Bitcoin Forum
December 03, 2016, 04:53:57 AM *
News: To be able to use the next phase of the beta forum software, please ensure that your email address is correct/functional.
 
   Home   Help Search Donate Login Register  
Pages: [1] 2 3 »  All
  Print  
Author Topic: Wallet just got emptied  (Read 4024 times)
pirate1
Member
**
Offline Offline

Activity: 75



View Profile
May 11, 2012, 02:38:31 AM
 #1

I opened up my wallet to update it and catch up.  When I went to check to see if it was done all my bitcoins had been sent out.  It was only 10 but it was all I had.  I've got pretty good anti-spyware, anti-virus, and firewalls on my computer.  I can see the address but I don't figure that is any help at all.  Should I delete everything and redownload and start from scratch or what? Nobody ever gets on my computer but me so it didn't happen from here but somehow through the Internet.  Just how secure are the wallets and how often is this happening?  I was under the impression that they were pretty secure against this kind of thing.  Anyway, it seems like it will be hard to trust the one I have again.  That is why I am thinking of deleting everything and starting over with new downloads.  What does anyone think about that?  Any suggestions?

As long as I wake up breathing it's all a bonus.  Sometimes not much of a bonus but still a bonus.
1480740837
Hero Member
*
Offline Offline

Posts: 1480740837

View Profile Personal Message (Offline)

Ignore
1480740837
Reply with quote  #2

1480740837
Report to moderator
1480740837
Hero Member
*
Offline Offline

Posts: 1480740837

View Profile Personal Message (Offline)

Ignore
1480740837
Reply with quote  #2

1480740837
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1480740837
Hero Member
*
Offline Offline

Posts: 1480740837

View Profile Personal Message (Offline)

Ignore
1480740837
Reply with quote  #2

1480740837
Report to moderator
1480740837
Hero Member
*
Offline Offline

Posts: 1480740837

View Profile Personal Message (Offline)

Ignore
1480740837
Reply with quote  #2

1480740837
Report to moderator
1480740837
Hero Member
*
Offline Offline

Posts: 1480740837

View Profile Personal Message (Offline)

Ignore
1480740837
Reply with quote  #2

1480740837
Report to moderator
FreeMoney
Legendary
*
Offline Offline

Activity: 1246


Strength in numbers


View Profile WWW
May 11, 2012, 02:45:01 AM
 #2

That sucks, sorry to hear.

What OS? Was your wallet encrypted? Did you ever back it up anywhere? Could a backup have leaked?

Play Bitcoin Poker at sealswithclubs.eu. We're active and open to everyone.
Rothgar
Sr. Member
****
Offline Offline

Activity: 375


Tune in to Neocash Radio


View Profile WWW
May 11, 2012, 02:46:56 AM
 #3

Do you see all the transactions in and there is a transaction out?

Shot in the dark:  Do you use any other "virtual currency?" 

Visit http://neocashradio.com for the premier weekly bitcoin podcast.
Follow neocashradio on twitter.  https://twitter.com/NeocashRadio
pirate1
Member
**
Offline Offline

Activity: 75



View Profile
May 11, 2012, 02:54:02 AM
 #4

No, I didn't have it encrypted.  I have never had any problems before and never bothered.  You can bet I will next time.  No, I don't use any other alternative currencies.  Yes, I can see the transaction out and the address though I don't see what good that will do me.  How often is this happening?  I think I am going to delete everything and start over.  I've got a couple of Bit Force Singles coming and I don't want this to happen again.  As it is 10 was about a month and a half of mining so that sucks but its not a real major hit.  I just want to make sure it doesn't happen again.  So if I delete everything and start over and next time I will encrypt my wallet what else should I do to make sure this doesn't happen?  I would like to understand how it happened this time.

As long as I wake up breathing it's all a bonus.  Sometimes not much of a bonus but still a bonus.
organofcorti
Donator
Legendary
*
Offline Offline

Activity: 1946


Poor impulse control.


View Profile WWW
May 11, 2012, 02:57:13 AM
 #5

Install any bitcoin related software lately?

Visit a bitcoin related website you haven't been to before, with javasccript turned on in your browser?

Bitcoin network and pool analysis 12QxPHEuxDrs7mCyGSx1iVSozTwtquDB3r
follow @oocBlog for new post notifications
pirate1
Member
**
Offline Offline

Activity: 75



View Profile
May 11, 2012, 03:14:02 AM
 #6

No to both.  I recently reloaded my guiminer since the last amd update seems to have killed my hashrate.  One of my cards went from about 275 m/hash to 30 and the other went from 275 to about 230.  I've been trying to get that figured out slowly for a week or so but I haven't visited anywhere new.  Just went by my pool, Bitclockers, to check on what I had there, and thought I would update my wallet with the new blocks.  I just ran my SuperAntiSpyware and it found a couple of things and a bunch of tracking cookies.  The two serious ones it found might have been my problem but I don't know for sure.  I am thinking the safest thing to do is to delete all my bitcoin stuff and start over though first I would like to understand exactly how this was done.

