Funds withdrawn from Stake without 2FA.

[AHOYBRAUSE]

I recently read about a similar case in the stake forum.
This user also had 2FA enabled and his funds were transferred to an unknown address.

It's a shame stake support never takes these cases serious and just replies something like "There is nothing we can do. Everything looks normal." If everything would be normal the money would still be there.

Normally stake is fast in blocking account after whatever suspicious activity. I don't understand why they wouldn't do that when a login is happening from a foreign IP and instantly withdrawing all the funds to an address that has never been used before as well.
I also don't understand how this withdrawal can be processed without entering 2fA. These days even if you want to make a tip to another stake player you need to enter 2FA, in the past that wasn't the case.
It's sad to know that money in account seems to be less safe than expected. Yet another fail of security at stake so it seems, when will that ever change.

[1714597385]

1714597385

[1714597385]

1714597385

[1714597385]

1714597385

[Fixelifix]

This transaction? 0.54092117 BTC•$ 23,713.67

Thats a lot of money,,, hope it gets solved with stake.

[EarnOnVictor]

My Question: How can a withdraw gets accepted without 2fa?
Reply: There are numerous ways that we are not familiar with.

Stake team is not providing me any details about the withdrawal. And on that they say their security is impenetrable.

Sorry about this experience, but as unsatisfactory as the response of Stake's representative is, I'm afraid is true. There is fraud here and there, even in fiats online and in banks that were supposed to be more traceable than cryptocurrency, yet stealing in accounts happens and banks can't truly provide a detailed reason for it or trace it whatsoever.

And I believe Stake can't provide additional information more than what you already know yourself since it is BTC we are talking about. Every normal transaction flows are visible to all. Only that you and they can't access the receiving end account that could later use m!xer to make it untraceable. I don't see how they can help here, unless for a refund.

Another point I want to ask to everyone here
Why there is not authenticity check when the user logs in from a different country in a day's time or even whenever he logs in from a different country rather than his home country.?

My friend, hacking is more than this, authenticity checks will be a forgotten issue when they are in. Hacking has different levels.

[ubercool]

@holydarkness
I have sent a PM to the team but no reply yet.

@TheUltraElite
I used to gamble frequently, thats why the BTC was there..
Hopefully, someone from the team will see this and will get a better reply from Stake.

@Sunderland
Which Police/Authority you are talking about..? Is there any "Bounty hunter" to search and hack the hacker which did this to me..?

@sokani

• NO
• NO
• NO

Thats why I am heavily disturbed by this.

@AHOYBRAUSE
Wondering the same...

@EarnOnVictor
You mean to say that even STAKE wont be knowing whether 2FA has been used for this withdrawal or not..?

My friend, hacking is more than this, authenticity checks will be a forgotten issue when they are in. Hacking has different levels.

Please let me know how to Bypass 2FA, Coz we have to find a solution for that... Otherwise there is no meaning in having it.

[holydarkness]

@holydarkness
I have sent a PM to the team but no reply yet.

[...]

Maybe they're trying to get to the bottom of this situation before reaching out to you with a concrete answer. I'd suggest we wait a little while.

@Sunderland
Which Police/Authority you are talking about..? Is there any "Bounty hunter" to search and hack the hacker which did this to me..?
[...]

I am not sure about fixedfloat, but binance allows account freezing if you can give them an official investigation letter from your local police and you can connect the dots [they provide a table for this] that prove the address used by the scammer is one of theirs. Maybe he's referring to this authority, your local police.

[Potato Chips]

I am not sure about fixedfloat, but binance allows account freezing if you can give them an official investigation letter from your local police and you can connect the dots [they provide a table for this] that prove the address used by the scammer is one of theirs. Maybe he's referring to this authority, your local police.

IIRC Fixedfloat claim they do too. But since the trade has most likely been completed and money has already left their end, they will just add the address/es involved in their blocklist then freeze funds if the perp transacted with the same address.

OP could try to request the perp's trade information as well but as always, fixedfloat will most likely request legal paper/s from op's local police too.

[Sunderland]

@Sunderland
Which Police/Authority you are talking about..? Is there any "Bounty hunter" to search and hack the hacker which did this to me..?
[...]

I am not sure about fixedfloat, but binance allows account freezing if you can give them an official investigation letter from your local police and you can connect the dots [they provide a table for this] that prove the address used by the scammer is one of theirs. Maybe he's referring to this authority, your local police.

IIRC Fixedfloat claim they do too. But since the trade has most likely been completed and money has already left their end, they will just add the address/es involved in their blocklist then freeze funds if the perp transacted with the same address.

OP could try to request the perp's trade information as well but as always, fixedfloat will most likely request legal paper/s from op's local police too.

