Xverse stacking issue

Support
#1

Hello, could someone help me for this stacking issue?

My wallet address is SP15ZEDV9HKJ33E0QZNCHCXMJD0KAQHDZ633V1JVY

My stacks coins were transferred to below address on the 26th November for stacking purpose
Recipient address is SP3MZ52ZTZ97V7088D1ER683A3CK8CSFFSEBSJSZ

But, it is not stacked any more, I only saw the success message of transfer in my mobile phone.

Does someone help me for this issue, I just want to return back my coins at my Hiro wallet.

Thanks you much for your assistance in advance.

#2

I attached transaction screen shot for your reference.

image

#3

Hello, Thank You for reporting.

Please, are you the owner of SP3MZ52ZTZ97V7088D1ER683A3CK8CSFFSEBSJSZ (The recipient address)?

If not your address, where did you find it, please?

This will help us for assisting you correctly :pray:

#4

Thanks for your support.

Let me summarize activities of SP15ZEDV9HKJ33E0QZNCHCXMJD0KAQHDZ633V1JVY.
I stacked 150k coins in Hiro wallet desktop version at cycle #41 ~ 46.
And, I tried to stack another coins in Xverse mobile app, this try had a fail message.
After #46 cycle, due to trying of stack in Xverse mobile app, my all coins was tried to stack in Xverse mobile app. I did nothing after cycle #46.

You can type my wallet address in stacks explore system.

I assume that this is system problem, where do I need to report this problem?

As for this address SP3MZ52ZTZ97V7088D1ER683A3CK8CSFFSEBSJSZ, I don’t know
why coins are transferred to this address, I just guess this is pool address of Xverse.

This is what I want to ask system team, what is the function of this address in Xverse mobile system, how do I return back coins from this address?

Is this something like system bug?

if you have any questions, please let me know.

Thank you for your assistance in advance.

image

#5

Hello Xverse team,

In conclusion, if I failed to delegate stacking in Xverse app, coins should be returned back to original wallet address, why this is not happened yet?

Also, I want to point out address SP3MZ52ZTZ97V7088D1ER683A3CK8CSFFSEBSJSZ,
what is this address function of stacking in Xverse?

Is this correct process of stacking in Xverse app? I am so confused about this process.

At now, where is my coins, what do I need to do in order to return back my coins in our system?

I am believer in STX system, and I am long term holder for future of STX eco system.

I am a little disappointed for this confused stacking system.

If you have any questions, please let me know.

Thanks and best regards.
From long term holder of STX

#6

Hello Dear Stacker,
Thank you for your response.

Indeed I have taken a deep look at the issue since you posted your first message. And I have explored the txs history of you address SP15ZEDV9HKJ33E0QZNCHCXMJD0KAQHDZ633V1JVY.
And as you describe, I have noticed the delegation to Xverse pool from your address were failed because your address was stacking in another pool at the same time.
To clarify this it is at the Stacks protocol level: AN ADDRESS CANNOT STACK IN 2 OR DIFFERENT POOLS AT THE SAME STACKING CYCLE. That was the reason the stacking in Xverse pool was not succeed.

Currently, in your account address txs always, there was a tx from your address to this address SP3MZ52ZTZ97V7088D1ER683A3CK8CSFFSEBSJSZ with txid Onstacks | Onchain explorer on Stacks
And it is where the mistake comes from IMO as you probably made this tx. I don’t know what is this tx was made for.

Now to clarify the situation, you did not stack with Xverse pool.

And I would like to remind you this about stacking STX:

  • STACKS TOKEN NEVER LEAVE YOUR WALLET WHEN YOU STACK IN A POOL OR ALONE. (This is at the Stacks Proof of Transfer consensus level) => XVERSE NEVER GETS ACCESS TO STX DURING THE STACKING CYCLE IN THE POOL SO YOU CAN/ WILL NEVER LOSE STX DURING STACKING CYCLE

  • STACKS NEVER GET SLASHED IN THE PROOF OF TRANSFER CONSENSUS =>YOU WILL NEVER LOSE STX DURING STACKING CYCLE

  • NATIVE BITCOIN REWARD

  • DURING STACKING CYCLE, STX LOCKED IS NOT AVAILABLE FOR USE AGAIN UNTIL THE STACKING CYCLE ENDS UP

So to summarise, I think you did not stack in Xverse pool. However you did transfer STX to unknown account address.
I am sorry about that.

