Currently we have several accounts which have revealed their active keys by some unknown means. The accounts are issuing transactions of monetary transfer and power down. Transactions are aimed at selling via Huobi with memo 370411.
This is unlikely to be a new method of key theft due to the age of these accounts and their activity patterns. Regardless, seeing the attacker resurface at this time and now active is a serious matter.
[This is a live post and will be updated as more information is discovered]
Attention:
If your name is on this list and you're still around:
- check your transactions and withdrawals
- change your keys and securely save them offline
- run a virus checker on your computer
- make sure your recovery account is set to someone you trust (not 'steem')
If you've already changed your keys please let me know below. Come talk to me on Discord at GuiltyParties [.com]#5071 (or you can find me on the main Hive Discord) when you see this message.
Think back to pre-Hive:
Anyone who remembers any 'dapps' or 'projects' that had a frontend between 2018 and 2020 with a website that accepted Active Keys without the use of SteemConnect (this would have been before HiveKeychain was the accepted norm), please respond in comments. This includes any mobile apps that existed during that time. Looking for any information, even if you forgot the name but remember what it looked like.
What we know so far:
- This is not a new incident
- We're uncovering large groups of accounts compromised outside of non-traditional phishing (not the usual phishing through links in comments)
- Thieves are not changing keys
- Possible algorithm that reacts to price fluctuations and sends a message to the thief to collect (manually)
If you never changed your keys:
- Change them asap
- Make sure your recovery account isn't 'steem'
Resources:
- Hive Recovery - A service built by
@arcange that lets you set a specific account as your trustee and then initiate a verified recovery process if needed
- Hive Recovery Tools - A set of three tools built by
@reazuliqbal which let you process recovery requests start to finish (for cases where the account owner and their trustee are both involved)
Special thanks to 
Second List
The following list are accounts belonging to the hacker 
