Bitcoin Talk account hacked any way to recover?

[TerraMaster]

Incase you are planning change the address, a small warning to you. I have captured your profile https://archive.today/AnssY

Are you an Admin? ... why do you seem so doubtful?, and no, take all the images you need too. I have nothing to hide. I am just giving the Admins time. I only sent them the documents 2 days ago, well 3 with today.. I think lol, and I am not going to bring in the devs that have verified me yet. Like the Admins here, they are very busy people, but in my corner now. Besides I think most know I am telling the truth. People just get a thrill out of beating up others in Bitcointalk. I have seen it over and over, but try to rise above it. I came here looking for help and I have been treated like I have done something wrong. Its like I am the guilty one until proven innocent, I mean, I never ever expected this when I started this thread. But that's ok, Ill do whatever it takes.

Actually I think the most realistic poster in here so far has been the fellow who has my MinermanNC account. And he more than anyone probably has put 2 and 2 together and is torn. And I understand because he got ripped off too. I believe he didn't steal my account, he was duped. He is as frustrated as I am no doubt. I guess I just want to have all doubt removed, that it is my account, for the rest in here. Then we'll go from there.  

[shorena]

I did not reply to this because I did not think it was necessary. As I said before, it proves that you owned the account once, but it does not prove that you did not stage the hack. I dont believe you did. As Quickseller told you and as I told you via PM, it is in your best interest to convince as many people as possible and the best way to do this is to post the proof you have publicly.

Incase you are planning change the address, a small warning to you. I have captured your profile https://archive.today/AnssY

Do you have full faith in these types of sites? that capture an image like you just did
-snip-

To be frank for a second. Your proof also depends on "these types of sites", at least a bit.

I have no problem to send a small amount to 19TDsep1Jhm4VDkbZK28tPze3pXhDwT8V4. Its a shared wallet so you can not sign a message, but I dont think its helping.

TX ID -> 2cd89c2364ca2a1aa1884c1f8f879061335132b3326e1c7dd1b48856e2e42684
link -> https://www.blocktrail.com/BTC/tx/2cd89c2364ca2a1aa1884c1f8f879061335132b3326e1c7dd1b48856e2e42684

Code:

-----BEGIN BITCOIN SIGNED MESSAGE-----
This is shorena from bitcointalk.org and today is 2015.03.13
I am in control of the address 1NfSYk1LFkfmFRmHw1LLr3jbCJXonYKzyK
and just send a small amount to TerraMaster / MinermanNC.
Please return the funds as donation to my node
-> 14GXh8khHXd8p4nQRCQdWi7fvHsNCDBkTG

-Sho
-----BEGIN SIGNATURE-----
1NfSYk1LFkfmFRmHw1LLr3jbCJXonYKzyK
IPkjckGXR/FhY22ctRmyjFcLZOBSee4G24PHbtp0LMYYK52wkH/DTPw+Fq9WIRZkAE3aA+3eRV7fyADz1UJZzXs=
-----END BITCOIN SIGNED MESSAGE-----

[Muhammed Zakir]

Quoting:

I did not reply to this because I did not think it was necessary. As I said before, it proves that you owned the account once, but it does not prove that you did not stage the hack. I dont believe you did. As Quickseller told you and as I told you via PM, it is in your best interest to convince as many people as possible and the best way to do this is to post the proof you have publicly.

Incase you are planning change the address, a small warning to you. I have captured your profile https://archive.today/AnssY

Do you have full faith in these types of sites? that capture an image like you just did
-snip-

To be frank for a second. Your proof also depends on "these types of sites", at least a bit.

I have no problem to send a small amount to 19TDsep1Jhm4VDkbZK28tPze3pXhDwT8V4. Its a shared wallet so you can not sign a message, but I dont think its helping.

