Funds stolen. I believe i was phished

[jelloshooter848]

I transferred ~2btc to my cold card. I was using a new laptop so i downloaded wasabi wallet. I suspect i accidentally downloaded a imitation because i was rushing and did not verify the key.

I used the coldcard only to sign the transaction via sd card. The coldcard has never been plugged into anything, and I have never typed the seed phrase on any digital device, only physical. I have to seed phrase physical backups and i checked both. Both were sealed and have not been compromised.

[MarnixCroes]

Hi,

So you had your "watch-only" coldcard wallet on Wasabi right?
Then they might have replaced the receive address in the Wasabi GUI with a different one.

Can you confirm that the address on the coldcard and in Wasabi don't match?

Other that that, basically same answer as previously on Telegram. It seems like you're victim of scam website unfortunately.

[yahiheb]

As confirmed here #11368 (reply in thread) OP has downloaded a malicious version.

[jelloshooter848]

I believe the address does match because i also have a watch-only wallet in bluewallet and it shows all the same transactions, including the final transaction I did not initiate.

[jelloshooter848]

Thank you for the detailed reply. I apologize for the delayed response. Life has gotten crazy, and losing these funds has only made things worse.

1. The first is possible but does seem unlikely. Especially since the last time I updated the coldcard would have been when I first set them up a few years ago.

2. I've thought about this a lot but I think this is extremely unlikely. I'm the only one who knows where both copies of my seed are located, and they are both in locations that would be extremely difficult for someone to access without my knowing, and I cannot fathom how anyone else would even know the locations to begin with.

3. The PIN's were randomly generated and stored on physical paper in a separate location, and the same issues from Support TOR #2 apply to this as well.

4. Very unlikely unless someone had access to my laptop camera or something, but I was using a brand new laptop for testing the first time when I set the coldcards up. Also just seems unlikely because I am very anon and I've told very few people in my life that I even own bitcoin, let alone the quantities.

5. I had separate PIN's and tested both. The only PIN I didnt test was the one that can brick the device.

6. Same as #'s 2,3, & 4.

7. Haha, that is a very interesting though, but no I have not done any mind altering drugs recently (as in anytime in the past 10+ years).

8. Haha very good again. Even if this were anywhere in the realm of possibility the timing is too unlikely. The wallet had 0btc for 2-3 years, and then a few hours after I transfered the bitcoin there was when the malicious txn was made.

9. Definitely possible. I wish we could get more input from coinkite on this. Have they ever responded to anyone? I checked my email again and have gotten no responses from them. Should I send another email to them? Is this typical for their technical support?

10. No. The PIN i used on blue wallet is a simple PIN that I commonly reuse, but I did not think this was critical since it was read only and at no point did I import any information into blue wallet that I thought would be sensitive.

How can I trace the stolen funds? I have done a little bit of tracing myself via mempool.space. I found one address that I believe may contain some of the bitcoin:

bc1q7uxlxmpamhl4p6ekv5zvhzfs20xlm5634rerfy

The rest seems to go through a mixer and I have no idea how to trace it. Are their people who can help me to see where the funds have ended up and find out if the addresses can be associated with any exchanges or similar services that could possibly help identify who took them?

I would love to have coldkite look at the device, but like I said earlier I have not been able to get in contact with anyone from their technical support yet. Can anyone here recommend an outside expert who may be able to help?

At this point the most likely scenario seems to be this IMO:

1. I downloaded a malicious version of Wasabi Wallet without realizing it at the time (I still have the install file if someone could take a look and confirm that for me).
2. When I created one of the transaction in the wallet app on my computer the app inserted some extra code that I was not aware of.
3. When I transferred that transaction to my coldcard via SD card to sign, the code somehow tricked my coldcard into revealing my private key
4. When I then transferred the SD card back to my laptop to publish the transaction to the network my private key was now there in my laptop and the conman was able to access it

I know that the step# 3 that I suggested is not supposed to be possible, but that is still what I think must have happened because I cannot imagine any other plausible scenario based on the facts, including the fact that I am just an anon with a trivial amount of bitcoin and cannot fathom how I could have been the target of nefarious conspiracy.

[yahiheb]

1. I downloaded a malicious version of Wasabi Wallet without realizing it at the time (I still have the install file if someone could take a look and confirm that for me).

To check this you can verify the PGP signatures:
https://docs.wasabiwallet.io/FAQ/FAQ-Installation.html#how-can-i-verify-pgp-signatures
https://docs.wasabiwallet.io/using-wasabi/InstallPackage.html

[Kruwed]

9. Definitely possible.  I wish we could get more input from coinkite on this.  Have they ever responded to anyone?  I checked my email again and have gotten no responses from them.  Should I send another email to them?  Is this typical for their technical support?

I've gotten reasonably fast responses from their support email about issues before.

