RAF_FenixDziś o 04:04
My Dash was stolen.
Can anyone help me investigate? How to track IP address from which tx was sent?
strophyDziś o 04:06
Hi @RAF_Fenix I'm sorry to hear that. To my knowledge, it is not possible to associate a transaction with an IP address, but you may be able to track the Dash to an exchange. You need to make a report to the police as soon as possible in order to be able to legally request an exchange to freeze your funds.
RAF_FenixDziś o 04:07
The stolen Dash sits at several addresses, not sent to any exchange
strophyDziś o 04:08
@xkcd will be able to help you tracking the Dash, at least until it gets sent to mixing
But I don't think you have any method of tracking the IP that created the transaction, or finding who controls those addresses
RAF_FenixDziś o 04:09
It was 75000 dash. Hard to mix that amount.
strophyDziś o 04:09
How did the theft take place? How did the attacked get control of your private keys? If it was remote control of your computer, there may be logs involved
RAF_FenixDziś o 04:09
75 MNs
strophyDziś o 04:09
@RAF_Fenix I believe @xkcd is already tracking this
RAF_FenixDziś o 04:09
What " this" ?
How long will it take to mix that amount? I know it's non trivial for such sums
My email is al4321@gmail.com please @xkcd contact me @Tao Of Satoshi maybe Tao can help me investigate
strophyDziś o 04:11
Mixing under Dash 0.13.x mixes much faster, and the attacker has already split it into multiple wallets to mix with himself. Together with multisession mixing, it is going quite fast.
I strongly recommend you get in touch with law enforcement asap. Can you give us more information on the attack vector?
RAF_FenixDziś o 04:12
Then it's game over.
For my crypto
stan.distortionDziś o 04:12
Pretty much, sry
RAF_FenixDziś o 04:12
I dunno, but either a virus or a "friend " planted keylogger
Or remote session
stan.distortionDziś o 04:13
please don't tell me you had it in a wallet live on a windows pc, a hardware wallet is essential
strophyDziś o 04:13
This is your chance to get it back. You need to find someone qualified to do digital forensics on your machine to try and figure out who was connected to your computer and possibly where it went.
xkcdDziś o 04:14
WOW, this is the largest theft I have heard of @Dworf ^^^ We have a winner.  Dworf can give you advice on how to deal with LE on this matter, he lost 9K DASH.
@RAF_Fenix I did and do analysis of that DASH in DASH TALK discord in #markets channel, invite sent.
RAF_FenixDziś o 04:16
How did you do? You noticed that MNs left the network?
stan.distortionDziś o 04:16
@RAF_Fenix , like @strophy says, shut down that pc asap and get someone to take a look at it. get it off the net imediately
RAF_FenixDziś o 04:17
Done
xkcdDziś o 04:18
I monitor all the masternodes all the time and track every single movement of collateral.
RAF_FenixDziś o 04:18
Do you monitor IP addresses by chance?
xkcdDziś o 04:19
No, it is not known to me how to determine the IP of the wallet that sent the TX.
RAF_FenixDziś o 04:20
Hmm... you suggest me to do what? Jump off a bridge? Go back and find a job? (Hard after I became a pensioner)... it's absolutely devastating, I wanna die
Like under the belt
Anyway, what can I do now?
I have hired private investigators but not yet called up the cops.
HinnomTXDziś o 04:21
@RAF_Fenix did you tell anyone about your stash?
RAF_FenixDziś o 04:22
Yes, my friends and family
HinnomTXDziś o 04:22
Anyone who might be computer savvy?
RAF_FenixDziś o 04:22
Yes, my friends are computer savvy.
I have some suspect "friend", but no evidence
How do I gather some evidence?
(But it also could be a virus... but more likely a human)
Basically you suggest the "social " way to investigate this.
HinnomTXDziś o 04:25
What OS was the host machine?
RAF_FenixDziś o 04:25
I have 2 suspects actually, but no evidence at all.
Windows 7 + Virtualbox + Windows 7, so he broke into a VM or used keylogger
Actually I looked into this VM. It was turned off at the time of the hack
stan.distortionDziś o 04:26
sorry again but don't get any hopes up, its very unlikely you'll get anything back. It wasn't in one lump which wouldn't have made it an obvious target but how you moved it might have. The best hope is someone targeted you because they heard about it, the chances of tracing that from your pc are slim but they're the best chance of all.
xkcdDziś o 04:28
@RAF_Fenix have you downloaded any other walles, been recovereding split coins eg BCH, BSV, Bitcoin Diamond?  Did you setup RVN miner?
