11 ms·
I just lost 1,400 BTC
- btilly 6y agoReading these threads I always have to wonder. Is the report of being scammed a scammer trying to make extra money on a sale? How would anyone know?
- deleted 6y ago[deleted]
- GaryNumanVevo 6y agoBitcoin being a public ledger, it's fairly easy to see if 1,400 BTC was moved recently: https://www.blockchain.com/btc/tx/ef600c380a239d9b929c6c964deaf7060e309750950a516cee65576232b0c53c https://www.blockchain.com/btc/tx/ef600c380a239d9b929c6c964d... I mean they definitely could have seen that transaction and just acted like it was their stolen money.
- pkrefta 6y agoWith big money comes big responsibility. Storing $16M should be taken very seriously and probably most people have no clue about that.
- bpodgursky 6y agoI think the point is that you can store $16M in a bank and take need to take no precautions against casual theft (and often can recover the money via person-to-person interactions, if theft does occur).
- abfan1127 6y agois it fair to say he could put that $16M in a digital equivalent of his mattress? Had he placed in a reputable exchange, or spread the coins across multiple exchanges, he would have been safer?
- thebean11 6y agoI completely disagree, only the first $250k is insured. I would never store $16M cash in a bank. You aren't protected against the bank becoming insolvent.
- google234123 6y agoIsn't it 250k per account?
- tialaramex 6y agoNo. FDIC is per depositor, per bank, per ownership category. So if you have $300k in Bank A, and $180k in Bank B, and then suddenly both Bank A and Bank B fail, the US Federal Government promises you'll get $250k from Bank A and $180k from Bank B, and pretty quickly - but the remaining $50k from Bank A depends on what happens when they try to wind up Bank A, if it's a complete wreck you may see nothing or almost nothing back or it may take years to get 10¢ on the dollar for the remaining amount. In some cases you may be able to create multiple ownership categories that help you, and I guess if you really had $16M you might do stuff like set up a multi-beneficiary trust fund that can have $1M in it with four beneficiaries for an additional $250k per person FDIC insured.
- sidewndr46 6y agoFDIC is presently $250,000 lifetime limit.
- smabie 6y agoOkay... where would you store 16m?
- majkinetor 6y agoWhats wrong with random hole on random private place you own ?
- ericd 6y agoProbably in US Treasury Bills?
- chipgap98 6y agoTo store $16M you definitely need to take precautions. Someone could steal your identity or compromise your account. It seems like different vulnerabilities rather than one that only exists for crypto.
- praxulus 6y agoWhile not guaranteed, it's pretty likely that you'll be able to get your $16M back if you lose it to identity theft or a compromised online account. You may have to escalate from customer service to legal action, but there are usually ways to reverse fraudulent transactions in the traditional banking system. On the other hand there's basically no way for this user to get their bitcoin back.
- sjs7007 6y agoI have more faith in the banking system but even there it can get tricky: https://news.ycombinator.com/item?id=24222045 https://news.ycombinator.com/item?id=24222045.
- brutuscat 6y agoUntil you can't https://en.wikipedia.org/wiki/Corralito https://en.wikipedia.org/wiki/Corralito
- paulcole 6y agoYeah that's because it's a bank not a pseudo-facsimile of a bank.
- Canada 6y agoI keep hearing that, and yet see mailbox hacks where the attacker tells accounts payable to update the payee's account and the money goes bye bye. Seems to turn into an insurance matter. I'm not sure why, but apparently just getting the bank to get the money back isn't so simple. Nobody talks about it in public. Haven't personally seen 8 figure amounts, but have seen amounts around a million dollars.
- nemothekid 6y agoAs far as I can understand 1. The user had 1,400 BTC in an old wallet using this software 2. An old version of the software was vulnerable to phishing 3. The user attempted to use the software, and was phished 4. Massive payday for the scammers Really unfortunate - and goes to show with software you manage yourself you need to be diligent about making sure it's updated. For all the shit coinbase gets, it's difficult to lose your coins in this manner.
