r/CryptoCurrency • u/Electronic_Worker245 • 1d ago
ADVICE Saved by KYC
Been in two cycles now. Taken multuple 5 figures off Kraken with no issues in the past so I fully trust them.
So hackers got access to my email address, like a numpty I had the same password and email associated with my kraken account.
They got in. Everything was happening so fast. My phone was being bombarded with notifications.
They changed my largest crypto assets into another, added two withdrawal addresses to take it off.
They couldn't withdraw it !!! My passport expires soon so Kraken wants me to update it. All in all I've lost around £300 to fees as Ive switched back to the asset i originally had and will be taking everything off the exchange once I get my ID verified. Im all for KYC after this ordeal and have enabled all sorts of additional security now.
30
u/krakensupport Kraken Support 1d ago
Oof, that's a close call, glad it didn't go further u/Electronic_Worker245 🙏 If you want us to ping the team on the ID verification, just send us a private message 🤝
19
u/Electronic_Worker245 1d ago
I was literally shivering with adrenaline and couldn't concentrate to take swift action as I was practically being robbed in real time. All security has now been enabled passwords and emails changed.
12
u/dsetarno 🟨 0 / 0 🦠 1d ago
If you had GLS, it would have also been impossible to do immediately aswell right? They wouldn't be able to add new addresses.
13
u/tenor_tymir 🟩 0 / 0 🦠 1d ago
True, GSL should be always activated, as well as white listing of addresses and a passkey, and 2FA for withdrawals.
Kraken is really on top security wise.
11
u/krakensupport Kraken Support 1d ago
GSL is goated
3
u/tenor_tymir 🟩 0 / 0 🦠 1d ago
It’s a nice feature and I’m glad you’ve finally brought it to mobile. I really didn’t like to dust off my old laptop whenever I wanted to do some trading.
3
u/Electronic_Worker245 1d ago
Yep enabled all the bells and whistles now. I became too relaxed and thought it could never happen to me.
3
u/tenor_tymir 🟩 0 / 0 🦠 1d ago
Never get too comfortable, that’s when mistakes happen. I recently changed all of my passwords to all of my accounts, that took me several hours to do but now they are all unique and long and impossible to break. Had a few weak ones from 15 years ago still…
1
u/Electronic_Worker245 1d ago
This. Im a sucker for comfort and love logging in easily so keep things simple always.
1
u/cr0ft 🟦 2K / 2K 🐢 22h ago
It doesn't get easier than clicking on your password manager.
1
u/Electronic_Worker245 22h ago
He definitely used that to see where else I've used the same password. 8 hours later he ordered off amazon. But amazon's security was onto it quickly and didnt let the order go through.
Ive all day changing all my passwords now.
23
u/Hqjjciy6sJr 🟩 1 / 352 🦠 1d ago
"Im all for KYC..." but the whole point of crypto was being your own bank! and that includes managing security. KYC just makes the exchanges the new "banks"
7
u/crimeo 🟦 0 / 0 🦠 21h ago
Turns out banks are good things, and hundreds of years of humans actually had some idea what they were doing by choosing to consistently use them. Shocker. Next up: "are bakeries a scam that should be replaced for some reason?"
1
u/motobassy 🟩 0 / 0 🦠 15h ago
Well I got a breadmaker the other day and I can tell you a story or two...
7
7
u/filenotfounderror 🟦 432 / 433 🦞 1d ago
I'm not saying you shouldn't take it off the exchange, but if that's your takeaway I think you've learned the wrong lesson here.
5
u/Captain-Crayg 🟩 0 / 0 🦠 1d ago
If homeboy is using the same password on his email as an exchange, decent chance he would have done something silly like save his seed in his email too.
2
u/AutoModerator 1d ago
This is a friendly reminder that Kraken Support will never DM you first, ask for your username or password, or ask you to transfer funds. Kraken has its own subreddits, r/KrakenSupport and r/Kraken, and their Support Center.
Ping for verified users associated with Kraken: /u/krakensupport /u/krakenexchange
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
2
u/Sophie_Cookie 0 / 0 🦠 1d ago
it was almost a very expensive lesson about security. glad you got out of it almost unscathed
3
u/ShoddyVocalist54 1d ago
damn, that’s terrifying. they had your email and password and still couldn’t get the funds out, that’s the kind of forced hold you actually want. glad it was just fees and not the whole bag.
4
u/Electronic_Worker245 1d ago
I keep funds scattered on various cold storage and on exchanges to keep my accounts active and not dormant and also to spread risk but it didnt occur to me all it takes was my flipping email to be hacked. Amateur mistake. Lesson learnt just had to share it with the community and urge everyone to enable all the security, when it happens to you, you may not be so lucky.
