Security flaw on HitBTC

in #hitbtc7 years ago

I helped my friend with getting into crypto. He bought 1 ETH via fiat bank transfer and moved it to his wallet on HitBTC. He waited for a good Ethereum and Envion price for a couple days.

In the meantime someone accessed his HitBTC account and transfered the Ethereum to the trading account. At this point all trace of the Ethereum is gone, except some dust of approximately 0.017 ETH.

Today we accessed his account and realized that something is fishy, we started to investigate.

Point No. 1

The Ethereum arrived to the HitBTC wallet with no problems.
The next day Ethereum is moved from the main account to the trading account by the hacker.

1.jpg

Point No. 2

Someone from a Russian IP address accessed his account after only one missed login attempt. My friends google authenticator didn't trigger any alarms, his email is in tact.

123124.jpg

Point No. 3

At the end, we found out that this weird sale pattern happened.

123124124.jpg

Buy high - sell low on the NEU/ETH market.
He obviously sold the ethereum to him self with a bot to avoid the withdrawal confirmation email that is usually issued by HitBTC. We contacted HitBTC about the issue and still wait for the reply.

So please be aware of this withdrawal avoiding method, really smart I must admit, we never saw it coming. We didn't setup the 2FA on HitBTC because my friend just wanted to buy some cheap Envion and send it to a paper wallet. We doubt its hacked via a keylogger because then they would have his google account also.

Any white hat hackers here to tell me how they could have done it?

Sort:  

UPDATE

This is their reply, is weird to me they want my browser history, there's lot of data about what I use on a daily basis. I read lots on bitcoin talk forums that they are the ones scamming their users. What do you guys think?

steemupdate.jpg

Congratulations @aravlic! You received a personal award!

Happy Birthday! - You are on the Steem blockchain for 1 year!

Click here to view your Board

Support SteemitBoard's project! Vote for its witness and get one more award!

Congratulations @aravlic! You received a personal award!

Happy Birthday! - You are on the Steem blockchain for 2 years!

You can view your badges on your Steem Board and compare to others on the Steem Ranking

Vote for @Steemitboard as a witness to get one more award and increased upvotes!