Diamond 5 Stake, account was hacked

[l3pox]

Stake doesn’t have authenticator based 2FA?
Still with the phishing situation sometimes the hackers can bypass it

I wouldn’t hope for tether to freeze this amount in this cases

Best to check directly with Stake website as some pointed

[OgNasty]

It sounds like you made a bad mistake and paid the price, but it also sounds like Stake did their part to freeze the funds to keep the loss at a minimum as soon as it was possible for them to do so (once you alerted them).  This is a huge loss and a terrible situation, but I'm not sure Stake owes you anything.  If they did, I could only imagine how many inside jobs would suddenly happen with users wanting payouts.  Did you ever have the frozen funds returned?  While I think it's unlikely you'll be able to recover anything, if Stake saved a large amount of money from being stolen from you, you really owe them some gratitude in my opinion. 

As I've said a million times...  Stay off telegram.  It should be branded the chat network preferred by scammers.

[seoincorporation]

As I've said a million times...  Stay off telegram.  It should be branded the chat network preferred by scammers.

Telegram has become a shit hole, the amount of scammers and the daily scam attempts is just crazy. I get tons
of daily messages trying to scam, and for each user you block 5 new users will come to you.

I didn't alert them to the last poster. It was caught only because the hacker tried to withdraw over his limit. I guess they should be applauded for that, depends how you look at it really. Draining your highest profile sports account in tips to a brand new none kyc account and losing 60 plus grand doesn't seem like the highest level of security to me really.

This sound really tricky to me too... How can an account get a $60k tip and easily make a withdrawal without KYC? I don't feel like they are doing something to avoid money laundering. They should at least investigate a bit when things like this happen.

[BenCodie]

I do wonder how it's possible that Stake are letting brand new accounts withdraw in excess of hundreds of thousands of dollars. You would think that there are some sort of flags or something in place to prevent brand new accounts from instantly withdrawing this much?

whats done is done. shoulda been a quick solution but its done. anyway has anyway to flag or do anything to the coins let me know. me calling the cops saying stake was robbed isnt going to do much.

In my opinion you should be fighting a lot harder than what you are. This is life changing money to some people...and one day, it could be to you too. Don't let your present cause regret for the future. Do everything you can so that you can't blame yourself for not doing enough later.

[Get-Paid.com]

crypto isn't really my world hence being on here. Any advice or ways to lock the funds or wallet and I'm all ears. The funds were stolen from stake on stake, calling police and saying what? Its a jurisdiction thing and it's not my company or my wallets that were hacked. The address info above I can't tell if that is accurate and those are the coins that were sent out or not. I am super interested and motivated to at least go down swinging here, so if theres some advice pls let me know. Definitely not taking it lightly at all.

The only thing you can do is try to trace the transfers from that wallet, see if transfers were made into some exchanges, and in this case contact the exchanges urgently - however if this is a hacker he might be a very smart person who mixed the transfers and won't use any exchanges and it would be difficult to trace where the money went to -

This is a very large amount, I would have used a service to try and help:

https://www.quora.com/How-do-I-find-a-very-good-ethical-hacker-for-Bitcoin-blockchain-and-cryptocurrency-recovery-jobs
https://transitnet.io/blog/can-you-recover-your-crypto-is-lost-stolen/

Don't pay anyone upfront, only if someone is willing to work on a no-win-no-fee basis then it's someone you "can" trust and the word "can" is emphasized (make sure he's genuine and won't scam you any further).

Search on Google "Recover Stolen Crypto" - try to see if you can find anything that might be useful.

[Get-Paid.com]

https://ethplorer.io/address/0xdeb197c73270288adbd93ac537311b46cab96f71#


that is where the coins ended up. Anyway to tell if this is a private wallet or an exchange wallet or what exactly this is? Not expecting ppl to work for free.

The balance is still there and hasn't left that wallet?

 

Surely someone from the forum member knows... ask about this urgently here as well please:

https://bitcointalk.org/index.php?board=4.0

[acroman08]

https://ethplorer.io/address/0xdeb197c73270288adbd93ac537311b46cab96f71#


that is where the coins ended up. Anyway to tell if this is a private wallet or an exchange wallet or what exactly this is? Not expecting ppl to work for free.

the wallet only has three transactions, it seems like a private wallet.

