<p>I have been a victim of a phishing attack today, and the perpetrator stole my bitcoin hosted at <a href="https://coinbase.com" rel="nofollow">coinbase.com</a>. I have an IP address that the attacker used. Is there anything I can do? Any info would be helpful.</p>

CC BY-SA 3.0
2014-05-28T00:55:00.050Z
In the future it would be a safer idea to set up an offline cold wallet. This prevents most attacks.
enigma
CC BY-SA 3.0
2014-05-28T02:49:54.313Z
Yeah, that was what I learned from this experience. I actually only gained access too my bitcoin a day or two ago and hadn't gotten around to it (stupid, I realize). Thank you, though!
user16992
CC BY-SA 3.0
2014-05-28T15:37:21.643Z
Does Coinbase show that your balance is 0 and a transfer out was done, e.g. "You sent bitcoin to an external account"? If Coinbase still shows your correct balance, then all that happened was that they moved money around.
Tim S.
CC BY-SA 3.0
2014-05-28T15:50:55.800Z
Please explain how you got phished so that others are aware of the strategies people are using and can protect themselves. Did you click a link that brought you to a coinbase.com look a like website where you entered your password?
Fraggle
CC BY-SA 3.0
2014-05-28T16:11:44.503Z
I clicked a link in an email that said "review user agreement." I then believe that I entered my username and password into a coinbase-like website, which was in retrospect not coinbase. However, it was so coinbase-like that I was fooled.
user16992
CC BY-SA 3.0
2014-05-28T16:13:01.043Z
Then the perpetrators were somehow able to add their adroid device and transfer the bitcoin within minutes. I don't know why they were able to get into my authy account, which has a different username and password. In any case, they were. Or coinbase did not properly require 2-factor authentication. They also did not wait even two minutes to transfer the bitcoin, which I find frustrating, because I noticed this within minutes, and the coin was already gone. I'm not sure exactly what happened, though, because coinbase is not responding to me.
user16992
CC BY-SA 3.0
2014-05-28T17:27:00.390Z
in your two factor settings there is a limit to what transactions require twofactor.  maybe it was set higher than what was stolen?
Willem Hengeveld
CC BY-SA 3.0
2014-05-28T19:15:31.840Z
No, it was not. It was set to $100 (the default) and they transferred one coin at the current value, which was around $575.
user16992
CC BY-SA 3.0
2014-05-28T19:16:12.557Z
Looks like they implemented new device confirmation today. Cold comfort to me now.
user16992
<phishing><wallet-security>
Someone stole my bitcoin. Help?
user16992
# Someone stole my bitcoin. Help?

(Asked by: username_0 on 2014-05-27)

I have been a victim of a phishing attack today, and the perpetrator stole my bitcoin hosted at [coinbase.com](https://coinbase.com). I have an IP address that the attacker used. Is there anything I can do? Any info would be helpful.

**Tags:** phishing, wallet-security

> **Comments:**
> **username_1**: In the future it would be a safer idea to set up an offline cold wallet. This prevents most attacks.  
> **username_0**: Yeah, that was what I learned from this experience. I actually only gained access too my bitcoin a day or two ago and hadn't gotten around to it (stupid, I realize). Thank you, though!  
> **username_2**: Does Coinbase show that your balance is 0 and a transfer out was done, e.g. "You sent bitcoin to an external account"? If Coinbase still shows your correct balance, then all that happened was that they moved money around.  
> **username_3**: Please explain how you got phished so that others are aware of the strategies people are using and can protect themselves. Did you click a link that brought you to a coinbase.com look a like website where you entered your password?  
> **username_0**: I clicked a link in an email that said "review user agreement." I then believe that I entered my username and password into a coinbase-like website, which was in retrospect not coinbase. However, it was so coinbase-like that I was fooled.  
> **username_0**: Then the perpetrators were somehow able to add their adroid device and transfer the bitcoin within minutes. I don't know why they were able to get into my authy account, which has a different username and password. In any case, they were. Or coinbase did not properly require 2-factor authentication. They also did not wait even two minutes to transfer the bitcoin, which I find frustrating, because I noticed this within minutes, and the coin was already gone. I'm not sure exactly what happened, though, because coinbase is not responding to me.  
> **username_4**: in your two factor settings there is a limit to what transactions require twofactor.  maybe it was set higher than what was stolen?  
> **username_0**: No, it was not. It was set to $100 (the default) and they transferred one coin at the current value, which was around $575.  
> **username_0**: Looks like they implemented new device confirmation today. Cold comfort to me now.  

---

## 0 answers

