Old Accounts That Have Likely Been Hacked/Traded

[DireWolfM14]

Eisenhower34

An account from 2011 recently woke up, again.  17 posts in the last 10 years, and none resemble the original writing style of the posts from 2016 and before.  The account has two positive reviews from the old days.  The account hasn't written a word since 2024 other than submitting an application for a signature campaign and requesting a $200 loan.

I suspect the campaign manager who accepted him did so based on the accounts posts prior to it changing hands.

[nutildah]

Eisenhower34

An account from 2011 recently woke up, again.  17 posts in the last 10 years, and none resemble the original writing style of the posts from 2016 and before.  The account has two positive reviews from the old days.  The account hasn't written a word since 2024 other than submitting an application for a signature campaign and requesting a $200 loan.

I suspect the campaign manager who accepted him did so based on the accounts posts prior to it changing hands.

Good catch. Quite obviously a bought account but let's go through the signs anyway:

- password reset in 2023
- wakes up to request loan after 2 year absence
- degredation of intelligence & writing proficiency over the years

Plus pretty much everything they've tried to do for the last few years looks like a scam attempt.

Need 1,000 USDT on Polygon. Will send 1,100 USD worth of STORJ as collateral. STORJ: https://www.coingecko.com/en/coins/storj

I will pay 0.5% interest a day, I might pay in 1 day or after a week, waiting on a transaction and don't really know when it will be sent. I'll also cover all transaction fees.

Please reply with your STORJ address.

Agreed. My STORJ address. 0xd7D2A4e987597C67dDE32f052096104Ea55D64E5

Glad you caught it pretty quickly.

[logfiles]

Eisenhower34

An account from 2011 recently woke up, again.  17 posts in the last 10 years, and none resemble the original writing style of the posts from 2016 and before.  The account has two positive reviews from the old days.  The account hasn't written a word since 2024 other than submitting an application for a signature campaign and requesting a $200 loan.

I suspect the campaign manager who accepted him did so based on the accounts posts prior to it changing hands.

It's worth noting that the account got accepted in the campaign and updated the avatar and signature but never bothered to make a single post since then except for the loan request.
I think they were banking on the lender getting fooled into thinking that they were enrolled in a signature campaign and end up giving them a no collateral loan. They were basically attempting to "sell" the stolen account for 0.003 BTC

[TokenTikas]

I think they were banking on the lender getting fooled into thinking that they were enrolled in a signature campaign and end up giving them a no collateral loan. They were basically attempting to "sell" the stolen account for 0.003 BTC

One will wonder how foolish a person has to be to do something like this. In the past, we used to hear mostly about spam issues on Telegram, but now they have upgraded and try to spam in more updated ways, even doing role play, yet this person still looks completely foolish. If wearing a signature code and avatar alone was enough to get a loan, it would have been very easy. Lenders on the forum are very careful and they always verify properly before giving any loan, so even if such careless users apply for loans, they will surely get caught without any doubt.

I don't really understand what they gain by doing this kind of thing. Buying a forum account will not help them last for long, and when an account changes hands, it is usually easy to notice the difference in behavior and writing style. So in the end, buying such accounts is nothing more than wasting their own money.

[Bitcoin_Arena]

Not a very old account, but this 5-year-old account just woke up yesterday. Password and email address changed, and after a very long posting gap, they decided to share a trading tool that they say makes a profit.

The funny thing is that they just uploaded the file on GitLab to make it appear as though it's "open source."

They quickly shared the VirusTotal results, very well knowing that none of the engines detected the malware but on a deeper analysis of the files in the zipped folder. Their app presents itself as a trading tool, but in the background, there is another hidden malicious executable file.

I am waiting for a response from the "enthusiastic trader" who is trying to share his "profit-making tool" in the forum but I am also going to report this to the malware thread later

Now tell us why the two files

Code:

lib/libtcl.dll

and

Code:

lib/libtk.dll

both dated 2026-02-07 don't actually contain the real DLL code. They are a ZIP archive disguised with a ".dll" extension. There is a hidden Windows PE executable called "agent.exe" which is about 3.5 MB when decompressed.

Your so-called tool also;
1. Disables Windows Defender via PowerShell + registry
2. Requests for admin privileges via "runas" on launch

Why would a trading tool do all this?

[DireWolfM14]

They quickly shared the VirusTotal results, very well knowing that none of the engines detected the malware but on a deeper analysis of the files in the zipped folder. Their app presents itself as a trading tool, but in the background, there is another hidden malicious executable file.

Do you have proof of that that?  I'm at work and don't have time (or a VM) to sandbox the zip file to inspect it further for what's really in it.  If you have evidence, take a screen shot and post it here or in it's own thread.  That would justify red-tagging the account and his alt, and reporting the post for deletion.

