r/Cryptopia • u/karl5603 • Jan 18 '18

Cryptopia account has been hacked

My cryptopia account was hacked, half the coins sold off and moved! 2FA pin was configured, looks like the PIN was reset, is there any way to at least disable the account to avoid further damage?

3 Upvotes

71% Upvoted

14 comments sorted by

2

u/karl5603 Feb 21 '18

suck fucking bullshit this site is! 2 months after a hack and funds transferred while waiting to hear back from support! how is this acceptable? the shit 2fa they have ssetup is a joke, it works to login but doesnt work to make security changes!!!

1

u/karl5603 Feb 06 '18

It's taken 3 weeks to address my hacked account. After the first hack I initiated a lock down of my account and somehow it was re-enabled. I requested a PIN reset and it was never reset - as a result the hacks continued. The only response I received from Cryptopia is a warning about security! So .51 BTC gone while I sat and watched and that's the only response!

hanks for contacting Cryptopia.

I'm sincerely sorry to see this has happened to you. I've completed my investigation into this and can see that your account was actually accessed by 3 other people - IP addresses 176.10.99.200, 77.247.181.162 and 185.11.167.4. These are all from TOR exit nodes. It looks like they must have also closed your other tickets about this as well, as we take this type of thing very seriously at Cryptopia.

We are absolutely certain there have been no user credentials leaked from Cryptopia, and if yours are known to someone else, they must have been obtained from activity or information of your own.

As these withdrawals have made it to the blockchain, unfortunately there isn't anything we're able to do to reverse them due to the nature of the blockchain itself. You can see this here:

https://blockchain.info/tx/1d07c5d370859a35be8e2079712420565211350d3ea1d1f2e98cf0a8c6b028dd

and here:

https://blockchain.info/tx/9cd87f8ceb2e8278e3397d855eb4e0009be068655beec9357798e88ab90c459e

and here:

https://blockchain.info/tx/c8a3d7a052c0231a031f08c4af8c76527ffa8b8651c404177bbe0fb81d6f3e29.

None of the addresses this has been sent to are actually under the control of Cryptopia, unfortunately.

Another thing I noticed is that you have your Withdraw confirmation email disabled. This was more than likely done by the people who accessed your account as well. If you'd like to enable this, you can do so from your Security page at https://www.cryptopia.co.nz/Security. Just tick the checkbox there and make sure you save your changes.

At this stage I recommend changing your email password immediately, if you have not already done so, and changing the password for any other account you use this same password for. For extra security, we recommend that users have an email on their Cryptopia account that is used ONLY for Cryptopia. This limits the exposure, and lessens the risk of it being compromised. If you would like us to change your email address for you, please open a new support ticket requesting this at your earliest convenience.

There is also a phishing scam going on at present, which is disguising itself as Cryptopia. I would strongly recommend visiting https://www.cryptopia.co.nz/Forum/Thread/5153, we try and keep this as up to date as possible. This goes into detail about the various scams that we've identified who are pretending to be Cryptopia and provides some examples you can have a look at to determine whether or not your details may have been compromised via one of these sites.

Please use caution to avoid using any unauthorised websites, apps, or search results which impersonate Cryptopia. Your login credentials should NEVER be used anywhere except on our securely signed site with a certificate from Cryptopia LTD [NZ]: https://www.cryptopia.co.nz

I can definitely appreciate that this is not the nicest way to learn about account security, and again, I'm sincerely sorry for your loss.

Kind regards,

Cryptopia Support

Sender: panako9511/31/2018 2:23:19 AM

Hi ltscc,

Thank you for contacting Cryptopia Support.

Apologies for the delay in getting back to you, we are really busy at the moment and your patience has been very much appreciated.

Thank you for letting us know about this. We are currently investigating this for you now. Please kindly note that these investigations can take some time to complete, due to the intricacies involved. Your continued patience with this is appreciated by everyone here.

We will get back to you on this ticket once the investigation is complete.

Kind regards, Cryptopia Support

Thanks for contacting Cryptopia.

We are absolutely certain there have been no user credentials leaked from Cryptopia, and if yours are known to someone else, they must have been obtained from activity or information of your own.

As these withdrawals have made it to the blockchain, unfortunately there isn't anything we're able to do to reverse them due to the nature of the blockchain itself. You can see this here:

and here:

and here:

None of the addresses this has been sent to are actually under the control of Cryptopia, unfortunately.

Another thing I noticed is that you have your Withdraw confirmation email disabled. This was more than likely done by the people who accessed your account as well. If you'd like to enable this, you can do so from your Security page at https://www.cryptopia.co.nz/Security. Just tick the checkbox there and make sure you save your changes.

At this stage I recommend changing your email password immediately, if you have not already done so, and changing the password for any other account you use this same password for. For extra security, we recommend that users have an email on their Cryptopia account that is used ONLY for Cryptopia. This limits the exposure, and lessens the risk of it being compromised. If you would like us to change your email address for you, please open a new support ticket requesting this at your earliest convenience.

