Ledger Nano XRP And More Theft Thugluvdoc - Revision history

Azoundria: Another 30 minutes complete. All sources merged in.

2023-06-25T14:30:41Z

Another 30 minutes complete. All sources merged in.

← Older revision		Revision as of 08:30, 25 June 2023
Line 1:		Line 1:
	{{~~Imported~~ Case Study ~~2\|source=https://www.quadrigainitiative.com/casestudy/ledgernanoxrpandmoretheftthugluvdoc.php}~~}		{{Case Study Under Construction}}[[File:Ledger.jpg\|thumb\|Ledger Wallet]]Reddit user Thugluvdoc purchased a new Ledger device from a "Ledger Official" store on Amazon, which included malware prompting him to enter the seed phrase on his computer, where it could be sent to the hacker. He didn't realize the proper process of setting up a Ledger wallet. All of his funds disappeared from his Ledger wallet except for some staked coins. It appears he was able to recover the staked coins by paying a developer to build a bot to transfer them faster than the attacker.
	~~{{Unattributed Sources~~}}

	[[File:Ledger.jpg\|thumb\|Ledger Wallet]]Reddit user Thugluvdoc purchased a new Ledger device from a "Ledger Official" store on Amazon, which included malware prompting him to enter the seed phrase on his computer, where it could be sent to the hacker. He didn't realize the proper process of setting up a Ledger wallet. All of his funds disappeared from his Ledger wallet except for some staked coins. It appears he was able to recover the staked coins by paying a developer to build a bot to transfer them faster than the attacker.

	This is a global/international case not involving a specific country.<ref name="redditold-11163" /><ref name="redditold-11164" /><ref name="redditold-11165" /><ref name="redditold-11166" /><ref name="redditold-11167" />

	== About Thugluvdoc ==		== About Thugluvdoc ==
	Thugluvdoc is an investor in Cosmos<ref name="redditold-11171" />, Avalanche<ref name="redditold-11171" />, Solana<ref name="redditold-11169" />, Ripple<ref name="redditold-11170" />, Tron<ref name="redditold-11170" />, and other cryptocurrencies.		Thugluvdoc is an investor in Cosmos<ref name="redditold-11171" />, Avalanche<ref name="redditold-11171" />, Solana<ref name="redditold-11169" />, Ripple<ref name="redditold-11170" />, Tron<ref name="redditold-11170" />, and other cryptocurrencies.

			Thugluvdoc has a habit of religiously checking all of his wallets every 3 to 4 days<ref name="redditold-11165" />.

	== About Ledger ==		== About Ledger ==
Line 91:		Line 88:
	\|January 17th, 2022 8:48:42 AM MST		\|January 17th, 2022 8:48:42 AM MST
	\|Reddit Post		\|Reddit Post
	\|The issue is posted on Reddit.		\|The issue is posted on Reddit<ref name="redditold-11164" />.
	\|-		\|-
	\|January 17th, 2022 8:58:53 AM MST		\|January 17th, 2022 8:58:53 AM MST
Line 100:		Line 97:
	\|CryptoCurrency SubReddit Attempt		\|CryptoCurrency SubReddit Attempt
	\|Thugluvdoc attempts to post on the Cryptocurrency subreddit. However, his post is automatically removed "for not having a high enough character count"<ref name="redditold-11172" />.		\|Thugluvdoc attempts to post on the Cryptocurrency subreddit. However, his post is automatically removed "for not having a high enough character count"<ref name="redditold-11172" />.
			\|-
			\|January 17th, 2022 9:52:35 AM MST
			\|Further Information Reported
			\|Thugluvdoc reports additional information including that they restored their wallet on their laptop. They regularly check their wallets and recently discovered that their XRP, TRON, and Monero holdings were removed. They suspect someone is trying to move their Atom holdings as well. The user is seeking help to stop this and is considering resetting their keys or taking other actions. They already reached out to "XRP Ledger" for assistance<ref name="redditold-11165" />.
			\|-
			\|January 17th, 2022 10:18:37 AM MST
			\|Request For Help To Stop Avalanche Drain
			\|Thugluvdoc posts on the Avalanche subreddit to request help stopping his Avalanche funds from also being drained<ref name="redditold-11167" />.
	\|-		\|-
	\|January 17th, 2022 11:04:38 AM MST		\|January 17th, 2022 11:04:38 AM MST
Line 108:		Line 113:
	\|Cosmos Unstaked		\|Cosmos Unstaked
	\|Thugluvdoc states that his Cosmos in his wallet has been unstaked, his Avalanche will be unstaked soon, and all his other coins are already gone<ref name="redditold-11171" />.		\|Thugluvdoc states that his Cosmos in his wallet has been unstaked, his Avalanche will be unstaked soon, and all his other coins are already gone<ref name="redditold-11171" />.
			\|-
			\|February 6th, 2022 7:40:38 AM MST
			\|Looking For Tax Advice
			\|Thugluvdoc posts on the Tax subreddit seeking advice on whether or not his cryptocurrency loss is tax deductible. Unfortunately, it is not<ref name="redditold-11166" />.
	\|}		\|}

