Attempt to recover hacked WWZSOCKI account

[crypto mania]

WWZSOCKI account was hacked yesterday and I want to recover it if possible

i am the owner and thanks to cryptomania, I can use this account to deal with it

I was able to lock WWZSOCKI account using link in email i received when the hack occurred


Proof of ownership
signed PGP signature from my wallet: 1B2Afp9GBjTqrR3fb9M8vV8N2qdzVG4DN8

G5lAbenTIPTrArzHEJo3BXK7Ab++Y7mM1VpLWpxA+KoWHHxjTIlU3L1FeX640ga4FP2QiUl8RW16W4/Gp06Dj74=

I have also sent email to: recoveries...@bitcointalk.org from my original: emoneyabc1@protonmail.com

here screens from email and signature


email i received



PGP signature verification

Theymos, Cyrrus please help to recover my account, thank you in advance
 
PS
hacker already posted scam thread from my account, would be great if moderators could remove it so nobody will get scammed

https://bitcointalk.org/index.php?topic=5507114.new#new
this is scam attempt don't use that!

[crypto mania]

@Cyrrus @Theymos please help to recover my account, thank you in advance

I have sent email to: recoveries...@bitcointalk.org from my original registered in WWzsocki account email: emoneyabc1@protonmail.com 

waiting for some reply from few days, I know it can take 2 weeks but please confirm that recovery process started if possible, so i can wait calmly, right now there is no reply to email or in both threads from Bitcointalk admins

[Lafu]

I know this is all nerve wracking and you get impatient because you dont know whats going on in the background.
But from the past what i know please stay calm , it is being checked 100% and the Account Recovery Team maybe is already on it.
And I guess at some stage you will be hear from them whats going on and what to do.

[crypto mania]

I know this is all nerve wracking and you get impatient because you dont know whats going on in the background.
But from the past what i know please stay calm , it is being checked 100% and the Account Recovery Team maybe is already on it.
And I guess at some stage you will be hear from them whats going on and what to do.

thank you Lafu

yes I am completely impatient and nervous, days seem like weeks now 

[skarais]

The recovery team will basically review your account recovery request as quickly as possible, this also work to all other users. They need time to solve your problem until your account is recovered. But I wonder, what did you do wrong that your account was hacked?

Second question, has someone reported this thread as an attempted scam?

https://bitcointalk.org/index.php?topic=5507114.new#new
this is scam attempt don't use that!

Hope your account is successfully recovered, wwzsocki.

[logfiles]

@Cyrrus @Theymos please help to recover my account, thank you in advance

Cyrus and team are the ones responsible for account recoveries and not Theymos.

I have sent email to: recoveries...@bitcointalk.org from my original registered in WWzsocki account email:

I don't think it's necessary to expose your email address to the public. You are only exposing it to more spam and probably phishing attacks. Team knows your  old email address already.

waiting for some reply from few days, I know it can take 2 weeks but please confirm that recovery process started if possible, so i can wait calmly, right now there is no reply to email or in both threads from Bitcointalk admins

Give it at least two weeks.

[Mr.right85]

I have sent email to: recoveries...@bitcointalk.org from my original registered in WWzsocki account email:

I don't think it's necessary to expose your email address to the public. You are only exposing it to more spam and probably phishing attacks. Team knows your  old email address already.

My thoughts exactly!
There is no good reason to expose your mail which is originally hidden by default. It doesn’t help your case, furthermore more, it exposes you to more and more danger. Others whom might be looking out there have now got a direction to direct there brute forcing and hacks.
State your case but, hide sensitive details. You could as well pm them to the recovery group and be good.
In trying to save yourself, don’t destroy your privacy.

[Cyrus]

The account is locked, probably shortly after posting that thread, so nobody currently has access to it. You will be contacted about the account recovery procedure.

[crypto mania]

The account is locked, probably shortly after posting that thread, so nobody currently has access to it. You will be contacted about the account recovery procedure.

I was able to lock that account using link in email I received after password was changed

I still have access to my email account and can sign message from registered BTC address (already did) so recovery should be possible

now I am waiting for contact about the account recovery procedure as requested

Thank you for reply Cyrus, really appreciate

[BitcoinGirl.Club]

It was hard to find your profile url @wwzsocki and it seems the last login is over a week ago. I was there and the recovery team did a great job, I am sure you are very close to get it recovered. It will require a few emails to exchange with the recovery team.

[Adbitco]

Op what is the cause of the hack? Is it because you didn't use a solid password or what could be the issues over here. Most time people hacking your account are those closer to you that is why you must learn to have a complicated and mix password where it would be too for someone to memorize it except you.. you are really lucky to had have this immediate attention sometimes most of the hack account ends up taking loan on the forum without the real owner's knowledge when it's restored back you start paying loans you didn't know about.

[nakamura12]

Since the account is now locked as we can read on cyrus's post then all you have to do is wait for contacting you by the team for recovery process. Hope you'll get your account back.

I don't think it's necessary to expose your email address to the public. You are only exposing it to more spam and probably phishing attacks. Team knows your  old email address already.

Since OP exposed his email address then he better use different email now just to be safe. If It were me then I would do the same to use new email rather than using the same email that many people already have seen as scammers may also sent some links or something like that to scam op.

[skarais]

It was hard to find your profile url @wwzsocki and it seems the last login is over a week ago. I was there and the recovery team did a great job, I am sure you are very close to get it recovered. It will require a few emails to exchange with the recovery team.

The @wwzsocki account was last active 8 days ago, now I find that the account is not only locked, but the status is Autobanned based on the information on bpip.  However cyrus has responded that it will likely be handle with recovery procedures, but I don't know what's next especially about the Autobanned status this account got.

