If you start using Keepass: don't forget to make regular backups of your password database.

As for the virus you found: I would never trust a once infected computer again without wiping it and doing a clean installation.

You should NEVER reuse your passwords for anything again, and I hope you learned a lesson about that.
Use some password manager like KeyPass for storing and generating new strong password for each website.

It could be a false positive, but it's possible that you have some clipboard malware that could collect your passwords and any keys related with crypto.
Switching to Linux may also be a good idea so you won't need to use any antiviruses, and offline computer is much better for dealing with crypto.

I remember a case in which someone signed a message with someone else's name, that was also used to scam. This is just as bad: it's common practice on the Collectibles board to ask for a photo with a handwritten username and the current date as proof of ownership.
You have single-handedly made this entire concept useless by doing this:


Was this part of the escrow deal? Even if the delivery would have happened, you would have no way to confirm this if either party says the other one didn't show up.

Why didn't you mention this to eseayan 19 days later, but instead just said you don't have the funds?

I must say I'm quite disappointed that 2 veteran Collectibles traders let themselves be used by a scammer!

Admin can restore deleted posts, I assume the same applies to PMs. But eseayan should ask for that, either by sending a PM to theymos, or by opening a topic in Meta. Admin may also be able to connect the account to other accounts.

Do you have any idea how your account got hacked?

Admin can restore deleted posts, I assume the same applies to PMs. But eseayan should ask for that, either by sending a PM to theymos, or by opening a topic in Meta.

Do you have any idea how your account got hacked?

Going off of times from my PMs:

Aug 28 2021 073933AM: eseayan contact about escrow

Aug 28 2021 084554AM: Rajubhusal contact confirming escrow with release address of 43Xf5BWzcdbdhDeHnj6cF1dG4fGnasQEUHyn2F92LK9VbyvP96nbhkdGZuEJKHd2X9eYhhbKQn4C6E1 V2h8EHSSvVjGs1rZ

Aug 28 2021 045333PM: eseayan paid escrow

Aug 28 2021 082807PM: eseayan confirm that coins will be delivered in person

Aug 29 2021 113837AM: minerjones confirms payment

Aug 29 2021 120243PM: eseayan send PM saying the coins were received

Aug 29 2021 012253PM: Rajubhusal confirms, saying to release to given address previously (see above)

Aug 29 2021 014725PM: minerjones releases funds.

Aug 30 2021 045711PM: from new/alt account "aseayan" asking to stop the deal because account "eseayan" was hacked.

Funds were received and sent out:

I have checked the DM's - I ignored all the other ones that were not related to this issue, reviewing only ones from the raj account, from buckrogers(1message) and from minerjones (2 messages) and I would have to agree that the message does appear to be from minerjones - but I get a "hash mismatch" when attempting to verify the PGP

what we need is to have minerjones chime in here - it appears he sent the dm and did supply the xmr address:

45gtrfipMYeYZ9ZRRLN4XKG5q2tiT7HUdSvqn5LUs5V3WmHSnQYHpF6ReaY1U2uGJfMo6QpP5zmS1gT hEASRcHdx3KZkDK6

I know somewhere above eseayan provided some screenshot of his exchange account that showed the first/last part of the "paid to" address and it appears to match the one supplied by minerjones. However, due to the nature of xmr - we cannot easily verify this txn.

I can see that the txn id: ed435c8c5aaa30a4ab9ea0ab0475986d3de27069538ff3535e096ed6a1a885a8 is a valid txn but that is about it. I cannot see the amount or addresses involved. having the address and transaction hash is only 2 of the 3 parts needed. we also would need the view key.

if minerjones sent that dm then he can provide verification on that xmr address whether it received funds or not. if minerjones did not send that dm - then it might be possible that at some point minerjones forum account was also compromised.

what it appears to me is that this raj account must have gotten access to eseayan's account and copied/used buckrogers dm to con/scam eseayan.

and then possibly changed the email address afterwards in an attempt to lock out eseayan.