2 Accounts Connected:

1. XenoFever
2. Alucard1
~

[nutildah]

I saw this guy complaining about his neutral trusts again.. its because he's applying for signature campaigns and keeps getting rejected. This means the tags are working, which is great.

From another thread (I didn't want to derail that one):

Feeling sorry for TryNinja
But he repaid me in full.

And "suspicious"!!
Although I signed message from the old address, you people tagged me multiple times to feed your gut.
I have neither scammed anyone nor have I any negative record on the forum.
You 2 people tag others to grow your reputation, but thats wrong deed. It is unfair to blame someone unless their guilt is proven.
You are pretending to be Lauda, but Lauda has another level of morality that you don't have.

Nobody told you to buy an account and start farming trust. That was entirely your decision. You run tons of other accounts on the forum. Your posts are trash and you don't even have a personality because that belongs to the original owner of this account (which is not you).

Voting bots, i was thinking about it a long time ago. This coin does not have such a big community. PolishCoin - hmmm i am from Poland .

Fuck you, and fuck off. Thanks for your consideration.

[Jaweria parveen]

Do you have proof of that that?  I'm at work and don't have time (or a VM) to sandbox the zip file to inspect it further for what's really in it.  If you have evidence, take a screen shot and post it here or in it's own thread.  That would justify red-tagging the account and his alt, and reporting the post for deletion.

What kind of cases are these that a person has proof of having 2 accounts and has also created a thread on it and he is still not giving proof of it. Even if he had proof, he would have informed us with their link or something else along with his post, thus his reputation can also be damaged. What kind of excuse is this that he is at work and still does not want to tell us through a picture that this is his proof. Out of all the posts like this that I have seen so far, they damage the reputation of people as this person has done, even though he may have proof, it cannot confuse us with such things and this is a matter of hard work and honor of 2 people. Therefore, he will have to confirm it fully soon or admit his mistake. I am also surprised that when he found out about these two, he did not tell the whole story.

[lovesmayfamilis]

Do you have proof of that that?  I'm at work and don't have time (or a VM) to sandbox the zip file to inspect it further for what's really in it.  If you have evidence, take a screen shot and post it here or in it's own thread.  That would justify red-tagging the account and his alt, and reporting the post for deletion.

What kind of cases are these that a person has proof of having 2 accounts and has also created a thread on it and he is still not giving proof of it. Even if he had proof, he would have informed us with their link or something else along with his post, thus his reputation can also be damaged. What kind of excuse is this that he is at work and still does not want to tell us through a picture that this is his proof. Out of all the posts like this that I have seen so far, they damage the reputation of people as this person has done, even though he may have proof, it cannot confuse us with such things and this is a matter of hard work and honor of 2 people. Therefore, he will have to confirm it fully soon or admit his mistake. I am also surprised that when he found out about these two, he did not tell the whole story.

Buddy, this post is just the case when you write just to write something, completely not understanding the meaning of the topic itself. Come on, try to refute my words. What topic and two accounts are you talking about, and who is at work right now? You've mixed everything into one "mess" without even trying to figure out who's talking about what.

Did Bitcoin_Arena have something to prove to you? Or someone else?🤔

And yes, this is not the first time you have misunderstood.
https://bitcointalk.org/index.php?topic=5575882.msg66521104#msg66521104

It's time for you to read more carefully.

a lot of DT have been selected for negative trust. Behind this, a lot of hard work and one has to keep one's reputation high in the form, that is why there are quite a few big people in our form who are included in this position and not. Your answer to this question is clear and you will also find the link to this thread above.

🤔🤔🤔🤔🤔

[nutildah]

Here's another one I saw for the first time.

whiteblue

Account registered in June 2014, over 2100 posts and only 4 merits -- its a dead giveaway this is a hacked account that was purchased. The owner of this account aspires only to be the invisible holder of a billboard, talking into the void about nothing, alongside their other invisible accounts.



BPIP suggests the account may have changed hands a couple of times:



Its hard to say for sure which country the first owner was from. English isn't their first language, and they say "sir" a lot, but they seem somewhat intelligent.

how to fix problem node not detected yet sir ..
i build 15 new node but two days node not detected yet ..

-_- .. i have been pay $_$ to cloud for getting 0 HZ ..

thank's

In 2017 they started posting in the Indonesian board.

lancar ah gan ,, ga pernah tuh ane ga bisa bitcoin talk ,,
...

Aside from an extended gap from July 2022 - Oct 2025, the account continuously posted on the Indonesian board(s). There's no reason to think the original owner wasn't also Indonesian.

I don't have time to finish it right now but I already saved this as a draft like a week ago.. I connected this account to CryptoSmile and realized this opened a whole new bucket of alt accounts... I am leaving this here for myself to finish looking at later.

Awesome i want to join ..

Btctalk name : whiteblue
Rank : Member
Current post count : 90
BTC Address : 1PhSDsWyxKANz84Jm18FTZks6XF434ABKX
Wear appropriate signature : Yes