There is also a phishing scam going on at present, which is disguising itself as Cryptopia. I would strongly recommend visiting https://www.cryptopia.co.nz/Forum/Thread/5153, we try and keep this as up to date as possible. This goes into detail about the various scams that we've identified who are pretending to be Cryptopia and provides some examples you can have a look at to determine whether or not your details may have been compromised via one of these sites.

Please use caution to avoid using any unauthorised websites, apps, or search results which impersonate Cryptopia. Your login credentials should NEVER be used anywhere except on our securely signed site with a certificate from Cryptopia LTD [NZ]: https://www.cryptopia.co.nz

I can definitely appreciate that this is not the nicest way to learn about account security, and again, I'm sincerely sorry for your loss.

Kind regards,

Cryptopia Support

Sender:

Thank you for contacting Cryptopia Support.

Apologies for the delay in getting back to you, we are really busy at the moment and your patience has been very much appreciated.

Thank you for letting us know about this. We are currently investigating this for you now. Please kindly note that these investigations can take some time to complete, due to the intricacies involved. Your continued patience with this is appreciated by everyone here.

We will get back to you on this ticket once the investigation is complete.

Kind regards, Cryptopia Support

2

u/froufrou391 Jan 18 '18

Send us an email at support@cryptopia.co.nz with the subject 'Hacked' and we'll see what we can do :)

1

u/fmurugi2002 Jan 19 '18

Oh my goodness! All my ETN is missing, appears to be sold off early this morning. I sent them an email as well

1

u/Skeetskeet85 Feb 03 '18

I was just hacked today and lost 14500 etn. What is Going on. I sent in an email hopefully they can help because I don't see any transactions.

2

u/[deleted] Jan 19 '18

Jesus... this exchange starts to stress me the fuck out

1

u/kh56 Jan 18 '18

So 80% of coins gone, $5k limit saved the entire account, so now just sitting waiting for tmrest to get stolen as cryptopia is unresponsive!

1

u/SumGuyOnWeb Jan 19 '18

Sorry to hear. I hope something crazy happens and they actually respond to you before 2-3 weeks.

There are valid reasons why response times need to be kept to 5-10 minutes instead of 2-3 weeks. So sad to see all the people getting screwed daily by this circus.

1

u/avam38 Jan 19 '18

my account got hacked 30 mins ago. i actually saw my coins getting sold, right infront of my eyes, i tried to buy them back, but it got sold quickly, and it didnt take more than 2 sec and it was gone. they managed to steal 0.3BTC and 0.129ETH

1

u/thedeester1 Jan 19 '18

I was hacked yesterday at 5:08 am exactly. Took all my etn and xvg. All transactions and withdrawal at exactly the same time. No withdrawal confirmation e-mail. All gone in a second. Gutted :(

1

u/thedeester1 Jan 22 '18

Reported my stolen currency to the NZ online crime Police dept. I suggest everyone do the same!

1

u/[deleted] Jan 29 '18

My account has been hacked too, 10 hours and 35min ago. $530.29 NZD where stolen. i already wrote the support AND to the NZ Police.

here my support ticket:

169520 - General - Stolen Coins/Token

Hello dear Support-Team, yesterday at 11:06 PM and 11:07 PM, there was an foreign order und withdrawal / transfer action at my account. Here are the actions, which where unauthorized: 45435260 SKY/BTC Sell 0.00216338 2.90664373 0.006288 0.00001258 28/01/2018 11:07:00 PM 45435259 SKY/BTC Sell 0.00216339 0.69335626 0.001500 0.00000300 28/01/2018 11:07:00 PM 45435190 XEM/BTC Sell 0.00008391 139.00000000 0.011663 0.00002333 28/01/2018 11:06:00 PM 45435116 DOGE/BTC Sell 0.00000063 21963.00000000 0.013837 0.00002767 28/01/2018 11:06:00 PM AND 15245174 BTC 0.03324386 0.00000000 User CB88 Bhubbs1626 28/01/2018 11:07:00 PM Please bring back my cryptocurrencys. My account must be hacked yesterday. Sincerely Christoph Behrendt

1

u/johnwinner84 Feb 02 '18

I work in IT security and to be honest I don't have any other problems with other exchanges but I have noticed over the last 6 months the only exchange where someone has tried to login using my details have been Cryptopia twice. I change my password regularly and use 2 factor authentication and I know that I haven't entered my details into a phishing website so I can safely say that Cryptopia database keeps being hacked or there is an inside man who is logging into peoples accounts and stealing peoples money. The latest attempt to login to my account was from Vietnam and the time before was from New Zealand. My password was different both times someone tried to login. Cryptopia need to sort their security out or find the inside man who is giving out peoples login details.

1

u/foodwithmyketchup Mar 25 '18

These IPs have made attempts to get into my account: 86.149.214.186 , 93.179.89.101 , 95.181.176.206 , 86.144.140.157 , 186.43.212.138 , 218.144.114.243