As long as I wake up breathing it's all a bonus.  Sometimes not much of a bonus but still a bonus.
notme
Legendary
*
Offline Offline

Activity: 1526


View Profile
May 11, 2012, 03:16:06 AM
 #7

Common antivirus may not yet detect bitcoin related malware.  If you are infected, redownloading bitcoin may not be enough.  If the malware also has a keylogger, encryption won't help either.  I would make a wallet on an airgapped Linux system if you want to store significant coinage.  Personally, I would never trust a windows box with anything more than a few bitcents.

https://www.bitcoin.org/bitcoin.pdf
While no idea is perfect, some ideas are useful.
12jh3odyAAaR2XedPKZNCR4X4sebuotQzN
Rothgar
Sr. Member
****
Offline Offline

Activity: 375


Tune in to Neocash Radio


View Profile WWW
May 11, 2012, 03:17:57 AM
 #8

notme beat me to it.  I wrote:

You'll need to do more than re install the client.  Your system must have been compromised somehow.  If you install another client, encrypt your wallet and only use addresses after encrypting.  

The fact is that there is a more serious issue.  Somehow a malicious program was run.  If you have a malicious program on the computer than you can't rule out that you have a keylogger which would compromise the encryption.  

Visit http://neocashradio.com for the premier weekly bitcoin podcast.
Follow neocashradio on twitter.  https://twitter.com/NeocashRadio
pirate1
Member
**
Offline Offline

Activity: 75



View Profile
May 11, 2012, 03:20:18 AM
 #9

I think I'll put my next wallet on a flash drive and just plug it in for transfers.  I am doing a pretty serious search now for any kind of spyware.  Yeah, I am worried about some kind of keylogger or something so I am running several malware searches.

As long as I wake up breathing it's all a bonus.  Sometimes not much of a bonus but still a bonus.
etotheipi
Legendary
*
expert
Offline Offline

Activity: 1428


Core Armory Developer


View Profile WWW
May 11, 2012, 03:42:34 AM
 #10

Or use Armory Offline Wallets to keep your Bitcoins off the internet completely.  It's designed to protect against exactly this...

I just made an Armory-plus-all-dependencies bundle that will work out of the box on Ubuntu 10.04 without ever touching the internet.  Especially good if you have an old laptop laying around with 256 MB of RAM.  Disable the wifi & bluetooth & ethernet in the BIOS, install Ubuntu 10.04 32-bit with all defaults, and then copy this file on there and run the "Install_All_Armory.sh" script.  Create your wallet, and make a watching-only copy to put on your internet-connected computer.   Of course, you need Armory on the online computer, too, but it's not a problem if it is Windows, even if the offline system is Linux. 

For more information, there's an Offline Wallet Tutorial on my website.  
</spam>

Founder and CEO of Armory Technologies, Inc.
Armory Bitcoin Wallet: Bringing cold storage to the average user!
Only use Armory software signed by the Armory Offline Signing Key (0x98832223)

Please donate to the Armory project by clicking here!    (or donate directly via 1QBDLYTDFHHZAABYSKGKPWKLSXZWCCJQBX -- yes, it's a real address!)
pirate1
Member
**
Offline Offline

Activity: 75



View Profile
May 11, 2012, 03:54:19 AM
 #11

This looks really interesting.  I will be looking into it.  I see a pretty high level of security in the Armory setup.  I like that nothing can be sent without going to the offline computer and getting it signed.  That would have saved my 10 BC tonight.  I want to make sure I am secure when I start mining with a much higher hash rate.

As long as I wake up breathing it's all a bonus.  Sometimes not much of a bonus but still a bonus.
Sukrim
Legendary
*
Offline Offline

Activity: 1848


View Profile
May 11, 2012, 08:35:07 AM
 #12

Maybe you also want to disclose the transaction or address where the 10 BTC went to? It might be helpful in finding out if the thief has emptied other wallets too...

https://bitfinex.com <-- leveraged trading of BTCUSD, LTCUSD and LTCBTC (long and short) - 10% discount on fees for the first 30 days with this refcode: x5K9YtL3Zb
Mail me at Bitmessage: BM-BbiHiVv5qh858ULsyRDtpRrG9WjXN3xf
Raoul Duke
aka psy
Legendary
*
Offline Offline

Activity: 1442



View Profile
May 11, 2012, 09:18:21 AM
 #13

Or instead of Malware was another case o0f someone with the RPC port open and accepting rpc commands from any IP in ther internet and a weak or non-existant password. Happened before...

pirate1
Member
**
Offline Offline

Activity: 75



View Profile
May 11, 2012, 04:15:05 PM
 #14

Here is the address the coins went to; 1PVc7JCJp3L3LqjzjjUw5Mm1NQHGFTj1fP.  I am not sure about the RPC port.  I think I have access turned off to everyone but our home network.  That is just my wife and I.  I know how to go to services and close RPC ports but I don't know which ports to close.  I can pull up a list of all my listening and established ports but am not sure where to go from there.  I'll be looking into it and making sure that everything is closed.  Any help would be apprecieated.

