Got hacked, lost 11 BTC

[soulcity]

Yesterday I lost 11 BTC from my Bitcoin Core 25.0 wallet.  The wallet wasn't open at the time.  I don't know how it happened. Lots of emotions right now.  

edit to add:

Definitely not my wife. We live in a rural setting. She doesn't have the computer knowledge to even launch the wallet. This was an external hack.

I first noticed when I logged into Koinly and saw my BTC balance was reduced.  I then launched Bitcoin Core and it was about a week behind.  Showed my 11btc as it updated, then hit the date of the hack and it went to zero.  Wallet is encrypted and appears to work fine. PC is turned off now and hard drives will be wiped. This definitely sucks, but not the end of the world.  Opportunity for others to learn or be reminded from my mistakes.

Also, the coins have not moved from hacker address.   After further investigation this looks to have been caused by a botnet.

edit 2:

All of my addresses in Bitcoin Core are segwit.  I can't seem to find a way to create a signed message with segwit and Bitcoin Core.  If you don't believe my post that's fine.  I'm not looking to gain anything, just want to tell my story so others don't make the mistakes I did.

TX IDs of the four transactions that drained my wallet:

e4fda9c61c782ad0035ee9b5c551e7e48a67c294499ae7cdc6702c7d3b06b19e

1ec109e71874990c33afd66eff4050776a1ba796d92b97cea8dc48b948fed6c8

95e9e7a88536668bbfaaf12b417ec3ec74d851d018726511ec797061d495c97a

ed8e7988e4c000b05c1814c3aaeb5170a452ee54c2dd33cc1e533fbc885ec25d

[1714678336]

1714678336

[1714678336]

1714678336

[1714678336]

1714678336

[mk4]

I checked your post history, and you seem to be playing with altcoins a lot. Maybe you installed an altcoin wallet with malicious code in it? With that said, unless you truly know what you're doing, it's quite careless to have 11 BTC on Bitcoin Core on a personal device.

Anyway, good luck moving forward.

[Charles-Tim]

Sorry for the loss. But why have huge amount of coins on an online wallet? The safest wallets are offline/cold and multisig wallets. If you know you can not run your node with cold wallets or with multisig, do not have huge amount of coins on it.

[NotATether]

We need more information to be able to piece together what happened.

The Bitcoin Core was running on what OS?

What were you doing around the time of the theft?

Bitcoin Core wallets are protected by a password, they don't use seed phrase technology but rely on some "hdseed" that's similar but will not be encrypted without a password. Therefore if the wallet file is stolen, it can be brute-forced for weak passwords.

[Yamane_Keto]

I would like to believe you, but many accounts claim to have lost Bitcoin. Therefore, to make the discussion serious, can you sign a message from a Bitcoin address proving that 11 Bitcoins were sent from that address in the past days?

Have you updated Bitcoin Core and verified the signature? By reviewing your previous posts, you mentioned that you purchased Bitcoin in 2013. Perhaps you did not download the correct software.

[soulcity]

Talked to my wife.  She tried to install a voice changer software yesterday from a link on twitter and it didn't install.  This is a windows 11 PC.  I see something new called WingFtpServer as a startup program. That has to be it. C'est la vie   

     

[Kakmakr]

We need more information to be able to piece together what happened.

The Bitcoin Core was running on what OS?

What were you doing around the time of the theft?

Bitcoin Core wallets are protected by a password, they don't use seed phrase technology but rely on some "hdseed" that's similar but will not be encrypted without a password. Therefore if the wallet file is stolen, it can be brute-forced for weak passwords.

Well, the hacker obviously got hold of the password... to be able to do that. Did you leave your computer running for extended times without watching it? (They could have installed keyboard logging tools and waited for you to leave the room and then logged in and transferred the funds)  

The bulk of my "treasure" are stored off-line so I know that it will not be accessible .....and it is split into smaller amounts, so even if someone hack me, they will only get access to say 1% of my coins.

I also put out "bait" in the form of small amounts of coins in desktop wallets ...so if that is triggered, then I know I am being targeted.

Sorry for your loss.  

[Sebas.tian]

Sorry for the loss OP, I know nobody is above mistakes because for some thing like this to happened for 11 Bitcoin to disappear from your core wallets, show that some thing strange happened to your personal details before but you didn't notice it before the incident happen. But 11 Bitcoin is not advisable for someone to store huge amount of Bitcoin on online wallet, because there are some details your siblings or your wife will discover and it will give them access to your coins immediately and they will withdraw everything at the moment. Well, this is a lesson to those that like holding huge amount of coins on their online wallet where there are many offline wallets secure and safe for any amount of coins.

[Yamane_Keto]

Talked to my wife.  She tried to install a voice changer software yesterday from a link on twitter and it didn't install.  This is a windows 11 PC.  I see something new called WingFtpServer as a startup program. That has to be it. C'est la vie    

    

If you have not installed that voice changer software, the hacker will not be able to easily access your bitcoins.
Wing FTP Server is a multi-operating system software that you can use to manage and supports multiple file transfer protocols such as FTP, FTPS, and SFTP. The program itself is not a virus, but if you connect to a server that has viruses, it may be downloaded to your device, but you still need administrator privileges to execute it. again, without executing these programs, it is difficult to be hacked unless you do it indirectly, such as Clipboard Hijacker Malware.

