think it does. Besides the reason you pointed out, I believe only Bitcoin signed messages are accepted for account recovery and doesn't include addresses from other networks.

Let the admin decide which can be used. But that is my only address on the forum.

I did not even sell it. I also do not have time to check the private message on yesterday when I first made my password change via email. I just hope that the account will be backed to the true owner, in this case, is me

You claim the account was hacked, but you say here you made the password change via email and did not make a complaint of being hacked, despite there being a huge gap from the password reset to the last password change.

When I tried to reset via email, I still received the resetting password request so i think that complaining is not necessary when you are able to solve the problem yourself, until right now.

[Upgrade00]

Let the admin decide which can be used. But that is my only address on the forum.

This is what you see on the recovering hacked and lost accounts thread; "Often, you need to prove ownership of the account with a PGP or Bitcoin signature."

Also, it's not the only address which has been posted by the account in question. The first signed message in the op is from a reply made a couple of years ago, which contains a Bitcoin address. And that Bitcoin address has been used multiple times by the account Piesel.

[SoYouThinkYouArePiesel]

This is what you see on the recovering hacked and lost accounts thread; "Often, you need to prove ownership of the account with a PGP or Bitcoin signature."

They say often, so I hope there will be exceptional case

Also, it's not the only address which has been posted by the account in question. The first signed message in the op is from a reply made a couple of years ago, which contains a Bitcoin address. And that Bitcoin address has been used multiple times by the account Piesel.

I have to say that it is the only accessible address by me - SoYouThinkYouArePiesel.

https://ninjastic.space/addresses?author=piesel

These are all addresses posted by piesel

[Ndabagi01]

One way to prove your ownership of your account is to sign a message from an address which you have posted before in the forum and is obviously yours.
The recovery team surely has some other criteria to verify the claims. For example, they can check IP logs.

Is this the only way one can verify his/her claim of an account in the forum, is there no any other way one can actually do it too asides signing a message?
If this is the most accepted and verifiable way to claim ownership of account, how is it done? A link or thread will help as a guide. Thank you.

[John Abraham]

Oh wow. What's happening here?
Mr. SoYouThinkYouArePiesel, Can you tell us if you have sold your account? No explanation, Just Yes or NO.
Of course, the recovery team knows how to deal with such cases. It may take time, but there will be a solution if you can get attention from them. Piesel shared five addresses so far. How many of them do you have access to?

[Piesel Alt]

What happens if you sell it yourself and then you try to lock the account because you still have access to everything including email because you don't really want to lose the account? Then who should we believe in each other's claims?

I believe if you are the account owner then you have access to the email address, wallet address and it is very possible to get you signed messages with it. But just one thing, what if it's actually you who sold the account and then you lock the account by resetting the password with a secret question?
IMO, only main users know about secret questions.

Then I do accept the consequence that my account will be locked forever or ban or red trust due to selling account. I guess I do not have any proof that I am not selling that account. I just suddenly came back to Bitcointalk and saw my account being used and I want to take it back.

Code:

-----BEGIN BITCOIN SIGNED MESSAGE-----
24-01-2023
I guess you are the hacker, so since you don't have anything to lose you want the account to remain banned. 
What a low life mentally sick person you are. 
-----BEGIN BITCOIN SIGNATURE-----
Version: Bitcoin-qt (1.0)
Address: bc1q22ssr8r5rxtjh4wqaj8kj8rtvwudngd7p8qq7v

INjg0sM1RoXtzriYiNc5s5/HhN1JeBdDbEl6iHQGTPZKAhrbNQQvQYZ0FSQawjQ2vPSKHeO3pYW8tw15hVXnXQs=
-----END BITCOIN SIGNATURE----- 

[hosseinimr93]

If this is the most accepted and verifiable way to claim ownership of account, how is it done? A link or thread will help as a guide. Thank you.

Stake your Bitcoin address here, so that you can use that for recovering your account in the case your account is hacked or you lose access to that for any reason.

Below is the guide on how you can sign a message.
How to sign a message?!

@Piesel Alt
I can't verify your message. What software do you use for signing message?

[Piesel Alt]

@Piesel Alt
I can't verify your message. http://What software do you use for signing message?

I used mycelium wallet to sign the messages
https://i.ibb.co/FJyncyq/IMG-20230123-WA0000.jpg

https://i.ibb.co/k51KrY3/IMG-20230124-WA0000.jpg
goodwill chico

[SoYouThinkYouArePiesel]

What happens if you sell it yourself and then you try to lock the account because you still have access to everything including email because you don't really want to lose the account? Then who should we believe in each other's claims?

I believe if you are the account owner then you have access to the email address, wallet address and it is very possible to get you signed messages with it. But just one thing, what if it's actually you who sold the account and then you lock the account by resetting the password with a secret question?
IMO, only main users know about secret questions.

Then I do accept the consequence that my account will be locked forever or ban or red trust due to selling account. I guess I do not have any proof that I am not selling that account. I just suddenly came back to Bitcointalk and saw my account being used and I want to take it back.

