Missing 10,000 ADA, have I been hacked?

[drballs]

Same thing happened to me. Might be some useful info in here for you… but no outcome yet unfortunately.

ADA Sent from exchange shows transferred back out only hours later

Back in February I bought 6,222 ADA from Binance. I transferreed 100 to my desktop wallet first to test out the transfer and everything showed up on my desktop wallet so I transferred the rest successfully. Later that evening (same day of a major wallet update for what it’s worth) all amounts show that they were transferred out to another address. I’m meticulous with my secret keys, phrases, keystores, etc. and feel very strongly this is not a hack job. Using the block explorer, I searched …

[headsaflame]

Very interesting, I too lost my ADA right after updating Daedalus. I may not have been as careful as you were with my key phrases having had them saved as a screenshot on my system, but it’s all felt fishy. I can’t see how someone could have gained access to my system.

[headsaflame]

Do any of you know of a way to scan a whole network for malware? I’m thinking of IoT devices as well like, VOIP phones, printers, smart thermostats. For the computers I can run antivirus on each system manually, but I’d love if there was a way to scan the whole network.

[headsaflame]

Here are my error logs as well:

Daedalus.old.log

Daedalus.log

There are also a bunch of files that are node.pub.x with numbers up to 18, are those files relevant?

[vantuz-subhuman]

@headsaflame

There are also a bunch of files that are node.pub.x with numbers up to 18, are those files relevant?

Yeah, you need to pack the whole Logs folder.

[_ilap]

Yep, you were hacked, but we should find out whether it was a local API attack or a seed stole attack w/ watching address. I assuming local API attack, but we need to check it.

So, pls pack&compress all your log files, as @vantuz-subhuman requested, which are under the %appdata%\Daedalus\Logs

[headsaflame]

I’ve zipped the whole Daedalus logs folder, hopefully this helps:

Logs.zip

[magnetar]

@werkof

Someone able to copy/read that screenshot is able to use it on a different computer to restore that wallet and then “savely” transfer it to another address.

The optional (and recommended) spending password helps preventing this.

If someone recovers a wallet from seed then they no longer need the password - right ?

@_ilap

@_ilap

Yep, you were hacked, but we should find out whether it was a local API attack or a seed stole attack w/ watching address. I assuming local API attack, but we need to check it.

How was he hacked ? Isn’t a phishing link usually the case ? I doubt someone just randomly hijacked his computer and found his ada seed.

[magnetar]

Did anybody know you had ada stored on your computer ? Did you mention in any forums that you had 10,000 ada ?

[magnetar]

@jb455

and was there really no password on the first Daedalus wallet version? that sounds weird since that almost sounds like the key would have been held un-encrypted, I highly doubt that. Or did you create the wallet without having to create a password for it when you havent had use it? is that an option Daedalus allows?

Of course the original wallet had a password option. I had the very first available version of Daedalus. I did keep getting a virus flag called zum.androm.1 for it though. I contacted Cardano and my antivirus company to stop the false flag.

[_ilap]

Thx for the logs. Here comes the result:

1. Your money was transferred on 23rd of March
2. Your Wallets was not running on the PC/Notebook from which you’ve collected the logs or the logs were modified.

36ec8336abf51e17b8332782a55d96310bfaacc36093d2deffc54359b8871603   23 Mar 2018 19:02:31 - 10,384.876393 ADA

[launcher:NOTICE] [2017-12-28 13:10:18 EST] Starting the wallet
[launcher:NOTICE] [2018-01-01 12:23:30 EST] Starting the wallet
[launcher:NOTICE] [2018-01-13 09:39:51 EST] Starting the wallet
[launcher:NOTICE] [2018-03-30 10:02:04 MDT] Starting the wallet
[launcher:NOTICE] [2018-03-30 10:08:24 MDT] Starting the wallet

@magnetar

If someone recovers a wallet from seed then they no longer need the password - right ?

Yes, the password is not required for restoring the wallet.

[werkof]

@magnetar

If someone recovers a wallet from seed then they no longer need the password - right ?

thanks you’re right, I put an edit mark on my previous comment.

[headsaflame]

As far as I know, no one knew I had 10,000 ADA. I didn’t post publicly about it and have only talked to a few non-tech savvy family members about this.

[headsaflame]

So the funds were not sent from my computer then. I never changed any of the logs files. Someone must have gotten my 12 word key and restored my wallet.

[_ilap]

Not necessary, if your computer was hijacked and you did not set the password, then he/she could just simply copy the Wallet-1.0, Secret-1.0 and DB-1.0 (everything except the blocks) to his/her computer and could easily start a Daedalus and do any transfer.

[headsaflame]

I don’t have any other evidence that my computer was hijacked. Hopefully no other wallets of mine are compromised.

[whitevo]

There may be more options what happened.

Perhaps Daedalus wallet had an issue and failed to register the amount on the wallet and instead tried to return the money, but receiver exchange couldn’t get your sender wallet address from Daedalus.

I’m not here to undervalue the Daedalus wallet I do believe they shipped software which is very functional.
However, as a developer, these things which are so rare to pop up tend to come up on the live server and not in testing.

[vantuz-subhuman]

@whitevo

Perhaps Daedalus wallet had an issue and failed to register the amount on the wallet and instead tried to return the money

This is not how any of this works )

Daedalus does not just send transactions for you willy nilly, it’s not a bank. And I don’t really understand what “failed to register the amount” means. None of this makes any sense in the context of a blockchain in general and Cardano-SL in particular.

[_ilap]

Your assumption is besed on a level of understadnig CSL, but your knowledge has not reached the level where you would understand what can and cannot be done.

Do not get me wrong, as the ignorance is not same w/ stupidity.
I am very ignorant of a lot of things (lack of knowledge or information) and often stupid (illusion of having knowledge).

[pesuazo]

@_ilap

I am very ignorant of a lot of things (lack of knowledge or information) and often stupid (illusion of having knowledge).

What a wonderful statement…I will plagiarize it (put it in my e-mail signature at work) and not give you credit for it)…