Dworf lost his coins due to malware in BTC Diamond or Private wallet when he tried to claim his forked coins.
The malware took all his DASH and about 6 other :poop:  coins.  I really hate this discord,.
cant have an adult conversation in here, jesus christ @Tao Of Satoshi what is the point of this?
HinnomTXDziś o 04:31
I’m cursing out loud for everyone!!
RAF_FenixDziś o 04:31
Malware or human? How to know?
xkcdDziś o 04:31
Did you install anything recently.
RAF_FenixDziś o 04:32
Can we know exact time of tx sent?
Only new Dash 13.1
xkcdDziś o 04:32
all on blockchain in UTC time.
RAF_FenixDziś o 04:32
But in seconds, or minutes?
Dash Core shows only minutes
xkcdDziś o 04:32
OK, did you check SHA256 and signatures of the 13.1 installer?
RAF_FenixDziś o 04:33
Nope, but they are from dash.org, and I still have that installer
HinnomTXDziś o 04:34
Dumb question but was your wallet.dat encrypted?
RAF_FenixDziś o 04:34
Yes, and with a strong password.
xkcdDziś o 04:34
Cool, so you can check it later.  windows7 is not the most insecure OS, that would be windows 10, but it is easy to get it infected. :thinking:
Yeah, so there was a ley logger involved most likely.
HinnomTXDziś o 04:35
Keylogger, right?
RAF_FenixDziś o 04:35
I think it's a human: he still left 0.74 DASH in my wallet. Would a virus leave it? Probably not.
xkcdDziś o 04:35
Key loggers are mostly in software, but there are some hardware ones, could be interesting to check the cables.
HinnomTXDziś o 04:35
Nope, that’s a taunt!!
Definitely human
stan.distortionDziś o 04:36
What country are you based in? might be someone well known can take a look at pc, verify checksums offline etc
RAF_FenixDziś o 04:36
Israel.
Okay, so we can rule out a virus. So a human.
Did dwarf had 0.x Dash left like me?
Or it was 0.000 DASH
Anyway I do have 2 suspect "friends ", whom know crypto and know I had the coins. But no evidence. What are my chances? Pritty nil.
HinnomTXDziś o 04:38
Also, it’s roughly 1/100,000 of your stash. Definitely feels like a malevolent taunt
stan.distortionDziś o 04:39
don't give up altogether
RAF_FenixDziś o 04:39
Anyway: what now? Police or private investigator?
JGCMinerDziś o 04:40
Sorry about the deletions guys, but just to be clear the mods are not actively deleting anything.

There is a swear filter bot active that has 0 concept for gravity of this horrible situation.

My condolences. Hopefully, you can find some evidence and nail the guy.
HinnomTXDziś o 04:40
Computer forensics
stan.distortionDziś o 04:42
all imo, police asap but you might need to get someone to copy yor hard drive before the police get it, they might even do a copy for you if you ask
RAF_FenixDziś o 04:42
The big philosophical question: Should I just off the bridge? Should I give up on crypto entirely?
The crypto needs to have some safeguards...
HinnomTXDziś o 04:43
Do you have any other crypto or valuable data on the machine? If so, you need to protect it
RAF_FenixDziś o 04:43
Which the banking system has in place. The small sums fly instantly, but for big sums, my banker always calls me up and denies any tx by default over $10,000
No. I have other crypto paper wallets
But not on this comp
You know what? After this hack I start to appreciate traditional banking more...
stan.distortionDziś o 04:45
lol,, give up on crypto? No :smiley: look at the boom-bust cycles, another is inevitable and another wave will jump on it and that's going to keep happening, you're still an early adopter
RAF_FenixDziś o 04:45
In traditional banking it's no so simple to steal $6 million. $6000, yes, maybe.
The very concept of one such disaster can wipe out a human.
And his life savings.
xkcdDziś o 04:46
@RAF_Fenix The crypto needs to have some safeguards...
Be your own Bank does come with some risks, I don't think your security was very good considering the amount of coin you had.
stan.distortionDziś o 04:46
banks have had just the same, billions in digital theft lately. their customers balances are restored but who foots the bill?