Surely someone from the forum member knows... ask about this urgently here as well please:

https://bitcointalk.org/index.php?board=4.0

that board is dedicated to bitcoin-related issues. the OP's problem has nothing to do with bitcoin, it would be best if he posted on beginners and help, this board is very broad, you can pretty much ask anything there as long as it has something to do with cryptocurrency.

[bitbollo]

Yeah so, a month or so ago I started getting messages from players on the site demanding money or they would dox me or they would do this and that, sending images of family members and so on. I wrote in and asked for help in making my account incognito or some kind of privacy and was denied.

What has happened is that my telegram where I get the notifications from stake was found out, someone sent me a link on telegram so it popped up on my computer looking just like stakes messages. I clicked it and the rest is history. As far as withdrawls and kyc no stake doesn't have any kyc on withdrawals up to 60k i believe for instant. In any event, clicking was idiotic but the 2fa being stripped and money not being withdrawn but tipped over to a new account is pretty shocking. They stopped 105k and are congratulating themselves for doing so but I lost 100k in the process of them cashing out a bet and stealing the funds.

Was hoping due to my level at the company they would reach some kind of agreement but it's simply 'we can't pay for stolen funds'

First of all I am really sorry to read such bad story and sure even if you get scammed by a phishing...isn't their fault (and really hard even to be proved!)

According your post, please note that I have a private account on stake what did you mean with incognito mode? Isn't private the same thing? Of course I don't spend any time on their chat simply because I don't care/have time for doing it.

Last but not least, telegram messages from stake are received ONLY in their channel for vip and not from random account ...

At this point there is nothing more to be done. You can try to reach TETHER to see what it can be done.
Secondly you can ask legal support specialized in such crypto activities... and track this ETH address (just in case scammer will use an exchange you can try to recover this sum)

[Wiwo]

So sorry for your lose, I also hope the right thing is fine because seriously, times are hard and we need the little we can get to survive through

But, if it's not possible, accept it as your loss and try to be more cautious and courageous.

From all indications and points of view, ops are to be blamed for everything because he click a phishing link and it's possible this is not the first time he has clicked the link and his account may have been compromised long before the hackers cashed out.
-I am sure his activities have been monitored for a long before the hacker finally struck when he has seen enough cash-out.
-The only place I see stake fault is where the withdrawal was approved even though the 2FA security was removed, because, in the change of any security details, the account should have been placed under 24-hour restrictions.

[South Park]

So sorry for your lose, I also hope the right thing is fine because seriously, times are hard and we need the little we can get to survive through

But, if it's not possible, accept it as your loss and try to be more cautious and courageous.

From all indications and points of view, ops are to be blamed for everything because he click a phishing link and it's possible this is not the first time he has clicked the link and his account may have been compromised long before the hackers cashed out.
-I am sure his activities have been monitored for a long before the hacker finally struck when he has seen enough cash-out.
-The only place I see stake fault is where the withdrawal was approved even though the 2FA security was removed, because, in the change of any security details, the account should have been placed under 24-hour restrictions.

Both the OP and stake have some blame to share, however in the case of the OP I agree with you that somehow he was already being watched by those scammers and they have been probably sending him links for some time waiting for him to fall into their scam, and while stake is also to blame, on their defense I do not remember ever seeing this particular kind of scam, instead of withdrawing money directly from the hacked account they sent tips to a new account and then withdrew that money from that account, so it makes sense they were not ready to stop such an unusual attack.

[livingfree]

Sad to see anyone who has been phished and the robbers took a lot of money from someone's fund. The incident happened with your negligence that you've click a suspicious linked and that had taken not just your stake account's credentials but also the email.

Usually with these withdrawals require a 2FA through email or an app and if they've taken over your email as well, there's nothing much you and the casino can do because they'll just take it as you're withdrawing from another location and different IP.

The other concern about tipping a new account, they should also suspect something like that and able to trace that some unwanted transaction has happened.