Line 118:		Line 127:

	<ref name="redditold-11171" /><ref name="redditold-11170" /><ref name="xrpscan-11168" />		<ref name="redditold-11171" /><ref name="redditold-11170" /><ref name="xrpscan-11168" />

			<ref name="redditold-11167" /><blockquote>I bought the Ledger from the “Ledger official” store on Amazon. It has a link to the ledger website so I thought it was legit. I guess I made that mistake by going thru the Amazon ledger store. Going to see if my credit card protects me on these losses next. Thanks to everyone who had helpful comments and messages. Everyone else, that negative energy will bite you in the end. Life’s a bitch, you better hope that bitch is beautiful #lilwayne</blockquote>

	== Total Amount Lost ==		== Total Amount Lost ==
			Thugluvdoc reports that his wallet contained Ripple, Tron, and Monero which were removed<ref name="redditold-11165" />. His wallet also contained Atom which was not removed<ref name="redditold-11165" />.

	The total amount lost has been estimated at $6,000 USD.		The total amount lost has been estimated at $6,000 USD.

Line 127:		Line 140:

	== Immediate Reactions ==		== Immediate Reactions ==
	~~How did~~ the ~~various parties involved (firm~~, ~~platform~~, ~~management, and~~/~~or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?~~		Thugluvdoc reports checking his wallet after all funds were removed<ref name="redditold-11165" />.

			=== Contact With "Xrp Ledger" ===
			Thugluvdoc reports that his initial reaction was to attempt to reach out to "xrp ledger"<ref name="redditold-11165" />. It is unclear if "xrp ledger" is the name of a subreddit, the official Ledger wallet support, or may have been a scam account.

			=== Assistance With Avalanche Funds ===
			<ref name="redditold-11167" />

	== Ultimate Outcome ==		== Ultimate Outcome ==
	What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?		What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

			=== Potential Assistance From Amanusk ===
			<ref>[https://old.reddit.com/r/Avax/comments/s697n6/ledger_hacked_avalanche_is_staked_how_can_i_stop/ht2j5gz/ cryptoskillz - "There was a similiar incident in /cc. Someone got hacked to and a guy helped him to write some kind of a script which executed a withdrawal as soon as the staking period was over. He managed to save a big portion of his assets, however not everything. Maybe you can look that post up and ask the same guy if he can help you. I think he said that it was the second time he was able to help someone with a similiar case. I bet he will help you out." - Reddit] (Jun 25, 2023)</ref><blockquote>"There was a similiar incident in /cc. Someone got hacked to and a guy helped him to write some kind of a script which executed a withdrawal as soon as the staking period was over. He managed to save a big portion of his assets, however not everything. Maybe you can look that post up and ask the same guy if he can help you. I think he said that it was the second time he was able to help someone with a similiar case. I bet he will help you out."</blockquote>

			=== Theft Loss Is Not Taxable ===
			<ref name="redditold-11166" /><ref>[https://old.reddit.com/r/tax/comments/sly8er/i_had_a_large_sum_of_money_in_cryptocurrency/hvtiaa7/ Thugluvdoc - "But do the thieves get taxed when they self report?" - Reddit] (Jun 25, 2023)</ref>

