<p>Could you be more specific on which 2 way authentication you used?
What where the exact steps so we can rebuild the scenario or at least understand what happened exactly.</p>

<p>If it was email by gmail consider the machines you used the blockchain.info/ gmail on as compromised. Most probably all login forms on this machines have been grabbed.</p>

CC BY-SA 3.0
2013-05-19T08:07:19.357Z
I used the Google 2-Step authentication.
Bastiaan Quast
CC BY-SA 3.0
2013-05-18T12:21:40.310Z
2013-05-18T12:21:40.310Z
Aurigae
<p>From this link: <a href="https://support.google.com/accounts/answer/180744?hl=en" rel="nofollow">https://support.google.com/accounts/answer/180744?hl=en</a></p>

<blockquote>
  <p>Keep it simple During sign in, you can tell us not to ask for a code
  again on that particular computer. You'll still be covered, because
  we'll ask for codes when you or anyone else tries to sign in to your
  account from other computers.</p>
</blockquote>

<p>Is it possible that you had authorized the computer the transaction was initiated from? This would match the idea that the computer was/is compromised. With a remote control tool an attacker eventually was able to login over this pc and make the transaction through remote control desktop.</p>

<p>If this is true, consider all actions taken on this computer as logged.</p>

CC BY-SA 3.0
2013-05-20T09:34:05.837Z
yes I considered this, I authorized two computers, one ubuntu gnome 13.04, and a chromebook. Also a rooted S3 running CM10.1.
Bastiaan Quast
CC BY-SA 3.0
2013-05-20T09:35:04.687Z
ah and as can be seen from the link, the command originated from somewhere near Ghana, I am in Geneva.
Bastiaan Quast
CC BY-SA 3.0
2013-05-20T11:48:41.417Z
Well, id contact blockchain.info asap to get more precise information. Beside that, there might be a slim chance the intruder has still the bot/trojan running (bots usually dont have remote control, my bet it was a trojan), in best case the intruder did not use a proxy, in worst case he had a multi proxy environment. Anyway, id monitor the traffic from the compomised machine in hope to get an ip where this bot connects to. Maybe from there this http://security.stackexchange.com/  is the place to go. On popular hackforums are also articles about tracing down trojan owners.
Aurigae
CC BY-SA 3.0
2013-06-11T00:00:18.377Z
The map showing a location 'somewhere near Ghana' is just showing latitude 0, longitude 0, so it's very unlikely that the request was actually from there.
Adam Iley
CC BY-SA 3.0
2013-05-19T15:34:51.477Z
2013-05-19T15:34:51.477Z
Aurigae
<p>Two days ago my wallet at blockchain.info was hacked, everything was taken (760 coins).</p>

<p><a href="https://blockchain.info/tx/0619d221a761a3b8ec205773440fa6607d65957ef985dac5fb5273a08bda2c89">https://blockchain.info/tx/0619d221a761a3b8ec205773440fa6607d65957ef985dac5fb5273a08bda2c89</a></p>

<p>Besides the password I use Google two step verification. I also use this on the gmail that I use to authorise computers, anybody knows how this could have happened?</p>

<p>I backed up my wallet to Google Drive.</p>

CC BY-SA 3.0
2013-08-10T07:40:13.833Z
Did you use Google Authenticator? https://support.google.com/accounts/answer/1066447?hl=en
Pacerier
CC BY-SA 3.0
2017-05-13T23:43:45.693Z
In 2017 (this question is from 2013) it would be irresponsible to store 760 coins (~$1.4M) on any custodial account.  Get a hardware wallet.
Erik
<blockchain.info><hacking>
Hacked my blockchain.info wallet, stole 760 coins
Bastiaan Quast
# Hacked my blockchain.info wallet, stole 760 coins

(Asked by: username_0 on 2013-05-18)

Two days ago my wallet at blockchain.info was hacked, everything was taken (760 coins).

<https://blockchain.info/tx/0619d221a761a3b8ec205773440fa6607d65957ef985dac5fb5273a08bda2c89>

Besides the password I use Google two step verification. I also use this on the gmail that I use to authorise computers, anybody knows how this could have happened?

I backed up my wallet to Google Drive.

**Tags:** blockchain.info, hacking

> **Comments:**
> **username_1**: Did you use Google Authenticator? https://support.google.com/accounts/answer/1066447?hl=en  
> **username_2**: In 2017 (this question is from 2013) it would be irresponsible to store 760 coins (~$1.4M) on any custodial account.  Get a hardware wallet.  

---

## 2 answers

### Answer by username_3 on 2013-05-18. Score: 2

Could you be more specific on which 2 way authentication you used?
What where the exact steps so we can rebuild the scenario or at least understand what happened exactly.

If it was email by gmail consider the machines you used the blockchain.info/ gmail on as compromised. Most probably all login forms on this machines have been grabbed.

> **Comments:**
> **username_0**: I used the Google 2-Step authentication.  

---

### Answer by username_3 on 2013-05-19. Score: 0

From this link: <https://support.google.com/accounts/answer/180744?hl=en>

> Keep it simple During sign in, you can tell us not to ask for a code
> again on that particular computer. You'll still be covered, because
> we'll ask for codes when you or anyone else tries to sign in to your
> account from other computers.

Is it possible that you had authorized the computer the transaction was initiated from? This would match the idea that the computer was/is compromised. With a remote control tool an attacker eventually was able to login over this pc and make the transaction through remote control desktop.

If this is true, consider all actions taken on this computer as logged.

> **Comments:**
> **username_0**: yes I considered this, I authorized two computers, one ubuntu gnome 13.04, and a chromebook. Also a rooted S3 running CM10.1.  
> **username_0**: ah and as can be seen from the link, the command originated from somewhere near Ghana, I am in Geneva.  
> **username_3**: Well, id contact blockchain.info asap to get more precise information. Beside that, there might be a slim chance the intruder has still the bot/trojan running (bots usually dont have remote control, my bet it was a trojan), in best case the intruder did not use a proxy, in worst case he had a multi proxy environment. Anyway, id monitor the traffic from the compomised machine in hope to get an ip where this bot connects to. Maybe from there this http://security.stackexchange.com/  is the place to go. On popular hackforums are also articles about tracing down trojan owners.  
> **username_4**: The map showing a location 'somewhere near Ghana' is just showing latitude 0, longitude 0, so it's very unlikely that the request was actually from there.  

---

