The aim of this article is a general PSA about wallet security and to delve a little bit deeper into some blockchain forensics. The cases provided are real and have occurred on the Gridcoin blockchain, the people in question will remain unnamed.
So recently there have been cases where Gridcoin has been stolen from members of the community. There have only been two cases that are official so far and I want to go in depth on how to keep your computer safe and simply document these events in case my information may be helpful in the future. If you have any information about the transactions or have ever dealt with any addresses that are featured here, your information is valuable and comments here are well appreciated. If there is any new information comes in, I will update it accordingly.
Transaction ID: 7bd3b716bb69cb201f03875d5f8eccebd5fc801f21660ad83f582f1cb507d9ee (view on block explorer)
Offender's address: S997pMdQ7L9KyjXQUsaZyXjVxYEscGxdht (view on block explorer)
As for the S7 address, this seems to be an exchange wallet. This is because the transaction chain goes on and on, spending only small chunks to crunchers and investors.
The SGE address is a little bit more interesting, it (as of posting this) contains 85.5k GRC in an investor wallet which has not staked ever but has transactions dating back years. It is likely that this person was a buyer from an exchange that listed GRC at the time.
Price action during this period does not provide any additional information considering an increase of only 0.0004 USD. Therefore we cannot make any conclusions on the reason for the delay between transactions 1 and 2.
Transaction ID: 4396a95cf0a0a906b939e1e4851803ae5dd0cca68ee979426c154f0123d33ada (view on block explorer)
Offender's addresses:
SE5Ry6eSzs5tifV5qFfMWVn9wfZRHhzGhe (view on block explorer)
S9531rB4TzcAfevud15AbWEzUvGLpaMant (view on block explorer)
Offender's IP address was logged, geoIP indicates that it originates from the Netherlands.
SLo9arnZaQiAnvjsdoQ7WAuoGcRit7yYQg)The interesting thing with this case is that none of the addresses appear to be exchange addresses. For the future, studying the actions of the address in action 4 might yield some interesting information if the offender decides to move such funds.
It is clear from these experiences that Remote Desktop Protocols (RDP) and related software have been to blame. This is software that allows you to remotely connect to your computer over the internet. Some examples include VNC, Teamviewer and Google's Chrome Remote Desktop.
So the key concept to learn from here is to never store Gridcoins (or cryptocurrency) on the same computer with RDP enabled.
Here is a video I made describing how to keep your Gridcoin wallet secure...
The following are some basic security steps, most of which are also mentioned in the video:
File > Backup wallet/config...Stay safe out there!
