Thought one of my online wallets was hacked and robbed

[grumpygit]

Actually there is still a good chance that it  has been and I have lost a few £1000, at least that is what I have 100% thought for the last 4 days and now I have a little hope and it's a weird one

But just for starters and I know someone will give me stick here as I partly use a blockchain.com among others and I have spread my risk around, I am not very clued up on crypto and just HODL and leave my wallets alone apart from a little trading on Binance.

Last week I had a text from blockchain notifying me that my 2fa security had been removed around 1 am in the morning while I slept and I saw it at 7am, I went straight onto my blockchain.com wallet but the first thing I wondered was how could someone remove my 2fa security when they first needed 2fa to get into the wallet to then remove it, I tried to explain that to Blockchain.com.

But anyway I could see my wallet was empty and thought shit, I then could see 6 transaction were sent early in the morning  and it wasn't me so I have basically just thought lesson learnt. And just for the record I am super security conscious and there is no chance that I would tell anyone anything about seeds, passwords or wallet ID. But there was just this one case way back in 2021 where loads of us could not access our wallets and customer service was totally crap so what I was a advised was open another wallet and use my seed phrases. I used Electrum as they had a good name but found it difficult to use and could not get my head around it so just gave up in the end and trusted it to God and thankfully it all got sorted out and I just left the wallet for years and left some funds in it and just checked once in a while.

So I have had the Electrum account set up for years and never looked at it since and for the first time opened it up today grasping at straws and what did I see but 6 events only in my history all happening on the same day and within an hour of all my transactions in Blockchain.com, coincidence or connected but how?
I am still sure if it is my Btc and Eth there because all the jargon makes no sense and in all my years I have never sent Btc wallet to wallet, like I said I just mostly HODL.

But there is also one other thing, when I checked my blockchain wallet a few times this last few days it was left with only £29 and I thought why have the thieving shits done that, but a few days later it went to £43 and today it is £65, I cannot work any of this out.

But for the last 4 days the only thought in my head was how could this be hacked, there are 4 stages to the security and it just did not make sense.

[Broadanbig]

Sorry about your hack mate but I am just curious how they could scale through four stages of your wallet security to do away with your assets. This is worrisome mate, If I am not mistaken, you talked about using  Electrum wallet and of lately, there has been series of hack in this same wallet possible their must be some breach somewhere. As at last month a high ranked member here suffered a hack too and funds meant for campaign all stolen. No wallet is safe but it takes extra measures to properly keep your funds safe in your own wallet. Keep your pass phrase safe and secured where only you have access to. If i may ask did you update your wallet to the current version? If no then I will recommend you do that for your next wallet so as not to loose your funds.but I am still curious about your case.

[stompix]

I used Electrum as they had a good name but found it difficult to use and could not get my head around it so just gave up in the end and trusted it to God and thankfully it all got sorted out and I just left the wallet for years and left some funds in it and just checked once in a while.sense.

What was so difficult to use in Electrum?
It's a simple wallet, you have your addresses and your balance, you type the address and the amount you want to send and that's it!
I understand importing addresses and seeds would be more complicated for the new user but overall I don't see how it's harder to use that and think of a web-based wallet.

So I have had the Electrum account set up for years and never looked at it since and for the first time opened it up today grasping at straws and what did I see but 6 events only in my history all happening on the same day and within an hour of all my transactions in Blockchain.com, coincidence or connected but how?

Did you import your seed from blockchain into electrum?
If it's the same wallet of course it will show the same transactions.

But there is also one other thing, when I checked my blockchain wallet a few times this last few days it was left with only £29 and I thought why have the thieving shits done that, but a few days later it went to £43 and today it is £65, I cannot work any of this out.

Do you have any other coins in your wallet?
Since the value is shown in £ it might just be that you have some coins that have gained 200% in the last few days.

[Crypt0Gore]

It's a shame you don't know the difference  between custodial wallet and non custodial wallet, this is why you belittle Electrum wallet, if the Electrum wallet is what you have been using there is a probability of having your asset intact right now. You took things into your hand that's why you lose your assets, blockchain dot com sucks to the core, I have used it in the past and it's easier to get hacked, anyway.

Electrum wallet is fully open source, and it gives you your keys 🔑, all you have to do is keep the recovery seeds safe.

