Got hacked, lost 11 BTC

[DeathAngel]

This really sucks & there’s nothing anybody can say to make it any better. You really shouldn’t be using that computer for anything other than Bitcoin Core. If you must use the computer for other things then cold storage is much safer with Ledger or Trezor. I hope you can recover from this, sorry it happened to you.

[1714773981]

1714773981

[1714773981]

1714773981

[1714773981]

1714773981

[1714773981]

1714773981

[1714773981]

1714773981

[1714773981]

1714773981

[HelliumZ]

Yesterday I lost 11 BTC from my Bitcoin Core 25.0 wallet.  The wallet wasn't open at the time.  I don't know how it happened. Lots of emotions right now. 

But you can't tell clearly if your Bitcoin wallet is hacked or damaged. If your wallet password or Security Seedphase is lost, your 11 BTC will be lost forever. And if you don't login for a lot of time, there might be a problem with your device or network line. If you keep trying to login your wallet repeatedly, if there is a device error, turn it off and try again.

[Shenanigan]

Can I recommend a method to help OP? I really don't think this method will work.

Just promise not to laugh at me. I don't know much about wallets

[soulcity]

Definitely not my wife. We live in a rural setting. She doesn't have the computer knowledge to even launch the wallet. This was an external hack.

I first noticed when I logged into Koinly and saw my BTC balance was reduced.  I then launched Bitcoin Core and it was about a week behind.  Showed my 11btc as it updated, then hit the date of the hack and it went to zero.  Wallet is encrypted and appears to work fine. PC is turned off now and hard drives will be wiped. This definitely sucks, but not the end of the world.  Opportunity for others to learn or be reminded from my mistakes.

Also, the coins have not moved from hacker address

[Shenanigan]

I first noticed when I logged into Koinly and saw my BTC balance was reduced.  

Sad, it means my method won't help you.

I want to clarify - can you see outgoing transactions from your wallet address? transactions which you didn't do. transactions of a hacker who transferred your money from your wallet to himself

Do you know how to use blockchain-explorers?

For example
https://www.blockchain.com/explorer

[soulcity]

I first noticed when I logged into Koinly and saw my BTC balance was reduced.  

Sad, it means my method won't help you.

I want to clarify - can you see outgoing transactions from your wallet address? transactions which you didn't do. transactions of a hacker who transferred your money from your wallet to himself

Do you know how to use blockchain-explorers?

For example
https://www.blockchain.com/explorer

Yes, I can see the coins moved in  to two addresses in the explorer

[Mehedi72]

Talked to my wife.  She tried to install a voice changer software yesterday from a link on twitter and it didn't install.  This is a windows 11 PC.  I see something new called WingFtpServer as a startup program. That has to be it. C'est la vie   

windows 11 has updated security but there are unknown kind of malicious/ pc virus that windows defender fail to defend yet. As you said, she was trying to install a voice changer software, clicking Twitter links, might be the reason. Although software didn't install but may be virus get downloaded to your device & get installed that time. But after that, there are so many step to crack for hack your 11 btc. Core wallets are protected by a password, hard to get crack only if you use weak password. But chance is less here. But i suggest, use a freash device , not for fault useage but only for store your cryptocurrencies, otherwise i found many users experienced such hacking incidents

[Shenanigan]

PC is turned off now and hard drives will be wiped.

Don't do this. All malware should be there as evidence

All you need to do is sue either the hosting provider or the owner of the domain that hosted the malware that caused you to lose your bitcoins.

If your wife downloaded this voice changing software from the official website, then the likelihood of you winning the case increases

By the way, tell me the name of the voice changing software - we will check it through virustotal

[HelliumZ]

Also, the coins have not moved from hacker address

Since you are sure that Bitcoins are not transferred from your wallet to hackers' wallets. So you can rest assured that it is a temporary fault of your PC or device. Also, if your device is not faulty then you should check the security of your wallet Seedphase. It might be a mechanical fault of your wallet or device.

