Hacker moved coins from my wallet

[shasan]

Only what I noticed that you can click on is the Electrum URL for update, which was never like before but having the correct Electrum URL for update. Another thing that I know that can be clicked on is the blockchain explorer.

You can fall for the trap too if you are the type of person that do not take wallet safety and online security seriously. It is not about Electrum wallet, it is about carelessness. Anyone that can fall for the scam while using Electrum can also fall for the scam while using any other online wallet.

I think you are right but in the maximum case, we can see hacking of Electrum instead of any other wallet. In the case of Julerz many people thought julerz s lying to steal the fund of the campaign. But there is no way to think that about the OP. Actually, both fall on the hacking and no-one lying.

[1714546891]

1714546891

[1714546891]

1714546891

[BTCGalaxyA12]

I am sorry and saddened by the loss you have experienced.

Electrum is a pretty good bitcoin wallet from what I know that keeps me looking for it by reading every post related to electrum wallet.

A few days ago I signed/verified the address with electrum to prove ownership of the address and it was quoted and verified by @bitbollo

OP broke the news that broke me Today at 12:31:19 PM.
I came across a discussion about electrum wallet users 2FA Today at 11:53:20 AM.

There seems to be continuity.
I just want to follow for the sake of gaining new knowledge.

[andulolika]

If your private key was recoverable with security questions then you might have the answer.

Hi andulolika
you can recover private keys from electrum with security question?!
I've never heard of this possibility.
it's a "classic" wallet they shouldn't have this option since you don't set... but I could be wrong maybe I don't know this function ?!?

Hey there! .
It is possible if the private key was created in a different place and imported there.
I find it more likely that his device was compromised by untrustworthy apps which can very very easily leak into the pc such as a fake file or corrupted installer.

[coin-investor]

I am sorry and saddened by the loss you have experienced.

Electrum is a pretty good bitcoin wallet from what I know that keeps me looking for it by reading every post related to electrum wallet.

A few days ago I signed/verified the address with electrum to prove ownership of the address and it was quoted and verified by @bitbollo

OP broke the news that broke me Today at 12:31:19 PM.
I came across a discussion about electrum wallet users 2FA Today at 11:53:20 AM.

There seems to be continuity.
I just want to follow for the sake of gaining new knowledge.

I also verify and signed the wallet using Electrum and now checking articles and discussions about Electrum's security, this is not good if we have two reputable and I believe knowledgeable members getting hacked using the same wallet,
I hope Avirunes can give us more details about our security concerns, I'm using Malwarebytes too, and Kaspersky if this is not enough I guess the only option is to transfer to Linux for better security, this was highly recommended when Julerz Electrum wallet was hacked.

[BenCodie]

Only what I noticed that you can click on is the Electrum URL for update, which was never like before but having the correct Electrum URL for update. Another thing that I know that can be clicked on is the blockchain explorer.

You can fall for the trap too if you are the type of person that do not take wallet safety and online security seriously. It is not about Electrum wallet, it is about carelessness. Anyone that can fall for the scam while using Electrum can also fall for the scam while using any other online wallet.

I think you are right but in the maximum case, we can see hacking of Electrum instead of any other wallet. In the case of Julerz many people thought julerz s lying to steal the fund of the campaign. But there is no way to think that about the OP. Actually, both fall on the hacking and no-one lying.

It has nothing to do with Electrum itself, it has to do with a virus or malware that is capable of sweeping/sending coins from Electrum to an address the moment it is received or as andulolika clued, the virus/malware got the security phrase and the hacker was able to move the coins that way.

I am guessing the OP was using Windows and relied on nothing more than malware-bytes to protect him from online threats, contracted a form of virus/malware at some stage (as presumed Julerz did also) and the hacker was able to sweep/send the funds to their address.

This is yet another validation for the cybersecurity & privacy board to be implemented into the forum.

[Avirunes]

I will try to answer as much as questions as I can but right now since I don't have any particular answer I will say due to my carelessness it happened. I will be quick and direct as much as I can so pardon me for not explaining properly or to the point as needed.

Have you clicked on an update after logging in to the Electrum wallet?

It wasn't through any Electrum popup and I am aware about case where someone installed a hacker version of Electrum. I actually updated the Electrum wallet some time ago. Maybe like 2-3 months from the site after verifying gpg signatures.

I just want to inquire that you saved this phrase cloudly online anywhere.

No, it wasn't.