- Ansil849 6y ago> For all the shit coinbase gets, it's difficult to lose your coins in this manner. Aside from U2F, Coinbase offers TOTP and SMS-based 2FA, both of which are vulnerable to phishing. So no, Coinbase is not immune to losing coins in this manner. If Coinbase wanted to prevent being vulnerable to phishing they would i) only allow U2F 2FA, and ii) make U2F mandatory for all accounts.
- nemothekid 6y ago1. AFACT the user was phished in a manner that was specific to this platform. It's not really comparable to clicking a nasty link in an email. Whether you chose to use U2F or TOTP, the risks is upfront. The user in this case was running official software - there was no URL to check. 2. The vector of the attack isn't important. The user ultimately lost his coins because he wasn't running the latest version of the software. He could have have easily lost his shirt from an RCE. That is much more difficult on a managed SaaS platform.
- eastbayjake 6y agoIt was my understanding that the user had installed a version of the Electrum wallet that was not from the official source at electrum.org. (But agree - it was really difficult to identify the core issue from this string of GitHub comments.)
- crtasm 6y agoThey were running an old official version which has a serious issue allowing the full node servers it connects to to pop up a message. e.g. "You need to upgrade - click here" - that led to the malware.
- gota 6y agoI've said this time and time again: 'be your own bank' is a terrible design error, not a feature, for 99.99% of users. This guy is most likely somewhat technically literate, and this happened to him.
- ed25519FUUU 6y agoThe virtues people often use for crypto (trustless, irreversible, untraceable) are almost always user-hostile. Banks aren’t great, but at least it’s harder to phish $16million.
- seotut2 6y ago> somewhat technically literate But doesn't know what IRC or freenode is, as illustrated by a comment in that thread.
- throwaway43234 6y agoIs that really your bar for being "somewhat technically literate"? Being familiar with decentralized chat protocols and services? What a world...
- sam_lowry_ 6y agoOnce in a while, I refer to Hacker News in a job interview, just to understand the cultural fit of the hire. Same here.
- illgenr 6y agoyes
- BTCOG 6y agoIn general I'd say that most "higher functioning" Bitcoin users are fairly decent with C++, using CLI/TTY only wallets, and familiar with the cypherpunk movement, culture, and history. If you are not familiar with IRC it makes it sound like you just started using a computer the last couple years.
- ztratar 6y agoMany folks shit on the modern financial system, with its centralization and Government-coupling, but things like this are actually trackable and reversible in that ecosystem. The safeguards have evolved over centuries. I am curious when crypto will get there. Maybe 10 years or so?
- gota 6y agoHonestly would like to know how you see it would "get there". In my mind, the 'fiat' part of 'fiat currency' and government-coupling are what gives the financial system the safeguards, so...? I mean, it is always the state, if you follow the string to the end, that oversees and enforce compensation, rollback and error correction. What kind of fully-distributed non-autoritative algorithm can do that?
