I lost all my crypto in Stake.com

[danielpires91]

On August 12, 2024, my password was changed on Stake.com (the weird thing was that I did not receive any email notifying me about this), and as a result, I lost access to my account on Stake.com.

In addition to changing the password, a 2FA was also set up, making it nearly impossible for me to reset my password. After sending numerous documents and proving that I was the legitimate account owner, I was able to "remove" the 2FA and reset my password to regain access to my account (on August 14, 2024).

It was then that I discovered that on the same day, August 12, 2024, someone had accessed my account and transferred all my cryptocurrencies (2k in USDT, 0.26 ETH and 0.045 BTC) to an unknown account. When I traced the transactions, I saw that this same account has received multiple transfers from Stake's wallet over the past year (which makes me wonder, if this is a hacker and he is stealing crypto from Stake's clients,  why didn't Stake even blocked this address and continues to make transfers to this same wallet).

I contacted Stake's chat support, and they simply said they could not do anything about it.

How did someone manage to change my password and add a 2FA without having access to my e-mail? (I'm pretty sure they didn't have access to my gmail) and why I did  not receive any email notifying me of these changes to my stake account?

I started to think that it must have been an employee of Stake.com who could have access to my account and perfom the changes without sending any alert to my e-mail.

As they will not resolve the issue, I ask that new users be cautious with Stake.com.

And I did not have 2FA at the moment this all happen, so it's part of my own fault.

[logfiles]

1. I think it's important you share other details in your report screenshots of your chat with support, email notifications when you changed the 2-factor authentication etc. if you want your claim to look authentic.
2. If the money has already been moved out of your account, there is nothing much they can do to help you, since it was due to your negligence when it came to the security of your funds. This should not even be a scam accusation against Stake.

[danielpires91]

1. I think it's important you share other details in your report screenshots of your chat with support, email notifications when you changed the 2-factor authentication etc. if you want your claim to look authentic.
2. If the money has already been moved out of your account, there is nothing much they can do to help you, since it was due to your negligence when it came to the security of your funds. This should not even be a scam accusation against Stake.

As I explained above, I did not receive any email's notification about 2FA or change the password. I can put the screenshots of the chat support but it is in portuguese, so, I don't know if will help a lot.

I know it's "part" my fault since I didn't put the 2FA, but I just want to know if it's possible to hacker my account and block the notifications to go to my email.

[khaled0111]

As I explained above, I did not receive any email's notification about 2FA or change the password. I can put the screenshots of the chat support but it is in portuguese, so, I don't know if will help a lot.

I know it's "part" my fault since I didn't put the 2FA, but I just want to know if it's possible to hacker my account and block the notifications to go to my email.

I just changed my Stake's account password to test this and you are right! They didn't request an email verification to approve the changes or even send a notification email.
This is definitely something Stake should fix ASAP, for obvious security reasons. Sending a notification email is mandatory especially for those who didn't activate 2FA.

I'm sure Stake would've blacklisted the hacker's address if one of the victims had reported it.

[Cantsay]

I just changed my Stake's account password to test this and you are right! They didn't request an email verification to approve the changes or even send a notification email.
This is definitely something Stake should fix ASAP, for obvious security reasons. Sending a notification email is mandatory especially for those who didn't activate 2FA.

Wow that’s crazy - that’s not a good practice, since they know that their service involves people’s funds they should make it more secure by alerting users when anyone makes an attempt to change their password - from what you guys said now, if I’m able to get the previous password of a stake account I’ll be able to change their password, and do whatever I wish to do with that account without the owner getting any security email from them,right?

I'm sure Stake would've blacklisted the hacker's address if one of the victims had reported it.

Address blacklisting won’t do any good though, because it takes less than a minute to setup a new account and have your new address to do whatever you won’t to do.

[danielpires91]

 from what you guys said now, if I’m able to get the previous password of a stake account I’ll be able to change their password, and do whatever I wish to do with that account without the owner getting any security email from them,right?

If you don't have the 2FA on, that's pretty much what can happen.

[danielpires91]

I just changed my Stake's account password to test this and you are right! They didn't request an email verification to approve the changes or even send a notification email.

When I changed my password after the hacker, it sent me a notification in my e-mail. And it sent me another notification when I add the 2FA again. And I disable the 2FA just to do a test, and I got notified too, but when the support disabled the hacker 2FA for me, I didn't get notified, so that's why I thought it was a inside job (be able to do these things and not notify the email related to the account), so I basically just made this accusation in order to see if there was other people with the same problem as me and what they did after.

