Quote from: Taek on June 27, 2016, 03:52:27 PM

Check your ports. What software are you using? If you are not using the official miner binaries, there may be malware. But more likely, the attacker has somehow gotten past your firewall some other way and is able to query your network. We've only had reports of miners getting their coins stolen. Most up until this point have later confessed that they were serving the API over the public internet with their wallet unlocked. (Wallet does need to be unlocked to mine - this is something we can address, but it will take time).

The first reports of theft were only a few weeks ago. It's a new set of attacks, but largely the problem seems to be miners doing insecure practices.

I want to work with you to figure out how the attacker is getting access to your wallet. You need to know though, that after the attacker has stolen coins once, he will be able to steal them again as many times as he wants without access to your API, because the attacker will have the wallet seed. Once the attacks start, the only protection is to get a completely new wallet and hope you can transfer your coins to it before the attacker takes them.

Can you tell me more about the attack though? How many coins are getting stolen? Are you using the v0.5.2 GUI, because that has some bugs in the way it talks to the wallet, and sometimes reports transactions as 'negative' erroneously. The best way to know your balance and know the status of the miner is to use `siac`.

I am using Sia-v0.6.0-beta-windows-amd64 original (btw the intel version always crashes around block 37000, so using a AMD PC for server).
I am binding siad to internalIP:port and starting to mine.
I than copied my wallet on my own PC with Sia-UI-win32-x64 original GUI for easy use.
I am mining at a business center I think they have some protection but IDK. I am using Win8.1 and I have to allow siad in my firewall so basically I don't think I have any protection.
All ports are closed now but when I got my first block stolen a few days back I was mining over the internet and there was a port to my siad, so attacker might know my IP but everything is closed now (learned from my mistake), and I am using a new wallet on a different PC.
I don't think miner software is to blame! This is the third time this has happened. First two I used GOminer from a friend I thrust, last time used my own build from official miner.

Before I start mining I send to my wallet some Siacoins for testing end even before I caught my first block they got transferred without me issuing a transfer.
The weird thing is (PLEASE EXPLAIN THIS) is why the hacker transaction gets displayed with a red $ instead of a red heart in the GUI wallet?

I have been hacked 4 times now and got two blocks stolen Sad

Only wallets that haven't been hacked are the once mining at LOCALHOST and the once that are not mining (they are in the same building)