It's the first time you get hacked ? Other funds on other addresses from your wallets are still here or some other have been theft too? Did you check your logs from Electrum to see if your funds have been stolen through Electrum on your computer? Because if you haven't exposed your seed anywhere else, I wonder how the attacker has been able to hack your funds, if it's not from Electrum directly ? It would be a really bad news because it would mean that Electrum is currently not safe anymore.

a) Yes, its my first time getting hacked like this.
b) There were other addresses but they didn't had any transactions.
c) I don't think it was Electrum actually because I have been using Electrum for long time and before installing, I confirm its from original source. The question is why now?

I highly suspect something running in the background. But I've autorun software to check if there is something malicious in registry which has been set to autorun and I check it too and I check the processes running in background regularly as well.

Do you accidentally allow something which malwarebytes blocked?

No if my memory serves me right. I usually read the alerts by antivirus, antimalware programs and I always choose quarantine/remove option , allow is not even a chance.

What do you mean "only one in the wallet"?  Did you create the wallet with an imported private key?  So, you don't have a seed phrase?

This will serve as an answer to anduloika and you as well: The wallet address was created by VanitySearch and I trust this software but as a precaution I use it for only small amounts. Since its been so long , I started trusting for more balance. There were other addresses as well which also was created by VanitySearch as I like to generate some cool addresses and use it but none of them had any balance in it or were used in the forum except the one I use.

so @anduloika it wasn't a private key with recoverable security questions.

Can you give us more detail, please?  Windows version, Electrum version before the re-install, any other software you may have downloaded in the recent months?

Yes, it was a Windows version. I am not sure of Electrum version but I recall something like 4.3.3  something. Software I could have but they were usual like Chrome and Winrar and stuff. Just the things I need. All were downloaded from original sources.

I don't use any malware software other than what's included in Win11, and to be honest I don't know how effective any of them really are.  It seems like they can only work once the malware is identified by the developer, and added to the software's blacklist.

Yes, it is only added once some has been affected by it. By the time its added, they already have got their initial victims. I am not saying it happened to me or maybe it did but the purpose is to let others aware of problems like this.


I don't think Electrum is the case actually as I've been using it for more than 2-3 years in this lappie and over this course of years bc1qwerty0uuuee9t3jf5tvr0952a099p67qama7k3.... address has received many signature campaign earnings and later on there were times when there was more funds than that. So why now?

I've also come to conclusion right now that it was probably some script running in background whenever I open Electrum and it probably sends private keys of all the addresses in the wallet and then have a system of some sorts which sweeps all the balances when the addresses receives some balances. <--as some of you guys have mentioned here

As for Malwarebytes, I am bit surprised that it didn't alerted something running in background whenever I opened Electrum. I am bit paranoid about scripts running in background or autostartup so I had softwares to check those as well and delete/remove those things as well.


What I am not sure of is that entry point of this script/malware or whatever. I also seriously don't recall anything suspicious being downloaded. I've already made a fresh install of the Windows on my laptop after clearing everything in every partition my laptop has including the partition in MB size having some boot records so I can't go back and check those things about what happened for clear.

At the end, I can only say always be wary of these things. Anti-viruses/anti-malware also sometimes might not protect you all the time.

About hardware wallet, I still have a Ledger Nano which I have used in the past to hold big balances but right now I don't use it. So yeah I have the policy of big balances to hardware wallets but there are cases where I need to move coins fast I tend to loose up a little and move into wallets that I have in my easily accessible devices.


Thank you everyone for answering here and discussing with ideas on what could have happened.

[LoyceV]

Wow even if I wouldn't call that a massive attack for now, it starts to scare me a little bit to be honest. Unlike what some people are saying above, Electrum could be not so safe to use anymore if those testimonies are true. So what could we do now ? Only using it as a cold wallet? But how we will make Lightning Network transactions now?

Hot wallets have never been 100% safe, no matter which one you use. Microsoft Windows has never been safe either, and most computer users make mistakes once in a while. Any substantial funds should indeed be kept in cold wallets.

Do you accidentally allow something which malwarebytes blocked?

No if my memory serves me right. I usually read the alerts by antivirus, antimalware programs and I always choose quarantine/remove option , allow is not even a chance.

I haven't use Windows in a long time, so I have to ask: is this "normal"? I would expect to use antivirus software as an absolute last resort, and wipe the system the moment it finds something. You make it sound as if it finds and quarantines malware on a regular basis.