- derefr 6y agoYou can build a fiat currency system on top of crypto-holding smart contracts just as well as you can build one on top of gold-holding (or T-bond-holding) banks. The main difference between cryptocurrency and regular currency comes down to interoperability. The infrastructure that handles fiat cryptocurrencies could be built generically, such that a given "bank account" could hold a mix of fiat crypto-tokens, each associated with a given regulatory regime that would validate actions taken upon those tokens. With regular fiat currency, the currency is effectively a fiction local to a given regulatory regime; but that fiction can also take on other lives as other fictions, if "re-used" in other regimes. (I.e., some other country can use US dollars as "their" currency, with their own rules about how you can spend/exchange those US dollars while you're there.) Effectively, the value of the currency in each economy is independent, a separate fiat declaration of value by the economy that trades in the currency. And, if you want to "translate" the value of that currency into a different regulatory regime that doesn't "share" in the fiction of that currency, you (or the bank you're interacting with) must exchange it through a ForEx broker (which effectively recycles the source currency back into the regulatory regime it comes from) to attain a different fiat currency regulated by the destination regime. Cryptocurrency skips all that. You don't need ForEx. Anyone from anywhere can hold anything. It's less like current fiat, and more like commodities trading with each fiat currency being a country-unique export (e.g. an elemental metal only found there) traded on, and valued by, the global market as a whole. And yet, if someone were holding a hypothetical government-regulated USD token, every interaction that person does with that token would be done with under regulatory validation of the US government. There wouldn't be separate fictions of "the US dollar" in each economy it trades in (as happens in e.g. Venezuela); instead, it'd be more like everyone in Venezuela buying and selling everything by having implicit US bank accounts owned by proxy US citizens beholden to US law, and doing transfers between those accounts. Of course, at any point you could "cash out" of the fiat currency by exchanging it for some non-regulated token (if the regulatory regime that controls the regulated fiat token allows that exchange to happen.) Just like you can take cash out of a bank, and walk away. (Or more precisely, just like you can buy a non-controlled commodity like gold or oil using your chequing-account balance, and then walk away with the commodity.)
- addcninblue 6y agoThis looks like the relevant transaction: https://www.blockchain.com/btc/tx/ef600c380a239d9b929c6c964deaf7060e309750950a516cee65576232b0c53c https://www.blockchain.com/btc/tx/ef600c380a239d9b929c6c964d...
- rtx 6y agoThis is why we need, order > Community > Society > Government > Banks We are at the community stage with crypto.
- gchamonlive 6y agoThis structure is just one form of security implementation and not flawless at that, and I would dare say biased towards the richer parties. Scams, in and outside of banks happen really frequently, so turning to traditional structures of control just because new ones failed at some point is defeatist. We can have nice things, but they need time to evolve properly.
- rtx 6y agoDon't disagree, always happy to see the alternative. Another one that we had earlier in India was Rta (natural order) > Rna (debt on non conformist) > Karma > Gods. But as we understood the world better, this one went out of fashion
- knorker 6y agoThe whole point of cryptocurrency on is that they don't believe in ANY of those institutions.
- rtx 6y agoMaybe in the beginning, it looks like gold rush now.
- knorker 6y agoI still keep reading about the cryptocoin utopia fantasy. Where Bitcoin somehow starts being used as currency for some reason. I keep reading about how bad fiat currency is, and how it's backed by nothing (except, you know, literally superpowers who have nukes). But yes, there are tulip speculators too.
- vmception 6y agoIts kind of crazy that the phishing attack people are still operating those servers for all these years! But since they pay for themselves no reason to turn them off. The knowledge gulf is so wide in cryptocurrency that schemes are resurrectable every bull market Like, some people will use this to reinforce their juvenile binary argument about why “crypto bad”, and then they enter next bull market after someone they respect shows them something they didn't consider. But then they are still a decade late in knowledge while chasing every new shiny thing. If people want to learn its there, permissionless, lucrative.
- Xcelerate 6y agoIf I had that much in an old wallet, no way would I touch that myself or allow it anywhere near the internet. I would hire a team of experts and get the transaction over to my bank insured.
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- herpderperator 6y agoDo any big banks offer a BTC account?
- notRobot 6y agoStuff like this is why you shouldn't use a lightweight wallet and should use the official wallet, or at least host a full node. Read more here: Full nodes: https://en.bitcoin.it/wiki/Full_node https://en.bitcoin.it/wiki/Full_node Lightweight nodes: https://en.bitcoin.it/wiki/Lightweight_node https://en.bitcoin.it/wiki/Lightweight_node
- qwertox 6y agoWhat about an hardware wallet like Ledger?
