0

First of all, this is to bring awareness of how an attacher may gain access to a persons' Blockchain Wallet: i hope this never happens to anyone else but it probably will. i am quite new to bitcoin, like probably a month. I feel stupid, no one need remind me. what happened is this: i was on fb asking questions about a transaction i did to a third party that was pending for like 2 days, and the other person still hadnt seen it yet in their account so i was worried. so i was asking about this happening etc. and a person on fb commented it wasnt unusual to take a while for transactions to process. so start private messaging, asking all sorts of questions. says he works for blockchain. And then he says this" blockchain wallet is starting to do mining with the extra funds in a wallet but it is only available in certain countries, not in the us yet, due to regulations. so we talk on, he says he can set up a new blockchain wallet to also do mining with the extra funds even if i live in the states. then if i want i can fund it. so i create the wallet with no btc in it, and send him the identifier and pw. he was supposed to do some settings to it to access the mining aspect,, and i log back in, change the password,, and fund it, i see the balance in the new wallet and after few seconds balance goes to zero. he says that is because it is now in the mining side of blockchain. then he says, add more btc to see what the proceeds are from the mining. i am starting to realize right then i had been scammed. he kept saying no, just add more btc to see the balance, etc. it went on like that for a while. i was out a few hundred dollars. what I think what he did was sink his smart phone to the account and it stayed sinked to the account, even though i changed the pw. or perhaps there was some crypto-key he accessed and was then able to take the money out. i still dont really know. but i think BLOCKCHAIN Wallet should plug that hole ! so it doesnt happen to more people... so i have changed a bunch of my passwords, etc, hoping that's the end of it. i had my cellphone listed in the verify section etc. so i went in and put in another number hoping that stops anything there. after this, i really had to re-think bitcoin and how easy it was to get scammed. i would say i was very tired, been working some long hours, and was worried about the other transaction going thru. i know there is no way to get it back, just have to take the lesson, but i want to make sure there are no other doors for this guy to walk thru since he got that information. also, he would have had the private key off the log in and just got it that way somehow.. Something Blockchain could do that would have prevented this: Not to allow more than one incidence of the wallet being open at once, or Notifying the user when more than once incidence is Open. Has anyone else been scammed , please share what happened ?

closed as unclear what you're asking by Jestin, Andrew Chow Jan 10 '18 at 21:40

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

3

Yep, you got scammed all right. Sorry to hear about that. As I suppose you have realized, everything the guy told you was total nonsense.

perhaps there was some crypto-key he accessed and was then able to take the money out.

I think that's exactly right. Blockchain.info lets you (i.e. the person with the password) retrieve and back up the private keys and wallet seed for the addresses in that account. Having the private key for an address always allows you to spend money received by an account; if you have the private key you don't need any other passwords or anything else. Keeping a backup of the private keys guarantees that you will have access to all funds received in that account, now or in the future, even if you forget your password, change it to something you don't know, or if the blockchain.info site quits working.

Of course, when someone else has the password and uses it to get the private keys, they get this same power, and can spend the coins even if the password is later changed.

i think BLOCKCHAIN Wallet should plug that hole ! so it doesnt happen to more people

I don't think they should, since as I mentioned above, if used properly, it's not a hole, but a safety feature. One of the things that many people like about Bitcoin is that it's decentralized - your control over your funds is not dependent on any one company or government. Having backups of your own private keys is a big part of that.

so i have changed a bunch of my passwords, etc, hoping that's the end of it. i had my cellphone listed in the verify section etc. so i went in and put in another number hoping that stops anything there

Caution. The scammer still has the private keys, so he still has the ability to take out any further funds you might put in that account. As you saw, changing the password won't help with that, nor will the two-factor authentication.

The best thing to do would just be to never use that blockchain.info account again. If you still want to use the site, make a brand new account. (There might be a way to reset the private key - I am not sure - but I would be reluctant to try that unless you are sure you know what you're doing.)

  • Ok, but shouldnt the private key be somewhere else then on the front of the log in page for all to see ? perhaps keep it safely tucked away. anyone walking by, a spouse, child, etc, can bring up blockchain and get the key, it is right there on the log in screen. or is that supposed to changed to a username once it is copied and safely tucked away.. – lightfoot Jan 10 '18 at 3:55
  • or is the wallet ID that is used to log in with, different from the private key that someone can use to take btc out of an account – lightfoot Jan 10 '18 at 4:02
  • Yeah, the wallet ID and login are not the same as the private keys. I just made a test account to see how blockchain.info does it. The master private key is encoded as the "backup recovery phrase". You can find it in the Security Center menu; the phrase itself isn't shown until you have clicked through several confirmations, and only 4 of the 12 words are shown at a time. It's certainly not "on the front of the login page". – Nate Eldredge Jan 10 '18 at 4:08
  • ok, so you would guess he copied down those 12 words and that is how he regained access. i just wasnt thinking yesterday. i was aware of them. but still, that would give many people access. – lightfoot Jan 10 '18 at 13:03
  • 1
    That's why it is important to "backup phrase" ASAP after creating an account, because once backed up and the recovery phrase shows as Verified. No one can view seeds again. – Chak Jan 13 '18 at 16:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.