[Wiwo]

So sorry for your lose, I also hope the right thing is fine because seriously, times are hard and we need the little we can get to survive through

But, if it's not possible, accept it as your loss and try to be more cautious and courageous.

()

Both the OP and stake have some blame to share, however in the case of the OP I agree with you that somehow he was already being watched by those scammers and they have been probably sending him links for some time waiting for him to fall into their scam, and while stake is also to blame, on their defense I do not remember ever seeing this particular kind of scam, instead of withdrawing money directly from the hacked account they sent tips to a new account and then withdrew that money from that account, so it makes sense they were not ready to stop such an unusual attack.

Yes the thing is, we can blame both for everything but the fact still remains that ops are still in the right position to take all the blames since he initiated the vulnerability in the first place, we are warned never to click any link without proper check and if we visit our favourite site and we a prompt to input password we should always be careful and try to check everything right to know if the site is legit or not.
-Hackers are smart and there have clown popular sites all with an attempt to steal users' information even bitcointalk accounts have been hacked before using this same method.

[SirLancelot]

It is a little strange that they didn't make your account incignito.

A lot of members which you can see in the top 10 in the daily races are incognito, so that's a normal thing.

Your fault happened, we all make mistakes, but that security should really flag suspicious tip transactions to newbie accounts, I don't understand how this could happen. From time to time here we read of accounts that get blocked "for security reasons" in suspicion of multi accounting or whatever but real fraud in 6 digits doesn't get found out, that's alarming.

Well looking at stake history of things like that ( I am very active in stake's forum and read about strange cases a lot ) I think there is nothing that they will do to refund you. A little bit of a shame since you are almost diamond 5 and therefor have wagered almost 500 million $, what a crazy amount.

I am platinum 4 and also ran into problems in the past where I didn't get help, for some reason though I always stick with stake.

Even if stake incognito his account, I think that won't still help because he was the one who click on the phishing link on the chat and also, we are the ones who can choose to incognito our accounts and not stake. We can do this by going on the settings and enabling the ghost mode feature. Stake allows multiple accounts if I am not mistaken and anyone can create a brand new account. They will then tip their alt accounts.

This must be the reason why stake allow it but after this incident maybe they will now be a little stricter. If the money is already withdrawn outside the platform then I doubt stake can help but maybe they can give some donations to the OP if he is telling the truth only to ease some pain.

[sciack]

Just wanted to pitch in here:

Over the years, I've had 3 different Stake accounts hacked. Each time, Stake support was incredibly horrible at understanding the situation and taking appropriate action. Actually, in two of the cases, they straight up denied the claim that they were originally my accounts, even with extensive proof.

Good luck with this. Stake is known to have very very poor support beyond simple requests, I would take this as a lesson, cut your losses, and move on to another casino.

[pixie85]

The phish occurred that morning of the 17th at 553am so they waited two days until there was a balance. Full responsibility for sure and I’m living w the consequences but the security was truly pathetic and I had been raising alarm bells to the owner for a month on deaf ears

If they had 2fa requirement + your password and email confirmation for withdrawals I feel like the security was good. The only 2 holes that I can see is that there's no email confirmation needed to disable 2fa. Once 2fa is enabled it shouldn't be disabled simply by logging in with a password. The only way to disable 2fa should be to either enter 2fa token or password + email link.
The second hole is tipping amount. It shouldn't be possible to tip 50 thousand just like that. The amounts should be lower. Nobody in their right mind is going to tip someone 50 000.

You also made a huge mistake clicking suspicious links and not checking your account at that point. If you were clicking around and entering your password in every single popup window, withdraw the money to keep the account at minimum or change your password. You had 2 days to fix your mistake.

