Quote from: CaLPaR on February 03, 2014, 02:22:09 AM

About 14 hours ago I had about 700 Cat coins and 500000 Doge coins on my Cryptsy account. I have sold 0.02725061 BTC worth of DOGE and withdraw it to another address. Soon after as expected I received an email to verify the withdrawal.

About 30 minutes later my account got hacked. All of my Doge coins ware withdrawn from my account, All of my Cat coins ware sold to BTC and then they were also withdrawn from my account.

All of this happened while I was using my PC, therefore it can't be a remote desktop program. Secondly, this account has two factor authentication which requires access to my phone, which means that simply having my user name and my password would not help in this case.

The most disturbing thing hare is that I did not receive a verification email for any of these 2 withdrawals. As far as I know after every withdrawal from Cryptsy I'm supposed to get a email to verify the withdrawal, which clearly did not happen. Whoever did this managed to withdraw from my account without needing to access to my email account, which indicates that there is a serious security hole in Cryptsy.

By the time I found out about this all of the transactions ware already confirmed. I opened a support ticket, but I did not receive an answer yet. I just can't wrap my mind around this. How on earth did this happen? He bypassed my two factor authentication, he did it while I way using my PC, and he did it without needing to access my email.

I'm posting this because I'm looking for ideas about how whoever did this managed to accomplish this taking into account everything that I have just said.
Secondly I would like to know if this is a single case, or whether more people have experiences similar to this from Cryptsy.

something like this happened to me on BTC-E last year. BTC was withdrawn from my account with no email confirmation. the hacker disabled my 2FA and BTC-E didn't email me or suspend the account (anytime 2FA is disabled the account is supposed to be locked for 2 weeks according to their FAQ's). after I grilled them and posted on their trollbox they locked my account for another month.