A Darknet Vendor is Selling Millions Of Stolen Bitcoin User Accounts
Hackers aren't going to just Source: Shutterstock
A darknet vendor called “DoubleFlag” is selling user data stolen between 2011 and 2017 from 11 bitcoin forums for traders and miners, according to Hackread.com . The selling price is $400 (0.3817 BTC).
The heists include:
• About 12 million data units from 536,727 MerlinsMagicBitcoin.com accounts stolen in January 2017
• 514,409 from BitcoinTalk.org stolen in May 2015
• 568,357 stolen from BTC-E in October 2014
• 21,439 stolen from BTC4Free in January 2014
• 3,153 from Bitcoin.Lixter.com in September 2014
• 1,780 from BitLeak.net in March 2014
• 28,298 from DogeWallet.com in January 2014
• 61,011 from MtGox.com in June 2011
• 34,513 from BitsCircle.com, breach date unknown
• 10,855,376 from BitcoinSec in 2014
• 3,149 from TheBitcoinShop.pixub.com, breach date unknown
Extensive Personal Data For Sale
The accounts mostly contain an email address, date of birth, username, gender, personal text number, website URL, password and location. Some passwords have been decrypted. Some use an SHA-1 hash which can be decrypted easily since Google researchers recently broke the SHA-1 web security tool.
Individuals with accounts on these forums are advised to change their passwords immediately.
Not all forums are currently active.
The same seller has also offered 68 million hacked hashed passwords of Dropbox users. In addition, DoubleFlag previously sold millions of data units from U.S. Cellular customers and 1 billion from Chinese Internet sites.
DoubleFlag buyer ratings have been positive, indicating the data has been legitimate. When the May 2015 hack occurred, the stolen data was from unknown sources.
Also read: Hacked BitcoinTalk.org user data goes up for sale on dark web
May Heist Leaked To Notification Sites
“DoubleFlag” grabbed the data it stole in May before anyone else could. That leaked data was only accessible to data breaches notification sites like Hacked-DB and LeakedSource. LeakedSource was able to crack 30,389 passwords in total.
Hackers stole and sold 427 Million MySpace passwords last year on a dark web marketplace.
In May 2016, 33 million Twitter and 117 million LinkedIn login credentials were listed on a dark web marketplace for sale.
Featured image from Shutterstock.