[Frankolala]

You are a newbie and I won't blame your carelessness of using a centralized system to safe your coins. I guess maybe,you must have imported your seed phrase of your blockchain wallet to your wallet. Laziness is what has caused your lost because spectrum wallet is very easy to understand and use.

Online wallets are not safe due to their vulnerability to attacks,you have learnt a hard lesson and I feel for your lost. You use learn how to use electrum wallet to keep your investment  safe, try and learn more on the forum,to broaden your knowledge. Not your keys,not your bitcoin.

[jossiel]

Keep track on what you did for the past years if you can that relates to these wallet of yours. It's likely that you've been phished and you've entered a fake website where it has required you to do some verification requiring your seeds. Is it only you that know these wallets and not one in your family or relatives where possibly you've mentioned about owning them or entrusting them your seeds?

Electrum was actually one of the best and I don't know why you found it difficult to use. I have also used blockchain.com when it was still .info but after knowing the difference of custodial and non-custodial through the efforts of other forum members, I've started using the right ones.

[grumpygit]

You are a newbie and I won't blame your carelessness of using a centralized system to safe your coins. I guess maybe,you must have imported your seed phrase of your blockchain wallet to your wallet. Laziness is what has caused your lost because spectrum wallet is very easy to understand and use.

Online wallets are not safe due to their vulnerability to attacks,you have learnt a hard lesson and I feel for your lost. You use learn how to use electrum wallet to keep your investment  safe, try and learn more on the forum,to broaden your knowledge. Not your keys,not your bitcoin.

In all probability it is something I have done, the only thing is I cannot work out what I have done wrong.

In 2021 I could not get access to my bitcoin in Blockchain so I  opened a spectrum account/wallet and tried to import my bitcoin to spectrum which never worked at the time and I tried to use my seed phrase to do this.

I am not sure what I have done wrong here and the only place that my seed phrase was exposed to was my spectrum wallet which at the time I thought I must have been doing wrong, it's only now two years later something seems to have happened, maybe my bitcoin is in spectrum?, all I know is that something happened in spectrum on Friday six times where nothing at all has happened in two years and that is the same night my bitcoin left blockchain.

I am probably wrong here as usual but my seed phrase being in my spectrum wallet I cannot see how that is a problem, from what I have heard it is safer, that is the only time ever I tried to use it.

[Cantsay]

Could you at least provide the address of the wallet that you're referring to? At least that could help us understand more of what you're trying to explain in Op

We have so many wallets out there that have good reviews but still yet you chose to use blockchain.com, I once created an account back then in blockchain.com but had to abandon it due to some red flag I saw and migrated to Electrum.

But there is also one other thing, when I checked my blockchain wallet a few times this last few days it was left with only £29 and I thought why have the thieving shits done that, but a few days later it went to £43 and today it is £65, I cannot work any of this out.

The only thing I can think that could possibly have caused this is that maybe the price of some of your coin rose to some certain amount and that lead to your wallet balance increasing.

[tjtonmoy]

I am probably wrong here as usual but my seed phrase being in my spectrum wallet I cannot see how that is a problem, from what I have heard it is safer, that is the only time ever I tried to use it.

It is only safe when you can use it in a safe way. Everything on the internet in vulnerable. So if you choose to keep your assets safe, keep them in personal hardware wallet. The way you expressed your story, I think given the reputation of what blockchain.com have, it is more likely the hacker got the access to your wallet from that. And they can get your seed if they have access over your wallet. No big deal. I am not defending electrum, as it is an online wallet, it could get hacked too.
Lesson learned. Now I think you know what to do and how to keep your assets safe.

[pixie85]

In all probability it is something I have done, the only thing is I cannot work out what I have done wrong.

In 2021 I could not get access to my bitcoin in Blockchain so I  opened a spectrum account/wallet and tried to import my bitcoin to spectrum which never worked at the time and I tried to use my seed phrase to do this.

I am not sure what I have done wrong here and the only place that my seed phrase was exposed to was my spectrum wallet which at the time I thought I must have been doing wrong, it's only now two years later something seems to have happened, maybe my bitcoin is in spectrum?, all I know is that something happened in spectrum on Friday six times where nothing at all has happened in two years and that is the same night my bitcoin left blockchain.

I am probably wrong here as usual but my seed phrase being in my spectrum wallet I cannot see how that is a problem, from what I have heard it is safer, that is the only time ever I tried to use it.

