Someone Loan using My Account

[Peanutswar]

Good day!

Dear All,

This morning I saw a neutral tag given by Shashan related to a collateral loan I didn't commit. I know this reason can be skeptical to others. My mistake was that I overlooked a message sent to shashan during my inactive time.

This unknown user continuously makes a comment to Shashan's thread that I didn't notice because if someone messages me, most likely I open those immediately to check if there's a revision for the translations I made. But the user keeps deleting the conversation, which is the reason why too late to catch them up. Also, Gmail is not linked to my phone, so I didn't receive a notification about their conversation, and shashan showed this to me. My account password didn't change seems like I experienced a DOM Attack.

Quoted below is the address I'm only using in the forum.

Good day everyone I would like to update my wallet address

A better way to update your address is to sign the message containing the new address with your old address. Anybody who acquires your account could post a message saying that they are changing the address, but only the original owner can sign that post with the original address.

Without signing using the old address, here are the possibilities:

1. You are the original owner.
2. You are not the original owner, and you hacked the account.
3. You are not the original owner, and you bought the account.

Thanks for the information.

This is my old wallet address

Code:

-----BEGIN BITCOIN SIGNED MESSAGE-----
This is peanutswars, old wallet address bc1qh45r8qdp5zqf5cux77sq0k3gmjdljv4jdac0n0 and would like to add my new wallet address bc1qnrcpx4q970yhp5t0qqgu5svcu27982cpdd8xnl
-----BEGIN SIGNATURE-----
HwfgN/Z/80aAv1DRUsndg1yWcqi/3IOEOW22lMA2YQ3LdJLn5CNsJbwOVHY3knLRxwEL1ujUQgRN7fO1wW4YHt8=
-----END BITCOIN SIGNED MESSAGE-----

This is my new wallet address.

Code:

-----BEGIN BITCOIN SIGNED MESSAGE-----
This is peanutswar 11/20/22 new wallet address bc1qnrcpx4q970yhp5t0qqgu5svcu27982cpdd8xnl
-----BEGIN SIGNATURE-----
ILiYa+mSEiu7SB/crI/OujyjELPwJr6tno2mrqIcI0ImOEZvDNHx7EF4eyQwmXeN9WIxVJEN6376YpJp3p3EGp8=
-----END BITCOIN SIGNED MESSAGE-----

I will repay Shashan but not on the designated date given to the loan; every time I receive a payment in a Signature Campaign/another source of income, I will deposit this immediately to Shashan's Address as repayment for the trouble created by that hacker.


I created this thread to be aware that I will only use the quoted and signed address to prevent this from happening again. If someone receives a request not with this address, please don't entertain it. I changed all of the password related to this account.  After noticing this issue of that, there's someone can access my account.

[1714249848]

1714249848

[1714249848]

1714249848

[TryNinja]

Thanks for sharing. I admit lending money here multiple times without asking for a signed message, so it could have been me (and I would have have fulfilled your request if I saw it).

Even scarier that he could have managed to get multiple loans (i.e me and shasan; 1k each).

[Jawhead999]

That's really scary, did you click malicious link before? it would be better if you could attach the proof of how you can guess you're get DOM attack.

Well, it looks like the borrower need to sign a message with the address which has been posted in this forum before. Although there's a chance if the user using web wallet and it's installed in the same device, the hacker can regain access to the wallet too. But that's seems the last way to prove an ownership.

Sorry to hear that @OP and I respect with your promise to pay back your losses.

[jokers10]

Very sad story. I'm very sorry to read that.

I just added a line that I never take any loans to one of a blank lines in my profile. Of course an intruder can easily change this line as well, but if some others will remember that I don't take loans this will make it harder to take a loan from my name. At least some can ask why and what happened and it will take time.

If there was a universal option for everyone to declare that they never take any loans it'd be even better. But making a separate topic for that would be too complicated and I don't see any easy way for that.

Maybe asking a signed message from known addresses of a user by default will be a good decision for loan service.

[_act_]

It is good to always follow the proper procedure. If anyone wants to lend you money, you supposed to sign a message with a bitcoin address that you have used in the past. On the message, the date you want to collect the loan must be included.

I can not wait to see the 2FA authentication to login on this forum for an additional security.