	== Total Amount Recovered ==		== Total Amount Recovered ==
Line 164:		Line 189:
	== References ==		== References ==
	<references>		<references>
	<ref name="redditold-11163">[https://old.reddit.com/r/Ripple/comments/s671s0/my_xrp_was_transferred_off_my_nano_ledger_somehow/ht3jfax/ My XRP was transferred off my nano ledger somehow ~~: Ripple~~] (Oct 3, 2022)</ref>		<ref name="redditold-11163">[https://old.reddit.com/r/Ripple/comments/s671s0/my_xrp_was_transferred_off_my_nano_ledger_somehow/ht3jfax/ Thugluvdoc - My XRP was transferred off my nano ledger somehow - Reddit] (Oct 3, 2022)</ref>
	<ref name="redditold-11164">[https://old.reddit.com/r/Ripple/comments/s671s0/my_xrp_was_transferred_off_my_nano_ledger_somehow/ My XRP was transferred off my nano ledger somehow : Ripple] (May 29, 2023)</ref>		<ref name="redditold-11164">[https://old.reddit.com/r/Ripple/comments/s671s0/my_xrp_was_transferred_off_my_nano_ledger_somehow/ Thugluvdoc - My XRP was transferred off my nano ledger somehow - Ripple - Reddit] (May 29, 2023)</ref>
	<ref name="redditold-11165">[https://old.reddit.com/r/Ripple/comments/s671s0/my_xrp_was_transferred_off_my_nano_ledger_somehow/ht21z68/ Thugluvdoc ~~comments~~ on My XRP was ~~transferred~~ off my ~~nano~~ ledger ~~somehow~~] (May 29, 2023)</ref>		<ref name="redditold-11165">[https://old.reddit.com/r/Ripple/comments/s671s0/my_xrp_was_transferred_off_my_nano_ledger_somehow/ht21z68/ Thugluvdoc - "I did not go to any website. I restored it on my actual laptop. I check all of my wallets religiously every 3-4 days. I just checked today, and all of my XRP, TRON, and Monero was removed. My atom is being undelegated and i assume they want to move that off. Can I stop this in any way? Reset my keys? Or something? I did reach out to xrp ledger for help since atom wasn't staking rewards. I am so crushed rn" - Reddit] (May 29, 2023)</ref>
	<ref name="redditold-11166">[https://old.reddit.com/r/tax/comments/sly8er/i_had_a_large_sum_of_money_in_cryptocurrency/ I had a large sum of money in cryptocurrency cyber-robbed from me. Is this tax deductible? ~~: tax~~] (Jun 1, 2023)</ref>		<ref name="redditold-11166">[https://old.reddit.com/r/tax/comments/sly8er/i_had_a_large_sum_of_money_in_cryptocurrency/ Thugluvdoc - "I had a large sum of money in cryptocurrency cyber-robbed from me. Is this tax deductible?" - Reddit] (Jun 1, 2023)</ref>
	<ref name="redditold-11167">[https://old.reddit.com/r/Avax/comments/s697n6/ledger_hacked_avalanche_is_staked_how_can_i_stop/ Ledger hacked, avalanche is staked. How can I stop them from draining my avalanche once staking period is finished? : Avax] (Jun 1, 2023)</ref>		<ref name="redditold-11167">[https://old.reddit.com/r/Avax/comments/s697n6/ledger_hacked_avalanche_is_staked_how_can_i_stop/ Thugluvdoc - "Ledger hacked, avalanche is staked. How can I stop them from draining my avalanche once staking period is finished?" - Avax Reddit] (Jun 1, 2023)</ref>
	<ref name="xrpscan-11168">[https://xrpscan.com/tx/C60E0624753D91EF0657441186B6D6119E854B253A702B3E76B59651B509EF8D Theft Transaction Stealing 6,907.995481 XRP From Thugluvdoc - XrpScan] (Jun 1, 2023)</ref>		<ref name="xrpscan-11168">[https://xrpscan.com/tx/C60E0624753D91EF0657441186B6D6119E854B253A702B3E76B59651B509EF8D Theft Transaction Stealing 6,907.995481 XRP From Thugluvdoc - XrpScan] (Jun 1, 2023)</ref>
	<ref name="redditold-11169">[https://old.reddit.com/r/solana/comments/rzwf9x/phantom_wallet_not_showing_my_coins_did_i_get/ Thugluvdoc - "Phantom wallet not showing my coins. Did I get hacked?" - Solana Reddit] (Jun 1, 2023)</ref>		<ref name="redditold-11169">[https://old.reddit.com/r/solana/comments/rzwf9x/phantom_wallet_not_showing_my_coins_did_i_get/ Thugluvdoc - "Phantom wallet not showing my coins. Did I get hacked?" - Solana Reddit] (Jun 1, 2023)</ref>

Azoundria: Initial 30 minutes completed. Prevention added.

2023-06-11T02:34:29Z

Initial 30 minutes completed. Prevention added.

Show changes

Azoundria: Created page with "{{Imported Case Study 2|source=https://www.quadrigainitiative.com/casestudy/ledgernanoxrpandmoretheftthugluvdoc.php}} {{Unattributed Sources}} Ledger WalletReddit user Thugluvdoc purchased a new Ledger device from a "Ledger Official" store on Amazon, which included malware prompting him to enter the seed phrase on his computer, where it could be sent to the hacker. He didn't realize the proper process of setting up a Ledger wallet. All of his f..."