Correct, this is a screenshot of email from Fixedfloat to one of NFT scam victims:



They suggest to contacting cipherblade but they dont take cases under $100k, and a basic report costs $100, adding a police report brings the price to $350.

[yhiaali3]

Another point I want to ask to everyone here
Why there is not authenticity check when the user logs in from a different country in a day's time or even whenever he logs in from a different country rather than his home country.?

This is a very important point to consider, but I expect the default response from the platform will be that they allow the use of a VPN and therefore the IP used can change several times per day.

This is not an acceptable excuse of course, even if using a VPN there should be at least a warning message in the email that you are logging in from a different IP. This will make you verify your account immediately.

[CryptSafe]

So sorry for your loss, OP. This is funny how funds could be withdrawn from your stake account without you getting any notification. I am becoming more interested in this case because it is not possible for an account with a 2FA function to be bypassed to take or withdraw funds from it. Does this mean that stake security apparatus is that weak for an account with the 2FA function to be hacked without the owner of the account getting notification about it?. Ordinarily, we all know the 2FA function, but I am still curious how this happens without any trace. This is a good follow-up to see how it happened.

[holydarkness]

Should have asked about this sooner... OP, to be sure we cover all the bases [well, at least several of it] with the proper format for scam accusation, can you complete this thread with the supporting evidence? Screenshot of the said withdrawal from your stake account, the IP from stake's log [please cover your own IP], and conversation with their support and your host discussing as what you describe on the opening post will be much appreciated.

[Symphonized]

Stake has a representative that forward every case against them on this board to their team to be addressed, you probably want to try to PM him to get to the bottom of this issue, Symphonized, though he probably is already aware of this situation.

I usually gladly invite representatives of casinos to address an issue or to simply inform them about an open accusation against their platform, but on our previous exchange of PM, he informed me that he's well aware of every case against Stake and asked me to stop sending him PM for such matter. Thus I am not doing it in concern that my PM will be considered as unsolicited.

I have since 18th...

[EarnOnVictor]

You mean to say that even STAKE wont be knowing whether 2FA has been used for this withdrawal or not..?

I am not that tech-savvy but I follow them online and their advice on how we can keep ourselves safe online, which includes what people don't know that hackers can do. So, let me not speak entirely for Stake, but it is possible that they (Stake) see all security checks passed as regular once they (the hackers) are in.

My friend, hacking is more than this, authenticity checks will be a forgotten issue when they are in. Hacking has different levels.

Please let me know how to Bypass 2FA, Coz we have to find a solution for that... Otherwise there is no meaning in having it.

You know what, I wouldn't say that 2FA is totally useless, it will still be safe over 99%+ of all hacking attempts if I am correct. But as it is, these guys (hackers) are more brilliant and crafty than each other. So, let's pray that the more sophisticated ones will never see us as targets or randomly steal from us.

[Saint-loup]

In an age where any device can be hacked from a distance why reputed, large scale websites are not doing anything regarding this.
In my case, Norway is like 24 hours away on an airplane.

There has to be some logical authentication method when a user logs in from a far away country within some hours.

You can't say that, it would be unfair for serious and professional platforms. Actually most platforms don't allow withdrawals from a new country without doing anything. They fortunately don't rely on an 2FA code only in those situations, they usually send an email, a sms and/or lock withdrawals to new addresses for 24h at least.
On one exchange I even need to enter a 2FA code AND a SMS one for every transfert I'm doing while I'm using the same old IP  
And some exchanges like Bitfinex, downright allow you to whitelist your IP addresses.

[holydarkness]

You mean to say that even STAKE wont be knowing whether 2FA has been used for this withdrawal or not..?

I am not that tech-savvy but I follow them online and their advice on how we can keep ourselves safe online, which includes what people don't know that hackers can do. So, let me not speak entirely for Stake, but it is possible that they (Stake) see all security checks passed as regular once they (the hackers) are in.

My friend, hacking is more than this, authenticity checks will be a forgotten issue when they are in. Hacking has different levels.

Please let me know how to Bypass 2FA, Coz we have to find a solution for that... Otherwise there is no meaning in having it.

You know what, I wouldn't say that 2FA is totally useless, it will still be safe over 99%+ of all hacking attempts if I am correct. But as it is, these guys (hackers) are more brilliant and crafty than each other. So, let's pray that the more sophisticated ones will never see us as a targets or randomly steal from us.

The question being raised here is not only about how the hacker get into the account, it's also [and more emphasized on] how they bypass the 2FA verification to withdraw OP's fund. OP knows the safety and efficacy of 2FA, which with Stake's security that's claimed to be impenetrable, shouldn't put OP here on the first place. What OP asked from you is an further explanation on your statement, to mitigate future situation, about how do these "different level" of hacking works on 2FA.