RAF_FenixDziś o 04:46
Basically it's like losing a house due to war and enemy bombardment. House is everything that most families have, with small savings in the bank.
House is most wealth that most families have... so I lost my biggest asset. Dash.
xkcdDziś o 04:48
Yes, but it is possible to create 75 wallets offline, print out the private keys and send 1 K DASH to each of them and know those keys are never online, you can and should start masternodes that way, or use a Trezor.
RAF_FenixDziś o 04:50
If never online, then how to start a MN?
xkcdDziś o 04:50
@RAF_Fenix Don't give up hope, there may be ways to recover this DASH if the thief makes a mistake, it will be almost impossible to mix that amount of DASH, much less sell it, we are tracking it all.
HinnomTXDziś o 04:51
One thing I’ll point out. Dash Core keeps a backups folder of old wallet.dat files. You should check to see if any old backup was not encrypted.
RAF_FenixDziś o 04:51
My email is al4321@gmail.com if you find anything. I may be offline, because I feel like a dead sausage.
xkcdDziś o 04:52
You can start the MN from DMT, or core wallet by submitting the protx commands, I believe the masternodekey in <DIP3 MNs was what was needed, not the actual collateral.
RAF_FenixDziś o 04:52
Hinnom: impossibility. It's an old wallet.
stan.distortionDziś o 04:53
@RAF_Fenix ,starting a masternode while keeping the wallet offline works by cryptographic signatures, being able to know for sure a message was sent by a wallet without having a copy of that wallet
RAF_FenixDziś o 04:53
And a new VM
TroyDASHDziś o 04:54
@RAF_Fenix I'm sorry to hear about this, it must be devastating. Please, in all seriousness if you feel like you might be a danger to yourself either now or in the  future, do seek help
stan.distortionDziś o 04:55
what time is it over there?
RAF_FenixDziś o 04:55
I don't know if I'm in danger, I think not...
I don't feel danger.
But...
TroyDASHDziś o 04:55
yeah I'm just trained not to take hypothetical questions about jumping off bridges lightly
RAF_FenixDziś o 04:56
5:55 AM in the morning
stan.distortionDziś o 04:56
If it's morning go and see the cops, needs to be done soon anyway
TroyDASHDziś o 04:56
how recently did the theft occur?
RAF_FenixDziś o 04:56
1.March, few days ago
stan.distortionDziś o 04:58
do you know when the transactions started moving?
RAF_FenixDziś o 04:58
They didn't.
Coins sit idle
@xkcd what kind of blockchain forensics can I collect?
Dash was the majority of my total wealth.
I still have other coins to boot...
TroyDASHDziś o 05:00
are you sure your other coins are secured?
RAF_FenixDziś o 05:00
No.
But I cannot use a Windows PC  to create new wallets anymore
The problem is that I'm unable to manage a 1man bank. I have failed. And faith in crypto reduced.
xkcdDziś o 05:03
*  75 Masternodes rolled up and collected into the below addresses
XmbEiJ18q2ntiqk74fXpUY7m6BmGDrT3NU 31.5K
Xxh1ADFhTuikPQYW69LXChbEHyEyGoXwpp 16K
XcG3dm2sWnkdzDbFgxfa5qw3pjtijmCbVB 15K
XqLEYh2WFAVjvgbLEFdbe5hHhnQYDiDq9g 12.489K

Mixing has started on Xxh1ADFhTuikPQYW69LXChbEHyEyGoXwpp  it is running multiple sessions.  I believe the thief reads DASH TALK discord as after I mentioned you can mix 2K DASH at a time, he started peeling off 2K chunks for mixing.
RAF_FenixDziś o 05:04
I had only 75 MNs
Where did 76 come from?
xkcdDziś o 05:04
Maybe a few rewards, these MNs were nice little money printers. :wink:
RAF_FenixDziś o 05:04
74+ rewards
It was like 74950+
Less than 75 nodes
xkcdDziś o 05:05
Can you check the addresses and see if he collected someone else's stolem funds too?
RAF_FenixDziś o 05:05
They print, until it's gone.
Good idea.
xkcdDziś o 05:06
If he is stupid enough to mix with two robberies, it might make tracking easier.
RAF_FenixDziś o 05:07
Actually the count is 75k coins
xkcdDziś o 05:07
Also, @Dworf will discuss with you how to track mixed coins, we wont mention in here.