[lovesmayfamilis]

It's pretty weird what happened. Could you describe in more detail what device you are using and how someone was able to hack into your account? Did you have a simple password? Is your mail intact? I think that the hacker who got into your account purposefully went to take out a loan. And maybe it could be someone from your environment, someone who knows you.
Have you seen the IP address change?
All these questions will help you and all other users understand what went wrong with your login to the forum.

[CryptoHFs]

Do you have any web wallet? This hacker couldn't hack them? I believe I saw DM problems here before but posting a lending comment is the most advanced part. Nothing to say but it seems like a couple of loans got stolen these couple of days.

[invincible49]

That wallet address has connection with this Tron address: TXtp6FhA3NXP2eZehTu3W1CptFjaMECDcJ which seems like an exchange address that is mostly used for depositing funds from various investors who then become the victim of Ponzi scam mostly by this person. It kind of feels like that exchange is a safe haven for scammers and frauds.


Reference:
https://www.hyiper.net/blog/421.html
https://invest-tracing.com/detail-FinssConLimited.html
https://scamwatcher.org/Finnscon-review/
https://www.forexpeacearmy.com/forex-reviews/5098/fbs-forex-brokers?per-page=15
https://graspgold.com/details/lid/80/

[Mahdirakib]

Here is the TRC20 USDT address which has been used to take the loan from shasan.

TRX Address: TReZah87Zxhfk7YZtYksQ2Z9fNiq7Z2PMB

shasan has accepted your loan request and sent the USDT to the above address. Then, you or the hacker has sent 999+ USDT to a different address in 3 transactions. The USDT was sent to this address

TRC20 - USDT address: TJjqnqEhWQ8oW9AUgQLwrtMCAxfbEwREeF

This address was posted by user mdgabrielzim whose loan request was declined by shasan one month ago. The user 'mdgabrielzim' had also deleted his post from the lending thread. I'm wondering what is the connection between the hacker and mdgabrielzim!

[Cantsay]

I think I have also seen a similar case although this one was spotted fast by the original owner before the loan was accepted.

Op it isn't a pleasant experience having to pay for money that you had no idea how it was spent and that has brought some curiosity to my mind to know how they were able to gain access to your account; like how often do you log in your account in a different device? Do you frequent those funny sites? like the ones that offer free downloads for apps or software meant to be paid for, Do you use mod apps? I just wanted to know if there's any activity you have done recently or in the past that could have resulted in those hackers getting access to your device, as it could help others avoid making such errors.

~~~

That is very interesting info, but we need also to keep in mind that it could be another hack unless otherwise confirmed...

I'm not sure if @mdgabrielzim uses a Telegram bot, but if he does, he should be aware of this thread. To be safe, I think sending him a PM would also be nice, just in case he doesn't use any notification tool.

[LoyceV]

@Peanutswar: Check https://bitcointalk.org/myips.php

Well, it looks like the borrower need to sign a message with the address which has been posted in this forum before.

The hacked borrower can't help that, if the lender doesn't ask for it.
I can only hope nobody would fall for this if someone ever manages to compromise my account. I've never taken a loan, and if I do, that should raise a big red flag (and there's only one exception).

If there was a universal option for everyone to declare that they never take any loans it'd be even better. But making a separate topic for that would be too complicated and I don't see any easy way for that.

I can give you neutral feedback if you want, with a link to your post. Something like:
"This user confirmed he never wants to take a loan. If his account asks for it, it's not him."
If anyone else wants such feedback: post your confirmation here and I'll add it once I see it. I assume my account will be on DT for many years to come

[CryptoHFs]

@Peanutswar: Check https://bitcointalk.org/myips.php

Well, it looks like the borrower need to sign a message with the address which has been posted in this forum before.

The hacked borrower can't help that, if the lender doesn't ask for it.
I can only hope nobody would fall for this if someone ever manages to compromise my account. I've never taken a loan, and if I do, that should raise a big red flag (and there's only one exception).

If there was a universal option for everyone to declare that they never take any loans it'd be even better. But making a separate topic for that would be too complicated and I don't see any easy way for that.

I can give you neutral feedback if you want, with a link to your post. Something like:
"This user confirmed he never wants to take a loan. If his account asks for it, it's not him."
If anyone else wants such feedback: post your confirmation here and I'll add it once I see it. I assume my account will be on DT for many years to come

Let's make the forum clean.. give me that tag!

[Peanutswar]

It's pretty weird what happened. Could you describe in more detail what device you are using and how someone was able to hack into your account? Did you have a simple password? Is your mail intact? I think that the hacker who got into your account purposefully went to take out a loan. And maybe it could be someone from your environment, someone who knows you.
Have you seen the IP address change?
All these questions will help you and all other users understand what went wrong with your login to the forum.

Before, there was a link sent to me for discord community management, the sender have a link makes a redirect link to other page and the message sent multiple times so i suspected immediately could be an attack, I immediately cleaned my PC for possible preventive attacks, I got confident by that time but my mistake too I didn't change my password, my email are on my PC but not in my device itself that notifies the information of my account, I mislook before that there's a change of wallet address in my profile, I thought I just paste my other address so I ignore this.

LoyceV recently give the IP addresses as I suspected the unknown user makes a move since he make a loan Date of 7-06-23.





Seems like this person lurking around first in the bitcointalk community and checking my activity before committing this trouble.

I think I have also seen a similar case although this one was spotted fast by the original owner before the loan was accepted.

Op it isn't a pleasant experience having to pay for money that you had no idea how it was spent and that has brought some curiosity to my mind to know how they were able to gain access to your account; like how often do you log in your account in a different device? Do you frequent those funny sites? like the ones that offer free downloads for apps or software meant to be paid for, Do you use mod apps? I just wanted to know if there's any activity you have done recently or in the past that could have resulted in those hackers getting access to your device, as it could help others avoid making such errors.

