6BTC stolen from my Bittrex account even my account was protected by Google 2FA

I have a bitcoin account in Bittrex and had deposited around 6.3 BTC (around 24000 USD equivalent in value)in my account. My account was protected with the Google 2FA system. However, on 25/9/17, my account was hacked by the following IP address and all my coins were stolen. 09/25/17 06:25:38 101.98.169.241 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0 UNKNOWN_IP_LOGIN_B4_2FA All the money were withdrawn and deposited to the following wallet: Address: 19tzYBN4ku9xM9uPu3iaaL3Yt3QqmcLPP6 TxId: 69d1367645dd34b056859c95e5c3beff456e300f097f2ce01c0103b63da83b12 Moreover, since I have my google 2FA protected, to change my account setting for hacking, my g-email was hacked at the moment where my Bittrex account was hacked. The hacker tricked the system by putting everything relating to the login notification emails at that time into trash bins. (I don't know how he did it, but the fact is I did not receive any notifications about my login in gmail nor login in bittrex because everything was put into trash bins) The IP address that hacked in my gmail account is: 185.20.99.20 I suspect it was the staff in the Bittrex who commited the crime because of the following reasons: First, my account was protected by google 2FA. To login into my account and change my 2FA setting, one must get my 2FA code in my mobile phone first, but I have never lost my mobile phone. I am also sure that I did not go into the phishing website to leak my account information and 2FA code because I have retained the screeshot at the moment I could not login. Secondly, the hacking happened exactly when I tried to logged in my Bittrex account but failed. If the hacker is from outside, he did not need to wait at the moment I logged in. But in fact the case is that when I logged in on 25 September at around 6:20 am, I have to input my 2FA code but the Bittrex website told me that I entered the wrong 2FA code. At that time I thought it was due to time synchronize problem so I kept trying. But after about half an hour trial, I still could not get into my account so I decided to submit information to Bittrex support centre and ask them to remove 2FA for me. On the next day, my 2FA was removed and I was able to get into my account again. But all the money was stolen. It was weird that the staff helped me to remove 2FA setting after a day but without noticing any abnormality. A big lesson: Never believe in Exchanges. 2FA does not guarantee any safety but could make things worse. If I did not enable 2FA or did not go through any verification process, at least I won't get all the money stolen due to withdrawal limit.

Submitted September 29, 2017 at 01:37AM by benbenthree http://bit.ly/2xFzuCs