[AHOYBRAUSE]

Well, lesson learned. 
You should ALWAYS have 2FA activated, on any site where you are holding funds. Not doing so opens the door for something like this unfortunate case to happen.
Not receiving any notification via email that the password has been changed is not cool though, that's true.

On the other hand, when the hacker accessed your account you should have received an email when he logged in.
Every time I log into my account I get an email looking like this:

[Wiwo]

This is a sad one, and note that this could be an insider job in the sense that someone close to you may have hard access to your phone or better still clone your phone and is it to carry out this transactions, because aside from you no one have access to a password change, even stake backend policy state that the platform doesn't have aceess to your password, but if such happens and the account is still in order, you can share more evidence by taking screenshot of your account.

Most important the part that covers the time and transactions, both with the password change, so that we could know if the password reset was through email or not.

[Saint-loup]

1. I think it's important you share other details in your report screenshots of your chat with support, email notifications when you changed the 2-factor authentication etc. if you want your claim to look authentic.
2. If the money has already been moved out of your account, there is nothing much they can do to help you, since it was due to your negligence when it came to the security of your funds. This should not even be a scam accusation against Stake.

I'm sorry but I disagree with that, security of the funds doesn't only belong to the customer, it's a shared responsability between the customers and the platform. If the hacker has been able to login from a new IP address (especially one from another country or area), change his password and make a withdrawal to a new crypto address in one go without any email or SMS link/code, there is something wrong in the security policy of the platform.  

[Findingnemo]

I just have one question, how do you know that those address received funds from stake because it's almost impossible to trace the funds in that way by ourselves.

And lack of notification about email change is definitely a security flaw but here stake has no reason to be blamed unless you prove that you never let anyone to access your account by any means like can be infected with malware, clipboard hijacker then the hacker able to use your keystrokes and accessed your funds.

[AHOYBRAUSE]

I just have one question, how do you know that those address received funds from stake because it's almost impossible to trace the funds in that way by ourselves.

Funds (USDT, ETH, ... ) that are sent from stake can be identified as a stake address.
Looks for example here: https://etherscan.io/address/0x974caa59e49682cda0ad2bbe82983419a2ecc400

[holydarkness]

OP, well... Technically Stake is not the one scamming you here, though their lack of countermeasure of a hacking is really concerning. There are, as I recall, two past cases with similar nature. I am not familiar with the older one, so I barely have any idea of how that happened and how the story rolled, but the other one even had his 2FA set in place and it was bypassed as well.

I honestly don't think there is much we can do for this case, but if you don't mind, just to give more context, do you mind to provide that screenshots of conversation with their support? Just so we can see how Stake react to this kind of situation.

Don't worry much about it being in BP, I believe someone trusted will be more than helpful to translate them for us, and we always have our friendly-neighborhood-google-lens that'll do the translation if there is no one to jump in.

Also, what did your IP login session told you?

[danielpires91]

On the other hand, when the hacker accessed your account you should have received an email when he logged in.

That is what I thought too, I always receive this email warning about new login. But this time I did not receive anything (unless the hacker could somehow hack my gmail and delete this warning as soon as it was sent from stake).

But every time I try to login my gmail from a new device, it has a lot of steps, which involves even my phone Samsung S20 FE (I can enter unless I have my phone with me and confirm the login attempt).

[danielpires91]

This is a sad one, and note that this could be an insider job in the sense that someone close to you may have hard access to your phone or better still clone your phone and is it to carry out this transactions, because aside from you no one have access to a password change, even stake backend policy state that the platform doesn't have aceess to your password, but if such happens and the account is still in order, you can share more evidence by taking screenshot of your account.

Most important the part that covers the time and transactions, both with the password change, so that we could know if the password reset was through email or not.

I don't think it was a insider job from someone next to me because except from my mom, no one knows I bet with stake.com or have any funds in there.

I will provide some information (IP login, support conversation, etc) bellow.

[danielpires91]

OP, well... Technically Stake is not the one scamming you here, though their lack of countermeasure of a hacking is really concerning. There are, as I recall, two past cases with similar nature. I am not familiar with the older one, so I barely have any idea of how that happened and how the story rolled, but the other one even had his 2FA set in place and it was bypassed as well.

