<p><strong>For maximum security</strong>, use maximum paranoia. Assume that any script or wallet he gives you is invasive malware that's intent on stealing your bitcoins.</p>

<p>Create a brand new wallet (on a different machine, that's never had his stuff installed) using the standard client and configuration (not anything that he set up for you), and send any remaining bitcoins from your old wallet to your new one.</p>

<p>Then delete both the bitcoind wallet and game script, and if in doubt, wipe the computer(s) that had them installed and only reinstall trusted things.</p>

<p>For a <strong>lower</strong>, but still reasonable, <strong>level of security/paranoia</strong>, create a new wallet with a new password and transfer the old wallet's bitcoins to it. It's important to not reuse a possibly-compromised wallet, even with a new password and new addresses, because of the <a href="https://en.bitcoin.it/wiki/Key_pool" rel="nofollow">key pool</a>. This pool basically means that he's (possibly) already downloaded your private keys, not just for your past addresses, but for your next 100, too.</p>

<p>And if possible, inspect the game script for anything suspicious, or simply stop using it. Or use it only on a computer that cannot access the bitcoins, and in which you never type your wallet password.</p>

<p>In any case, do not use any passwords (RPC, wallet, etc.) or wallets that he gave you, since they could be compromised.</p>

CC BY-SA 3.0
2014-04-28T06:33:26.017Z
What if I shift to a wallet that is not on my server? Like wallets provided by https://blockchain.info/
Zaaid
CC BY-SA 3.0
2014-04-22T12:10:36.227Z
2014-04-22T12:10:36.227Z
Tim S.
<p>I purchased a game script from a guy. I think the same guy is stealing my bitcoins. I need help in stopping him.</p>

<p>The guy also installed the script on my server and set up the bitcoind wallet too. The rpc username and password are set by him himself. I have changed the passwords of my server but not of wallet. Is there a chance that he could have remote access to my wallet on the server? If yes how can I disallow connections to wallet from remote IPs?</p>

CC BY-SA 3.0
2014-04-25T07:16:58.240Z
He isn't hacking if he configured the username and password to something he knows. Maybe this should be your first step?
John T
CC BY-SA 3.0
2014-04-28T06:35:55.213Z
Yes I already did that
Zaaid
<wallet><bitcoind>
How to stop a hacker stealing my bitcoins?
Zaaid
# How to stop a hacker stealing my bitcoins?

(Asked by: username_0 on 2014-04-22)

I purchased a game script from a guy. I think the same guy is stealing my bitcoins. I need help in stopping him.

The guy also installed the script on my server and set up the bitcoind wallet too. The rpc username and password are set by him himself. I have changed the passwords of my server but not of wallet. Is there a chance that he could have remote access to my wallet on the server? If yes how can I disallow connections to wallet from remote IPs?

**Tags:** wallet, bitcoind

> **Comments:**
> **username_1**: He isn't hacking if he configured the username and password to something he knows. Maybe this should be your first step?  
> **username_0**: Yes I already did that  

---

## 1 answers

### Answer by username_2 on 2014-04-22. Score: 1

**For maximum security**, use maximum paranoia. Assume that any script or wallet he gives you is invasive malware that's intent on stealing your bitcoins.

Create a brand new wallet (on a different machine, that's never had his stuff installed) using the standard client and configuration (not anything that he set up for you), and send any remaining bitcoins from your old wallet to your new one.

Then delete both the bitcoind wallet and game script, and if in doubt, wipe the computer(s) that had them installed and only reinstall trusted things.

For a **lower**, but still reasonable, **level of security/paranoia**, create a new wallet with a new password and transfer the old wallet's bitcoins to it. It's important to not reuse a possibly-compromised wallet, even with a new password and new addresses, because of the [key pool](https://en.bitcoin.it/wiki/Key_pool). This pool basically means that he's (possibly) already downloaded your private keys, not just for your past addresses, but for your next 100, too.

And if possible, inspect the game script for anything suspicious, or simply stop using it. Or use it only on a computer that cannot access the bitcoins, and in which you never type your wallet password.

In any case, do not use any passwords (RPC, wallet, etc.) or wallets that he gave you, since they could be compromised.

> **Comments:**
> **username_0**: What if I shift to a wallet that is not on my server? Like wallets provided by https://blockchain.info/  

---