---eseayan - can you get the view key from your exchange?

It is late and I am going to bed - I await to see what others say and what minerjones will say.

---eseayan - can you get the view key from your exchange?

Feel free to PM me.

I just sent you a PM with instructions.

You'd have to agree to let a well-trusted member of the forum have access to your Bitcointalk account to verify the contents of the PM. I could do this for you if you like, there's probably some others like LoyceV, or you could have a global mod do it, though it might take a while to get their attention.

You claim to have made a new account on August 30th, but the account shows it was created on November 23rd 2020, can you explain this and why you said this was your brand new account after being "hacked"?

https://bitcointalk.org/index.php?action=profile;u=2885681

https://bitcointalk.org/index.php?action=profile;u=2885681;sa=showPosts

You claim to have made a new account on August 30th, but the account shows it was created on November 23rd 2020, can you explain this and why you said this was your brand new account after being "hacked"?

I AM eseayan, and this is my new account

He was scammed - most likely buy that Raj guy.

This is why escrows put in the PGP message - SO YOU CAN VERIFY IT!

OP:

Honestly I know it sucks, but you should have done your due diligence with all the tools that were freely provided to you by the escrow. Especially with that amount of coin.

Sad to see, but you aren't the first and you wont be the last to get scammed, hopefully someone besides the OP ofc can learn from this terrible mistake and scam, and triple check everything before sending out funds to anyone.

you should have done your due diligence with all the tools that were freely provided to you by the escrow. Especially with that amount of coin.

You said your account was hacked right? it doesnt take a genius to figure out it was this Raj guy who did it and took a DM and used it against you.

You should have checked with Escrow, me or anyone else on the forum, or posted in your thread at least that "something" was off or different. Kind of basic knowledge in life before sending a random stranger a few hundered XMR!

Instead you assumed and took his word for it, and in turn accused me of stealing your coins.

SMH

*** oh and id never say "Cheers"

You said your account was hacked right? it doesnt take a genius to figure out it was this Raj guy who did it and took a DM and used it against you.

Instead you assumed and took his word for it, and in turn accused me of stealing your coins.

I see that it appears minerjones really did send you the PM, however the signed message doesn't verify with the PGP key in his keybase.

https://i.ibb.co/yByTVSk/minerj1.png

Did you attempt to verify the signature against keybase before sending the funds?

Hard to know exactly what happened without input from MJ. Right now I have to assume yours is a faked screenshot.

Did you attempt to verify the signature against keybase before sending the funds?

Hard to know exactly what happened without input from MJ. Right now I have to assume yours is a faked screenshot.

Btw uploading (on imgur or bbcode) full pics of the screenshots' of the conversation could be very helpful instead of a cropped one to fully understand the info while waiting MJ to respond here for more info.

Maybe it is true.
Let me tell you how it happened to me.

After I posted thread to buy physical coins on August 20, and buckrogers  contacted me for this on August 23.  On August 25 Rajubhusal
(first time to send me a massage) sent me a massage, and told me that Rajubhusal is buckrogers. Even this massage quoted the massage that buckrogers sent to me on August 23(At that time I did not understand how Rajubhusal got the buckrogers's massage if this is not the same man). At that time I suspected this may be scam. But I like monero physical coins and I wanna buy it. I thought that I can use escrow service , my money will be safe even if I don't receive the physical coins. So I contact MJ for escrow.

I found this in my messages from august 31st:

https://i.imgur.com/rGsvgtb.png

I can only assume that raj dude scammed you,  and used my name for that purpose somehow.

I AM NOT INVLVED AT ALL HERE!



https://bitcointalk.org/index.php?action=profile;u=2300231;sa=showPosts

let the detectives here go to work!

***shady - reviewing his lasts posts, changed names and emails a lot, lots of scam like history, sorry for that guys loss, but he didn't do his due diligence with a simple search , not sure what the "escrow-man" thinks?

