Two days ago my wallet at blockchain.info was hacked, everything was taken (760 coins).

https://blockchain.info/tx/0619d221a761a3b8ec205773440fa6607d65957ef985dac5fb5273a08bda2c89

Besides the password I use Google two step verification. I also use this on the gmail that I use to authorise computers, anybody knows how this could have happened?

I backed up my wallet to Google Drive.

Could you be more specific on which 2 way authentication you used? What where the exact steps so we can rebuild the scenario or at least understand what happened exactly.

If it was email by gmail consider the machines you used the blockchain.info/ gmail on as compromised. Most probably all login forms on this machines have been grabbed.

  • 1
    I used the Google 2-Step authentication. – Bastiaan Quast May 19 '13 at 8:07

From this link: https://support.google.com/accounts/answer/180744?hl=en

Keep it simple During sign in, you can tell us not to ask for a code again on that particular computer. You'll still be covered, because we'll ask for codes when you or anyone else tries to sign in to your account from other computers.

Is it possible that you had authorized the computer the transaction was initiated from? This would match the idea that the computer was/is compromised. With a remote control tool an attacker eventually was able to login over this pc and make the transaction through remote control desktop.

If this is true, consider all actions taken on this computer as logged.

  • yes I considered this, I authorized two computers, one ubuntu gnome 13.04, and a chromebook. Also a rooted S3 running CM10.1. – Bastiaan Quast May 20 '13 at 9:34
  • ah and as can be seen from the link, the command originated from somewhere near Ghana, I am in Geneva. – Bastiaan Quast May 20 '13 at 9:35
  • 1
    Well, id contact blockchain.info asap to get more precise information. Beside that, there might be a slim chance the intruder has still the bot/trojan running (bots usually dont have remote control, my bet it was a trojan), in best case the intruder did not use a proxy, in worst case he had a multi proxy environment. Anyway, id monitor the traffic from the compomised machine in hope to get an ip where this bot connects to. Maybe from there this security.stackexchange.com is the place to go. On popular hackforums are also articles about tracing down trojan owners. – Aurigae May 20 '13 at 11:48
  • 1
    The map showing a location 'somewhere near Ghana' is just showing latitude 0, longitude 0, so it's very unlikely that the request was actually from there. – kybernetikos Jun 11 '13 at 0:00

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.