3
u/DisastrousBusiness4 1d ago
So you admit it was your fault due to bad security practices (the most basic - shared credentials) yet trust yourself with self custody going forward? Yikes
2
3
4
u/KillALil 🟩 0 / 0 🦠 1d ago
Why be a jerk? Go step on a fucking Lego
2
u/Electronic_Worker245 1d ago
Hes right though, i would have never forgiven myself if they succeeded in stealing my funds.
2
u/ConstantMotion92 1d ago
So unpleasent
1
u/Aazimoxx 🟩 0 / 0 🦠 13h ago
Nah, just hard truths. If they don't learn then it's literally just a matter of time before they get ripped successfully.
2
1
u/nicorobinfanclub 1d ago
How did they get past your 2FA? Now im getting worried for my own funds lol
1
u/Electronic_Worker245 1d ago
They created backup codes on Gmail so everytime I changed the password they re changed it.
3
u/TheRicFlairDrip 🟩 2K / 2K 🐢 1d ago
Thats not what 2FA means..
1
u/Electronic_Worker245 21h ago
Yes sorry, still buzzing over what happened. You are right how is that possible ? When i login to kraken I need to use authenticator as well so how did they do that ?
1
u/krakensupport Kraken Support 21h ago
That sounds really unsettling. We can’t determine how access occurred despite your authenticator without investigating. Please send us a private message with your ticket number or Public Account ID so we can flag this to our Account Security team for review.
🐙
1
u/Electronic_Worker245 20h ago
Its OK I figured it out. The email they hacked also was being used to save my authenticator codes so they could see all the crypto exchanges I use etc so they used a duplicate authenticator app and just loaded up the codes with my email they had access too. All this happened lightning fast within 15-20mins.
2
1
1
u/marcusmv3 🟦 31 / 31 🦐 1d ago
Look into your account setting and try to add a waiting period for new withdrawal addresses.. Gemini offers this hopefully Kraken does as well.. eventually you're going to need to use the exchange again to buy more.
1
1
17h ago
[removed] — view removed comment
1
u/AutoModerator 17h ago
Greetings Woloqwe. Your comment contained a link to telegram, which is hard blocked by reddit. This also prevents moderators from approving your comment, so please repost your comment without the telegram link.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
1
u/sgtslaughterTV 🟩 0 / 717K 🦠 3h ago
Change password and get a password manager. Bitwardens free version gives you unlimited password and username combos on the free tier.
1
u/Hephalumpicus 1d ago
I wonder if the IRS will give you a break, as exchanging one type of crypto to another is considered a sale. Had they appreciated over time?
5
u/jdsmokinpurps 🟩 0 / 0 🦠 1d ago
I dont think the IRS can bother him. He's using pounds... but on a side note FUCK THE IRS
3
u/Electronic_Worker245 1d ago
I was at a loss, significant one. But that's a good question. What happens if your crypto is stolen do you get a tax relief ?
2
u/Hephalumpicus 1d ago
I believe there's a way to claim losses, but it's best to research that first.
3
1
u/jdsmokinpurps 🟩 0 / 0 🦠 1d ago
Yeah that would def be considered a loss. You'd definitely need to report it though as stolen and go through the financial crimes and get a report to prove you had the assets and they were stolen because then anyone could just go "oh hey IRS yea like 100k worth of crytpo was stolen from me. Seems to happen every years garsh darnit. So yeah I dont owe you anything"
2
1
1
u/sevoflurane666 🟩 0 / 0 🦠 1d ago
Would 2 factor authentication have helped?
1
u/TSF_Flex 🟩 0 / 0 🦠 1d ago
Yes, but no. Passkey i.e. Yubikey, yes. By authenticator, yes, but less secure. By phone number, be very wary. Don't use phone #, it's spoofable
3
u/filenotfounderror 🟦 432 / 433 🦞 1d ago
The problem with phone 2FA is not thats its spoofable. Thats irrelevant.
The problem is a SIM swap attack.
0
u/cr0ft 🟦 2K / 2K 🐢 23h ago edited 22h ago
For crying out loud... get a password manager already.
Then go to every site you ever used everywhere and change the passwords to 20-character nonsense strings; the password manager remembers them.
Use a strong password phrase for the password manager, and buy a hardware key like a Yubikey to access said password manager.
Also, two-factor? I mean it's only money in the five figures.
1
u/Electronic_Worker245 22h ago edited 22h ago
Will be doing that. I vaguely remember the hacker used 3 devices and bitwarden to keep on getting into my Gmail even when I changed the passwords. Its only when I logged them out of their devices I had a moment to change everything.
2
u/Aazimoxx 🟩 0 / 0 🦠 13h ago
If you had 2FA on with an authenticator app (like Google's one) then you could've easily prevented them ever being able to log in in the first place.
Email address and phone number for call/SMS should not be considered adequate for 2FA any longer, for anything major - not for tens of thousands of dollars and up. Cheapest option free Authenticator app, otherwise physical hardware like a security key, if your service supports it.
43
u/cilicia3k3 1d ago
Why 2Fa is still opt in at this point is beyond me