Evil Roommate Bitcoin Theft

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

An early bitcoin adopter reported in 2013 that their roommate had managed to steal funds from their computer. They identified the theft through blockchain analysis, since the roommate had used it to pay one of their friends, who had paid them back. While their roommate had moved out and was ignoring communications, the latest messages from them suggest that they were planning to pursue legal action.

The country for this case study is not yet known.

About None

"There's actually been stories of room mates stealing Bitcoins (using a keylogger)."

"I first got into bitcoin about a year ago. Like many folks on this sub, I told my friends about it, and used it to buy pizza, play cards, and reimburse others for lending me cash. I didn't make a million dollars through hoarding, but instead I kept my wallet pretty active. Never had a problem with lost coins and I thought I had a pretty good grasp on keeping my funds safe."

"About four months ago my software wallet was drained of a whopping 2.3ish BTC."

"After doing some research, I figured it must have been a problem with my operating system. Maybe I went to the wrong site, downloaded spyware, whatever. I immediately uninstalled Windows and started to learn Linux, figuring that Linux was safer."

"Once I felt comfortable enough with Linux, I decided to buy a cheap netbook, install an OS with a small footprint, and use my netbook for banking only: bitcoin stuff, fiat stuff, anything that I wanted to keep separate from general browsing. I made all the necessary precautions (ad blocker, script blocker, encrypted HD, backups, etc). Then went about the business of funding my wallet."

"Two weeks ago... I'd accumulated a savings of almost 21 bitcoin before I logged on to my wallet and found them all missing! They were sent to an unknown address, then another address, then another. Needless to say I was pissed off. What had I done wrong? How could I have been hacked again?"

"I started telling my friends about it, and some of them took pity on me, even sending me a few coins to a new wallet I created. For some reason (probably paranoia) I started using blockchain.info to track these new transactions. Many late nights looking at addresses and transactions going in and out of my friends' wallets. Thought I was going crazy until I noticed something."

"Some of the coins that a friend sent me led back to my roommate's wallet."

"I'm sure you see where this is going ... after painstakingly tracking transactions through the blockchain, I finally discovered that it was my roommate who stole my coins! He then sent some of those coins to various addresses, but made the mistake of using those same coins to pay a mutual friend for a debt he owed in a real-life poker game that we all play together. (Not very big stakes, just a fun get-together)."

"I confronted my roommate and of course he denied everything. He accused me of being paranoid, got loud and almost violent with me, then started making plans to move out of the apartment."

"I don't feel good about what happened next … because I waited for my roommate to go to work, and then I snuck into his room and tried to log onto his computer. Couldn't get into his computer because of an encrypted password, but I did find a CD in his optical drive. The CD was entitled “BackTrack” which I've since learned is a “hacker” distro used for penetration testing."

"My theory is that my roommate used this CD to monitor my computer on our shared network. Of course this is only a theory. I have no proof that he did this (only proof that he has at least some of my stolen coins). If he was in fact monitoring me, he probably stole my passwords, got into my computer, and then sent the coins to himself. I can't think of another way he could have stolen my coins."

"All in all, I lost nearly 3,000 USD to this guy. Not counting this month's rent and utilities, which I'm sure I won't get, since he moved back into his parent's house and refuses to answer my phone calls. He not only spyed on me, stole from me, but left me with 2x the bills I expected to pay this month."

"The only real proof I have that he stole my coins is a complex web of transactions that I tracked through the blockchain. But it's definitive proof. The blockchain doesn't lie. And though he thought he was acting anonymously, I managed to catch him. Still I have no idea what I'm going to do next. Not sure the blockchain record will help me in court."

"Anyway, I posted this because I wanted to warn others. Hopefully my story will inspire you to take steps to protect yourself. I certainly learned an expensive lesson."

"Most likely he had physical access to your computer and installed a backdoor/keylogger." "Not that it would have been very hard for him. He could have accessed my netbook while I walked away for a moment, to talk on the phone or to take a shower."

"My password to get into my encrypted HD was the same password I used to get into my software wallet and several other websites and programs. My theory is that he somehow got this password by monitoring my keystrokes via Backtrack or by installing a keylogger on my computer via a link or an email he sent to me. Then he waited till I wasn't home, logged into my computer, and sent the coins to himself. It's only a theory though."

"My roommate took advantage of the fact that he lived with me and had many opportunities to steal from me. He failed because he didn't keep his transactions anonymous (enough) on the blockchain, so I was able to track my coins back to him. But it took hours and hours and hours, and many sleepless nights to do so. Not that it matters much. The coins are gone, and he denies it anyway."

"I have created a log of all the transactions that link his wallet to the stolen BTC. Also, I have a friend who says he will testify that the one of the payments came from his wallet."

"I can't even get in touch with him anymore. Neither he nor his parents are answering my phone calls nor returning my messages."

"Regardless of HOW he did it, I have definitive proof via the blockchain that he, in fact, was the one who stole my coins. Just hope that it's enough proof to hold up in court. I doubt it though. Just glad he's out of my life." "I have created a log of all the transactions that link his wallet to the stolen BTC. Also, I have a friend who says he will testify that the one of the payments came from his wallet; however, I'm not sure if this will help. I have never done anything like this before."

The country for this case study is not yet known.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Evil Roommate Bitcoin Theft

Date	Event	Description
June 5th, 2013 12:55:21 PM	Main Event	Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.

Total Amount Lost

The total amount lost has been estimated at $3,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

The total amount recovered is unknown.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Prevention Policies

The majority of funds should be stored in offline cold storage. Break up a seed phrase and store the components in multiple separate secure locations, or use a hardware wallet. Even more advanced security can be achieved by using a multi-sig wallet or storing information in a location such as a bank safety deposit box.