How can I trace the stolen funds? I have done a little bit of tracing myself via mempool.space. I found one address that I believe may contain some of the bitcoin:
bc1q7uxlxmpamhl4p6ekv5zvhzfs20xlm5634rerfy
The rest seems to go through a mixer and I have no idea how to trace it. Are their people who can help me to see where the funds have ended up and find out if the addresses can be associated with any exchanges or similar services that could possibly help identify who took them?

I see 4 inputs consumed in this tx, which is presumably one where the attacker compromised the wallet: https://mempool.space/tx/45f9143b239535d67cfa339c982a579a1785f05b06b245d3fa5e6dc47eb6892a

All inputs originated as 3 nearly simultaneous withdrawals from an exchange or other service using this address as a hot wallet: bc1q7cyrfmck2ffu2ud3rn5l5a8yv6f0chkp0zpemf

Inputs 3 and 4 are direct withdrawals from this exchange, but inputs 1 and 2 are descendants of this transaction: https://mempool.space/tx/7f97e8403ac497983b6e71575e7dbcf50952900dcf73e8383eba70a1ee231e79

10,000 sats was sent to 3PXAA2doX3kskBkHYSqzNfq8K2CgV5o6gz (some external wallet), then the change was used for a 10,000 sat self spend to bc1q7ej6fqy8lxljwk7t30cv782yt3zp2sh0v7en5y, and the change for that was used for a 10,000 sat self spend to bc1qx2d55vpqje2xe5xy4t879wtfnmk7gkat46l79f. These two 10,000 sat coins created from self spending created one final 10,000 sat self spend sent to bc1qgy0nmetvurfjgsff94k9e3z4fz7xpe7cv07le2 and left 8537 sats in change here: bc1qtw2xcyt5s35fzrtc8tj7gkk42ylskv4m9ndryd

Presumably, the attacker should have also taken the 8537 sats in change left from the final transaction.

Edit: When you previously described this behavior on Telegram you said you were testing two coldcards. I assume the 8537 sats remain on the other coldcard?

[jelloshooter848]

Yes that's correct. Either that card was not compromised, or the small amount of sats made it not worth the attackers time. I am assuming the latter until I know more.

I can send along the zpub for that wallet as well if it would be at all useful.

All inputs originated as 3 nearly simultaneous withdrawals from an exchange or other service using this address as a hot wallet: bc1q7cyrfmck2ffu2ud3rn5l5a8yv6f0chkp0zpemf

Any way to know what exchange it might belong to so I can reach out to them as well?

Thank you all again for all the help and input.

I tried reaching out to uncipehered.com as well on the suggestion of someone else. Haven't gotten any response yet so I'm not sure if they'll be helpful at all and/or how much they would expect in compensation for their services.

[jelloshooter848]

Could you provide any more info at all about those wallets being tied to exchanges or how you are able to figure that out? Or can you suggest someone I could contact who can help me more with that?

[jelloshooter848]

To check this you can verify the PGP signatures: https://docs.wasabiwallet.io/FAQ/FAQ-Installation.html#how-can-i-verify-pgp-signatures https://docs.wasabiwallet.io/using-wasabi/InstallPackage.html

So I downloaded the signature file and put it in the same folder as the install file. I got to directory in terminal and put this line from that page:

gpg --verify Wasabi-2.0.4.deb.asc Wasabi-2.0.4.deb

but then I just get this error message that doesn't seem right:

At line:1 char:3

• --verify Wasabi-2.0.4.deb.asc Wasabi-2.0.4.deb
• ~
  Missing expression after unary operator '--'.
  At line:1 char:3
• --verify Wasabi-2.0.4.deb.asc Wasabi-2.0.4.deb

Unexpected token 'verify' in expression or statement.
+ CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : MissingExpressionAfterOperator

[yahiheb]

You need to import the signing key, as described in the step 1 of this guide: https://docs.wasabiwallet.io/using-wasabi/InstallPackage.html#debian-and-ubuntu

Download zkSNACKs' PGP public key here, and then import it with gpg --import PGP.txt.
Verify that the fingerprint is 6FB3 872B 5D42 292F 5992 0797 8563 4832 8949 861E by running this command gpg --list-keys zkSNACKs.

And as I told you in the previous comment you should verify the 2.0.3 version, that is the one that you downloaded (from some fake website) when the bitcoin was gone.

[jelloshooter848]

I know I need to test the 2.0.3 version, but first I want to make sure I am doing the process correctly with a legitimate file so I can compare the results. I think i successfully verified the 2.0.4 version. Does this look correct?

[jelloshooter848]

Here are the results using the same method for the 2.0.3 file. It definitely appears to be malicious.

[MarnixCroes]

yes the first one is OK, the second one NOT

[jelloshooter848]

So does anyone here have any tips for next steps? I think my only chance is to try to trace the transactions to see if they every go through a KYC wallet.