TX ID -> 2cd89c2364ca2a1aa1884c1f8f879061335132b3326e1c7dd1b48856e2e42684
link -> https://www.blocktrail.com/BTC/tx/2cd89c2364ca2a1aa1884c1f8f879061335132b3326e1c7dd1b48856e2e42684

Code:

-----BEGIN BITCOIN SIGNED MESSAGE-----
This is shorena from bitcointalk.org and today is 2015.03.13
I am in control of the address 1NfSYk1LFkfmFRmHw1LLr3jbCJXonYKzyK
and just send a small amount to TerraMaster / MinermanNC.
Please return the funds as donation to my node
-> 14GXh8khHXd8p4nQRCQdWi7fvHsNCDBkTG

-Sho
-----BEGIN SIGNATURE-----
1NfSYk1LFkfmFRmHw1LLr3jbCJXonYKzyK
IPkjckGXR/FhY22ctRmyjFcLZOBSee4G24PHbtp0LMYYK52wkH/DTPw+Fq9WIRZkAE3aA+3eRV7fyADz1UJZzXs=
-----END BITCOIN SIGNED MESSAGE-----

Did TerraMaster gave you proof that 19TDsep1Jhm4VDkbZK28tPze3pXhDwT8V4 is associated with his account? I couldn't find it when I searched in the forum. Thank you!

[shorena]

Quoting:
-snip-

Did TerraMaster gave you proof that 19TDsep1Jhm4VDkbZK28tPze3pXhDwT8V4 is associated with his account? I couldn't find it when I searched in the forum. Thank you!

Yes, in a sense. They found an old thread that was archived, where the address is in the signature. I was also presented with a screenshot of it. Since it belongs to a service they are unable to sign a message with it. I am a bit vague here, not because I dont know any better, but I think TerraMaster should reveal those information, not me.

I received 0.01172746 via TX ID 632c7ce982285db0cab46bb0339da771f70722e624d3bc22a2bd4250c5040c4a
link: https://www.blocktrail.com/BTC/tx/632c7ce982285db0cab46bb0339da771f70722e624d3bc22a2bd4250c5040c4a

Its 0.01 higher because of said services policies. I will return the 0.01 to a proper wallet if requested or keep it as donation for my node, whichever suits TerraMaster better. I know you gave me the option to keep it via PM, but I have no problem sending it to any address requested.

[TerraMaster]

Quoting:
-snip-

Did TerraMaster gave you proof that 19TDsep1Jhm4VDkbZK28tPze3pXhDwT8V4 is associated with his account? I couldn't find it when I searched in the forum. Thank you!

Yes, in a sense. They found an old thread that was archived, where the address is in the signature. I was also presented with a screenshot of it. Since it belongs to a service they are unable to sign a message with it. I am a bit vague here, not because I dont know any better, but I think TerraMaster should reveal those information, not me.

I received 0.01172746 via TX ID 632c7ce982285db0cab46bb0339da771f70722e624d3bc22a2bd4250c5040c4a
link: https://www.blocktrail.com/BTC/tx/632c7ce982285db0cab46bb0339da771f70722e624d3bc22a2bd4250c5040c4a

Its 0.01 higher because of said services policies. I will return the 0.01 to a proper wallet if requested or keep it as donation for my node, whichever suits TerraMaster better. I know you gave me the option to keep it via PM, but I have no problem sending it to any address requested.

Hey shorena,  
yes please keep the difference as a donation to the node, which I did visit your website for that earlier today, pretty cool. And thank you for respecting the privacy of that particular wallet service, it is the active account address that mattered.

As far as posting all relevant data regarding the account MinermanNC. I will begin posting some items later this evening for those who wish to review. Some will be screenshots and some will be links etc. And I will include more detailed data of the actual Trojans found that resulted from the bad wallet download where this all began, regretfully.

THX

EDIT: will post some thing tomorrow. thx

[MinermanNC]

Honestly, I am not yet sure, that you are not staging it. Most of the proof submitted here by you, can easily be faked.

This question I think is still inadequately answered:
Why did you take 3 days to realize your account was hacked?

I didn't understand how you are proving that address actually belongs to you? especially since you can't sign it? All I can see is that you are wearing that address in your profile, but you can wear anyone's address. So where is the catch?

Even if you controlled it once, what is the proof that you didn't stage it. I can, if needed, stage most of the things you did here, including finding an infected wallet for this. Scams are getting more confiscated and my estimate atm is a 60% chance that the account was actually hacked, 30% chance that you sold it to me, 10% chance that you either controlled it once and not now (or you never did).

I think it would be unfair for an administrator to reset the account to OP. It will make the one who was not very careful, get his hacked* account back, all expenses borne by me, who is not willing to do so.

