First Steps After A Theft

[casey15]

Hello Bitcointalkers

If you are a beginner and you successfully get hacked or become a victim of a phishing scam here is an advice on what to do.

* Firstly, you want to secure any assets that may be remaining. The scammer or hacker may still have access to your system or email or any other connected service, and if there are any funds elsewhere, they most likely are going to target there too.

If you have any remaining funds in the wallet that was compromised, transfer them to a completely new and clean wallet that has never been used before, preferably a hardware wallet.

• Change all passwords that are linked to the system. Change the password to your email, Centralized Exchange, and any other account linked to the wallet that was hacked. Preferably, use a password manager to get erate strong unique password for each of them.. do not use the same password for all of them.

• You should then Disable any permission or API. Revoke every permission the wallet have on the system.

• You can start gathering evidence by taking screenshot of the scam transaction ID, the scammer receiving wallet, and every associated emails or website.. Make sure they are documented, do not rely on your memory alone

• You can use a Blockchain explorer to follow the stolen funds, if it was moved to a centralized exchange, then there is a better chance of recovery

• If the receiving address is from a centralized exchange, contact them immediately and provide the evidence and ask them to freeze the receiving address... Time is of the essence

• File a police report with your local law enforcement and any relevant national cybercrime agency in your locality.

Do not be scammed twice.. this is because after a hack, the victims are still usually targeted but so called 'Crypto recovery Experts'  who promises to get the funds back for a fee. Do not fall for it.

Have you ever been scammed? what steps did you take after?
This can be of help to a lot of beginners.

[coinlary]

Firstly, you want to secure any assets that may be remaining. The scammer or hacker may still have access to your system or email or any other connected service, and if there are any funds elsewhere, they most likely are going to target there too.

Well, there might still be some remaining funds, but the only way you can get to know that you were hacked is through your wallet getting drained. The hacker can possibly pay to  many addresses at once instead of moving it in small amounts.

Also, if it involves access to your email, by the time you realize anything, you might have been kicked out already because any transaction will alert you. If you use 2FA, they will be needing that as well. Now, if it's connected to an email like the same or another email on the same device, then you just made their work easier. Although a new login  IP should be detected, which you might want to tackle immediately before anything is done, unless the whole operation was done directly through your device.

You can use a Blockchain explorer to follow the stolen funds, if it was moved to a centralized exchange, then there is a better chance of recovery

Only a dumb scammer would eventually do this, but it could somehow be traced to an exchange in the future if the track isn't fully covered. But even if traced to an exchange and a freeze is implemented, there's still no guarantee you will get it, especially if you're in a country where the usage of some of these exchanges might have been banned. Apart from these issues, they will frustrate you with a lot of Know Your Customer (KYC) documentation and still won't release it to you directly without a court order.
Don't get me wrong, there are possibilities for this to help, and your point is absolutely valid for it. But it's much better if they never find themselves in such a state by taking the necessary measures to avoid it.

[casey15]

[
Don't get me wrong, there are possibilities for this to help, and your point is absolutely valid for it. But it's much better if they never find themselves in such a state by taking the necessary measures to avoid it.

The best practice still remains PREVENTION... That is why we should take security measures very important, it helps to prevent every other hassles that comes with being scammed or hacked

[Emjay24]

Hello Bitcointalkers

If you are a beginner and you successfully get hacked or become a victim of a phishing scam here is an advice on what to do.

* Firstly, you want to secure any assets that may be remaining. The scammer or hacker may still have access to your system or email or any other connected service, and if there are any funds elsewhere, they most likely are going to target there too.

If you have any remaining funds in the wallet that was compromised, transfer them to a completely new and clean wallet that has never been used before, preferably a hardware wallet.

• Change all passwords that are linked to the system. Change the password to your email, Centralized Exchange, and any other account linked to the wallet that was hacked. Preferably, use a password manager to get erate strong unique password for each of them.. do not use the same password for all of them.

• You should then Disable any permission or API. Revoke every permission the wallet have on the system.

• You can start gathering evidence by taking screenshot of the scam transaction ID, the scammer receiving wallet, and every associated emails or website.. Make sure they are documented, do not rely on your memory alone

If you do all these still on the same device, then you are preparing yourself for yet another successful hack. This is because the device may have been compromised to an extent you may not even know about and the hacker may be monitoring all activities on the device.

The best shot is starting a new, get a clean device which would not be visiting the internet and transfer all your crypto and financial apps while you find a way to reset the compromised device and flash/format it depending on the device it is and do not use it anymore for financial dealings since you don't know the extent at which it was compromised and if it became clean even after you reset it.

[Aanuoluwatofunmi]

OP i like the advise that you gave and in most cases, they are only applicable before they got the full access to a particular wallet we use, because these guys out there are very smart and also quick in actions, once they made an entry in, all they do is to first target on how they could quickly withdraw any amount found in your wallet, so prevention is more better than cure on this regard, except they never gain entry on us.

[Obim34]

If your Bitcoin is stolen and moved, whatever action you take after theft is good as nothing. If your device is compromised by malware or hack, erase or flash the device completely.