It's possible the copy of that wallet was infected with malware.

It's possible you have other malware, unrelated to bitcoin and bitcoin wallet, like a keylogger trojan.

I've never used a "spectrum walet". Do you mean that DEX exchange https://spectrum.fi ?

I'll be honest with you. Online wallets and exchanges aren't a good way to hold coins. You should at the very least have an Electrum wallet for that and learning to use it would be worth every minute spent on it.

[lovesmayfamilis]

It's clear that the OP is an inexperienced user and had or still has a virus on his computer that grants full access. OP, what system are you using, are you the only user of your computer? In fact, the whole history of the OP is so vague that there are literally errors at every turn. OP, you are talking about ETH, in which wallet did you store it, since it simply cannot be in Electrum.

[bettercrypto]

According to your story, my friend, it's obvious that a hacker got into your blockchain.com account, that's because your 2FA is disabled on this platform, that's why you should be surprised. And you don't seem to be aware of this matter because you don't know. There is a lack of experience here in the crypto industry.

           And you're right, this is a lesson learned from you, my friend, and you did the right thing now that you're using Electrum, as long as you always update electrum when you see my new version because if you don't update it, the electrum wallet can be compromised when the hacker sees or peeks at it.

[noorman0]

-snip-
Last week I had a text from blockchain notifying me that my 2fa security had been removed

Maybe you forgot that you also received a 2fa reset request before this notification? A thief can easily remove 2fa if he has access to your email.

-snip-
I am not sure what I have done wrong here and the only place that my seed phrase was exposed to was my spectrum wallet which at the time I thought I must have been doing wrong,

Last I remember, opening a blockchain wallet requires a registered wallet ID or email. So if you don't think you've ever exposed the seed phrase, then what about email?

[grumpygit]

Look, lets start from scratch in a clear set of sequences as to what happened to me but because as helpful as so many people are many just do not read opening posts and just blurt out anything that is not relevant to my question, and bare in mind as clear as I have made it that it is probably something dumb that I have done, hands up. But I am still  eager to know and as a learning curve want to know where it was that I was compromised.

This is it more clearly.

1. Opened a blockchain wallet in 2018

2. fine for 3 years and then in 2021 many blockchain users were shut out of their wallets for a few months, some(including myself) were advised to import to a better wallet using the seed phrase and I created a spectrum wallet to do that.

3. I attempted to do this on my new spectrum wallet and this would of been my first ever use of it, I was struggling with it so left it a few days and in the mean time Blockchain.com fixed their issues(sever problem is I remember correctly) and problem was solved.

4.  So I now had a spectrum wallet and no use for it though I still kept it on hand and password etc hidden way, it sat there unused and not touched until yesterday(2 years), we will come onto that in a minute.

5.last Friday I had a text from blockchain 2fa had been turned off(though could not of been me)  5 minutes later and first time in a month or two I checked blockchain wallet to see that it had been robbed(probably)

6. Since last Friday all I have really wanted to do was know from what area/angle or source they had got to me with no thought of spectrum, as far as I was concerned it was a f*** up by me or blockchain but for the life of me I cannot see how anyone got through the blockchain security that was well hidden away and protected.

7. Still unclear how and what happened and I can see the record in blockchain of my crypto leaving my wallet in six stages at 1 am on the 17th Feb, I just thought I would check my spectrum wallet for the first time in two years and went to history and the only events in all that time that happened were the day I  created a spectrum wallet in early 2021 and six events that happen(precisely the same time as my blockchain departing) at 1 am on the 17th Feb, odds are that this is nearly an impossible coincidence.

8. So for the record I have never had any crypto in my spectrum wallet and it has only been looked  a couple of times in 2 years in the early days it was created. The 6 events that make no sense to me are not wallets or sums of Btc, they make no sense at all to me and are just numbers, but they are events that happened that I am sure are connected somehow.
Yes someone could have somehow got my seed phrases but all the information would have been on blockchain.com(which it is) and spectrum does not even come into the equation as it should not even be relevant.

[rby]

Look, lets start from scratch in a clear set of sequences as to what happened to me but because as helpful as so many people are many just do not read opening posts and just blurt out anything that is not relevant to my question, and bare in mind as clear as I have made it that it is probably something dumb that I have done, hands up. But I am still  eager to know and as a learning curve want to know where it was that I was compromised.