~~~

That is very interesting info, but we need also to keep in mind that it could be another hack unless otherwise confirmed...

I'm not sure if @mdgabrielzim uses a Telegram bot, but if he does, he should be aware of this thread. To be safe, I think sending him a PM would also be nice, just in case he doesn't use any notification tool.

Only every morning before i go to office i check the forum and message if there's any translations i need to revise, and also after going to work, I didn't use any mod apps i know the possible malware they can inject with those free software. At the end I don't want to ruin my reputation here even though its too painful to pay that amount.

[CryptoHFs]

It's pretty weird what happened. Could you describe in more detail what device you are using and how someone was able to hack into your account? Did you have a simple password? Is your mail intact? I think that the hacker who got into your account purposefully went to take out a loan. And maybe it could be someone from your environment, someone who knows you.
Have you seen the IP address change?
All these questions will help you and all other users understand what went wrong with your login to the forum.

Before, there was a link sent to me for discord community management, the sender have a link makes a redirect link to other page and the message sent multiple times so i suspected immediately could be an attack, I immediately cleaned my PC for possible preventive attacks, I got confident by that time but my mistake too I didn't change my password, my email are on my PC but not in my device itself that notifies the information of my account, I mislook before that there's a change of wallet address in my profile, I thought I just paste my other address so I ignore this.

LoyceV recently give the IP addresses as I suspected the unknown user makes a move since he make a loan Date of 7-06-23.

[

Seems like this person lurking around first in the bitcointalk community and checking my activity before committing this trouble.

I think I have also seen a similar case although this one was spotted fast by the original owner before the loan was accepted.

