stolen paper wallet

Hey guys! So, about a week ago, someone took my whole btc from this offline paper wallet I've had since December 2018. I never touched it since I created it, and now I'm super bummed not just about losing my coins but also because I can't figure out where I went wrong! Oh, and the address where my btc ended up is still sitting there with only one transaction (just my btc). You can check it out here. https://www.blockchain.com/btc/address/1CtmmUkxEbQ8nsa2XFSKy7bo5XmBxYFP5n What do you think could've happened? Why is the address still empty? And why did this happen after six months?

Some questions: How did you create the paper wallet? What software did you use? Did you create it on an offline airgapped system? Did you wipe the computer, or did it go online again afterwards? Do you still have the paper wallet? Could someone have accessed it? Could this be the cause: Disclosure: Key generation vulnerability found on WalletGenerator.net—potentially malicious.?

yes i used WalletGenerator.net, exactly as you described : wipe the computer, and go online again afterwards no i dont have, it was a single one

1)probably 2)probably 3)absolutely not well i created it offline, and stored it on a <<paper>>

but why its still unspent? do you think its possible to write to every single crypto market to report this adress ?will it work out?

"Unspent" means nothing more than "the funds are on that address". It's like having $1000 in the attacker's wallet, it's unspent until he spends it. No. See much longer answer.

thank you for your attention! seems like its 100% lost. good lesson. expensive one.

You should contact the police

Sorry for your loss. This is a common subject here often these days (like this https://bitcointalk.org/index.php?topic=5161786.0), about paper wallet security. Most of people think it is easy and simple to make a paper wallet, but it is not. Generating a paper wallet is risky. You shouldn't have put your computer back online afterwards... In my opinion, the best is to invest in a hardware wallet, which is safer BECAUSE it is easier to use. I believe the attacker got your private keys few days after you put your computer back online. He was probably monitoring your address, waiting for you to put more money there.

OP wiped his computer, that should be enough to remove all traces of private keys. I still prefer a Linux LIVE DVD though, running from memory to ensure nothing ever ends up on a hard drive.

..And less hassle of zero-fill~ing the disk for paranoids (+ reinstalling OS and drivers takes time). He must have browsed to the webpage then cut down the connection. His supposedly randomly generated private key wasn't random at all but pre-generated key from an image file and can be reproduced by the culprit. So even if he's offline the whole time (after loading the page), they can regenerate the possible key based from the malicious page's provided image. This wont happen if he used the original code from Github.

jorro-ts, I'm sorry for your loss, it is big amount of money and I think you should report to police and to every crypto exchange to make this hacker life a little more difficult. Most victims do nothing, and hackers count on that - it is easy money for them. People blindy trust to paper wallets, but they are not aware how important it is to secure a safe environment for making such wallets. If you ever again decide to invest in bitcoin, maybe you should need to consider hardware wallet - it cost some $70, but it can save you from such risks.

@OP I can teach you how to properly secure your funds. We can do it here or if you'd like you can PM me. Paper wallets can be the absolute best option for long term storage if you do it right. Hardware wallets, however, constantly have vulnerabilities found out. Don't believe me. Go ahead and Google "hardware wallet vulnerability". You'll notice that the vulnerabilities have come out over many years and fresh ones have just been found out. They're obviously not properly tested, other than of course the general public buying them and reporting vulnerabilities. Don't blindly trust third parties (hardware wallet manufacturers) because of this mishap. Learn from it, change your method accordingly and sleep easy knowing you'll never have to worry about your funds being stolen again.

Show me one example where the user lost funds due to any detected vulnerability in any hardware wallet? Most of these vulnerabilities required physical access to user device and a superior level of technical knowledge. For some reason you are against hardware wallets, but if OP is using one we would not have this thread and he would still have 1 BTC. Your ideas about insecurity of HW are not groundless, they are not 100% safe - but most of vulnerabilities you are talking about are fixed before they became known to the public.

Really sorry for your loss. Just one question for you, have you encrypted it with bip38? Would he have avoided theft by doing so?

Encryption doesn't help if the thief knows the private key already.

yeah that's what I thought, it's obvious. I made some paper wallet too but not on walletgenerator.net, with the intention of keeping them 10 years. I would not bear such a loss easily. Perhaps it would be useful to set a time lock to prevent someone from spending your coins before you want. Could the attacker come to know it and get around this obstacle?

If he has the private key, he can simply sign another transaction without locktime and broadcast that one instead.. ? I don't know of any wallets that lock "adresses" or private keys rather, from spending funds, as that's just not possible, AFAIK. (Since the attacker could simply export the private key into his own wallet & broadcast.)

In the end, that is all that matters. Ledger nano S costs now about 60 USD, or 0,006 btc (can't see the price in USD, only in my local fiat, but the conversion is close to that). A very small investment for some peace of mind. I see no problem in paying trusted professionals to deal with security of my private keys (while I am the only one who holds them). I am not a pro and I am more likely to make a mistake than ledger professionals.

well, the wallet is still untouched. Just a single transaction. Why do they not withdrawed it so far?Maybe thief has died?lol