Ive been hacked

[Spreadloveprana]

Please help.
I checked my Blockchain.info account this morning to find 3 payments had been made while i was asleep last night.

All are currently still pending and all the have a warning regarding they being double spends and how I should be extremely careful when trusting any transactions to/from this sender. 230710377

The only thing i did any different was last night I verified via the Blockchain.info site a QR code so i could use the app version on my Iphone5.

Apart from this just before I slept my internet was off all night and only saw transactions at 8.30 once i reached new destination for the day.

The fishy thing is they have added similar descriptions to 2 of the transactions and one has nothing

Can anyone advise as to what i should do to stop or reverse them

[mocacinno]

if you're really, really fast, you can try to double spend the inputs, generate a new transaction with a big fee and the output going to an address generated by a clean wallet on a clean pc.

This can ONLY be done as long as the "stealing" transactions are not confirmed.

Step 1= make sure you have the private keys for ALL addresses where funds dissapeared.
Step 2= post the tx id's from the "stealing" transactions
Step 3= make a new wallet, for example using electrum, on a clean pc, generate a receiving address and post it here

Step 4= i'll make a new transaction, double spending the inputs used by the stealing transactions and post it here... You'll need to sign the transactions, for example using electrum and broadcast them.

Once again: this will ONLY work as long as the stealing transactions are not confirmed!!! once they have a confirmation, your BTC is gone...

[Spreadloveprana]

Wow many thanks for the info
Ill try i now

[bitkilo]

If you need him to then you should be able to trust mocacinno to preform the above task for you, he is a long term community member and someone i would consider trustworthy.

Seems odd that a hackers would stuff up 3 consecutive transactions or try double spend what wasn't even his yet, greed?

[mocacinno]

If you need him to then you should be able to trust mocacinno to preform the above task for you, he is a long term community member and someone i would consider trustworthy.

Seems odd that a hackers would stuff up 3 consecutive transactions or try double spend what wasn't even his yet, greed?

Thanks for the kind words
I haven't seen the OP's tx (yet), but it's possible an attacker gained acccess to OP's wallet, created a tx to one of his own addresses and broadcasted it, then realised the fee was to low, so double-spent the inputs using a higher fee (so there was less chance the OP would notice the theft untill it was to late).

So, the only thing left to do is tripple (or quadruppel) spend the inputs leaving (yet) a higher fee, overpaying the thief... That way the OP has a reasonable (but not 100% chance) of recovering his funds minus the hefty fee to overbid the thief.

BTW: OP: you can post addresses and tx id's freely, but never post, PM, tox,... your private keys. Never give those private keys away, not even to trusted members... don't post your private keys in this thread!!!

[bitkilo]

If you need him to then you should be able to trust mocacinno to preform the above task for you, he is a long term community member and someone i would consider trustworthy.

Seems odd that a hackers would stuff up 3 consecutive transactions or try double spend what wasn't even his yet, greed?

Thanks for the kind words
I haven't seen the OP's tx (yet), but it's possible an attacker gained acccess to OP's wallet, created a tx to one of his own addresses and broadcasted it, then realised the fee was to low, so double-spent the inputs using a higher fee (so there was less chance the OP would notice the theft untill it was to late).

So, the only thing left to do is tripple (or quadruppel) spend the inputs leaving (yet) a higher fee, overpaying the thief... That way the OP has a reasonable (but not 100% chance) of recovering his funds minus the hefty fee to overbid the thief.

BTW: OP: you can post addresses and tx id's freely, but never post, PM, tox,... your private keys. Never give those private keys away, not even to trusted members... don't post your private keys in this thread!!!

Yes its a shame the OP didn't post the txid's first off or this could already be underway.
It would be worth paying a 50% fee just so the hacker gets nothing, i would rather give it to a miner than a hacker.

[mocacinno]

Yes its a shame the OP didn't post the txid's first off or this could already be underway.
It would be worth paying a 50% fee just so the hacker gets nothing, i would rather give it to a miner than a hacker.

indeed... I'd personally rather give 100% to a miner than giving it to a hacker...

I'm going on a lunchbreak now, but since this question is time-critical, there is a way to create the transaction yourself:

http://www.mocacinno.com/page/createraw
In the top part, list all inputs, both the transactionid as the n (the number of the output)
In the bottom part, only put your address, nothing else

Run the script once, look at how much fee it left, re-run it, but in the bottom form, leave more fee.

There is a small how-to tutorial after running the wizard that explains how to sign a transaction using electrum (i wouldn't use core, since this is all very time-critical, and core needs hours/days to sync)

As an example, if i wanted to double spend the inputs for the ,already confirmed transaction 5dce2fe0b961ae228a06bfb66451ee90c0aa82f6bf6b1833b4939d8c10e9b90b, which is impossible, i'd enter following things in the wizard linked to above this text:

Code: Select all

inputs: 01d96f59b463d2d24fafe6a9adc2b69c94b96ae99d8d94bc9309ccf1d4ea7a15,0 outputs: mynewaddress,0.05

[Spreadloveprana]

on further investigation 2 of the receive addresses are people i know and have sent to before and one is anonymous. Im trying to contact them both to see if they have received the coin. The last one is a mystery and its odd they added similar descriptions on the 2 people i know.

Could this be a simple system error?

Because 2 of the receive addresses are the same and familiar people, does this mean they can only be the wallets that receive the payments?

[mocacinno]

on further investigation 2 of the receive addresses are people i know and have sent to before and one is anonymous. Im trying to contact them both to see if they have received the coin. The last one is a mystery and its odd they added similar descriptions on the 2 people i know.

Could this be a simple system error?

Because 2 of the receive addresses are the same and familiar people, does this mean they can only be the wallets that receive the payments?

Yes, if you know the people with those output addresses, it's probably a blockchain bug, or maybe a misinterpretation of an older transaction.