Problem in wallet 2 XCH lost

[iliaset]

Good afternoon!

I have a problem. 2 Chia coins were grown. Today, the official wallet showed a balance of "0", although there were no debits and transactions. I checked the "Chia Explorer" - similarly, the wallet balance is "0", and there are only two payment receipts in the history, and no other expenses. Where are my coins and how do I correct the balance?

https://chia.tt/info/address/xch10qg2hs03gdsrdhlcg49uxhfj5ummglz9j4zny67f0yyyr26ahuhqpphlnc

Добрый день!

У меня появилась проблема. Было выращено 2 Chia coin. Сегодня официальный кошелек показал баланс "0", хотя никаких списаний и транзакций не было. Проверил "Chia Explorer" - аналогично, баланс кошелька "0", и в истории только два поступления платежа, и никаких других трат. Где мои монеты и как исправить баланс?

[loppefaaret]

https://xchscan.com/address/xch10qg2hs03gdsrdhlcg49uxhfj5ummglz9j4zny67f0yyyr26ahuhqpphlnc
8 days ago, there was moved 2 XCH out of the address and moved again, they are now on:
https://xchscan.com/address/xch1cxzumkz37w72md9ysh9qc4t5vn4pl87h4mcfmnsett6w6a8pd52qvteks0

if you did not do this transaction yourself - try and identify hw someone else could take control of you key - does anyone else ever have access to machines that the key is imported on ?
have you run 3rd party code that might have stolen the key ?
do you run other programs on your machine that might have been hacked ?

[iliaset]

yes, I saw that the funds were moved to a new wallet and are there now. I did not conduct this transaction myself. The coins were stolen from my wallet in an unknown way. Most likely, it's a virus of some kind. No third parties had access to my computer. there were various third-party software on the computer. I'm leaning towards two main versions: 1) Stotiks (MadMax) Chia plotter for Windows https://stotiks.github.io/chia-plotter/ - I don't know if there could be a problem in it. In this software, you do not need to specify your 24 words. Many people use it. However, such unoriginal software could be the source of the problem. 2) Approximately in the same days when the theft occurred, there was a hacking of mailboxes on yandex.ru and mail.ru domains. I could not log in to my e-mail passwords on these two sites. I had to restore access to them and create new passwords. Old passwords for accessing e-mail have been compromised. At the same time, Yandex reported the largest DDOS attacks on servers, but said that user data was not affected. The connection of mailboxes with 24 words is theoretical - I did not store them as text in e-mail, but I stored a picture with 24 words in the Yandex cloud service, and the login and password are the same for mail and several other services, one account at a time. Also, the picture with 24 words was on the computer on the desktop. I don't know if viruses could recognize words from the picture, I thought this was unlikely before. These are the main versions of the reasons why viruses and hacking could have appeared. There are also many other places where the problem could theoretically appear - the computer was an ordinary gaming one. Windows is not initially an official build (although there were no problems before). Also uTorrent, TeamViewer, Remote access (I tried to configure it for a few days). Now I'm reinstalling Windows (although not the original build either), I'm starting a new wallet. As I understand it, the old wallet has already been compromised and it is not safe to use it further. I am very upset that this happened and my funds were stolen. As I understand it, it is already unlikely to return them. On my own behalf, I could suggest that you add two-factor authentication for debiting funds from your wallet via SMS to your mobile phone, for those who want to strengthen security. And also to understand and find the malicious code that makes it so easy to steal Chia without the owner's knowledge. This has never happened with Bitcoin and other cryptocurrencies before.

[iliaset]

I will also add that I did not specify my code 24 words on any pools or third-party sites. Farming in Solo on the old type of plots.
Windows 10 LTSC without additional antiviruses

[iliaset]

Unfortunately, this was not the only theft from my accounts. It turned out that on September 6, an illegal login was made to several e-mail boxes. The most unpleasant thing is that the attackers got access to the password manager inside Yandex browser, and these passwords were not additionally protected. In these passwords, the password and login from the bitcoin wallet on the site are saved blockchain.com. As a result, I found it impossible to access my bitcoin wallet, and what is even worse-the withdrawal of all funds from there. In bitcoin, the loss amounted to an additional 0.0735 btc or$ 3406 at current rates, in addition to Chia. The total damage from the hacking amounted to more than $ 4,000. A very bad day for me. According to Chia, I still could not fully understand how the attackers were able to enter the wallet - either they manually found a picture with 24 words in the Yandex.disk account, or they stole some inconspicuous software. Two entries were made from another country, Zurich IP 185.9.18.174 and somewhere in Germany IP 2a0b:f4c2:1:0:0:0:0:1. Most likely, via a VPN, but this is not accurate.

[BrandtH22]

@iliaset , unfortunately it appears someone has gained access to your keyset and/or device and stolen your funds. Since chia is a truly decentralized network there is no way to reclaim the funds or revert the transaction(s). One thing we recommend is ensuring that you and your farm are following security best practices to reduce malicious actors ability to gain access to your keys and/or device, many of these best practices are outlined here: https://www.chia.net/2021/05/28/securing-your-chia-how-to-be-a-hard-target/

Since we unfortunately cannot do more to assist with the stolen funds we will be closing this ticket but if we have closed this ticket in error do not hesitate to reach out to us again with any followup questions.

The best place to reach our support team is on Discord (https://discord.gg/chia) or by reopening this ticket.