[TerraMaster]

Honestly, I am not yet sure, that you are not staging it. Most of the proof submitted here by you, can easily be faked.

This question I think is still inadequately answered:
Why did you take 3 days to realize your account was hacked?

I didn't understand how you are proving that address actually belongs to you? especially since you can't sign it? All I can see is that you are wearing that address in your profile, but you can wear anyone's address. So where is the catch?

Even if you controlled it once, what is the proof that you didn't stage it. I can, if needed, stage most of the things you did here, including finding an infected wallet for this. Scams are getting more confiscated and my estimate atm is a 60% chance that the account was actually hacked, 30% chance that you sold it to me, 10% chance that you either controlled it once and not now (or you never did).

I think it would be unfair for an administrator to reset the account to OP. It will make the one who was not very careful, get his hacked* account back, all expenses borne by me, who is not willing to do so.

Hey I will post shortly the unedited image of my MinermanNC account with my same wallet address that I still am using now.

I understand your looking for some way to disprove me, despite everything so far and what I plan to post. I know you got took when you bought the account... that's a given. And as far as not logging in, I spent the next 2 days scanning and racing around changing passwords to more important accounts, and ultimately pulled that infected hard drive offline. It was the weekend you know and pretty weather here,,,, like I said and I was very busy with other things. Surely You can provide some addresses etc. to prove your story as well, I don't think we have seen much proof of anything from you end, its been me doing all the work and I am the victim! lol which should become even more obvious today. And I am not staging anything, that is pure hogwash. I am very successful in here as MinermanNC, and as Miner. I have several friends in here who know me, a few good devs as well, you can see my PM's,,, do you really think I would sell my account?? and why? and what about my scryptonite account that got stolen and the pass changed within minutes of MMNC?,,, did I stage that as well? come on now.... 

Look I understand your out a few bucks, I am 2 years of work. So what do I do?

[TerraMaster]

My current profile TerraMaster: Image capture courtesy of Muhammed Zakir
Direct Link: https://archive.today/AnssY



My MinermanNC profile: Image capture courtesy of "Dnotes" The coin dev of Dnotes coin. feel free to PM him and verify this.

Direct Link: https://web.archive.org/web/20140519215559/https://bitcointalk.org/index.php?topic=470155.1320    3rd post down.


Link to my website still active as listed in my profile as shown:
http://coindrone.com/

My other account, "scryptonite" also stolen at the same time. Passwords changed at basically the same time. https://bitcointalk.org/seclog.php

•March 08, 2015, 01:14:22 PM - MinermanNC - password changed
•March 08, 2015, 01:12:55 PM - hallared - password changed
•March 08, 2015, 01:10:48 PM - scryptonite - password changed
•March 08, 2015, 01:06:02 PM - MinermanNC - password changed

My scryptonite account profile from the web as it shows now after the hack.



Link to my website still active as listed in my profile as shown:
http://www.coinnoodle.com/

The confirmed transactions info as confirmed by "shorena"

Your deposit info:

BitCoin 19TDsep1Jhm4VDkbZK28tPze3pXhDwT8V4 0.00172746 BTC 2015-03-13 06:25:53
BTC TrxID: 2cd89c2364ca2a1aa1884c1f8f879061335132b3326e1c7dd1b48856e2e42684

BTC sent back info:

BitCoin 14GXh8khHXd8p4nQRCQdWi7fvHsNCDBkTG 0.01272746 BTC Yes 2015-03-13 11:49:46
Processed TrxID: 632c7ce982285db0cab46bb0339da771f70722e624d3bc22a2bd4250c5040c4a @ 2015-03-13 12:04:30

Yes this is an online wallet, still active, still owned by me, and as has served as my signature address for MinermanNC and now TerraMaster. Verified by shorena.

The actual backdoor Trojan found after the hack/intrusion into my PC while I slept. NOTICE the time/date and source of Trojan. Blackcatcoin wallet QT.
This scan was performed after removing hard drive and scanned using another PC before I went to bed Sunday Night.



I will post later the other Trojans and viruses I found from that wallet install, but will have to load up that hard drive and get a screenshot from malware bytes scan also showing time and dates. I'm sure it will help fill in some of the gaps of time chasing all this down. I have also posted in here earlier other Items such as the associated IP address of the hacker and so forth. Please take a second look at that stuff too.