[goldkingcoiner]

Yesterday I lost 11 BTC from my Bitcoin Core 25.0 wallet.  The wallet wasn't open at the time.  I don't know how it happened. Lots of emotions right now. 

Wow that really sucks. These things can happen, nobody can see it coming. Even if people here say that they have special security to deal with avoiding situations like this, nobody is really safe.

This can happen to anyone at any time. There is no 100% way to avoid getting scammed, hacked or robbed. It is just part of the human condition.

If I were to guess, I would say you either gave away your seed phrase without knowing it and/or you had malicious software on your device. But you have not really given us much information, so there is nothing to go on.

[Shenanigan]

If OP has not yet formatted his hard drives. It's possible to analyze the behavior of this FTPServer thing and, based on this, calculate where all the paths lead. I think a competent specialist can figure out which servers this malicious program was communicating with. And by servers - a calculate the IP of the thieves lair

[headingnorth]

Always use a passphrase that is stored only in your head.

So even if someone steals your seedphrase they cant do anything with it without the passphrase.

[sokani]

I think your wife isn't telling you full, Why does this voice changing software need a some kind a ftp-server? Is this software cloud based? Tell me the name of the software? Have you uninstalled this software? Provide information from the windows registry? Or did your wife say that this program has already been removed?

You gave your wife access. After it you lost money. This is the basis for initiating a case. Even if she doesn't understand computers, she caused you damage through negligence. Let her pay you compensation for damages

I don't think the wife knew something about the stolen Bitcoin and I wouldn't blame her. It was the op's fault, he was just careless. I could bet his kids are using the same computer to play games and browse the internet.

Compensation for what? I don't get it, you mean if this were to happen to you, would you get your wife arrested and demand for compensation? You must be a joker. What I know is that all this would have been avoided if he had stored his Bitcoin offline.

[freedomgo]

I guess that's it; it's confirmed that it was hacked. I understand the feeling, mate. 11 BTC is a significant amount, especially considering the current price. Unfortunately, there's nothing you can do since Bitcoin transactions are irreversible. You just have to learn from the mistake and move on.

I hope you won't blame your wife or anyone if it was lost due to an unintentional mistake. It's not the end of the world. As long as we are alive and in the crypto space, there's still a chance to regain that amount. However, next time, let's be wiser and avoid making the same mistake.

Perhaps consider setting up a dedicated PC for your wallet to prevent compromise in case new applications are installed.

[Z-tight]

Really😢 most times this is why I prefer to use good CEX with a good asset security measures. I use Bitget and that’s because I’m very sure of their security. Also they always carryout regular security implementations to assure their customers of 100% security.

I have checked your post history and trust feedback, and it is clear that you are shilling for Bitget, so i would advise op and every other newbie reading this post as well as your other posts to ignore anything you say. There is no 'good centralized exchange' for storing your funds, BTC's should not be stored in custodial wallets but in self custodial wallets.

Op sorry for your loss, but there are many things you probably did wrong, your funds should have been stored offline, because anything that is stored online is prone to hacking, only the funds that you need for spending on the go ought to be in an online wallet.

[Shenanigan]

I think your wife isn't telling you full, Why does this voice changing software need a some kind a ftp-server? Is this software cloud based? Tell me the name of the software? Have you uninstalled this software? Provide information from the windows registry? Or did your wife say that this program has already been removed?

You gave your wife access. After it you lost money. This is the basis for initiating a case. Even if she doesn't understand computers, she caused you damage through negligence. Let her pay you compensation for damages

I don't think the wife knew something about the stolen Bitcoin and I wouldn't blame her. It was the op's fault, he was just careless. I could bet his kids are using the same computer to play games and browse the internet.

Compensation for what? I don't get it, you mean if this were to happened to you, you would get your wife arrested and demand for compensation? You must be a joker. What I know is that, all this would have been avoided if he had stored his Bitcoin offline.

People are different. Some people love, but others get divorced because of an unprepared dinner. If OP is ready to forgive his wife for 11 btc, then everything is fine

There is little information, so we have to draw different conclusions.