2023-06-11T02:02:22Z

Created page with "{{Imported Case Study 2|source=https://www.quadrigainitiative.com/casestudy/ledgernanoxrpandmoretheftthugluvdoc.php}} {{Unattributed Sources}} thumb|Ledger WalletReddit user Thugluvdoc purchased a new Ledger device from a "Ledger Official" store on Amazon, which included malware prompting him to enter the seed phrase on his computer, where it could be sent to the hacker. He didn't realize the proper process of setting up a Ledger wallet. All of his f..."

New page

{{Imported Case Study 2|source=https://www.quadrigainitiative.com/casestudy/ledgernanoxrpandmoretheftthugluvdoc.php}}
{{Unattributed Sources}}

[[File:Ledger.jpg|thumb|Ledger Wallet]]Reddit user Thugluvdoc purchased a new Ledger device from a "Ledger Official" store on Amazon, which included malware prompting him to enter the seed phrase on his computer, where it could be sent to the hacker. He didn't realize the proper process of setting up a Ledger wallet. All of his funds disappeared from his Ledger wallet except for some staked coins. It appears he was able to recover the staked coins by paying a developer to build a bot to transfer them faster than the attacker.

This is a global/international case not involving a specific country.<ref name="redditold-11163" /><ref name="redditold-11164" /><ref name="redditold-11165" /><ref name="redditold-11166" /><ref name="redditold-11167" /><ref name="xrpscan-11168" /><ref name="redditold-11169" /><ref name="redditold-11170" /><ref name="redditold-11171" /><ref name="redditold-11172" /><ref name="redditold-11173" /><ref name="xrpscan-11174" /><ref name="xrpscan-11175" /><ref name="coinmarketcap-2237" />

== About Ledger ==
"I bought the Ledger from the “Ledger official” store on Amazon. It has a link to the ledger website so I thought it was legit. I guess I made that mistake by going thru the Amazon ledger store."

"All coins unstaked are gone. Only the staked coins (cosmos and avalanche) are left. Cosmos has been undelegated by the hacker, and I have a few weeks before I can pull them. Hopefully faster than them. Avalanche auto unstakes at the end of February. Seeing if there is any way to secure my ledger or get a script to move coins out beforehand"

"I don't know how, but I believe I was hacked. Is there any way to retrieve XRP that was sent to an unknown wallet? I have a transaction from last Wednesday, and I never sent my ripple ANYWHERE. I have the wallet address it was sent to below. If anyone can help, please let me know.

This is the wallet where my stolen XRP was sent to: rPca9fVC5747DB3r8hDB6r8nkRxA3PsMYr

Cosmos is unable to do anything about the unstaking and transfer. So I have to race against the thief to hope I transfer it off somewhere quickly

I am still hoping for better luck with avalanche"

"it’s stored in the box in my suitcase. This ledger I bought must’ve been compromised."

"It’s been in my box in my suitcase since I bought this. I upgraded from my old ledger I held my coins on for 5 years, and this new one I was drained of my cosmos, tron, ripple, and monero"

"None, nobody. My cleaning lady I guess. I don't want to underestimate anyone, but that is doubtful"

"I did not go to any website. I restored it on my actual laptop. I check all of my wallets religiously every 3-4 days. I just checked today, and all of my XRP, TRON, and Monero was removed. My atom is being undelegated and i assume they want to move that off. Can I stop this in any way? Reset my keys? Or something?

"I did type it in to restore my old wallet" "How did I transfer my coins from my old to new ledger then? Not sure" "No part of the restore process requires you to type your seed into the computer"

I did reach out to xrp ledger for help since atom wasn't staking rewards. I am so crushed rn"

"I don't know how my ledger could've been hacked. I got a new one a few months back because I have more coins than I did 4 years ago. Now everything is drained (XRP, TRON, MONERO) but they are undelegating my Cosmos as we speak."

"Seeming like a malware. No clue how they could’ve accessed my monero wallet on my laptop"

"That’s the wallet they deposited my 6900 xrp"

"Also if anyone knows how I can make sure my AVAX is sent to another wallet immediately upon the staking period ending, I’d really appreciate the help and you will receive payment in crypto as a thank you once it is done."