THX for looking.

MMNC  










 

[MinermanNC]

My current profile TerraMaster: Image capture courtesy of Muhammed Zakir
Direct Link: https://archive.today/AnssY



My MinermanNC profile: Image capture courtesy of "Dnotes" The coin dev of Dnotes coin. feel free to PM him and verify this.

Direct Link: https://web.archive.org/web/20140519215559/https://bitcointalk.org/index.php?topic=470155.1320    3rd post down.


Link to my website still active as listed in my profile as shown:
http://coindrone.com/

My other account, "scryptonite" also stolen at the same time. Passwords changed at basically the same time. https://bitcointalk.org/seclog.php

•March 08, 2015, 01:14:22 PM - MinermanNC - password changed
•March 08, 2015, 01:12:55 PM - hallared - password changed
•March 08, 2015, 01:10:48 PM - scryptonite - password changed
•March 08, 2015, 01:06:02 PM - MinermanNC - password changed

My scryptonite account profile from the web as it shows now after the hack.



Link to my website still active as listed in my profile as shown:
http://www.coinnoodle.com/

The confirmed transactions info as confirmed by "shorena"

Your deposit info:

BitCoin 19TDsep1Jhm4VDkbZK28tPze3pXhDwT8V4 0.00172746 BTC 2015-03-13 06:25:53
BTC TrxID: 2cd89c2364ca2a1aa1884c1f8f879061335132b3326e1c7dd1b48856e2e42684

BTC sent back info:

BitCoin 14GXh8khHXd8p4nQRCQdWi7fvHsNCDBkTG 0.01272746 BTC Yes 2015-03-13 11:49:46
Processed TrxID: 632c7ce982285db0cab46bb0339da771f70722e624d3bc22a2bd4250c5040c4a @ 2015-03-13 12:04:30

Yes this is an online wallet, still active, still owned by me, and as has served as my signature address for MinermanNC and now TerraMaster. Verified by shorena.

The actual backdoor Trojan found after the hack/intrusion into my PC while I slept. NOTICE the time/date and source of Trojan. Blackcatcoin wallet QT.
This scan was performed after removing hard drive and scanned using another PC before I went to bed Sunday Night.



I will post later the other Trojans and viruses I found from that wallet install, but will have to load up that hard drive and get a screenshot from malware bytes scan also showing time and dates. I'm sure it will help fill in some of the gaps of time chasing all this down. I have also posted in here earlier other Items such as the associated IP address of the hacker and so forth. Please take a second look at that stuff too.

THX for looking.

MMNC  
 

I will put the address of Theymos in my profile and take snapshots of both and what? I am Theymos?

Can you explain how shorena proved that it is your own address? I can most probably disprove your claim.


As for the MSE snapshot, I had plaenty of examples. Only I switched from Windows Defender (that is its name in WIndows 8.1) to another service which offers better security.
And I think I removed the items from Quarantine.

None of them is a credible proof.

[Muhammed Zakir]

My current profile TerraMaster: Image capture courtesy of Muhammed Zakir
Direct Link: https://archive.today/AnssY

[ img]http://s22.postimg.org/rjzo928oh/TM_profile.jpg[/img]

Incase you are planning change the address, a small warning to you. I have captured your profile https://archive.today/AnssY

Do you have full faith in these types of sites? that capture an image like you just did
-snip-

The confirmed transactions info as confirmed by "shorena"

Your deposit info:

BitCoin 19TDsep1Jhm4VDkbZK28tPze3pXhDwT8V4 0.00172746 BTC 2015-03-13 06:25:53
BTC TrxID: 2cd89c2364ca2a1aa1884c1f8f879061335132b3326e1c7dd1b48856e2e42684

BTC sent back info:

BitCoin 14GXh8khHXd8p4nQRCQdWi7fvHsNCDBkTG 0.01272746 BTC Yes 2015-03-13 11:49:46
Processed TrxID: 632c7ce982285db0cab46bb0339da771f70722e624d3bc22a2bd4250c5040c4a @ 2015-03-13 12:04:30

Don't online wallets usually send coins from same address when withdrawing? I couldn't understand this part. Please make the proofs public as much as possible.

