Someone Loan using My Account

[JeromeTash]

Thanks for sharing. I admit lending money here multiple times without asking for a signed message, so it could have been me (and I would have have fulfilled your request if I saw it).

I guess requesting a signed message from an old staked address should be part of procedure from now on. These streets are really so slippery  


Sorry about terrible ordeal OP and Shashan

[1714614102]

1714614102

[1714614102]

1714614102

[1714614102]

1714614102

[1714614102]

1714614102

[decodx]

I don't understand how something like this is even possible if the user's password is not compromised.

If the scammer changes the password, he gets noticed quickly. By not changing the password, the scammer can stay under the radar and impersonate the real account owner for a while. It has happened before.

That makes sense, but I'm still having trouble understanding what exactly happened here. How did the scammer get into OP's account if he didn't have his password?
I noticed that Peanutswar mentioned receiving a link for Discord community management. Is it really possible for someone to gain access to your bitcointalk account just by clicking on such a link? Sorry if this sounds like a silly question, but I'm genuinely curious to learn about the countermeasures against this type of attack.


Peanutswar, could you please provide more details? When did you first realize that your account had been compromised? Have you noticed any suspicious activity on your system? Also, could you elaborate on the links you mentioned?

[DireWolfM14]

Maybe asking a signed message from known addresses of a user by default will be a good decision for loan service.

This is what I was thinking.  I see shasan often giving loans without requesting a signed message, and I think it adds undue risk.  If for whatever reason the borrower doesn't have the ability to sign a message, at the very least check to see if the funding address has been posted by the borrower on the forum in the past.

[Little Mouse]

I noticed that Peanutswar mentioned receiving a link for Discord community management. Is it really possible for someone to gain access to your bitcointalk account just by clicking on such a link? Sorry if this sounds like a silly question, but I'm genuinely curious to learn about the countermeasures against this type of attack.

There was another such case happened here, I can't remember who was it. Will try to find it out.
I'm not an expert in such cases though I didn't the guy who claimed this few months back. However, I heard such a case recently where hacker got access of facebook account just because the victim clicked on a link. It was not a phishing password steal method. There was a group who recently got arrested in Bangladesh. They used to access facebook account by this trick and blackmail many people by collecting their private data.

[Igebotz]

Maybe asking a signed message from known addresses of a user by default will be a good decision for loan service.

This is what I was thinking.  I see shasan often giving loans without requesting a signed message, and I think it adds undue risk.  If for whatever reason the borrower doesn't have the ability to sign a message, at the very least check to see if the funding address has been posted by the borrower on the forum in the past.

Until one gets scammed, he would never believe scam exist, and sometimes we build blind trust based on past transactions. Op will know the usefulness of linking his forum account to his regular email and the lender will also learn how to secure his deals.

I've never received a loan from Shahan, but if he's giving out loans based on reputation and active signature participants without additional checks, he has to add another layer of security to his loan business to avoid this from happening again.

[SamReomo]

I noticed that Peanutswar mentioned receiving a link for Discord community management. Is it really possible for someone to gain access to your bitcointalk account just by clicking on such a link? Sorry if this sounds like a silly question, but I'm genuinely curious to learn about the countermeasures against this type of attack.

There was another such case happened here, I can't remember who was it. Will try to find it out.
I'm not an expert in such cases though I didn't the guy who claimed this few months back. However, I heard such a case recently where hacker got access of facebook account just because the victim clicked on a link. It was not a phishing password steal method. There was a group who recently got arrested in Bangladesh. They used to access facebook account by this trick and blackmail many people by collecting their private data.

If I'm not wrong then the method is called as "session hijacking" or "session cookie theft." In such type of attacks the hacker often send you a malicious link, and when a users clicks on the link then the hacker take advantage of the vulnerabilities of the browser that the user is using to access the link. The hacker then steal the session cookies of the user and then use that cookie on his/her browser with the help of extensions like cookie editor. Such type of attacks are often planned by the hackers who have access to some hidden vulnerabilities of the browsers that no-one knows yet. Those hackers can steal session cookies of any website they want, and that way they hack the access of the users.

I'm quite sure that the same thing happened with @Peanutswar when he clicked on that malicious link without even thinking about such exploits. The hacker knew that the user would click on the link, and he would be able to steal the cookies one the user will click the link. It's better to be aware of such type of hacks because they can easily hack someone's account and ask for loans that the user isn't asking for. It's our responsivity to protect ourselves from such type of hacking attacks, and we should never click on the links sent by a unknown user. That way we will be able to protect ourselves from such kind of hacks.

[Igebotz]

I've left 2 neutral "no loan" tags so far. If someone ever asks me to remove them, I'll require a signed message from an old staked address, and I'll probably wait for 30 days (a cooldown period).

Why wait 30 days after someone has signed a message from an old staked address to remove a tag? You should assume that the person making such a request may be in desperate need of a loan.

A signed message is enough IMO.