- notRobot 6y agoI would simply recommend hosting a full node and using the latest release of the official Bitcoin Core wallet. Hardware wallets are relatively new and uncommon, so not much is known about their security risks. That said, there are no glaring, obvious issues and you could use one if you want. Read: https://en.bitcoin.it/wiki/Hardware_wallet#Security_risks https://en.bitcoin.it/wiki/Hardware_wallet#Security_risks As always, do not take advice from strangers on the internet about storing your crypto without doing extensive research on your own. The Bitcoin wiki is a great starting point: https://en.bitcoin.it/ https://en.bitcoin.it/
- mianos 6y agoThe popular Trezor wallet has a hardware vulnerability, where, if you physically have the hardware it can be exploited. Hardware wallets are a vast improvement but not without issues. Large scale fraud, where the money goes missing is much more common so far.
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- kutorio 6y agoI'm not an expert in BTC storage, but as far as I understand such an attack could have been prevented if the owner invested in a hardware wallet for $100-200. As the final step in a transaction would be to sign it on your ledger/trezor device, and would be much harder to phish.
- AgentME 6y agoThis was my first thought too. Hardware wallets show transactions on their own screen so the amount and destination address can be confirmed on-device before the device signs the transaction, which seems like a great tool to avoid this kind of issue. Anyone that owns more cryptocurrency than a hardware wallet costs really needs to have a hardware wallet.
- xwdv 6y agoFools and their bitcoin are easily parted. Perhaps this man has lost his only chance at possessing millions. What an expensive lesson.
- phedboi 6y agoWhy would someone holding 1400 BTC use a software wallet instead of an offline hardware wallet? SMH
- spurgu 6y agoYeah this is what blows my mind. I would be paranoid if I had 14 BTC, let alone 1400. When I had (as much as) 19 BTC some while ago I stored them on a Trezor, with the seed on a paper (three copies in different places) in a form that no one would realize it actually was a seed.
- herpderperator 6y agoBe careful... sometimes we end up making things so complicated that we forget how it works. Think why comments are so crucial after looking at your own code from a year ago and having no clue what you meant. :-)
- jkepler 6y agoEven a single hardware wallet would have been risky - loss or damage, or theft. For high values, set up multi signature hardware wallets, at least a 2 of 3 scheme, each stored in different geographic locations.
- phedboi 6y agoThat's overly complicated. A single hardware wallet in a fire proof safe or a safe deposit box in a bank vault is sufficient for this use case. If a hardware wallet were stolen, the thief would still have to guess the password. q.v. https://xkcd.com/538 https://xkcd.com/538
- Hackbraten 6y agoA single hardware wallet is not sufficient for any use case because no matter how safely you store it, it can fail anytime.
- willemlabu 6y agoHere [1] is the explanation: I had 1,400 BTC in a wallet that I had not accessed since 2017. I foolishly installed the old version of the electrum wallet. My coins propagated. I attempted to transfer about 1 BTC however was unable to proceed. A pop-up displayed stating I was required to update my security prior to being able to transfer funds. I installed the update which immediately triggered the transfer of my entire balance to a scammers address. [1] https://github.com/spesmilo/electrum/issues/5072#issuecomment-683374289 https://github.com/spesmilo/electrum/issues/5072#issuecommen...
- krapp 6y agoCaveat fucking emptor.
- CameronBanga 6y agoGiven that the first post in tracker mentions "0,09", I think the comment here may actually be using a Euro standard decimal notation. So the author may have lost 1.4 BTC, or ~16k. Still a loss, but not 16m.
- spurgu 6y agoNope: https://www.blockchain.com/btc/address/bc1qcygs9dl4pqw6atc4yqudrzd76p3r9cp6xp2kny https://www.blockchain.com/btc/address/bc1qcygs9dl4pqw6atc4y... Address mentioned here: https://github.com/spesmilo/electrum/issues/5072#issuecomment-683356120 https://github.com/spesmilo/electrum/issues/5072#issuecommen...