[MinermanNC]

OP is too vague and has not provided any credible proof till now.

I sincerely hope, administrators won't make the victim instead. He gave this account low priority, and all this is because of his carelessness and negligence.

No offence.

[MinermanNC]

I am going to fake I am Muhammad Zakir by giving same stupid proofs as you did.

[Neonecrox13]

OP is too vague and has not provided any credible proof till now.

I sincerely hope, administrators won't make the victim instead. He gave this account low priority, and all this is because of his carelessness and negligence.

No offence.

Don't worry. They won't get it back no time soon if they do then. You got well enough time to do a month or 3 sig campaigns to get your btc back.

[MinermanNC]

I am going to fake I am Muhammad Zakir by giving same stupid proofs as you did.

Done. Didn't bother to take snapshots.

Check my profile. See anything similar? Now you know that I am Muhammad Zakir.  (I am acting like OP did)

Send 0.001 to that address, I will check the receiving address from any block explorers and send the amount to it from my wallet.

I also have alts other than these 2 (if I don't I will pay someone to do it) , and I will confirm from them that this is my account.


P.S. I haven't changed anything (except address just now, password and email). Nothing at all. Deleted none of the posts you made. Yet, you cannot come up with a proper proof?

[TerraMaster]

I am going to fake I am Muhammad Zakir by giving same stupid proofs as you did.

Done. Didn't bother to take snapshots.

Check my profile. See anything similar? Now you know that I am Muhammad Zakir.  (I am acting like OP did)

Send 0.001 to that address, I will check the receiving address from any block explorers and send the amount to it from my wallet.

I also have alts other than these 2 (if I don't I will pay someone to do it) , and I will confirm from them that this is my account.


P.S. I haven't changed anything (except address just now, password and email). Nothing at all. Deleted none of the posts you made. Yet, you cannot come up with a proper proof?

Now you are really "grasping at straws"  

I wish I was half as smart and clever as all that you described,,, but you lost me. Are you sure your not the hacker? you may be showing your true colors here now,,, you seem to be pretty crafty all of the sudden?  How do we know your not raindev, or even Blackcatdev ?  I think you got some explaining to do of your own.

Prove how much you say you paid some guy for this account and so on... you claim .75 BTC? .. transactions? and where were you and what were you doing when my account passwords got changed? and why did you NOT get proof he owned the account by asking for a signature address yourself?

You have not presented much of anything substantial in here ... at all.

I have been giving you the benefit of the doubt until now. I think everyone needs to demand a little more proof of your pretty lame story of how you came to get ahold of it?

Actually I am wondering if you didn't steal the account to begin with.... How do we know if you didn't steal it? maybe you are raindev and you realized I had started a thread wanting my stolen account back which, immediately got us both negative remarks, and so now you are just trying to save face and somehow get the bad remarks removed so you can continue on trying to sell it off to some sucker? Prove that? I am really having second thoughts about your claim and I think its high time you catch a little scrutiny in here on your claims.

I have presented more than enough for most with any common sense to draw a logical conclusion now. If there is something more I can add to satisfy an Admin, or persons that have realistic questions, and not bogus, farfetched and stretched imaginative type questions, then all they have to do is ask.

THX, everyone else.

[MinermanNC]

I am going to fake I am Muhammad Zakir by giving same stupid proofs as you did.

Done. Didn't bother to take snapshots.

Check my profile. See anything similar? Now you know that I am Muhammad Zakir.  (I am acting like OP did)

Send 0.001 to that address, I will check the receiving address from any block explorers and send the amount to it from my wallet.

I also have alts other than these 2 (if I don't I will pay someone to do it) , and I will confirm from them that this is my account.


P.S. I haven't changed anything (except address just now, password and email). Nothing at all. Deleted none of the posts you made. Yet, you cannot come up with a proper proof?

Now you are really "grasping at straws"  

I wish I was half as smart and clever as all that you described,,, but you lost me. Are you sure your not the hacker? you may be showing your true colors here now,,, you seem to be pretty crafty all of the sudden?  How do we know your not raindev, or even Blackcatdev ?  I think you got some explaining to do of your own.

Prove how much you say you paid some guy for this account and so on... you claim .75 BTC? .. transactions? and where were you and what were you doing when my account passwords got changed? and why did you NOT get proof he owned the account by asking for a signature address yourself?