Source: https://bpip.org/Profile?id=131333

Code:

8/23/2024 5:29:23 PM	password changed
Profile has been Autobanned

[logfiles]

Op what is the cause of the hack? Is it because you didn't use a solid password or what could be the issues over here. Most time people hacking your account are those closer to you that is why you must learn to have a complicated and mix password where it would be too for someone to memorize it except you.. you are really lucky to had have this immediate attention sometimes most of the hack account ends up taking loan on the forum without the real owner's knowledge when it's restored back you start paying loans you didn't know about.

He answered a similar question in another thread through he is not sure how his login details got exposed or leaked, but here is what he said;

sorry that I am not replying please try to understand

looks like only my Bitcointalk account was hacked, nothing more

my only guess they brute-forced my Bitcointalk password or it leaked somehow and when it comes to that on my end only thing that comes to my mind is:

I downloaded some malicious file exactly 1 day before it happened on laptop that I use when traveling, so nothing important on it, at least I thought so, I missed that there was brave browser synced to my other devices and I haven't unsynced it (big mistake)

If this is true then like this they could bruteforce my password manager password and get aces to Bitcointalk password and account

but if this is true why haven't they also removed email on my Protonmail from Bitcointalk, I was able to suspend that account

only explanation that they where not able to hack brave password manager so logged to my account using synced Brave browser and then changed the password as there was no 2FA (another big mistake i don't know how I missed that)

also I have seen attempts to login to few of my accounts that I haven't initiated lately, still it wasn't successful and i was able to change passwords and add 2FA to them

so is hard to tell what happened exactly

Source: https://bpip.org/Profile?id=131333

Code:

8/23/2024 5:29:23 PM	password changed
Profile has been Autobanned

Perhaps it's one of the reasons why are taking long to recover the account but I am positive he will be helped.There is another account that has been queued for ownership change.

[crypto mania]

I need help with the email that I just received from recovery Team

-----BEGIN BITCOIN SIGNED MESSAGE-----
My account <account> has been hacked/lost. Please reset the email to <email>. The current date is <date>.
-----BEGIN SIGNATURE-----
<insert address here>
<insert signature here>
-----END BITCOIN SIGNED MESSAGE-----

I don't understand this part:

<insert address here> - ok this is my BTC address (I assume the one i have registered here on forum and need to sign this message with it:

1B2Afp9GBjTqrR3fb9M8vV8N2qdzVG4DN8

but what shall I put here?

<insert signature here> - what for signature?

signature I will get after I click send?



if yes then how to do it? shall I send the message twice and then use the signature by second attempt 

[logfiles]

<...>

PLEASE BEFORE YOU DO ANYTHING ELSE, CAN YOU CONFIRM TO US THE EMAIL ADDRESS THAT SENT YOU THE MESSAGE?

I warned you not to expose your email in public, you may end up being a victim of multiple phishing attacks. I want to sort of help, but I need to be sure if you actually received the reply from the account recoveries team.

[Rizzrack]

PLEASE BEFORE YOU DO ANYTHING ELSE, CAN YOU CONFIRM TO US THE EMAIL ADDRESS THAT SENT YOU THE MESSAGE?

I warned you not to expose your email in public, you may end up being a victim of multiple phishing attacks. I want to sort of help, but I need to be sure if you actually received the reply from the account recoveries team.

I sent him the reply...

Does this message verify on your end ?

-----BEGIN BITCOIN SIGNED MESSAGE-----
wwzsocki 8/24/2024
-----BEGIN SIGNATURE-----
1B2Afp9GBjTqrR3fb9M8vV8N2qdzVG4DN8
G5lAbenTIPTrArzHEJo3BXK7Ab++Y7mM1VpLWpxA+KoWHHxjTIlU3L1FeX640ga4FP2QiUl8RW16W4/Gp06Dj74=
-----END BITCOIN SIGNED MESSAGE-----

...or is it too late and my 2 brain cells are shutting down ?

[logfiles]

PLEASE BEFORE YOU DO ANYTHING ELSE, CAN YOU CONFIRM TO US THE EMAIL ADDRESS THAT SENT YOU THE MESSAGE?

I warned you not to expose your email in public, you may end up being a victim of multiple phishing attacks. I want to sort of help, but I need to be sure if you actually received the reply from the account recoveries team.

I sent him the reply...

Does this message verify on your end ?

-----BEGIN BITCOIN SIGNED MESSAGE-----
wwzsocki 8/24/2024
-----BEGIN SIGNATURE-----
1B2Afp9GBjTqrR3fb9M8vV8N2qdzVG4DN8
G5lAbenTIPTrArzHEJo3BXK7Ab++Y7mM1VpLWpxA+KoWHHxjTIlU3L1FeX640ga4FP2QiUl8RW16W4/Gp06Dj74=
-----END BITCOIN SIGNED MESSAGE-----

No, it doesn't

I was only trying to caution OP, given that he had exposed his email to the public earlier on and didn't even bother removing it after i advised. Any malicious actor would trick him to sign a message and later, copy and send it to you claiming he is the owner of the account. I hope you understand my angle of thought.

[Rizzrack]

I was only trying to caution OP, given that he had exposed his email to the public earlier on and didn't even bother removing it after i advised. Any malicious actor would trick him to sign a message and later, copy and send it to you claiming he is the owner of the account. I hope you understand my angle of thought.

I definitely do !

And seems there's a long way from warning users about phishing attempts with punycode to flashing his email address around ... hope you understand my angle 

[Upgrade00]

Does this message verify on your end ?

It verified from my end. The mistake the op made is to write the signed message in a single line here, while when they were signing the message they wrote in with a line space between them;

Code:

wwzsocki

8/24/2024

Try removing the space between both words then adding a line gap as above and you should be able to verify it. Or the op can sign another without any line gap