I honestly don't think there is much we can do for this case, but if you don't mind, just to give more context, do you mind to provide that screenshots of conversation with their support? Just so we can see how Stake react to this kind of situation.

Don't worry much about it being in BP, I believe someone trusted will be more than helpful to translate them for us, and we always have our friendly-neighborhood-google-lens that'll do the translation if there is no one to jump in.

Also, what did your IP login session told you?

Thanks for sharing the other cases (the one that happen with the 2FA set in makes me think that the best way for me is just stop betting with stake or any other brand).

I will provide bellow the prints from my stake account with some of the activities.

This is the ETH transaction (from my stake account to the hacker wallet)

https://etherscan.io/tx/0x92e58a838ffbb7e5e14a48d99450563934fc106584aba14a8b63ca276a9d0c3c

If you click in the activities from the account that receive my ETC, you will see a lot of transferings coming from stake (actually there was one just 24 hours ago, but there is one more than a year ago).

Link to see the trasations of the "hacker" wallet:

https://etherscan.io/address/0x7546de9514ab7070a1bd0a385373a099b6ce2027


About the BTC and USDT, were is the transactions:

https://tronscan.org/#/transaction/ba454e1efaf8bc0e3935f7ea55006c4747f31dc9610d56bcd770ada4fc26798f

https://www.blockchain.com/pt/explorer/transactions/btc/d46fcbda2da29461652f1ae8a1fb110cc5681a26b46469654d69b628e7fff84b

[danielpires91]

The screenshot from the IP activity in my account

https://www.talkimg.com/images/2024/08/18/73dtP.png


the screenshot from the transfers from my account

https://www.talkimg.com/images/2024/08/18/73uLq.png

[danielpires91]

the conversation (it is in portuguese) with the support:

Conversation with Stake.com
Started on August 15, 2024 at 02:21 AM Belgrade time CEST (GMT+0200)

---

02:21 AM | danielpires91: there's 3 transaction from 2 days ago that I didn't do

02:22 AM | danielpires91: someone stole all my USDT, BTC and ETH

02:22 AM | Andrew from Stake.com: Olá, tudo bem?👋
 
 Obrigado por entrar em contato conosco!
 
 Como posso ajudar?

02:22 AM | danielpires91: existe 3 transferências na minha conta que eu não fiz

02:23 AM | danielpires91: simplesmente, alguem entrou e roubou todos os meus USTD, BTC e ETH

02:23 AM | danielpires91: e ate os 136 reais que eu tinha la sumiram

02:23 AM | Andrew from Stake.com: Só um momento, por favor.

02:24 AM | danielpires91: okay

02:29 AM | Andrew from Stake.com: Obrigado por aguardar!
 
 Sentimos muito pelo ocorrido. Se você acredita que a sua conta está comprometida, realize esses passos:
 
 1) Mude a sua senha.
 
2) Oferecemos a autenticação de dois fatores como uma camada extra de proteção. Posso te auxiliar na configuração do 2FA se for o caso.
 
 3) Certifique-se que de está utilizando uma rede de internet segura e em um dispositivo próprio e não de terceiros ou público.
​
4) Você pode encerrar sessões em dispositivos onde você não conhece a localização.
Para isso vá em Conta > Configurações > Sessões e clique em Remover Sessão caso não reconheça uma localização.
 
 O Stake , como segurança, oferece transações PIX utilizando apenas o seu CPF como chave PIX. Se houve uma transação em sua conta em PIX, essa transação foi para a sua conta bancária onde o seu CPF está cadastrado como Chave PIX.
 
 Infelizmente não temos como cancelar essas transações, já que elas foram concluídas e confirmadas.
 
 Caso tenha alguma outra dúvida, por favor, me avise.
 
​

01:34 AM | Stake Support: Olá danielpires91! Você recentemente entrou em contato com nossa equipe de Suporte ao Cliente. Por favor, poderia nos dar alguns segundos para nos dizer o quão satisfeito você está com o atendimento que recebeu, selecionado uma das seguintes opções:

01:34 AM | Stake Support: Classifique a sua conversa

---
Exported from Stake.com on August 18, 2024 at 08:00 PM Belgrade time CEST (GMT+0200)

[danielpires91]

and there was my local currency (BRL) too (they only allows you to transfer my local currency to a account with my Social Number in it)

So, the SOAB knowing he couldn't get my BRL, he just bet all of it in a game called Keno and lost it all.

[ibracks]

Expensive lesson,
Wrong to blame Stake for that