[BenCodie]

-snip-

All it takes is to connect to a suspicious website to become vulnerable on windows. Read into Reverse shell attacks. They target by the thousands, and do not require downloading files or inbound connections to take advantage of your system. All it takes is for you to connect to a predatory website, as it thrives on your systems outbound connection to a predatory server/website. To be clear about how easy it is to be reverse shelled, all software (even what you least expect) conducts outbound connections and every website you connect to has at least one outbound connection (usually between 3 and 10, depending on how many resources are required to load the page). This attack is commonly aimed toward Windows since it's the most common operating system, where attackers can build easily and gain the most. Switch to Linux as soon as you can.

I'm not saying this is what you have suffered from however it is possible considering you don't recall directly downloading anything suspicious or recall anything that you may have obviously done to become vulnerable.

[Avirunes]

You make it sound as if it finds and quarantines malware on a regular basis.

It was in past and not on this device but basically I was referring to first action that I took back then as my usual action there^^. In this device, I didn't had any alerts from the antimalware program.

-snip-

Interesting, I wasn't aware about that. I will give it a good read later and maybe you can give me link to a thread where these things can be properly discussed there.

Switch to Linux as soon as you can.

Regarding this, I am using Linux inside virtual software like VMware and so for operating wallets. What do you guys think about this? or there is still some vulnerability?

[BenCodie]

You make it sound as if it finds and quarantines malware on a regular basis.

It was in past and not on this device but basically I was referring to first action that I took back then as my usual action there^^. In this device, I didn't had any alerts from the antimalware program.

-snip-

Interesting, I wasn't aware about that. I will give it a good read later and maybe you can give me link to a thread where these things can be properly discussed there.

Unfortunately, there is no place to discuss these things right now. Around 3 months ago I made a request for a cybersecurity and privacy board, where discussion can at least go well-documented and all discussion added to that board would serve as a good knowledge resource, however it has not yet been addressed. For now people are just having their questions answered when asked or people are adding to topics after it's already too late

[BitcoinGirl.Club]

he wallet address was created by VanitySearch

This is where it was compromised. In fact any hot wallet can not be trusted.

Amount Scammed: 0.015 BTC

Thankfully it was not a fortune. Sorry for your loss brother.

P.S: I hope the large amount which you consider as your asset are safe in a multi sig wallet or hardware wallet. If it's not yet then your first priority will be to send them to a safe wallet.

[BenCodie]

he wallet address was created by VanitySearch

This is where it was compromised. In fact any hot wallet can not be trusted.

If Avirunes was using the open source VanitySearch by JeanLucPons then there is no reason why this would be the culprit, because it is software that you run locally and thus Avirunes should be the only one in control of the keys, you're not trusting someone else/another party with the keys as well. Technically, it should not be possible for VanitySearch to be the cause. Lets say that it was though, I am sure that the VanitySearch announcement thread would be flooded with similar complaints.

[LoyceV]

Regarding this, I am using Linux inside virtual software like VMware and so for operating wallets. What do you guys think about this? or there is still some vulnerability?

Your guest OS is only as secure as your host OS. It's better to do it the other way around: on a trusted OS, use a VM to run untrusted software without risking your host OS.

[T3PR00T]

Regarding this, I am using Linux inside virtual software like VMware and so for operating wallets. What do you guys think about this? or there is still some vulnerability?

Your guest OS is only as secure as your host OS. It's better to do it the other way around: on a trusted OS, use a VM to run untrusted software without risking your host OS.

Sorry it's off-topic.
I hear a lot about VM. How to have one and how much it costs. I will appreciate a link or article about it.

Thank you.

[Lucius]

As for Malwarebytes, I am bit surprised that it didn't alerted something running in background whenever I opened Electrum. I am bit paranoid about scripts running in background or autostartup so I had softwares to check those as well and delete/remove those things as well.

I assume you have the Premium version? Even then, you cannot be sure that it will detect every malicious software or attempt to compromise your operating system. When you look at the fact that hackers break into highly sophisticated systems and steal information, it should not be surprising that they bypass some trivial protections compared to such systems.

About hardware wallet, I still have a Ledger Nano which I have used in the past to hold big balances but right now I don't use it. So yeah I have the policy of big balances to hardware wallets but there are cases where I need to move coins fast I tend to loose up a little and move into wallets that I have in my easily accessible devices.

It's a shame that you stopped using the device that would have most likely protected you from what happened to you, but people learn best from their own mistakes. Surely you know that you can have multiple wallets on HW and protect each of them individually with a passphrase, so you can separate something that you keep long-term from what you will use in some way as a hot wallet.

