Lesson Learned: Further Investigation of Walictd Account Stolen Case

Image source

Please do not mention or tag the suspicious account name to avoid their attention to this post. I made this post to promote awareness of account security and unnecessary loss/theft issues by increasing our vigilance. I expect the recovery process of Walictd's account will be completed soon

The incident that happened to the Walictd account reminds me of the case that happened to @rayfa a few months ago, half of her account's wealth was taken away by the person who took over the account. Today I want to show all my friends how many accounts have been taken. After waiting for a while, the transfer transaction was finally carried out by the thief.

Unlike before, they would send it to an account that was deliberately created to hold the funds, but this time they sent it directly to the exchange wallet. It can be seen from the memo used to send the stolen fund from Walictd.

The memo transfer recorded in Walictd's account is to Binance Exchange Wallet

From that memo, I tried to check it down and found out that so many accounts have been hijacked since 2024-07-16, 11:51, as this link: https://steemworld.org/transfer-search?login=walictd

As you can see the account has been hijacked a lot, and these red marks of these accounts are suspected Indonesian user

I explored this memo further by assuming that the account where the first transfer transaction occurs is the account that needs to be checked thoroughly. The results of checking the account were surprising, as can be seen below.

Another memo ID to Binance appears on the transaction transfer search

Using this 100036993 memo ID, I re-preform the transfer search with this incredible result as everyone can see here: https://steemworld.org/transfer-search?login=gamzvidea, and this account most likely is one of the "victims" as well. Hundreds of accounts have been compromised and collected. Doesn't this attract your attention to keep your account more secure??. You better do!

From the list of transactions, I found out that @rayfa's name popped up two times, I remember her account because I was the one who initiated the recovery process back then. What else??

Then I went back to paying attention to the most striking account transactions, then something surprising I discovered as seen in the following screenshot:

Until today this account still collects the funds from various accounts and sends them to the same Binance memo ID which is 100036993

Are these two Binance Memo IDs connected somehow? it does matter to conduct more investigation. But anyway, the two wallets with ID Memo are where the funds go to. Does it have a connection or not that need to be investigated further by someone who has good tracking skills perhaps @the-gorilla interested in seeing it? Even though I know this, there is nothing I can do other than be more careful in the future.

What really caught my attention was that the hijacked accounts were mostly from Indonesia, although they were also from other countries, the striking similarity between these accounts was the dormant accounts that had not been active for a long time. There were only one or two active accounts, but they haven't changed keys for a long time and it's also possible that they've clicked some phishing link/website without realizing it.

An important thing that we can conclude from this lesson learned is: OUR OWN NEGLIGENCE CAUSES UNNECESSARY LOSS. Meanwhile, Steemit itself has a very high level of security and is reliable.

There are several things we must understand about this platform, whether you are a beginner or you are a user who has been active on this platform for a long time, let see it:

1. Steemit cannot recover if you lose your keys, due to your own negligence. And this is written in each of your wallets.
2. Recovery of an account that is hacked by someone will take a relatively long time, it can even take up to 14 days calculated from the first day you initiate account recovery. This is like what happened to the @rayfa account which I recovered several months ago.
3. Recovery can only be done within 30 days from the first time your account was hacked. After these 30 days have passed, it will be impossible for you to recover. Therefore, check your account activity regularly (I will give you tips for checking your account activity later).
4. Account recovery will only be approved by the Steemit team if you use the original email used when creating your account. If you use a different e-mail during recovery, it is very likely that the recovery process will not be approved.
5. Remember that the email you use to create an account is very important to maintain. If your e-mail is hacked then all your accounts associated with that e-mail will no longer be safe, it's just a matter of time.
6. If your account recovery is not @steem or @steemcurator01, then you must get approval from them when recovering the account. If your recovery account does not have the two official names, then the recovery process can only be carried out by the person whose name is listed as the recovery account. Here I show an example.
7. Don't ignore your account for too long without checking it, if you really think your account and wealth are important.
8. Learn about account security and the function of each key you have, because the level of influence of each key is different.
9. Study the tools that are available on the Steemit platform or those created to make it easier for users, for example in the following link https://steemworld.org/ from @steemchiller. The existing tools are complete, all you have to do is know the function of each existing tool.
10. Always be alert and only use your keys where they are supposed to be.

Below I show you how to view your account activity in detail and several other tools that are important for you to know;

As I said in point number 3, here you can check your account details using steemwolrd.org:

Go to steemworld.com then click account detail, you will see your account info, and from there you can see your account update information including the keys changing information

From this, you can see whether your account has been changed or not, and if you see some updated information but you did not do it yourself, then you need to be careful and take necessary action accordingly.

As I mentioned in point number 6, about the account recovery you can see it in the same section as well:

The recovery account of el-nailul is @steemit because I created my account directly from steemit.com in 2018 and I haven't changed it since then. So only the steemit team can recover my account if any issue happens

The recovery account of @smilesouthafrica is @worldsmile because worldsmile created this account through steemworld.org and claim it. By then recovery process can only be performed by worlsmile and steemit can not do anything about the recovery process

The recovery account that is newly created is Steemcurator01, because the SC01 is the one who claimed that account and only SC01 who can recover these accounts

Finally, I would like to encourage you to learn more about the tools provided at https://steemworld.org/ because these tools are useful for you if you understand how to use them.

These are some tools that are useful for you when you understand how to use them, it can be seen when you open steemworld.org.

Thank you for reading this post and that's my explanation, I hope it is useful for other users to maintain their account security properly.

Best Regards

El-Nailul