First of all, this is to bring awareness of how an attacher may gain access to a persons' Blockchain Wallet: i hope this never happens to anyone else but it probably will. i am quite new to bitcoin, like probably a month. I feel stupid, no one need remind me. what happened is this: i was on fb asking questions about a transaction i did to a third party that was pending for like 2 days, and the other person still hadnt seen it yet in their account so i was worried. so i was asking about this happening etc. and a person on fb commented it wasnt unusual to take a while for transactions to process. so start private messaging, asking all sorts of questions. says he works for blockchain. And then he says this" blockchain wallet is starting to do mining with the extra funds in a wallet but it is only available in certain countries, not in the us yet, due to regulations. so we talk on, he says he can set up a new blockchain wallet to also do mining with the extra funds even if i live in the states. then if i want i can fund it. so i create the wallet with no btc in it, and send him the identifier and pw. he was supposed to do some settings to it to access the mining aspect,, and i log back in, change the password,, and fund it, i see the balance in the new wallet and after few seconds balance goes to zero. he says that is because it is now in the mining side of blockchain. then he says, add more btc to see what the proceeds are from the mining. i am starting to realize right then i had been scammed. he kept saying no, just add more btc to see the balance, etc. it went on like that for a while. i was out a few hundred dollars. what I think what he did was sink his smart phone to the account and it stayed sinked to the account, even though i changed the pw. or perhaps there was some crypto-key he accessed and was then able to take the money out. i still dont really know. but i think BLOCKCHAIN Wallet should plug that hole ! so it doesnt happen to more people... so i have changed a bunch of my passwords, etc, hoping that's the end of it. i had my cellphone listed in the verify section etc. so i went in and put in another number hoping that stops anything there. after this, i really had to re-think bitcoin and how easy it was to get scammed. i would say i was very tired, been working some long hours, and was worried about the other transaction going thru. i know there is no way to get it back, just have to take the lesson, but i want to make sure there are no other doors for this guy to walk thru since he got that information. also, he would have had the private key off the log in and just got it that way somehow.. Something Blockchain could do that would have prevented this: Not to allow more than one incidence of the wallet being open at once, or Notifying the user when more than once incidence is Open. Has anyone else been scammed , please share what happened ?
Yep, you got scammed all right. Sorry to hear about that. As I suppose you have realized, everything the guy told you was total nonsense.
perhaps there was some crypto-key he accessed and was then able to take the money out.
I think that's exactly right. Blockchain.info lets you (i.e. the person with the password) retrieve and back up the private keys and wallet seed for the addresses in that account. Having the private key for an address always allows you to spend money received by an account; if you have the private key you don't need any other passwords or anything else. Keeping a backup of the private keys guarantees that you will have access to all funds received in that account, now or in the future, even if you forget your password, change it to something you don't know, or if the blockchain.info site quits working.
Of course, when someone else has the password and uses it to get the private keys, they get this same power, and can spend the coins even if the password is later changed.
i think BLOCKCHAIN Wallet should plug that hole ! so it doesnt happen to more people
I don't think they should, since as I mentioned above, if used properly, it's not a hole, but a safety feature. One of the things that many people like about Bitcoin is that it's decentralized - your control over your funds is not dependent on any one company or government. Having backups of your own private keys is a big part of that.
so i have changed a bunch of my passwords, etc, hoping that's the end of it. i had my cellphone listed in the verify section etc. so i went in and put in another number hoping that stops anything there
Caution. The scammer still has the private keys, so he still has the ability to take out any further funds you might put in that account. As you saw, changing the password won't help with that, nor will the two-factor authentication.
The best thing to do would just be to never use that blockchain.info account again. If you still want to use the site, make a brand new account. (There might be a way to reset the private key - I am not sure - but I would be reluctant to try that unless you are sure you know what you're doing.)