Hey Steemians! I just want to talk about the hacking incident involving Ian Balina, a notable ICO investor, and share my thoughts. Ian Balina is a well-known crypto investor who had made millions of dollars with just under $100k capital. He gained quite a large following as a result of his success in crypto investing and he has 143k followers just on Twitter alone.
Not sure why hackers must wear hoodies 😒
Ian Balina recounted how he thought the hacker might have hacked him. Below is what he posted:
This is how I think I got hacked. My college email was listed as a recovery email to my Gmail. I remember getting an email about it being compromised, and tried to follow up with my college security to get it resolved, but wasn’t able to get it handled in a fast manner and gave up on it thinking it was just an old email. I kept text versions of my private keys stored in my Evernote, as encrypted text files with passwords. I think they hacked my email using my college email, and then hacked my Evernote.
Some key learning points here:
- Do not underestimate any compromised account. It might seem trivial to you if an old email account, which you no longer use, is hacked. But you never know what kind of information can be extracted from the account. In this case, Ian Balina had that email address listed as a recovery email and led to the compromise of his main email address.
- Use 2FA as much as possible. In this case, both Gmail and Evernote supports 2FA. If Ian Balina had that turned on, it may not be so easy for his accounts to be compromised.
- Try not to save private keys to high valued crypto accounts online. If you only have a few hundreds or thousands dollars worth of cryptocurrencies, it may not be required to use a hardware wallet. But if you have millions, please invest in a hardware wallet and have the keys stored offline.
- Password security. If you read what Ian Balina posted in detail, his keys were stored in an encrypted text file. This means that the hacker managed to decrypt the text file and access his keys. The fact that the hackers were able to decrypt the file in a short span of time indicates either a weak password or a reused password. You can refer to one of my earlier posts for some pointers to secure your passwords.
In addition, I will like to recommend this article as an additional read. Some ideas in the article might be overly paranoid but there are many practical security recommendations that I hope all my readers can learn about.
On a sidenote, there are some online speculations that Ian Balina staged this incident in an attempt to evade tax. But this sounded a little far-fetched. So I am going to give the man the benefits of doubt.
This is just a very short post. The main aim is to raise the security awareness, especially when your money is at stake. Thanks for reading! What are your thoughts on this incident? And are you keeping your keys safe?