QUADRIGA INITIATIVE
CRYPTO WATCHDOG & FRAUD RECOVERY PLATFORM
A COMMUNITY-BASED, NOT-FOR-PROFIT
$64 000 USD
MARCH 2019
TURKEY
LEDGER
DESCRIPTION OF EVENTS
"Based in France, Ledger is the largest cryptocurrency hardware wallet company." "Ledger is a hardware cryptocurrency wallet that is used to store, manage, and sell cryptocurrency. The funds held in these wallets are secured using a 24-word recovery phrase and an optional secret passphrase that only the owner knows."
"Ledger offers two products, the Nano S and Nano X, that can store the digital keys used to secure crypto wallets. The devices can be used with a variety of cryptocurrencies, are compatible with numerous apps, and are supposed to offer a safe way to manage crypto without compromising too much on convenience. Ledger says on its website that it has sold 1.5 million products to customers in 165 countries to date."
"I used the myetherwallet site while uploading my MKR coins to my ledger nano s." "I preferred the myetherwallet application. Trusting myetherwallet was a problem for me. by the way, ledger nano s also recommends using myetherwallet application."
"My ledger nano s wallet hacked. 19 march 2019. 90.82 MKR..." "My $65,000 worth of money was stolen." "My 90,82 MKR tokens stolen..."
"I only had MKR coins in my account. [The] hac[k]er sent ETH to my wallet to withdraw MKR coins. Hac[k]er sent the eth coin to my wallet for the fee. [H]ac[k]er stole my mkr coins first. The hacker then withdrew the eth coin. The hacker then sent my stolen MKR coins to 10 different wallets within 2 days. The hacker then sent the MKR coins in these 10 separate wallets to the HITBTC exchange in the same second. The ability to send mkr coins in the same second is proof that the hacker is using a professional program." "When we look at the exit details from 10 wallets, it can be seen that the mkr coins are sent to the hitbtc exchange, all in the same second."
"@EricLarch @Ledger @myetherwallet @iLhanGULENC1 @hitbtc didn't care enough to solve this problem of mine." "@Ledger why is it your avoiding the growing number of hackings that are coming to light with your nano s product??"
"Why don't you take my 90.83 @MakerDAO tokens stolen from my @ledger - @myetherwallet wallet seriously? My $65,000 worth of money was stolen. You know the link where the theft is done; You do not respond to my e-mails."
"I sent e-mails to myetherwallet application with ledger nano s device manufacturer. But they don't want to admit it. Actually, it is obvious that it is professional fraud.. My country's prosecutor's office wrote an article for hitbtc stock market through interpol. hitbtc is not responding."
"@Hitbtc, which I traded for 2 years, didn't make any effort to solve my problem. I feel like I've been shot in the back." "@hitbtc your legal unit never works."
Twitter user rasgun66 reports that 90.83 MakerDAO (worth $64,000 at the time) were stolen from their Ledger device. In addition, 0.09904276 ETH appears to have been taken from the same wallet to the same recipient shortly thereafter. Few details are provided, except that the exploit happened via three separate transactions and no token approvals are present on the wallet. This suggests it's more likely to be a compromised seed phrase as opposed to tricking him into signing any transaction. The coins ultimately ended up going through HitBTC. There is no indication that rasgun66 was able to recover any funds and he has continually expressed his frustration at that inability.
HOW COULD THIS HAVE BEEN PREVENTED?
Seed phrases need to be kept 100% offline. Further security can be obtained by splitting the seed phrase into multiple parts or setting up a multi-signature wallet.
@jpeezy555 Twitter (Mar 26)
@Guy_Parker Twitter (Jun 12)
@Ledger Twitter (Jun 12)
Ledger Live : Most trusted & secure crypto wallet | Ledger (Feb 13)
Ledger Refuses Refunds, Tells Clients “Bank Vault Is More Secure” | Financegates (Mar 19)
Physical Addresses of 270K Ledger Owners Leaked On Hacker Forum - Slashdot (Mar 19)
Scammers Are Using Fake Devices to Steal Cryptocurrency Wallets | PCMag (Mar 6)
https://etherscan.io/address/0xe3e47ec4a4533159470fab37d1c4908f289ab9a5#tokentxns (Jun 18)
https://etherscan.io/tx/0x910b2a4e5a84392dbe22faffb87361bcbb44ad74bdcb631d847ead872e21da9a (Jun 18)
https://etherscan.io/tx/0x58f762622593fc7787a58c87efa06b742cb0b6028d6f3cdf5bcba75f4c1abfca (Jun 18)
@rasgun66 Twitter (Jun 18)
@Guy_Parker Twitter (Jun 18)
@rasgun66 Twitter (Jun 18)
@rasgun66 Twitter (Jun 18)
https://etherscan.io/tx/0xe531aefa4d87fdb37ac728af3f2cc11186bed20f61d22e4a4ea44dd07840e556 (Jun 18)
https://etherscan.io/tokenapprovalchecker?search=0x283b554c719c5391c61a2172adde9ce6335c8e98 (Jun 18)
Maker price today, MKR live marketcap, chart, and info | CoinMarketCap (Jul 31)
Ethereum Transaction Hash (Txhash) Details | Etherscan (Nov 16)
Ethereum Transaction Hash (Txhash) Details | Etherscan (Nov 16)
Ethereum Transaction Hash (Txhash) Details | Etherscan (Nov 16)
