After holding ETH in a cold wallet for more than 7 years, I thought I'd prep for the Bull Run in December by moving the Eth to an exchange.
In June, I used Metamask to import the json file of an Ethereum wallet - since I don't know of an exchange that allows wallet import. The import failed twice because bad password. So I left it for later. Thinking the wallet would be safe as it had been for the previous 7 years.
I use Metamask almost everyday and have had no issues with it, except the occasional mismatch on calculated account value.
Later came in 1st week of November. When I checked the wallet balance, I found that it had been drained of 90% of the ETH that it contained. Over Beginning on the day that I attempted to import the json file into Metamask, transactions out of the wallet were occurring and continued for nearly a month.
Upon noticing the theft, I immediately performed the import again - which succeeded with correct password. Then transferred the ETH to another account. Safeguarding the 10% that the thief left me. As I thought that was important.
So my question is what is the process to track down the A$$ who was able to get into my Eth wallet? Does anyone here have experience with this or know someone who does?
I've contacted 2 of the "investigation teams" that come up on a google search. 1 hasn't replied to my inquirey. The second claims to be able to DOX the person responsible and will offer guidance on prosecution. For their help, they will charge me a non-renfundable $6.5K for one day's work plus 12.5% of any recovered funds. They can not guarantee any recovery of the stolen Eth.
I was all set to sign them up for the job, but when I requested an in-person meeting to deliver the funds, they declined the meeting. I live only 45 minutes from their stated office address. So it seemed an obvious way to deliver the money and get comfortable with my investigative team. But they weren't interested and even stated that the investigators are not at that location.
I've exported all of the transactions from Etherscan, but I don't see any IP information. I also made a comment on the transaction hoping that the thief would see the comment and engage in negotiating the return of the Eth. But haven't had any success there.
What I can see is that most of the funds were sent to HITBTC exchange. I sent messages to them but they have not responded to anything I've sent to them about one of their user's funneling stolen funds through them.
Also, Metamask has not responded to my queries asking them how this could occur in their extension.
Any advice that is different from "you're SOL" will be appreciated.