[Ale88]

Talked to my wife.  She tried to install a voice changer software yesterday from a link on twitter and it didn't install.  This is a windows 11 PC.  I see something new called WingFtpServer as a startup program. That has to be it. C'est la vie   

I'm very sorry for you, I can't even image how you feel right now. I don't store any bitcoin information on my computer but if I were, I would never let anyone use it, not even to check his/her Facebook or email. A friend of mine lost a few bitcoins because his mother used once his computer, I don't remeber what se did, I think she clicked on some link she wasn't supposed to and they stole everything.

[Cantsay]

Talked to my wife.  She tried to install a voice changer software yesterday from a link on twitter and it didn't install.  This is a windows 11 PC.  I see something new called WingFtpServer as a startup program. That has to be it. C'est la vie         

Apart from your wife who else has access to your computer? Right now there are several options; which include someone else accessing your wallet physically and sending your coins to their wallet or malware so you’d have to help us narrow it down, let’s start by you answering the question I asked initially, does anyone else aside from your wife know the password to your computer? And also how often do you use your system to access sites that may not be secure? There’s a possibility that the malware (if it was caused be one) might have been in your system for some time before they finally got activated and acts.

[Publictalk792]

That is a big loss. By the way move forward. And think and learn from your mistake. This loss is teaching you a lesson and you should learn from it. I think this happen because you give an access to your device to hackers. It can be an application or a link or any other sources which have that kind of links which make a bridge for the hackers. So you should be careful in the future and I will recommend if you have a big amount like this so always use a hardware wallet to store it. And if you want to store online so buy a separate device for this purpose. I am feeling sad due to your loss. By the way just leave and move on. Now what was supposed to happen has already happened.

[headingnorth]

Talked to my wife.  She tried to install a voice changer software yesterday from a link on twitter and it didn't install.  This is a windows 11 PC.  I see something new called WingFtpServer as a startup program. That has to be it. C'est la vie    

    

1. What is voice changer software?

2. Does your wife know about your bitcoin? Is it possible she was involved?

3. Did you run anti-malware and virus scanner software after the loss?

[D ltr]

Very sad, 11 BTC lost, you need a very strong mentality to stay sane, try to remember, was there the last person to use your PC besides your wife?
Installing anything without security is very vulnerable on a PC or cellphone because there is so much malware circulating that without us even realizing it, just clicking on an image can cause loss.
there is no hope of coming back, so just keep living

[fat buddah]

Damn, sorry for your loss. But I'd like to hear more details. What exactly were you doing before that happened? And why didn't you put your BTC in a cold wallet? Also when were you able to get that 11 BTC?

[Shenanigan]

Talked to my wife.  She tried to install a voice changer software yesterday from a link on twitter and it didn't install.  This is a windows 11 PC.  I see something new called WingFtpServer as a startup program. That has to be it. C'est la vie    

I think your wife isn't telling you full

Why does this voice changing software need a some kind a ftp-server? Is this software cloud based? Tell me the name of the software? Have you uninstalled this software? Provide information from the windows registry? Or did your wife say that this program has already been removed?

You gave your wife access. After it you lost money. This is the basis for initiating a case. Even if she doesn't understand computers, she caused you damage through negligence. Let her pay you compensation for damages

[Jawhead999]

Clicking a link in Twitter was already a mistake, never trust anyone except the official site. But the first mistake is why you hold your 11 coins in a PC which still connected with internet, a hardware wallet price didn't even close to 1 BTC.

You might blame your wife, but it's actually both of you are make mistakes. Since it's high likely you will not able to reclaim back your coins, you can only learn how to protect it for the next coins you hold.

[Assface16678]

Talked to my wife.  She tried to install a voice changer software yesterday from a link on twitter and it didn't install.  This is a windows 11 PC.  I see something new called WingFtpServer as a startup program. That has to be it. C'est la vie   

     

If you are sure about that, maybe there are more reasons to check your PC and the applications available on it, and also make sure there are no hidden applications because most of those malware applications are making themselves hidden, so better run a diagnostic and full scan of your PC. But there are maybe more reasons, like what websites you are accessing; that's one reason for a malware or virus to get through to your PC. Anyway, sorry for the loss. It is regretful because the bitcoin amount is not a joke—11 BTC? That cost a lot, and I can feel how sad and heartbroken you are. If there is a way to recover your loss, I hope you've found it and recovered your loss. Now that you know what to do next, you need to keep your PC containing your assets safer. You should have a separate PC for personal things that could make your assets prone to malicious malware and viruses scattered around the internet.

[Shenanigan]

There is only one conclusion here. Do not give anyone access to your wallets. And especially to their wives. If you want to save your marriage

Install and test all programs in any operating environment, just not near your wallets

Beware of shenanigans everywehere

[Ale88]

There is only one conclusion here. Do not give anyone access to your wallets. And especially to their wives. If you want to save your marriage

Install and test all programs in any operating environment, just not near your wallets

Beware of shenanigans everywehere

He said he never gave any wallet access to his wife, she used the computer and clicked/downloaded a program, that is (probably) the problem. And the point is that bitcoins, or whatever crypto with some actual value, shouldn't be kept in a computer that is used by multiple people because you can be aware of some stuff but other don't.