"paid someone to write me a bot. Costed me $7500 but well worth it. Recovered my cosmos I’ll never recover the XRP, tron, or monero. Hoping I still hold my Avax which unstakes soon"

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Ledger Nano XRP And More Theft Thugluvdoc
!Date
!Event
!Description
|-
|January 12th, 2022 12:34:22 PM MST
|XRP Stolen
|The XRP is stolen from his wallet.
|-
|January 17th, 2022 8:48:42 AM MST
|Reddit Post
|The issue is posted on Reddit.
|}

== Technical Details ==
This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

== Total Amount Lost ==
The total amount lost has been estimated at $6,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== General Prevention Policies ==
It is absolutely critical to use official sources when purchasing hardware wallets. Seed phrases should never be entered on a computer when using a hardware wallet. When transferring to a new wallet, risk can be reduced by first setting up a new wallet with a smaller balance instead of transferring all funds at once.
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="redditold-11163">[https://old.reddit.com/r/Ripple/comments/s671s0/my_xrp_was_transferred_off_my_nano_ledger_somehow/ht3jfax/ My XRP was transferred off my nano ledger somehow : Ripple] (Oct 3, 2022)</ref>

<ref name="redditold-11164">[https://old.reddit.com/r/Ripple/comments/s671s0/my_xrp_was_transferred_off_my_nano_ledger_somehow/ My XRP was transferred off my nano ledger somehow : Ripple] (May 29, 2023)</ref>

<ref name="redditold-11165">[https://old.reddit.com/r/Ripple/comments/s671s0/my_xrp_was_transferred_off_my_nano_ledger_somehow/ht21z68/ Thugluvdoc comments on My XRP was transferred off my nano ledger somehow] (May 29, 2023)</ref>

<ref name="redditold-11166">[https://old.reddit.com/r/tax/comments/sly8er/i_had_a_large_sum_of_money_in_cryptocurrency/ I had a large sum of money in cryptocurrency cyber-robbed from me. Is this tax deductible? : tax] (Jun 1, 2023)</ref>

<ref name="redditold-11167">[https://old.reddit.com/r/Avax/comments/s697n6/ledger_hacked_avalanche_is_staked_how_can_i_stop/ Ledger hacked, avalanche is staked. How can I stop them from draining my avalanche once staking period is finished? : Avax] (Jun 1, 2023)</ref>

<ref name="xrpscan-11168">[https://xrpscan.com/tx/C60E0624753D91EF0657441186B6D6119E854B253A702B3E76B59651B509EF8D XRP Ledger Explorer - XRPSCAN] (Jun 1, 2023)</ref>

<ref name="redditold-11169">[https://old.reddit.com/r/solana/comments/rzwf9x/phantom_wallet_not_showing_my_coins_did_i_get/ Phantom wallet not showing my coins. Did I get hacked? : solana] (Jun 1, 2023)</ref>

<ref name="redditold-11170">[https://old.reddit.com/r/ledgerwallet/comments/s67a2z/hacked_and_actively_draining_coins_how_can_i_stop/ HACKED and actively draining coins. HOW CAN I STOP THIS : ledgerwallet] (Jun 1, 2023)</ref>

<ref name="redditold-11171">[https://old.reddit.com/r/ledgerwallet/comments/s67a2z/hacked_and_actively_draining_coins_how_can_i_stop/ht32jdz/ Thugluvdoc comments on HACKED and actively draining coins. HOW CAN I STOP THIS] (Jun 1, 2023)</ref>

<ref name="redditold-11172">[https://old.reddit.com/r/CryptoCurrency/comments/s68ccz/nano_ledger_hacked_everything_drained_now_theyre/ Nano ledger hacked, everything drained. Now they’re undelegating my Cosmos and I need to stop them from stealing it after that’s done undelegating. Help please : CryptoCurrency] (Jun 1, 2023)</ref>

<ref name="redditold-11173">[https://old.reddit.com/r/cosmosnetwork/comments/s68mtv/ledger_hacked_cosmos_is_being_undelegated_how_can/ht2dd4z/ Thugluvdoc comments on Ledger hacked, COSMOS is being undelegated. How can I stop this?] (Jun 1, 2023)</ref>

<ref name="xrpscan-11174">[https://xrpscan.com/account/rPca9fVC5747DB3r8hDB6r8nkRxA3PsMYr XRP Ledger Explorer - XRPSCAN] (Jun 1, 2023)</ref>

<ref name="xrpscan-11175">[https://xrpscan.com/account/r4PfwniEfVAUSYiHTL7WBHfTndzWZoCJrE XRP Ledger Explorer - XRPSCAN] (Jun 1, 2023)</ref>

<ref name="coinmarketcap-2237">[https://coinmarketcap.com/currencies/xrp/historical-data/ XRP price today, XRP live marketcap, chart, and info | CoinMarketCap] (Aug 7, 2021)</ref></references>