Why did an elderly wife from a rural area need a program to change her voice? So, after all his wife understand computer software very well? If she was able to install the program, that means she is at least an advanced user

Why OP don't tells what this software is called? It's a secret or sometning?

[legendbtc]

Talked to my wife.  She tried to install a voice changer software yesterday from a link on twitter and it didn't install.  This is a windows 11 PC.  I see something new called WingFtpServer as a startup program. That has to be it. C'est la vie   

windows 11 has updated security but there are unknown kind of malicious/ pc virus that windows defender fail to defend yet. As you said, she was trying to install a voice changer software, clicking Twitter links, might be the reason. Although software didn't install but may be virus get downloaded to your device & get installed that time. But after that, there are so many step to crack for hack your 11 btc. Core wallets are protected by a password, hard to get crack only if you use weak password. But chance is less here. But i suggest, use a freash device , not for fault useage but only for store your cryptocurrencies, otherwise i found many users experienced such hacking incidents

No operating system is completely safe and immune to hackers and viruses whether it is linux or macOS...the safety of computers depends on how we use them.

This is completely the OP's fault, not the wife's fault. He owns a large amount of bitcoin but he does not store it on a hardware wallet or offline device. He used a device with an online connection to store bitcoins, which was a big mistake. Meanwhile OP is not a newbie and he also understands the risks of storing bitcoins on regular online devices. This really makes me doubt what the OP is saying.

[riverdip]

Yesterday I lost 11 BTC from my Bitcoin Core 25.0 wallet.  The wallet wasn't open at the time.  I don't know how it happened. Lots of emotions right now.  

edit to add:

Definitely not my wife. We live in a rural setting. She doesn't have the computer knowledge to even launch the wallet. This was an external hack.

I first noticed when I logged into Koinly and saw my BTC balance was reduced.  I then launched Bitcoin Core and it was about a week behind.  Showed my 11btc as it updated, then hit the date of the hack and it went to zero.  Wallet is encrypted and appears to work fine. PC is turned off now and hard drives will be wiped. This definitely sucks, but not the end of the world.  Opportunity for others to learn or be reminded from my mistakes.

Also, the coins have not moved from hacker address

give us a transaction hash or maybe list of installed softwares, maybe we can help

[virasog]

Yesterday I lost 11 BTC from my Bitcoin Core 25.0 wallet.  The wallet wasn't open at the time.  I don't know how it happened. Lots of emotions right now.  

edit to add:

Definitely not my wife. We live in a rural setting. She doesn't have the computer knowledge to even launch the wallet. This was an external hack.

I first noticed when I logged into Koinly and saw my BTC balance was reduced.  I then launched Bitcoin Core and it was about a week behind.  Showed my 11btc as it updated, then hit the date of the hack and it went to zero.  Wallet is encrypted and appears to work fine. PC is turned off now and hard drives will be wiped. This definitely sucks, but not the end of the world.  Opportunity for others to learn or be reminded from my mistakes.

Also, the coins have not moved from hacker address

First things first, why would you store 11 btc on a hot wallet ?  11 bitcoin is a lot of money, and you should either have a hardware wallet for that purpose or if you are a bit techy, an air gapped device (with no access to the internet) should be configured for your bitcoins.
11 bitcoin is a life's money for someone and there are places in the world where you do not have to work for the rest of your life if you have 11 bitcoins with you  

Yes, I can see the coins moved in  to two addresses in the explorer

Is this possible that you can share the transaction hashes? Someone may try to dig more once they know which transactions we are taking about. Whether the coins were moved to exchanges and all such investigations?

[soulcity]

TX IDs:

e4fda9c61c782ad0035ee9b5c551e7e48a67c294499ae7cdc6702c7d3b06b19e

1ec109e71874990c33afd66eff4050776a1ba796d92b97cea8dc48b948fed6c8

95e9e7a88536668bbfaaf12b417ec3ec74d851d018726511ec797061d495c97a

ed8e7988e4c000b05c1814c3aaeb5170a452ee54c2dd33cc1e533fbc885ec25d