8

I am currently looking at my ethereum wallet and it shows that a transaction happened overnight and wiped my whole balance. I was trying to transfer some funds from my cold wallet. I went on www dot ether-wall dot com and logged on with my private key. I was looking at the rates fluctuating and was waiting before to engage a transaction on shapeshit. I decided not to go through and i notice that my balance was not showing on the right-hand side of the screen. i went on etherscan and myetherwallet.com sites this morning and i discovered that 189 ether were withdrawn and my balance is now 0

I am not sure what happened and why?

Anyone could help me and clarify if my 189 ether got stolen? And is there a way to get support or help to recover that transaction?!? or ban the thief!

enter image description here

enter image description here

  • 2
    Please post relevant blockchain explorer links and screenshots. The current question is not written very clearly and it is not easy for a reader to understand it. – Mikko Ohtamaa Sep 7 '16 at 12:31
  • Do you know exactly what site you used? If you could find the domain, it would help. I wouldn't hold out too much hope for your ether though – Tjaden Hess Sep 7 '16 at 12:31
  • Did you do something on ETC? I am thinking "replay attack". – Xavier Leprêtre B9lab Sep 7 '16 at 13:23
  • here are further details Height: < Prev 2211864 Next > TimeStamp: 20 hrs 50 mins ago (Sep-06-2016 10:07:59 PM +UTC) Transactions: 34 transactions and 32 contract internal transactions in this block Hash: 0x64a856ff016db35238fe2ed1e26a2857e31ee4d20c523900500ffdb7e13fc3f8 Parent Hash: 0x3c62ef6b176b58b76b6bd02361800cf2b438828baf685ad74ad5bf41f4a4a3bb Sha3Uncles: 0x1dcc4de8dec75d7aab85b567b6ccd41ad312451b948a7413f0a142fd40d49347 Mined By: 0x30b6ef1ea77dc4e114c6a7865869b932503f4e6d IN 9 secs – dandan Sep 7 '16 at 19:08
  • Salut @xavier i have not been anywhere close to ETC as i am fairly new and don t really understand how the classic chain works. Would his public address be more helpful to identify the person? and stop him doing the same thing to other ppl? Address 0x1b668C77947A8d0fbbb394D7e68056B5bE6e52b0 – dandan Sep 7 '16 at 19:12
10

This was a phishing attack.

The true URL for MyEtherWallet is https://www.myetherwallet.com

You went to ether-wall dot com. Always check that your connection is over HTTPS.

There's not much we can do. The phishing site does come up as a sponsored ad on Google, which is likely what caught you.

You can report the phishing scam to Google here

  • thanks @Tjaden i will report right away. I still don t understand why these phishing sites cannot be taken down if they are doing illegal activities. and also why the person behind the public address cannot be stopped if he s clearing people balances. I have also noted that the money is still under the same public address unmoved or unspent. – dandan Sep 8 '16 at 8:10
  • 1
    @dandan This happens because Internet is much unregulated entitiy and there is no single party controlling it. Cryptocurrencies like Bitcoin or Ethereum do not have any consumer protection. The fact that transactions are irreversible and cryptocurrency is anonymous and easy to liquidate makes it attractive to perform such scams. If cryptocurrencies were not anonymous, know-your-customer would be enforced by domain name registrants and cryptocurrency exchanges such phishing sites could not thrive. – Mikko Ohtamaa Sep 9 '16 at 11:05
  • @mikko i totally understand the idea of progress through deregulation within a decentralised system but those savvy thieves are actually calling upon the need to police and safeguard vulnerable people endorsing this new technology. This really highlights the human nature and tendency to irresponsibly exploit our own system and neighbours. Given a slim opportunity to morally elevate and advance our society, our true perverse nature crops up and shows how indifferent and powerless we are when trying to responsively live together. – dandan Sep 10 '16 at 9:53
  • @tayvano Community appreciates all your work and your frustration is understandable, but the last part of your comment could be "improved" :) Suggest some modification per meta.stackexchange.com/questions/22232/… – eth Sep 12 '16 at 9:11
  • How far we've come. We have 3 lawyers now. :O – tayvano Jul 18 '17 at 7:04
4

Since this question seems to be gaining traction again.

===

I’m really sorry, but it sounds like you may have been the victim of a phishing attack (link from Slack, Reddit, Forum, Google Ad, etc.), malware, remote-access hack (e.g. via Teamviewer), or something similar. I cannot easily tell you how this could have happened without exactly knowing what you do.

MyEtherWallet.com is a client-side wallet, which means you hold your keys. If someone gets your private information (private key, keystore file, mnemonic, passwords), they have complete access to your funds. There is no stopping transactions, canceling transactions, or resetting passwords on the blockchain. Once a transaction is on the blockchain, it's final.

This is why you must be diligent about the safety and security of your private key. Just like you wouldn't enter your credit card information into a random site or click a random link in your email, you shouldn't enter your private key into a random site or click a random link in your DM.

There are people who follow, track, and attempt to shut down the people behind these sites. We at MyEtherWallet do what we can to warn others, take down the site, and notify exchanges of confirmed addresses and information.

Document & Collect Information

  1. Look through your history for any URLs that look like MyEtherWallet.com (or any other crypto-related site) but are actually a very similar URL (e.g. myetherwallet[.]su or myetherwallet[.]com[.]co).

  2. Document your Ethereum address, transaction hashes, and malicious website or malware or wahtever it was.

  3. Document how you got to this link. Was it on a forum? Posted to reddit? In a Slack DM?

  4. Screenshots, if available, are good of the message sent and the malicious website. Screenshots of your address or transaction should always be accompanied by text / links to them on etherscan.io. No one wants to hand-type an address from a screenshot..

If the website is related to MyEtherWallet, we want to know so we can add to our documentation and records. You can email us at support[at]myetherwallet.com

Move your Funds ASAP

Protect Yourself Moving Forward

Get the Malicous Website Taken Down

Again, I'm really sorry.

Not the answer you're looking for? Browse other questions tagged or ask your own question.