7
1
Two days ago my wallet at blockchain.info was hacked, everything was taken (760 coins).
https://blockchain.info/tx/0619d221a761a3b8ec205773440fa6607d65957ef985dac5fb5273a08bda2c89
Besides the password I use Google two step verification. I also use this on the gmail that I use to authorise computers, anybody knows how this could have happened?
I backed up my wallet to Google Drive.
2
Could you be more specific on which 2 way authentication you used? What where the exact steps so we can rebuild the scenario or at least understand what happened exactly.
If it was email by gmail consider the machines you used the blockchain.info/ gmail on as compromised. Most probably all login forms on this machines have been grabbed.
1I used the Google 2-Step authentication. – Bastiaan Quast – 2013-05-19T08:07:19.357
0
From this link: https://support.google.com/accounts/answer/180744?hl=en
Keep it simple During sign in, you can tell us not to ask for a code again on that particular computer. You'll still be covered, because we'll ask for codes when you or anyone else tries to sign in to your account from other computers.
Is it possible that you had authorized the computer the transaction was initiated from? This would match the idea that the computer was/is compromised. With a remote control tool an attacker eventually was able to login over this pc and make the transaction through remote control desktop.
If this is true, consider all actions taken on this computer as logged.
yes I considered this, I authorized two computers, one ubuntu gnome 13.04, and a chromebook. Also a rooted S3 running CM10.1. – Bastiaan Quast – 2013-05-20T09:34:05.837
ah and as can be seen from the link, the command originated from somewhere near Ghana, I am in Geneva. – Bastiaan Quast – 2013-05-20T09:35:04.687
1 Well, id contact blockchain.info asap to get more precise information. Beside that, there might be a slim chance the intruder has still the bot/trojan running (bots usually dont have remote control, my bet it was a trojan), in best case the intruder did not use a proxy, in worst case he had a multi proxy environment. Anyway, id monitor the traffic from the compomised machine in hope to get an ip where this bot connects to. Maybe from there this http://security.stackexchange.com/ is the place to go. On popular hackforums are also articles about tracing down trojan owners.
1The map showing a location 'somewhere near Ghana' is just showing latitude 0, longitude 0, so it's very unlikely that the request was actually from there. – Adam Iley – 2013-06-11T00:00:18.377
Did you use Google Authenticator? https://support.google.com/accounts/answer/1066447?hl=en
– Pacerier – 2013-08-10T07:40:13.833In 2017 (this question is from 2013) it would be irresponsible to store 760 coins (~$1.4M) on any custodial account. Get a hardware wallet. – Erik – 2017-05-13T23:43:45.693