[bitbollo]

the point is not that i am not taking responsibility for clicking a link and i know how stake works and their bonuses work. The point is i asked to change my username after dozens of extortion attempts both on and offline and doxxing and we denied, now they are eager to do it. Also tipping 165k to a brand new account, which by the way is not something i have ever done, 14 minutes exactly since my 2fa was stripped is not proper security. They changed their protocol today and it should have been tighter from the begining. Keep in mind they had no information to make an actual withdrawl from my account or i would not be complaining this was all done because the internal security didn't exist. This is after the email leak a few months ago and countless phishing attacks on all of its users over and over. So opinions are welcome and it's my burden to lose that money but a company accepting millions of dollars from me every month or so should have some kind of security to not allow someone to drain my entire account in a tip to a new account that was made five minutes earlier with no history and also this to occur 14 minutes after my 2fa stripped. That was my gripe but now I am focused on trying to track the coins if anyones able to help any further. I don't need a lesson on how the site works, I am fully aware of what I did wrong, just shocking that it didn't reject a tip of that magnitute or have some internal alert that it was instantly suspicious.

I understand that you are angry and you are ...right...
the fact that they have introduced changes to their policy is a step forward.


regarding this post I didn't understand:
-even if "they" know your username and they are going to doxx you what is the real issue? I mean, if you're able to play with such figures for sure you're not living in a suburb driving a fiat panda...
what about keep the account private so no one will known anymore what are you doing on stake?
-how did you know that this account was created 5 minutes before the tip?
-I fully understand that such a tip is nonsense (of course).
I don't want to give you any lessons but I would always try the legal route (company negligence?) in short, you can always look for such support in addition to writing here on the forum...

[Wakate]

The lost funds in your balance in the account of the gambling site you are playing on are also quite large, but you yourself said that you clicked on a link that caused your account to be hacked.

      But what happened to you is worrying, even though 2FA is enabled, it is still possible to disable it like what happened to you. Then I don't think that can do anything and you won't be able to catch up with what you lost because for sure it has been moved to different addresses.

It is just very unfortunate for op to have lost that kind of huge amount of money in a few hours. I don't know how easy it will be to track down the scammer but the casino do not have to be blamed because this case is unlikely so op need to sophisticated team that can look into the wallet that received the fund and track it down if he meet the right team that can do that for him.
The fund is huge and I am still very surprised how easy it is for scammers to hack into someone's account with just a phishing link.

[bitbollo]

It says when the acct was created. I’m at peace w the mistake but there is definitely responsibility both ways especially when they were warned for a month about several scams being targeted etc. tbh if someone can help me at least disrupt anything to do with the coins I would sleep a lot better. I failed stake for sure by clicking but they absolutely failed me as well by not listening or caring about all the warnings. Tipping some new acct 165k within 2 minutes is absurd. They handle very very big clients which means very very big money. Gotta be more secure than to let an eternal theft occur.

for what I can see ( and I know) you can just access to DATE of when an account has been created and not the time.

btw...
if you think they have some deficiency on some part of the process or they are "guilty", you need to talk with a lawyer imho. for sure, if they have implemented some new solutions.... they have taken serious your complaint.

as I have suggested before  

track this ETH address (just in case scammer will use an exchange you can try to recover this sum)

scammer has used tether... it's a crypto with a TOS....

[aioc]

The phish occurred that morning of the 17th at 553am so they waited two days until there was a balance. Full responsibility for sure and I’m living w the consequences but the security was truly pathetic and I had been raising alarm bells to the owner for a month on deaf ears

Since it's posted here, they are going to pick it up, security really starts from ourselves be always mindful of what we are doing and what we are clicking, there are two things that you need to be fully aware of, the existence of phishing links and clipboard malware.
So always take your time Always think of security, it's a big amount of money for me it's hard for me to get over if I lose that amount, all we can say now is we learn from this and we'll be better, I'm sure you will be better when it comes to security.

[BitcoinGirl.Club]

Code:

The phishing site I ended up on is here https://stake.com-bonus.io/?action=login&modal=auth&error=fail  it's obviously pretty pathetic replica but it was 5am when i clicked and it did the trick.

Do you mind to remove the link or at least make is in between quote with a warning not to click it. Someone may click it and become a victim. I have no idea how the hacker knew you had such big amount in the account?

Here is one thing you can try [one of the user already suggested I guess], find out from where they bought the domain stake.com-bonus.io, contact the domain and hosting provider. They will have IP log and if you are lucky then they may have the hackers personal information too. Anything you find may help you.

Sorry to hear such big loss.