[_BlackStar]

Peanutswar - this is a very unpleasant experience about you. But anyway - you don't seem to be running away from the fact that you have to bear the consequences of this incident.

Of course it is a downright scary occurrence if someone manages to get into an account that is highly reputable. Intruders can take advantage of account reputation for profit by making loans instead of changing password and email and selling account. This might be a new trend for intruders - and I hope I can prevent the same from happening in the future. I didn't take out a loan and probably never will - so someone has to really verify anything if one day this account applies for a loan.

[Findingnemo]

Here is the TRC20 USDT address which has been used to take the loan from shasan.

TRX Address: TReZah87Zxhfk7YZtYksQ2Z9fNiq7Z2PMB

shasan has accepted your loan request and sent the USDT to the above address. Then, you or the hacker has sent 999+ USDT to a different address in 3 transactions. The USDT was sent to this address

TRC20 - USDT address: TJjqnqEhWQ8oW9AUgQLwrtMCAxfbEwREeF

This address was posted by user mdgabrielzim whose loan request was declined by shasan one month ago. The user 'mdgabrielzim' had also deleted his post from the lending thread. I'm wondering what is the connection between the hacker and mdgabrielzim!

In this thread everyone forget to pick this, I hope this will give some clue about what happened to the account since its clear that address used to take loan is under control of hacker and made a transaction with one of the forum member. Either the hacker send the funds to his own addresses or used it for any service or deal among forum member.

So @mdgabrielzim can give some clarification about the incident which may find the way for further investigation.

[DireWolfM14]

There was another such case happened here, I can't remember who was it. Will try to find it out.

kenzawak.

[Dr.Bitcoin_Strange]

Since I joined this forum, I have not seen a case like this, although in my place, someone has used a friend's Mobile phone to request a Loan, collected a loan that's about $800, and disappeared. Another case was that one dude collected his friend's debit card, withdrawn all the money in his account, and disappeared. Those two cases was not really a pleasant experience, but lastly, they courted the two of them after some months.

But in this situation, this is a Blockchain transaction, and there is no way you can catch this thief. I really feel sorry for this kind of experience. It's very painful having to repay this kind of money for the fact that you were not even the one who sent it.


Edit

Instead of creating a separate thread, I would like to make it Open that any time I am requesting a loan, it will likely be a loan on only Bitcoin and USDT, for which I will use my Bitcoin address, which I have been using here and also my BEP-20 USDT address which are in the bracket below.( BTC address bc1qkcnglxmm8hxr9lzxdk95e5jj3xcujag442zxgu and Bep-20 USDT address 0x9eb9c615ed45f3a17365d2041e6fdb36a1df8621).

Any loan request using any other address if not those above two listed adress should never be granted. I will use this as proof should there be any incident like this on my account any day.



Cheers 🥂, Dr.Bitcoin_Strange 👺👺

[Mahdirakib]

~snip~

Beside this, I just noticed another address is connected with the hacker TRX address which has been used in the lending board for loan request. 900 USDT loan was requested by user Woodie two times in shasan lending service. Like the previous case, those loan request post have been deleted by the user (check in Ninjastic). Anyway, it seems like shasan had noticed one of those loan requests and declined it. Here is the address which was used for the loan request

USDT Address(TRC-20): TWN2BYmN1cmoGQmNaAVjzYLUX12As4zTrX

Connection between the hacker address which was used in Peanutswar loan request and Woodie loan request.


(Transaction link)

Woodie was worried about the loan request and made a post in shasan lending thread, but he has deleted that post too. What's going on actually? Peanutswar ~ mdgabrielzim ~ Woodie, how big the hacking attempt is?

[Peanutswar]

~~

Seems like there's a lot too not only me as per checking the date its 6-30-23 and in my case the incident starts on 7-06-23, I guess before taking loan they must need to raise up a Signed / Verified address before accepting loans, and the same time hoping in the future have another layer of security in the forum too. This guy is lucky only have ~400 USD and mine takes a thousand USD just to clean my name here.

@CryptoHFs sorry for the DM the forum does not load properly.

@LoyceV Can I have that tag too that I will never take a loan here in the community.

[SmartGold01]

Oh no this is a very bad situation but how could someone login your account and apply for a loan without your knowledge or could it be after your absence and inactive the hacker has been using your account without your knowledge? Do we say the forum should enable a login notification whereby if there's a any unusual activity we get notified via our mails and any other notification medium to ensure the security of our account?

Sincerely speaking, having gone through op's statement I am beginning to be afraid because I won't know what may happen to others or even to me. Before given out loan they should sign message with their current address on a campaign before they can receive loan otherwise if such person fails to sign a message then the loan shouldn't be granted to the requester. Because to what happened to peanutswar is a great lost and a kind of imposing unwanted bill or debt to him or her to start paying $1000 that he didn't plan of.