Code:

-----BEGIN BITCOIN SIGNED MESSAGE-----
24-01-2023
I guess you are the hacker, so since you don't have anything to lose you want the account to remain banned. 
What a low life mentally sick person you are. 
-----BEGIN BITCOIN SIGNATURE-----
Version: Bitcoin-qt (1.0)
Address: bc1q22ssr8r5rxtjh4wqaj8kj8rtvwudngd7p8qq7v

INjg0sM1RoXtzriYiNc5s5/HhN1JeBdDbEl6iHQGTPZKAhrbNQQvQYZ0FSQawjQ2vPSKHeO3pYW8tw15hVXnXQs=
-----END BITCOIN SIGNATURE----- 

no bro, Im the true owner of the account. I just want my account back. I know you put a lot of effort on the account. But you buy the account from the unknown source and now the owner - which is me, apparently - comes to take it back. I have the oldest address of the account Piesel, which is posted on 2018: 0xc08f62f38998784cef6803006ff8c4be50326b3c and also the email.

Code:

-----BEGIN ETHEREUM SIGNED MESSAGE-----
I just want my account - Piesel - backed to the true owner of it. Today it 24/01/2023. The current time is 03:56:59 PM
-----BEGIN ETHEREUM SIGNATURE-----
{
  "address": "0xc08f62f38998784cef6803006ff8c4be50326b3c",
  "msg": "0x49206a7573742077616e74206d79206163636f756e74202d2050696573656c202d206261636b656420746f207468652074727565206f776e6572206f662069742e20546f6461792069742032342f30312f323032332e205468652063757272656e742074696d652069732030333a35363a353920504d",
  "sig": "2638f81411a1a0bb1062b1194ca10bf39e972ebc2b482278f2921ea9346397a225b4e687c09cdfaa74e8ed73e44ffe93e3085c74d68b500fcfc038525b0b36141b",
  "version": "3",
  "signer": "MEW"
}
-----END ETHEREUM SIGNATURE-----

[Smartvirus]

Then this should be someone close to you, maybe try reach out to your friends who often share same system with you or could be a friend you hand your phone over to. How is that possible for a hacker to have full control over your btt account as same time with your mail.

Not really someone close. Supposing the email attached to the account isn't some throw-away email that is used only on the account, there are chances of other usages that could have lead to giving the mail off. Like from your TRC20 address presented in OP, it means OP has been about some bounties at some point and could lead to some email exposure in filling out some forms and subsequently, compromise.

It's good enough the mail address wasn't swapped and even better now, the account has been locked due to recovery via secret question so, you stand a better cjnace at unlocking by following the processes as given above by _Blackstar in proving yourself and when that is done successfully, you do your hit to ensure privacy and security by changing important access points @OP.

[sujonali1819]

I noticed an unusual activities on my account Piesel yesterday when i tried to log in, my account password have been charged and the hacker made a post in the football transfer speculation thread in gambling section immediately after he gain access.

It's a matter of a few hours. So How can we understand that you are not that hacker and making drama? (don't mind please)

So the drama is already started what I have guessed at the beginning. Now it's really hard to find the real owner of this account. What are you thinking? For me, there is something hidden in both of them. They are not sharing the things that they (both) know. For example, buy / selling or any other deal.

[Piesel Alt]

@Piesel Alt
I can't verify your message. http://What software do you use for signing message?

I used mycelium wallet to sign the messages
https://i.ibb.co/FJyncyq/IMG-20230123-WA0000.jpg

https://i.ibb.co/k51KrY3/IMG-20230124-WA0000.jpg
goodwill chico

For obvious reasons i don't know why my signed messages are not verifiable by some members and clarity sake i will like to inform members here that i use mycelium wallet to sign the messaseg but verified both mycelium and electron as posted comment.

Also below is the signed message i sent to moderator email.
https://i.ibb.co/JKt5rR9/Screenshot-2023-0124-174802.png
image uploader

Code:

-----BEGIN BITCOIN SIGNED MESSAGE-----
24-01-2024 
Signing this message to prove the ownership of account piesel that was hacked in the last 24-48 hours ago
-----BEGIN BITCOIN SIGNATURE-----
Version: Bitcoin-qt (1.0)
Address: bc1q22ssr8r5rxtjh4wqaj8kj8rtvwudngd7p8qq7v

H4qGrqKStOPB9AZ5YaIUwq6f8yQyfwVbkzEbaklRqgSCPWtatrC7q1vN3YGxLeEwhuLJ3K1GLxGcAagplA0E8ec=
-----END BITCOIN SIGNATURE-----

Please higher rank member quote the comment before i lock the thread.
Thank you all for the replies let moderators do the rest.
sujonali1819
Smartvirus
Or any higher rank member due to my forum rank the image can not display.
Please quote this comment should incase the signed message is not verifiable by some members

[sujonali1819]

Also below is the signed message i sent to moderator email.

image uploader

Code:

-----BEGIN BITCOIN SIGNED MESSAGE-----
24-01-2024 
Signing this message to prove the ownership of account piesel that was hacked in the last 24-48 hours ago
-----BEGIN BITCOIN SIGNATURE-----
Version: Bitcoin-qt (1.0)
Address: bc1q22ssr8r5rxtjh4wqaj8kj8rtvwudngd7p8qq7v

H4qGrqKStOPB9AZ5YaIUwq6f8yQyfwVbkzEbaklRqgSCPWtatrC7q1vN3YGxLeEwhuLJ3K1GLxGcAagplA0E8ec=
-----END BITCOIN SIGNATURE-----

Quoted to make the image visible