Op it isn't a pleasant experience having to pay for money that you had no idea how it was spent and that has brought some curiosity to my mind to know how they were able to gain access to your account; like how often do you log in your account in a different device? Do you frequent those funny sites? like the ones that offer free downloads for apps or software meant to be paid for, Do you use mod apps? I just wanted to know if there's any activity you have done recently or in the past that could have resulted in those hackers getting access to your device, as it could help others avoid making such errors.

~~~

That is very interesting info, but we need also to keep in mind that it could be another hack unless otherwise confirmed...

I'm not sure if @mdgabrielzim uses a Telegram bot, but if he does, he should be aware of this thread. To be safe, I think sending him a PM would also be nice, just in case he doesn't use any notification tool.

Only every morning before i go to office i check the forum and message if there's any translations i need to revise, and also after going to work, I didn't use any mod apps i know the possible malware they can inject with those free software. At the end I don't want to ruin my reputation here even though its too painful to pay that amount.

That's really sad. The discord link was clicked from phone or pc? Do you still have the link? Did it download anything or just redirects? Does that mean all bounty and community managers and signature campaign managers may post false loan requests by the time passing? As that hacker would have sent to all the possible targets.

[lovesmayfamilis]

I can give you neutral feedback if you want, with a link to your post. Something like:
"This user confirmed he never wants to take a loan. If his account asks for it, it's not him."
If anyone else wants such feedback: post your confirmation here and I'll add it once I see it. I assume my account will be on DT for many years to come

Yes, I want to ask you, LoyceV, to leave a neutral tag on my profile that I will never take loans on this forum.
Thank you.

[RickDeckard]

Before, there was a link sent to me for discord community management, the sender have a link makes a redirect link to other page and the message sent multiple times so i suspected immediately could be an attack, I immediately cleaned my PC for possible preventive attacks, I got confident by that time but my mistake too I didn't change my password, my email are on my PC but not in my device itself that notifies the information of my account, I mislook before that there's a change of wallet address in my profile, I thought I just paste my other address so I ignore this.

Was the password unique to bitcointalk or did you shared it with other places? I highly advice you to make a full format of your PC (I don't know how deep was your cleaning) and change immediately all the passwords to essential services that you have (banking, services, governmental websites, e-mail...). You don't know for how long did the hacker had access to your account (or PC?) so one can never be too careful. If you don't use it, password managers[1][2][3] are also a great addition to increase the security of your accounts (it isn't foolproof, the greatest anti virus is always between the ears ).
[1]https://psono.com/
[2]https://keepassxc.org/
[3]https://bitwarden.com/

[Jawhead999]

I can only hope nobody would fall for this if someone ever manages to compromise my account. I've never taken a loan, and if I do, that should raise a big red flag (and there's only one exception).

It seems a good idea and increase the real usage of neutral feedback rather than for criticism or conflict

I don't want to be mean, but you, me, or anyone could disappear in the future and the tag always remain in their accounts. I'm just thinking if someone decided to ask a loan when there's a neutral tag where the account will not ever ask any loan in this forum. Do you think if he can sign a message on his old address, the account is still controlled by the real owner?

LoyceV recently give the IP addresses as I suspected the unknown user makes a move since he make a loan Date of 7-06-23.

It's your real IP addresses in this forum? I think it's better for you to remove the images if you're consider about your privacy. But if you not care about your privacy, then you can refuse my suggestion.

[CryptoHFs]

@Peanutswar: Check https://bitcointalk.org/myips.php

Well, it looks like the borrower need to sign a message with the address which has been posted in this forum before.

The hacked borrower can't help that, if the lender doesn't ask for it.
I can only hope nobody would fall for this if someone ever manages to compromise my account. I've never taken a loan, and if I do, that should raise a big red flag (and there's only one exception).

If there was a universal option for everyone to declare that they never take any loans it'd be even better. But making a separate topic for that would be too complicated and I don't see any easy way for that.

I can give you neutral feedback if you want, with a link to your post. Something like:
"This user confirmed he never wants to take a loan. If his account asks for it, it's not him."
If anyone else wants such feedback: post your confirmation here and I'll add it once I see it. I assume my account will be on DT for many years to come

You can also add to that extension per user request
1- This user confirmed he never wants to take a loan without signing a message from the staked address.....
2- This user confirmed he never wants to take a loan without a collateral
To attract more people to enroll in that and arrange with lenders to force request this feedback first before someone requests a loan and if he choose num 1 should be an old address if he's adding a new one must disclose his ip log and use the account for a week before requesting a loan

[decodx]

I don't understand how something like this is even possible if the user's password is not compromised. I tried Googling about the DOM attack, but I couldn't find an explanation that I could understand given my current level of knowledge. Have there been previous cases similar to this? And how can we prevent and defend against these types of attacks?

[LoyceV]

I don't want to be mean, but you, me, or anyone could disappear in the future and the tag always remain in their accounts. I'm just thinking if someone decided to ask a loan when there's a neutral tag where the account will not ever ask any loan in this forum. Do you think if he can sign a message on his old address, the account is still controlled by the real owner?

That will be up to the lender. At least he'll see a warning telling him to be extra careful.

I've left 2 neutral "no loan" tags so far. If someone ever asks me to remove them, I'll require a signed message from an old staked address, and I'll probably wait for 30 days (a cooldown period).

I don't understand how something like this is even possible if the user's password is not compromised.

If the scammer changes the password, he gets noticed quickly. By not changing the password, the scammer can stay under the radar and impersonate the real account owner for a while. It has happened before.