Quote from: bernardk on July 10, 2017, 12:50:44 PM

The exact same thing happen to me yesterday. Around 5000 EUR was drained out of my account.
First everything was transferred to BTC->XMR and afterwards traded on pairs with almost no liquidity.

I was completely sure my account was secure. Still have no idea how someone could access my password.

It doesn't help that Poloniex requires you to click a link in an email to withdraw. This gives you a false sense of security.
I was considering this to be my 2FA and never taught about this attack vector with low liquidity pairs.

I'm sure many more people fall victim to this attack that are not posting here. It's also a bit discouraging that Poloniex doesn't show even a bit of interest in fixing or informing users that this can happen. There are many simple things that they could do, just requiring an email confirmation when you first time trade something "strange". They have insight into the whole system, fraud detection should be one of their priorities. This looks like the most common attack right now.

I was lucky as I will survive without this money, but many others could have their lives destroyed. It's also sad to see the community react in such a victim blaming way. Saying, you should have done this or you should have done that. Why are you not as smart as me? Don't keep your money on an exchange!

This is not really helping anyone. We are all humans. Sometimes we forget to set up something (I should definitely change the brake-fluid in my car) or make mistakes. Why don't we work together to try to fix problems and save others? It's not someones fault to assume he is not going to get robbed.

Many thanks mate as this was my point of the original post not to say this and that but to help, as I said earlier 2FA is not mandatory and this may exactly be the same person who has robbed me. Makes me wonder if poloniex has done anything to stop this sort of attack. I suspect they have not even looked at my case where I sent them all the evidence to block the thief's account to recover my funds, what a shame