[NotATether]

What do you mean "only one in the wallet"?  Did you create the wallet with an imported private key?  So, you don't have a seed phrase?

This will serve as an answer to anduloika and you as well: The wallet address was created by VanitySearch and I trust this software but as a precaution I use it for only small amounts. Since its been so long , I started trusting for more balance. There were other addresses as well which also was created by VanitySearch as I like to generate some cool addresses and use it but none of them had any balance in it or were used in the forum except the one I use.

so @anduloika it wasn't a private key with recoverable security questions.

Bingo.

I'm not saying VanitySearch is stealing private keys from you, but being a cracking tool, it is designed for speed, so there's absolutely no security in mind. It doesn't try to scrub memory regions with private keys or anything.

That means if you used VanitySearch while connected to the internet or while there was a malware running, the private keys could've been captured that way, and it doesn't help that they usually don't provide checksums.

Also you have to be very careful where you download this kind of software from, these programs are the targets of malicious counterfeits that have backdoors in them for capturing the keys.

And PS. Antivirus software generally considers any software that deals with a "private key" to be a malware, so it would've went straight through it in that case.

[LoyceV]

I hear a lot about VM. How to have one and how much it costs. I will appreciate a link or article about it.

I use VirtualBox. It's free. Install it, and install your own OS inside or download an image.

[lovesmayfamilis]

OP, electrum recently posted a new version of the product; if you are talking about two or three months, then your version was not fresh. I'm always paranoid about updates and try to keep everything fresh.
In the same way, it is now important for you to find out, so as not to repeat what happened, if your Windows is really licensed with the latest updates. Winrar software is always recognized as very dangerous, as password-protected viruses are often put into it. In addition, the hacker can create a server for RDP remote access and hide it so that it is not detected in autoload and in the task manager. There are detailed instructions on the forums; the victim only needs to click on the link sent to hide the file and start surveillance.
In addition, if I understand correctly, on April 30, the hacker stole not only the OP but several other transfers worth more than $2,000. Please correct me.

[Avirunes]

Unfortunately, there is no place to discuss these things right now. Around 3 months ago I made a request for a cybersecurity and privacy board, where discussion can at least go well-documented and all discussion added to that board would serve as a good knowledge resource, however it has not yet been addressed. For now people are just having their questions answered when asked or people are adding to topics after it's already too late

I would also love to see that happen. My post would be kind of similar to what julerz wrote but there really should be board properly dedicated to this.

Your guest OS is only as secure as your host OS. It's better to do it the other way around: on a trusted OS, use a VM to run untrusted software without risking your host OS.

Yeah good point [+1]. I will set up a VM like this and work accordingly. Thanks really for pointing it out.

I assume you have the Premium version? Even then, you cannot be sure that it will detect every malicious software or attempt to compromise your operating system. When you look at the fact that hackers break into highly sophisticated systems and steal information, it should not be surprising that they bypass some trivial protections compared to such systems.

It's a shame that you stopped using the device that would have most likely protected you from what happened to you, but people learn best from their own mistakes. Surely you know that you can have multiple wallets on HW and protect each of them individually with a passphrase, so you can separate something that you keep long-term from what you will use in some way as a hot wallet.

Yeah lessons learned with some price but now I need to see what would be the best way to setup my system and my way of working around these things. I now really wished that I would have come down to my senses for once and would have used my hardware wallet but being casual along the way you just start to follow things like you have been doing and only come down to sense once the harm has been done.

In addition, if I understand correctly, on April 30, the hacker stole not only the OP but several other transfers worth more than $2,000. Please correct me.

It could be anything: It could be like as you said or if the hacker swept the wallet directly to exchange then its exchange sweeping the deposit address to another address of their own.


About the VanitySearch, I don't think its the reason but I am not gonna use it anymore. I have generated bc1qwerty address years ago and have been using it for long time. What @BenCodie said is also right , and @NotTether is also right but that will make it a different case as I was the one careless in the end for getting my device infected with malware.

[shasan]

I'm not saying VanitySearch is stealing private keys from you, but being a cracking tool, it is designed for speed, so there's absolutely no security in mind. It doesn't try to scrub memory regions with private keys or anything.

Though based on the post of the Op it seems that vanity search has not leaked or not stolen the fund. But I have still doubts about that. I think it might have happened to them. Someone or some site might not steal anything that doesn't mean they will not. In the same way, the same thing might not be happened by Vanitysearch but it may happen/happen this time.