- Canada 6y agoI can't believe someone would even allow a system with that balance to even connect to the internet. It's like filling a car with gold bars, driving it around town, and hoping nothing bad happens. He could have created another wallet, preferably a multisig, created the transaction with the software wallet offline, copied the signed transaction off and broadcast it from another system. What he did was reckless. Some people are going cry that Bitcoin is unsafe because of this. It's not. You must handle large amounts of cash or gold or other valuables with care.
- herpderperator 6y agoBitcoin is all online. The analogy doesn't work: your gold bars are being driven around town all day and night in public view, already. In this case, it's just the fact that the access was granted at the application level when the user logged into their wallet, which is like giving someone keys to your car by mistake.
- jkepler 6y agoNo. One can store keys offline. That's what hardware wallets do.
- herpderperator 6y agoIn order to do anything with Bitcoin, which appears to be what the author wanted, you would have to be connected to the Internet. Keys being stored in hardware wallet sure, but the gold bars are still in public view. Hardware wallets aren't without their flaws. With an application-level vulneravility in a hardware wallet, you are still screwed. Here is just one example: https://www.ledger.com/improving-the-ecosystem-disclosure-of-the-trezor-recovery-phrase-extraction-vulnerability https://www.ledger.com/improving-the-ecosystem-disclosure-of...
- vmception 6y agoYou can sign transactions offline and hand deliver the file if you felt so inclined. Signed transactions cant be modified. Someone needs to make sure nodes see it that transaction and add it to the database, eventually. This user experience has not been refined, but is very possible. A system with fewer nodes, like if the internet was attacked and not available, would still work for this currency.
- echopom 6y agoThis is fascinating. Honestly , while I found BlockChain & Immutable Ledger disruptive technology , I have zero trust in cryptos. The amount of scam in this industry is just obscene, unlike banking , there is no such thing as insurance for your wallet or legal recourse to get back your assets, your pretty much on your own and I'm fairly convinced he won't get back his 1.5M$ Bitcoin . I feel bad for him , but there is very little surprise playing with unregulated stuff.
- vmception 6y agoThere is a lot more scamming in those legal recourse systems, they have the benefit of not being masqueraded as international news every time! The user experience where you personally still have your money might be something you like. Also it was $16m bitcoin
- ur-whale 6y agoReading this, I feel compelled to repost this old but still largely relevant blogpost: http://trilema.com/2013/the-story-of-pointless-and-witless/ http://trilema.com/2013/the-story-of-pointless-and-witless/
- ncmncm 6y agoAnd somebody gained 1400 BTC.
- simonblack 6y agoIf you can't hold it in your hot little hand, it does not exist. This also applies to your money and other valuables held by third parties such as Banks or Trusts, or wealth stored as numbers in a computer. Unless you hold and control it personally, it's not yours at all. While it's definitely convenient in good times for your wealth storage to be in the hands of others, you're completely dependent on the goodwill of those others. In bad or difficult times, you're not going to keep that wealth for very long.
- EForEndeavour 6y agoPointing out that you don't technically own the money in your conventional bank's chequing account is a mere distraction from the fact that in the real world, it's easier to permanently lose access to your cryptocurrency than it is to permanently lose access to your bank account.
- kobasa 6y agoIt's not crypto-currencies and it's not crypto currencies. It's simply cryptocurrencies. At least learn to spell the word correctly before giving your absolutely ignorant opinion on it.
- iJohnDoe 6y agoSerious question. Not trolling. Would it have been possible to exchange that much BTC for US dollars? Ignoring taxes for a few seconds. Would it have actually been possible to get real fiat money for the 1,400 BTC? I’ve always heard of complete incompetence trying to get an account set up on any exchange. Getting verified, etc.
- noxer 6y agoIf he acquired them legal of course he can sell them an get fiat withdrawn to his bank, assuming hes not in a place where bitcoin is illegal. Doing this all at once without informing your bank will probably instantly freeze the funds and trigger some kind of investigation. That doesn't mean you eventually get access to it. Also there are exchanges withdraw limits so its not on your bank account in 1-2 working days. If you want to sell all at once and withdraw you would have to register on different exchanges to circumvent daily limits and do the KCY which that can take days to get verified.