You explained yourself very well but don't be surprised at unrelated responses because many people do not read posts, especially when it appears to be somewhat long. What they do is to base their response from the response of the last person that commented on the post.
Where I am confused is how 2fa verification was cancelled even before logging in. Because it will require 2fa verification to login.
I am not sure you use your laptop/phone only you. What happens is a sign that someone gained an ample access to your wallet.
For the remnant moving from £23 to £43 and £65. Could that not be volatility? I am surprised that the market has not moved to make such a huge profit

[philipma1957]

yeah blockchain.com is a c- rating at best


without an address we can't see what happened.

so give a viable address that the coins were in.


they are gone so the address has no meaning.


very likely there is a key logger on your pc.


lastly buy a trezor from trezor.io

it is a good hardware wallet.

[Potato Chips]

Also don't think op's seed was exposed/or it came from electrum because there would be no need for the hacker to disable blockchain.com's 2fa... As pointed above, it's pretty easy if you have access to the email account: you just need to approve the email request and your 2fa is gone. I think you can try to request account logs to blockchain.com, it's likely that they deleted corresponding emails.

Whatever the case, you should drop blockchain.com. Even for small amounts, there are better ones out there.

[grumpygit]

Look, lets start from scratch in a clear set of sequences as to what happened to me but because as helpful as so many people are many just do not read opening posts and just blurt out anything that is not relevant to my question, and bare in mind as clear as I have made it that it is probably something dumb that I have done, hands up. But I am still  eager to know and as a learning curve want to know where it was that I was compromised.

You explained yourself very well but don't be surprised at unrelated responses because many people do not read posts, especially when it appears to be somewhat long. What they do is to base their response from the response of the last person that commented on the post.
Where I am confused is how 2fa verification was cancelled even before logging in. Because it will require 2fa verification to login.
I am not sure you use your laptop/phone only you. What happens is a sign that someone gained an ample access to your wallet.
For the remnant moving from £23 to £43 and £65. Could that not be volatility? I am surprised that the market has not moved to make such a huge profit

For the first 4 days that was the biggest one with me and maybe still is as to how my 2fa could be switched off, they would first need to get around my 2fa to switch 2fa off if you get my meaning.

The reason I mentioned the £23, £46 and £65 sums is that it could have been a sign that blockchain.com's software had screwed up.

But I have to admit now the biggest clue is the Electrum thing, only 6 items logged in it's entire 2 year history and they happened within minutes of my money vanish in blockchain, but what is the connection, nobody can give me an answer

[hosseinimr93]

Are you sure the email was sent from blockchain.com? Are you sure the fund was stolen before opening the email? Maybe, that was a phishing email. (This is just a guess)
How did you login to your blockchain.com account after seeing that email? Did you go to blockchain.com as before or you clicked on a link sent via email?

[Lucius]

For the first 4 days that was the biggest one with me and maybe still is as to how my 2fa could be switched off, they would first need to get around my 2fa to switch 2fa off if you get my meaning.

If you search a bit online you will very easily find a lot of information on how to hack/bypass 2FA, so although I'm not claiming that it happened to you, you have to admit that someone managed to find a way to disable your 2FA protection - here's an example of how it can be done, and keep in mind that the article is from 2018.

The reason I mentioned the £23, £46 and £65 sums is that it could have been a sign that blockchain.com's software had screwed up.

Very easily possible, because I also used that service in the past and I encountered all kinds of situations, even with incorrect balances.

But I have to admit now the biggest clue is the Electrum thing, only 6 items logged in it's entire 2 year history and they happened within minutes of my money vanish in blockchain, but what is the connection, nobody can give me an answer

From your introductory post, we can conclude that you had certain problems with blockchain.com around 2021 and then you decided to install Electrum - and then I assume you used the option to enter your seed from blockchain (or maybe you just import your BTC addresses and created a watch-only wallet)  - do you remember if you did that? This would explain the fact that you see identical outgoing transactions in Electrum and blockchain.com - because they both share the same seed, that is, the same addresses/private keys.

If what I wrote is correct, then the only question is whether you left that seed unprotected in any form and someone managed to get hold of it - or are you a victim of some other exploit that exists on blockchain.com.

It probably has nothing to do with your case - but it reminded me of something from the past -> Blockchain.com scam - lost funds