TroyDASHDziś o 05:07
I would hope a thief would have a hard time unloading that many coins without making a mistake somewhere
RAF_FenixDziś o 05:07
Please count stolen coins again . I lost about 74950 coins.
stan.distortionDziś o 05:07
try and get in touch with local crypto communities, if and shops are accepting it near you they're worth asking and meetup groups might have someone to get in touch with:
https://www.meetup.com/bitcoin-il/messages/boards/
EDIT: Chances are the first person you talk to will put you in touch with someone who knows their way around pc's and if they're any good they'll put you in touch with a pro. Before they do anything ask them if they'll stop in for a chat here or the forum, you shouldn't have much  difficulty finding someone who go through storing your other offline coins safely and maybe the forensics too.
Israel Bitcoin Meetup Group Message Board -
Israel Bitcoin Meetup...
This group is for Israeli enthusiasts of Bitcoin, the world's first decentralized digital currency.

See also:

http://bitcoin.org.il/
https://groups.google.com/forum/?fromgroups#!forum/bitcoin-il
htt
xkcdDziś o 05:09
@RAF_Fenix Correct 75K, updated post.
tungfaDziś o 06:05
@RAF_Fenix
that is terrible news
hang in there buddy , so sorry to hear :pray:
RAF_FenixDziś o 06:49
Tungfa and others: is it possible to introduce delay for large transactions?
So that no one can use it, and I could cancel.
But it will not help me anyway, since then money will be locked. He will cancel my tx, he will cancel my
I start to appreciate the banking system more after this crazy hack.
strophyDziś o 06:50
It might be possible to configure timelocks on your own MNO collateral transactions, yes.
RAF_FenixDziś o 06:51
But it will not help for my scenario...
Where hacker got  private key
It will still execute, just with delay.
Only multisig... maybe.
strophyDziś o 06:52
Yes, this is something you would have needed to do while setting up your masternodes. It's not something that can be done at the protocol level without affecting all transactions above a certain value. The would require a change in consensus and thereby a hardfork I think. Multisig recently also became possible with DIP3, I believe.
RAF_FenixDziś o 06:54
Bank, being a regulated entity will ask for my passport and documents what I plan to purchase before doing even a $100 k tx
Basically I failed to become my own bank.
LebubarDziś o 06:56
I think it's important to understnad what happened. To know if it's inside job (ie: friend or person with fisical access to your cumputer) or hack from internet...
RAF_FenixDziś o 06:57
Can I figure out which PC or IP sent the tx ?
strophyDziś o 06:57
This is extremely high level stuff that I doubt even major operators like Crowdnode have considered. Don't beat yourself up too much. Focus on forensics, investigators and law enforcement. Talk to Dworf, he will have a boatload of advice about how to handle this.
RAF_FenixDziś o 06:57
I should choose the police or private investigator?
Private are smarter and more dedicated, but police has more ability
Maybe both :smiley:
Anyway money is gone.
strophyDziś o 06:59
I believe Dworf talked to Interpol and private investigators, but please check with him to make a plan on how to report this. In NZ for example we have a digital crimes unit that were involved with the Cryptopia hack, which probably involved a similar amount of currency.
Don't give up or get mad mate :wink: get even!
RAF_FenixDziś o 07:00
I barely could sleep tonight. Only 2 hours.
QuantumexplorerDziś o 07:43
I'm really sorry to hear about this.
pijiupingDziś o 08:13
many mns use only one password？
tungfaDziś o 08:22
@RAF_Fenix
i would go straight to cyber security department of your country + police report (to have it on record - u never know)
private investigators u still can hire , but tbh it will cost u a bunch of $ and i doubt they can recover anyway
check if the state (cyber security department) can take care of that
(isn’t that their job)
but as said , it will be super hard to recover anything , but 100% worth a try , even if it is to protect others (good karma in a bad event)
def have your computer checked by a 100% tech savvy + 200% trusted source (so your other coins do NOT disappear too !!)
PS
i messaged one of our core devs who is from your country if he is there and can help / or has a contact that can)
MoKaDziś o 10:55
@RAF_Fenix where did you store your dash when it was stolen? Trezor ? Ledger ? Core?  I'm simply asking to secure my own funds.
tungfaDziś o 10:56
QT wallet on PC he used
fuzzyduckDziś o 11:01
Windows 7 in VM on windows 7