- illgenr 6y agoThe negative comments on HN about crypto give me confidence RE: it's eventual success in dethroning fiat currency.
- reportgunner 6y agoThis story is kinda like: "I got pickpocketed once and lost all my cash. This means that cash is inherently unsafe and should not be used by anyone ever."
- knorker 6y agoNo, more like "I got pickpocketed of all my life savings, therefore maybe I shouldn't walk around with my life savings in my back pocket".
- asdz 6y agoThat's why getting a hardware wallet is important!!! The guy have 17 million USD and don't even bother to heighten up the security.
- toossmm 6y agoInvestment scam is all over the place in recent times and due to greediness people fall victim daily to bogus promises. May i tell you that out of 100% of people or companies advertising investment, just like 2% can guarantee the outcome. The rest are mere scorn artists who just want to take your money. Thread with caution! This is also a signal to all regulatory authorities to buckle up. You must know that if cryptocurrency is prohibited in your jurisdiction you do not have business with it. The reason being that when there is a problem or abuse, the investor lacks government protection. If you sense that you are being defrauded by an investment company there are few steps listed below which could help you to recover them if you have all your proof of investment and conversation history. The following are the process: Firstly, if cryptocurrency is regulated in your jurisdiction like in the United States, File your complaint with the SEC. Why file with the SEC? Some of these companies are registered and it is the duty of the SEC to regulate them. Filing will make the SEC investigate and bring down the company. This is usually not the case as we have experienced in our quest to recover money for victims of fraud. Virtually all the companies are unregistered and are usually operated by fake individuals with fake identities. So reporting to the SEC may not really do justice. File a report with any Law enforcement agency in your jurisdiction, like the FBI in the US. The essence of this is for investigation but this usually is not an easy one since most of them operate with fake identities and FBI’s investigation is usually very slow. Making it that before the investigations concluded the scorn would have emptied the wallet. The next is that if the amount lost is what you can bear, please bear it and invest no more. The last option is that you should try using virtual asset recovery companies. However, i must strongly advise you to thread with caution because most of these investment companies now pose to be recovery companies and they are out there to steal from you. This is owing to our experience in the recovery industry. Some people have been defrauded twice because they went to the wrong place to seek help. Do not be desperate. When you send your complaint to contact@activebonorum.com the firm will review your claim to ensure that you really invested with these companies and if the same turns out to be successful, the firm would proceed from there. Finally, I must advise you to inform those around you that you have been defrauded due to the trauma that comes with this. Also to recover all, log on to www.activebonorum.com
- toossmm 6y agoI JUST TRIED THIS NO UPFRONT PAYMENT !!!!! NO UPFRONT PAYMENT I made a deposit of $10,000 into this broker on 1st December, then I got a call from the account manager telling me about my account and the bonuses I could get if I put in more money. He was really good at convincing (maybe he brainwashed me ) I later put $86,000 in total.Then I sent all of my verification documents such as proof of address, ID and Bank card details (I sent without CVV) and Declaration form . Also I received lots of emails from them about verification and activation and etc. During the first 3 days which my account was funded and was ready to start; they called me many times to re-invest and increase my amount and I refused because they got too pushy about it. Ifigured something was wrong when I requested for a withdrawal and was told I had to reach a deposit target before I can make withdrawals.So I couldn't trust them as they changed their word and I asked the adviser I want to close my account as my account is verified and it's ready. I already told him I can't put more money in and now I changed my mind and I want to withdraw my money and close my account.I send lots of email, chat, request, text, call and etc and ask them to call me and explain but nobody answers and replies to me even through email (Used to be emailed straight away) Now I want to withdraw all of my money but I can't go through my account. THEY NEVER CAME BACK TO ME. TEL, ADDRESS AND COMPANY AND ALL ARE SCAM.Until I was introduced to a recovery company that helped me out contact@activebonorum.com www.activebonorum.com