That's very huge amount of money compared to our currency and is a kind of mind blowing to accepting unnecessary bill. Well I will like to plead with shasan to have patient with op as this could likely happened to anyone out there and if possible the interest should be cancelled for him to be able to clear the whole debt and also for a little extension as I believe even in 10 weeks he can't still pay off the debt, since the average weekly payments from his campaign currently will be $70 to $90, so with this pay rate I don't think he can be able to pay $1k within the next 10 weeks so I think 13 weeks payment can be able to clear the debt.

Except op has other physical business he is doing to generate money to pay quickly before 10 weeks.
I sincerely sympathized with you on this bad ugly situation you are facing right. Please take heart sir and again try increase your account security as you may not predicted what would happened next.

[CYBER_COWBOY]

Sorry for both OP and Sashan that this happen.  
Respect to you @Peanutswar that you take it the way you do and repaying. I hope you will recover from this..
 I could help you to pay back little bit like $10 if you send me your wallet address.


@LoyceV may I ask you for a favour? could you please also leave me the neutral feedback to that I never will ask for a loan just for safety.
I will never been needing a loan in the near future (ever)
Maybe I won't be a newbie forever and would be granted a loan in the future, and this thing was a very smart idéa to avoid problems like these (if my account would end up hacked in the future)

Thanks in advance!  

[Adbitco]

This is a very bad situation and I can't question you how and when it happened, just of few days ago my TG was hacked and I did get notification from my account. That so so device login in my TG from Brazil and I was shocked how could someone login my telegram account without them requesting for OTP to access the telegram, I was weird about the whole situation and how come about it.

Immediately I chatted a fellow local board user explaining to him on the recent activity and he was shocked to see my tg was hacked and immediately the hacker change my username and profile picture to his own, what I did was to go to settings and terminates all active session. This made me start wondering what if I have important thing stored as draft or something else what would have been my fate right now meaning I would had lost all thing.

Then lastly, I would love to say with what happened to peanutswar if my account request for a loan or change of address do not give without me signing a message from my current address in bestchange sig or maybe someone using TG to pm you and start relating with you about a loan please I don't carry out such action and even if I must request for a Loan I have to sign message and post to thread and to the lender. It was from my case I believe hacking is real and scamming is real. This happened immediately I fell asleep when I wasn't active online.


My question is does anyone also experience same thing as well?

[lovesmayfamilis]

That's very huge amount of money compared to our currency and is a kind of mind blowing to accepting unnecessary bill. Well I will like to plead with shasan to have patient with op as this could likely happened to anyone out there and if possible the interest should be cancelled for him to be able to clear the whole debt and also for a little extension as I believe even in 10 weeks he can't still pay off the debt, since the average weekly payments from his campaign currently will be $70 to $90, so with this pay rate I don't think he can be able to pay $1k within the next 10 weeks so I think 13 weeks payment can be able to clear the debt.

I agree with you that some concessions could be made to the OP, as the situation is not simple. Nevertheless, similar cases have already happened on the forum, and I think that everyone should take a closer look at the security of their system. Don't save your passwords in browsers, and also, I think the OP was running on a Windows system and might have some keylogger loaded, or indeed, as SamReomo wrote, a cookie session was stolen. I looked up some information about this, and I think we should know how we can protect ourselves from it.

https://learn.g2.com/session-hijacking

[ryzaadit]

-snip-

Discord Community Management? Does that mean jobs are offered for you for Moderator/Admin, or something like that?

I faced the same case 2 month+ ago, the difference is for (Discord Account) not BTT. It's for (Mod/Admin) jobs, the scammer targeting people who at least moderated a project and shared a phishing/scam.
I am wondering are @OP going to be responsible for the fund loan by a scammer, and need to repay it. Or is there some other solution/discussion between @OP and the lender for these cases?
--
First time to see, session-hijacking.

[AHOYBRAUSE]

I don't want to be mean, but you, me, or anyone could disappear in the future and the tag always remain in their accounts. I'm just thinking if someone decided to ask a loan when there's a neutral tag where the account will not ever ask any loan in this forum. Do you think if he can sign a message on his old address, the account is still controlled by the real owner?

That will be up to the lender. At least he'll see a warning telling him to be extra careful.

I've left 2 neutral "no loan" tags so far. If someone ever asks me to remove them, I'll require a signed message from an old staked address, and I'll probably wait for 30 days (a cooldown period).

I don't understand how something like this is even possible if the user's password is not compromised.

If the scammer changes the password, he gets noticed quickly. By not changing the password, the scammer can stay under the radar and impersonate the real account owner for a while. It has happened before.

Joke? 

[KingsDen]

Extraordinary everyday!
People are putting their brain in use to advance their standard of living or to be more comfortable or profitable and others are still very intelligent in the negative part. Look at how everything was executed smoothly and I guess Op became aware when he saw a negative feedback on their profile.

I have not taken a loan before, but I think there is a thread in the service section where the matter of loan is discussed extensively and agreed before execution?