You have not presented much of anything substantial in here ... at all.

I have been giving you the benefit of the doubt until now. I think everyone needs to demand a little more proof of your pretty lame story of how you came to get ahold of it?

Actually I am wondering if you didn't steal the account to begin with.... How do we know if you didn't steal it? maybe you are raindev and you realized I had started a thread wanting my stolen account back which, immediately got us both negative remarks, and so now you are just trying to save face and somehow get the bad remarks removed so you can continue on trying to sell it off to some sucker? Prove that? I am really having second thoughts about your claim and I think its high time you catch a little scrutiny in here on your claims.

I have presented more than enough for most with any common sense to draw a logical conclusion now. If there is something more I can add to satisfy an Admin, or persons that have realistic questions, and not bogus, farfetched and stretched imaginative type questions, then all they have to do is ask.

THX, everyone else.

I was expecting this kind of behavior. When you can't defend yourself, you go offensive.

I have enough brains to know that none of the proofs you submitted is real. You can't disprove it, can you?

I am not a scammer. And never will be. I busts scams not do that myself. If I hacked your account (which is something I would never do). as you suddenly act to be suspicious, I would have sold it. It is common sense.

I have posted transaction ids of the transactions a few posts back.You can check the timing, amount and anything you like. Administrators will also be able to check the PMs.

The burden of proving that your account is hacked is not mine. It is yours. Yet, you couldn't do that.

[TerraMaster]

You only came forward because the account is worthless with the negative remarks. Plus, I have proven I own MinermanNC, No matter what you say, that address in the screen capture of MinermanNC, IS MY WALLET ADDRESS PERIOD, ....then, now and in the future.

And what about the coindrone.com advertisement in that image capture, a website domain I STILL OWN. I suppose I copied and pasted that and went out and created a website to match? lol that in itself should speak volumes about my truthfulness.  like I said you are grasping at straws.

And to think I was almost a bit sympathetic about your situation... and taking that into considerations, for when all this is over.

Like I said before, and Ill say it again, you could do the right thing and simply return my account at anytime. Sometimes good things come to those with honesty and integrity.

MMNC

[shorena]

-snip-
Don't online wallets usually send coins from same address when withdrawing? I couldn't understand this part. Please make the proofs public as much as possible.

No, thats the problem, they send it from another address that also blongs to their wallet system. Its not random, but for an outside it might very well be.

--

-snip-

-snip-

Like I said earlier you two should considering finding a solution without theymos where you both bleed a little. Its reasonable that you both are the victim here. Sadly its also reasonable that either one of you is lying. I start to understand why some accounts just dont get restored. There is just no way for theymos or anyone else for that matter to know what happend and who should have the account.

[Muhammed Zakir]

I confirm that the address shorena sent Bitcoins to is his. It is an online wallet and he doesn't have access to private keys.

I can't say what to do. IMHO TerraMaster should pay atleast a small mutually agreed amount to get the account back.

Now it's upto you two. Decide what you are going to do and make everything public. I will be watching. Good luck!

Edit:

No, thats the problem, they send it from another address that also blongs to their wallet system. Its not random, but for an outside it might very well be.

I understood when he sent me the proofs.

-snip-

-snip-

Like I said earlier you two should considering finding a solution without theymos where you both bleed a little. Its reasonable that you both are the victim here. Sadly its also reasonable that either one of you is lying. I start to understand why some accounts just dont get restored. There is just no way for theymos or anyone else for that matter to know what happend and who should have the account.

(Y).

[Quickseller]

Like I said earlier you two should considering finding a solution without theymos where you both bleed a little. Its reasonable that you both are the victim here. Sadly its also reasonable that either one of you is lying. I start to understand why some accounts just dont get restored. There is just no way for theymos or anyone else for that matter to know what happend and who should have the account.

I think theymos/BadBear should look into the matter and say if it is reasonable to say that the account was hacked or if it is too difficult to say one way or another.

If the OP cannot sign a message from an address associated with the account today, then it would explain his lack of ability to sign a message from an address associated with the account when the account was sold.

I would say the evidence provided and claims to be able to provide in order to prove ownership is circumstantial at best. The timeline is almost a perfect match of someone trying to scam (referring to the OP)