For compromised Emails, after resetting passwords, log out from every other device and enable 2FA.

The amount of funds that will need you track, down to Centralized Exchange should be huge, medicine after death isn't helpful, avoid holding large portions of Bitcoin in a wallet connected to an online device.

Getting offline wallets may be a big deal, I can suggest using wallet like Electrum, extract seed phrase, create WOW, afterwards delete wallet and file completely from your device, this way you won't be a victim.

[EluguHcman]

~SNIP~

If you do all these still on the same device, then you are preparing yourself for yet another successful hack. This is because the device may have been compromised to an extent you may not even know about and the hacker may be monitoring all activities on the device.

The best shot is starting a new, get a clean device which would not be visiting the internet and transfer all your crypto and financial apps while you find a way to reset the compromised device and flash/format it depending on the device it is and do not use it anymore for financial dealings since you don't know the extent at which it was compromised and if it became clean even after you reset it.

Getting a new device for a startup is good as necessary but does not determine the only possibility to keep your securities safe.
I read the OP right said that you can send the funds to a new wallet and hardware Wallet which are off-line storage was recommended preferably which was good ideal.

You must not trash your device after scam attack it you must restore your safety and keep maintaining your securities and Privacies.
You can reset the device factory settings, update router firewall and reset all internet protocols and device security accesses.
And if possible as you formats the device, don't compromise your instincts with any app in your system including ones that are suspicion and not, but reinstall your apps afresh and must be from official sites.

Two factors authentications will increase the security of your device and software accessibility. It should be unfailingly to use unique and strong passwords as OP has earlier mentioned.

[NeuroticFish]

and enable 2FA.

It may worth mentioning that 2FA is used properly only if the "signer" device is different from the one you use for browsing/logging in.
If you have the 2FA app on the same (maybe compromised) device, you will remain in the (bad) loop.


PS. Imho hardware wallet or cold storage are the proper ways to keep your funds safe.

[BitMaxz]

I'm against the password manager if the device is always connected online since it's vulnerable to any online attacks unless you have a separate device and decide to never connect it online and only use it when you forget your password since for most of the sites nowadays, you can enable "remember me," then only check the separate device to copy and type them manually to your online device. It is way safer, but if you don't have an extra device, then write your password on the notebook/piece of paper to save your password.

I've been scammed before with cloud mining and some investment sites, but I've never been hacked, maybe because of my AV Kaspersky. So I also suggest once you've been hacked, format your device, and then the first thing you need to do is to install AV and update its database to make sure it has the most recent data to protect against newer viruses and malware and to avoid being hacked again.

[Rockstarguy]

Good advice, and I would also like to add to this. In every experience of theft and scams, there are enough lessons to learn from the mistakes. Normally, people will always be victims of scammers, but the most important thing about the experience is to learn from the mistake and never let it happen again. There are people who make mistakes unknowingly because of ignorance; they do not take it very seriously to learn from it. It is very important to pay attention and to have a good understanding, because when this is not there, it is the reason why people get into problems like this.

[Creeper0]

Consider whether your local laws are in favor of crypto first. It is not possible to legally recover or conduct a recovery operation for hacked crypto in all countries, in which case you may face danger yourself by seeking legal help.

The most important thing is that hackers work very quickly and steal valuable assets first after hacking. So by the time you detect a hack, all your valuable assets will be stolen. So even if you take any action, your losses may not be reduced much.

I think no remedy will be effective in this case. If any asset is stolen by hacking, try to let it go and gain preventive knowledge. Because prevention is more effective than cure against hacking.

[Wiwo]

[
Don't get me wrong, there are possibilities for this to help, and your point is absolutely valid for it. But it's much better if they never find themselves in such a state by taking the necessary measures to avoid it.

The best practice still remains PREVENTION... That is why we should take security measures very important, it helps to prevent every other hassles that comes with being scammed or hacked

Taking our security more seriously is the way to go, but in at that we need to point out and educate others on some important security checks that can keep you ahead of hackers and phishing attacks, making sure that your security software and your device operating software is up to date since having recent updates can fix alot of security issue's.

Prevention sure is the way to go, since once you become a victim all your fund will be drained.

If we say reporting internet hacks cases of our cryptocurrency wallet to law enforcement agencies,  what of those that reside in countries where cryptocurrency is banned or not fully regulated,  there is need to take personal security very seriously to avoid suxh case from happening.

[CryptSafe]

If you get hacked, at first, create a new wallet and move any available assets at the moment to a new wallet, whether in that wallet or another wallet, because there is every possibility that the hacker might also come for the others since they were able to get access to your device to get your details.

Change your login details across all boards and wallets as well, if you can, back up your information, and format your device or gadget back to factory settings and activate your device again.

As for security checks on tracing your funds, you can use https://intel.arkm.com/ to see the destination where your funds were sent to, then you can take further steps to recovery if the option is feasible.

[Ojima-ojo]

Do not be scammed twice.. this is because after a hack, the victims are still usually targeted but so called 'Crypto recovery Experts'  who promises to get the funds back for a fee. Do not fall for it.

Have you ever been scammed? what steps did you take after?
This can be of help to a lot of beginners.

