7

Two days ago my wallet at blockchain.info was hacked, everything was taken (760 coins).

https://blockchain.info/tx/0619d221a761a3b8ec205773440fa6607d65957ef985dac5fb5273a08bda2c89

Besides the password I use Google two step verification. I also use this on the gmail that I use to authorise computers, anybody knows how this could have happened?

I backed up my wallet to Google Drive.

Improve this question
2
  • Did you use Google Authenticator? support.google.com/accounts/answer/1066447?hl=en
    – Pacerier
    Commented Aug 10, 2013 at 7:40
  • In 2017 (this question is from 2013) it would be irresponsible to store 760 coins (~$1.4M) on any custodial account. Get a hardware wallet.
    – Erik
    Commented May 13, 2017 at 23:43

3 Answers 3

Reset to default
2

Could you be more specific on which 2 way authentication you used? What where the exact steps so we can rebuild the scenario or at least understand what happened exactly.

If it was email by gmail consider the machines you used the blockchain.info/ gmail on as compromised. Most probably all login forms on this machines have been grabbed.

Improve this answer
1
  • 1
    I used the Google 2-Step authentication.
    – Bastiaan Quast
    Commented May 19, 2013 at 8:07
0

From this link: https://support.google.com/accounts/answer/180744?hl=en

Keep it simple During sign in, you can tell us not to ask for a code again on that particular computer. You'll still be covered, because we'll ask for codes when you or anyone else tries to sign in to your account from other computers.

Is it possible that you had authorized the computer the transaction was initiated from? This would match the idea that the computer was/is compromised. With a remote control tool an attacker eventually was able to login over this pc and make the transaction through remote control desktop.

If this is true, consider all actions taken on this computer as logged.

Improve this answer
4
  • yes I considered this, I authorized two computers, one ubuntu gnome 13.04, and a chromebook. Also a rooted S3 running CM10.1.
    – Bastiaan Quast
    Commented May 20, 2013 at 9:34
  • ah and as can be seen from the link, the command originated from somewhere near Ghana, I am in Geneva.
    – Bastiaan Quast
    Commented May 20, 2013 at 9:35
  • 1
    Well, id contact blockchain.info asap to get more precise information. Beside that, there might be a slim chance the intruder has still the bot/trojan running (bots usually dont have remote control, my bet it was a trojan), in best case the intruder did not use a proxy, in worst case he had a multi proxy environment. Anyway, id monitor the traffic from the compomised machine in hope to get an ip where this bot connects to. Maybe from there this security.stackexchange.com is the place to go. On popular hackforums are also articles about tracing down trojan owners.
    – Aurigae
    Commented May 20, 2013 at 11:48
  • 1
    The map showing a location 'somewhere near Ghana' is just showing latitude 0, longitude 0, so it's very unlikely that the request was actually from there.
    – Adam Iley
    Commented Jun 11, 2013 at 0:00
0

This is an old question but I found this link on reddit while reading something else.

I backed up my wallet to Google Drive

Not sure what went wrong in your case but bitcoin related information or any credentials should never be saved in Google drive. Anyone who gets the access to this drive can make a huge impact on your life in few minutes and few things are irreversible like bitcoin transactions.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.