UnitTwopointZero · GitHub

Not sure if this is the right forum for this. Apologies if it isn't
I should also mention that I'm not a computer noob. I'm also not new to Cryptos, though I am new to IOTA.
After doing a bit of reading, I have to say that I had high hopes for it.
So I dived in and bought some on Bitfinex.
I then moved my purchased IOTA from the exchange and onto a wallet, as is the prudent thing to do when dealing with Cryptos. I initially chose the Android Wallet.
The transferred a small amount out of Bitfinex to test. This went smoothly enough and the balance showed in my wallet. So I transferred the rest into the Android wallet. Again, all relatively smooth.

The problems started when about 2 weeks later, I decided to transfer some IOTA back to the exchange to sell. I found the wallet to be quite unusable as it would take a long time to display the balance, there was a loading time between selecting each option. When I finally managed to send a transaction I found that getting it out of the wallet was not as smooth as getting it in. The transaction sat "pending" for days.

So I started doing a bit of digging and found that this seemed to be a common issue with the main advice being along the lines of: Re-broadcast / re-attach to tangle.

So I did that. Several times. It took a couple of days, but it finally got transferred to the exchange.
That it needed constant manual intervention to make the transaction stick was a concern to me.
So I decided to move the rest of my IOTA onto the exchange while I decide what to do next.

The second transfer though just would not move past pending status. No matter how much I did "Replay bundle".
At that point I thought that maybe the Desktop Light Wallet might be a better option than the Android Wallet (which is in beta).

So I downloaded the Light Wallet and logged in with the seed. The Light Wallet experience was no better.
I could see my balance, but the transactions would not move past pending. I re-broadcast and I re-attached... I did this every couple of hours as per advice online. Still no joy. By this point my transaction history had 10 or so pending transactions.

I went through the Light Wallet help menus. No solution there. The help menus lead me to the IOTA forum. No solution there. Just the same re-broadcast / Re-attach advice.
At this point my ability to login to my wallet was becoming more hit and miss since most of the time, the public nodes would just time out or give me connection refused errors. This frustration went on for about a week, during which, I tried different internet connections, re-installation of the wallet and even installed the wallet on another computer. The problem persisted.

I went back through the Light Wallet help menus in desperation. The led me to github, where i found numerous posts from people having the same issue.

I came across a couple of posts mentioning resolution to the issue via a site called "IOTASALAD". Which was basically a list of nodes that could be used in the Light Wallet.
Initially, I was a bit suspicious and there was a warning light in the back of my head, but since by this point I was barely able to connect to other nodes, frustration won over the warnings in my head.

So I tried one of the suggested nodes there. It took a while to log back into my wallet but at least it wasn't timing out (yet). I left my computer and when I came back found that it had logged in.
Finally! Momentary joy!
I then notice that my balance is ZERO, and I initially think my transaction is finally confirmed and balance has been transferred back to the exchange!".
Then I check the transaction history and notice over 400 new transactions have appeared. Hmmmm.. This doesn't seem right. I check the address they're going to and find that it is not mine! I scroll through the hundreds of pending transactions that I did not do and find 1 which is confirmed.
It only takes one transaction to confirm and just like that, you're over over $6000 out of pocket. Yes, that's how much appears to have been stolen from me!

I have only ever entered my seed in the Android wallet and the Light wallet. I work in the IT industry and know full well how to secure my device(s). If my devices were compromised, I would have lost other cryptos as well.
So I am still unsure as to what happened exactly. However, the 400+ transactions which I definitely did not do, are all time stamped in the 30 mins or so right after I used the "IOTASALAD" nodes. So at this stage, until I have new information, my assumption is that those nodes are malicious and have somehow hijacked my wallet seed. Is this possible? If so, how is it that someone can just setup their own node and steal people's money? Surely this would be a very obvious security hole which would increase exponentially as IOTA grows??

At this point, it seems I can't login at all using my seed. Neither on the Desktop Wallet nor the Android wallet.

Overall, very upset, very disappointed. Will be sure to give IOTA a wide berth from here on.

Read the original on github.com ↗