Speaking about not allowing oneself to be scammed twice, this is another aspect I think we all should also take note of.
When a wallet containing Eth and other erc20 token is hacked (for example), note that if the value of the Eth on that wallet is higher than the total value of the tokens on the wallet, the hacker will withdraw all the Eth to their own wallet address, and also possibly set up the hacked wallet in a way that any eth sent to the address automatically gets sent to the hackers wallet address.


If you ever find yourself in a situation like this, simply give up on such wallet and do not try to salvage the tokens, because the more you send eth to that address to use as gas fee to send out those tokens, the more the eth gets transfered to the hackers wallet, so simply give up that wallet, create a new one and move on wit your life being more careful and security conscious so you never be a victim to hack again.

[HONDACD125]

Useful information and newbies should definitely do these things if they get hacked, but I think pre-hack steps and precautions are much more important and valuable than post-hack steps and precautions, and newbies should mostly focus on securing their wallets and accounts, and make sure they don't click on links and download files sent to them by strangers or that they have seen somewhere on the internet in a place that isn't trustworthy.

Newbies in this space often make such simple mistakes that cost them in the end. You start using Telegram for some reason, maybe to join a group or something, and there if they are approached by someone pitching them either a project, a platform, or an investment opportunity that, according to them (the scammer), will make them rich if they do everything properly, and newbies, with their naivety, start thinking that they have got one in a lifetime opportunity that they shouldn't leave, and then they fall for it.

People need to understand that there is no free lunch in this world, and if someone is offering it to them, there is most probably a catch behind it.

[Amphenomenon]

The amount of funds that will need you track, down to Centralized Exchange should be huge, medicine after death isn't helpful, avoid holding large portions of Bitcoin in a wallet connected to an online device.

Yes, but this is if the amount is smaller but in other cases reporting this is not a bad idea and there is a chance of your money coming back if you follow legal means and if you are not careful, you may fall into coin recovery scam.

That aside, I still support reporting any of these scams to their official services available for full investigation and recovery process, providing the info on how one became a victim and the info of the scammer/hacker gotten, can help these officials or bodies to gather more info against such hacker/scammer whereby it becomes easier to identify them or maybe inform the general masses about prevention of it.

[Smartvirus]

If you are a beginner and you successfully get hacked or become a victim of a phishing scam here is an advice on what to do.

* Firstly, you want to secure any assets that may be remaining. The scammer or hacker may still have access to your system or email or any other connected service, and if there are any funds elsewhere, they most likely are going to target there too.

If you have any remaining funds in the wallet that was compromised, transfer them to a completely new and clean wallet that has never been used before, preferably a hardware wallet.

• Change all passwords that are linked to the system. Change the password to your email, Centralized Exchange, and any other account linked to the wallet that was hacked. Preferably, use a password manager to get erate strong unique password for each of them.. do not use the same password for all of them.

Having to create a new wallet with a new private key or seed phrase and transfer all your hodlings to it is definitely the first thing to do but while you do so, you must ensure you create it on a completely new device. Using same device would not guarantee you any safety as you are not completely aware of the point or extent of the hack and as such, anything you do on that device might as well lead to some compromise and you would end up not have solved any issue.

A completely new device would be a way to help your course and better secure your remaining assets.

[UchihaSarada]

Having to create a new wallet with a new private key or seed phrase and transfer all your hodlings to it is definitely the first thing to do but while you do so, you must ensure you create it on a completely new device. Using same device would not guarantee you any safety as you are not completely aware of the point or extent of the hack and as such, anything you do on that device might as well lead to some compromise and you would end up not have solved any issue.

A completely new device would be a way to help your course and better secure your remaining assets.

If it is impossible to have a completely new device for that, let's wipe out the OS or reset to factory mode, and install the OS, the wallet software again before creating your new wallet.

If possible, you can create a multisig wallet to use, that surely costs you a little bit more satoshi in transaction fees later but in security aspect, it is certainly better for your bitcoins.

Creating a multisig wallet with Electrum.
How to setup and use Electrum Multisig Wallet [Beginners Guide]

[SamReomo]

Those are some good steps that OP shared via this thread but I believe prevention is better than cure applies here as well. If you really want to be safe from such theft than it's mandatory to go for cold wallet as that's the only safest solution out there.

If any wallet that's ever connected to internet might not be safe for keeping huge funds and that's why the best we could do is to move to a cold wallet. Electrum allows such cold wallets and it's pretty safe to use such cold wallets. Here is there documentation link to set such a wallet.

[sokani]

If you have any remaining funds in the wallet that was compromised, transfer them to a completely new and clean wallet that has never been used before, preferably a hardware wallet.

I read a story recently about someone whose wallet was compromised, but because no coin was stolen, he didn't generate a new seed phrase and move his funds. He kept on using the wallet, but unknown to him, the scammer had other ideas. Basically, the scammer did not steal the fund initially because it was just a little amount. So, he decided to wait for some years for a substantial amount to enter the wallet before he strikes, and that was exactly what happened. So, whenever a wallet gets compromised, we shouldn't be like this guy whose story I just shared. Create a new wallet and move the funds.