As long as I wake up breathing it's all a bonus.  Sometimes not much of a bonus but still a bonus.
Raoul Duke
aka psy
Legendary
*
Offline Offline

Activity: 1442



View Profile
May 11, 2012, 04:18:13 PM
 #15

you just need to check on your bitcoin.conf file if you have rpc user and password set, and port also, if you don't have user and password set, nor IP restriction for rpc access, check if you have port 8333 open(or is it 8332?).

Check the wiki for the correct port.

organofcorti
Donator
Legendary
*
Offline Offline

Activity: 1946


Poor impulse control.


View Profile WWW
May 11, 2012, 04:34:07 PM
 #16

Your money seems to have ended up here:

18yFjBtEsf9CgzAnVJdvSdPJ2i3Fb2AXrY

And there seems to be an additional 13 btc in mostly large bitdust from from other sources mixed with it. You might not be the only one affected.

Bitcoin network and pool analysis 12QxPHEuxDrs7mCyGSx1iVSozTwtquDB3r
follow @oocBlog for new post notifications
DeathAndTaxes
Donator
Legendary
*
Offline Offline

Activity: 1218


Gerald Davis


View Profile
May 11, 2012, 04:35:47 PM
 #17

Here is the address the coins went to; 1PVc7JCJp3L3LqjzjjUw5Mm1NQHGFTj1fP.  I am not sure about the RPC port.  I think I have access turned off to everyone but our home network.  That is just my wife and I. 

Obviously your wife just robbed you.
deus-ex-machina
Full Member
***
Offline Offline

Activity: 166



View Profile
May 11, 2012, 04:39:25 PM
 #18

I have an idea that might prevent this. What about generating a paper wallet? I know a site that can do that and the wallets generated would basically be like paper money once loaded. When unloaded, the paper would be shredded.
pirate1
Member
**
Offline Offline

Activity: 75



View Profile
May 11, 2012, 06:53:34 PM
 #19

Here is the transaction id;8dce4c12698bcd7588b82b84e2c325e63c336b3b1a1c30d4b19cda6e09fb05bd.  I am trying to follow it through Block Explorer but have never used it before and it will take me a little bit to understand it.  I am leaning toward just deleting my all my bitcoin software including the wallet then redownloading them.  I am also thinking about the Armory offline wallet.  The way that is set up looks pretty good and definitely secure.  No one could send anything out without getting a signature from my offline computer.  Does anyone know anything about Armory?  Can tracking the transaction tell me anything useful?  From what I see it goes to the receive address which has 31 transactions for a total of 24.3 bitcoins all of which were immediately transferred.  My 10.33 is in there.

As long as I wake up breathing it's all a bonus.  Sometimes not much of a bonus but still a bonus.
etotheipi
Legendary
*
expert
Offline Offline

Activity: 1428


Core Armory Developer


View Profile WWW
May 11, 2012, 07:07:50 PM
 #20

I am leaning toward just deleting my all my bitcoin software including the wallet then redownloading them.  I am also thinking about the Armory offline wallet.  The way that is set up looks pretty good and definitely secure.  No one could send anything out without getting a signature from my offline computer.  Does anyone know anything about Armory?  Can tracking the transaction tell me anything useful?  From what I see it goes to the receive address which has 31 transactions for a total of 24.3 bitcoins all of which were immediately transferred.  My 10.33 is in there.

I would advise re-installing your operating system.  Any "respectable" virus has embedded itself in your OS, and there's no way to know if it's truly been purged.  Sure, some A/V can get rid of certain viruses... But in my experience, it's actually easier and much more secure to just wipe your whole hard-drive and reinstall the OS.  But I'm slightly biased ... I have done this so many times (for a variety of reasons, not usually viruses) that I can be back up and running like before the reinstall in one evening.  Either way, there's a lot of peace of mind knowing that no virus can survive an OS reinstallation...

Feel free to PM me if you have any questions about Armory.  I'll be happy to help you get setup with it, or answer any questions you have about security or usage.  (or ask the questions here, if you don't mind derailing your own thread Smiley)

P.S. -- Here's the official forum thread on Armory, though I haven't been updating this page much anymore.  I've been trying to use the bitcoinarmory website more for such things...


Founder and CEO of Armory Technologies, Inc.
Armory Bitcoin Wallet: Bringing cold storage to the average user!
Only use Armory software signed by the Armory Offline Signing Key (0x98832223)

Please donate to the Armory project by clicking here!    (or donate directly via 1QBDLYTDFHHZAABYSKGKPWKLSXZWCCJQBX -- yes, it's a real address!)
Pages: [1] 2 3 »  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!