It sounds like MJ never got the coins, but it looks to me like you sent them to the address he gave you.

Did you verify all the PGP signatures he gave you in the messages?

This is really fucked up to me.  

Also, @buckrogers - why is his name in here? [clarified by buckrogers below]

Edit - More info from MJ needed here for sure... I've seen something like this happen recently as well, to such an extent that I no longer trust ANYTHING about PM's on this forum - Not saying there is someone who may have infiltrated the server, but things are definitely getting shadier around here as time goes on, so I now prefer to use Telegram - How fuckin' sad is that, right?

I hope more info gets posted, that's a lot of XMR, and those are some of the sexiest coins on the planet.

Last edit: NEVER send XMR from an address you do not fully control if you need to PROVE you sent coins from it!

Did you verify all the PGP signatures he gave you in the messages?

@buckrogers - why is his name in here?

To further make your case, you might want to go here and follow along- particularly Decode Outputs and Prove sending, to offer more proof and see what went where:  

https://xmrchain.net/search?value=ed435c8c5aaa30a4ab9ea0ab0475986d3de27069538ff3535e096ed6a1a885a8

Just a quick guess on my part...  but judging from minerjones' response (what little we are allowed to see) it seems that he never received funds as he's asking if the scammer controlled your wallet as well.

My guess is that the seller pulled a Man-In-The-Middle attack and convinced the buyer to send funds to him while thinking he was sending funds to minerjones.  Again, just a guess since not enough information is provided in the messages, but the first thing I would do is check where you got the Bitcoin address to send the funds to escrow.  My again random quick guess of the situation is that you didn't get the address from minerjones.

Hello-

Happy to assist for the transaction.
Amount: 196 XMR
Donation: 1.96 XMR
Total to send: 197.96 XMR
Address: 45gtrfipMYeYZ9ZRRLN4XKG5q2tiT7HUdSvqn5LUs5V3WmHSnQYHpF6ReaY1U2uGJfMo6QpP5zmS1gT hEASRcHdx3KZkDK6

Once funds have been sent and confirmed, please use "reply to all" to let us know the txid of the payment.
After this, items can be shipped to the buyer.
When buyer receives items in good standing and reports back, I can release funds to the seller.

Thank you,
minerjones

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

August 28 2021 minerjones escrow between Rajubhusal and eseayan for the amount of 196 XMR using address 45gtrfipMYeYZ9ZRRLN4XKG5q2tiT7HUdSvqn5LUs5V3WmHSnQYHpF6ReaY1U2uGJfMo6QpP5zmS1gT hEASRcHdx3KZkDK6 in exchange for Lealana XMR silver coin set
-----BEGIN PGP SIGNATURE-----
Version: Keybase OpenPGP v2.1.13
Comment: https://keybase.io/crypto

wsBcBAABCgAGBQJhKhsKAAoJEIRUCAKscQ+OAscH/ijZxiI3i9nKXHbBRb46IgJJ
eX4NzXc90zeKEFkAc5lNf1e+yIQYQIhyR+7ZYYQVVTzoifaXeVyvIhhLyd2ROy0w
S21NpWxOPyh/FnZXnqi4cUn2ZO0wt8v1MyRRpPPXM9b/oEKAz0n8ZtOYmBfCRMYN
z5r/r62hscWizx2d7b7kE+xRRq9zp+wTdm9jtKP114PE5Y9HBZf+iUbsH92j7ST4
74BPh4FURCEBDDLybcXmwCsS58wZOlrYdktwHGWnXRPz0UihF3lJeUeqEXxDBsCw
3U7ja3IB+buDSWFhh5Qako/XUDTb5aSt2pJP5Q53IBbhnZPJsNgs7WfoTU6Iug4=
=svfC
-----END PGP SIGNATURE-----

Basically, if the item(s) were not shipped from the seller, no tracking # provided, unresponsive seller(no updates), no item(s) arrived on buyer's side on particular period of time considering the ETA, then a refund is a must.