Now, the question is where did you find this address SP3MZ52ZTZ97V7088D1ER683A3CK8CSFFSEBSJSZ you did transfer the STX to? (I would like to know personally)

I hope this heps.
Thank You kindly for your understanding.

#7

Hello,

I did nothing when my last stacking cycle #46 was ended at 25th November.

I want to know why my coins are moved to another address without my inputting passwords or phrase in Xverse system.

Definitely, I never know where is this address come from, SP3MZ52ZTZ97V7088D1ER683A3CK8CSFFSEBSJSZ

I got to know this address when transferring was happened in Xverse wallet,
is this happened by someone(hacker)?

How shall I know our system is hacked or not?

I believe our system is secured, and so I did stack and move transaction.

But, Considering all situations, our defensive system was already hacked by someone,
but I don’t know that situations, so after cycle #46, my coins was hacked by someone.

I am very upset with this situations, what is our defensive system from hacker?

How the user know that the system is hacked or not?

The user believe the system is fine(Not hacked), so have a transaction and stacking
in the system.

Why our system is so weak to defend from hacker?

Please prove me that our system is not weak, so strong from hacker.

And, after this, what shall I do?

#8

And, adding above my reply, I am not stupid like that I did transfer my coins to unknown address, that is why I want to know how hacker come into our system, how is it possible that they did transfer user coins to their address?

How user can know our system is not hacked?

My belief for Stacks Eco system is disappeared on today, can we definitely say to everybody, our system is safe and decentralized system???

Even though we don’t protect user coins from hacker, how user can trust STX system?

Though I am long term holder and believer for STX Eco system, I want to throw it away.

#9

Hello,
I get your point and understand your frustration rn.

First of all, want to clarify that Xverse is a self-custody wallet, secure and safe. No one gets access to any keys as well as recovery phrases, because all are locally stored on your Device.
And you and you only have access to your private keys. Also you can also retrieve your keys in Hiro’s wallet if Xverse stops working and vice-versa.

Stacks chain is secure and decentralized as well. You can check out how by exploring documents on the stacks website

Not sure how this happens to you.
But it’s obvious that your private keys got compromised and I am wondering how.

#10

If you have more hints what could have gone wrong, please share with us?

Questions that come to mind first :
Is your device compromised? How did you install xverse? Hiro desktop?

Then: Is there a security problem with xverse? With Hiro desktop?

Brute forced the keys?

1 Like
#11

Hello,

As for Binance exchanger, when I withdraw coins, they have three steps.

One is mobile phone digit six code, they send me this code to my mobile phone.
Two is e-mal digit six code, they send me this code to my e-mail address.

Above two things are confirmed with KYC certification when I create an account in binance.

The last one is google OTP key, this six digit code is created every 30 seconds, that is why it is
difficult to hack binance withdraw system, because google OTP key is only one existing in user handphone, and this one is of course confirmed with binance, when I create it.

I want to insist that we should upgrade our wallet security system.

I feel a little uncomfortable for our wallet security system, specially withdraw system.

#12

Hello friedger,

I will give everything what I did for Hiro desktop version and Xverse mobile version,
just like how to install, how to do stacking and so on.

Please be patience till when I wrote down everything what I did in the past about above work.

Best regards.

#13

Have you sent your seed phrase to anyone or been asked to input it anywhere? Did you have copies of the seed phrase else where? Keep in mind that no one from Xverse will ever ask you for your seed phrase.

It is unlikely that the Stacks network or wallets are compromised. I would check if your devices, phone and computer have been compromised.

1 Like
#14

Hello Yukan,

I only had seed phrase in the paper, and this paper is kept in my cabinet safely.

I really don’t understand why this was happened, anyway I give full history what I did for Hiro desktop version and Xverse mobile version by today

And absolutely I will cooperate with you for checking my devce, mobile phone, and I have two computer, one is desktop in company, and other is laptop which is only used in weekend at home.

Anytime is possible to check my devices with you, just let me know your available time.

Best regards.

image

#15

Regardless of the outcome of further investigations.

I believe your should consider reporting this to the police. This is a very serious matter. And you may be able to contact the exchanges, claiming fraud (I expect they will require a police report). I see SP3MZ52ZTZ97V7088D1ER683A3CK8CSFFSEBSJSZ send the funds to atleast three different exchanges with the following account numbers:

Kucoin account (memo): 1905238327

Binance account (memo): 101410840

unknown exchange (SP3RFAZMSH6YA1KTJD7DN997AG2DG54E3Z9ZJWYN8) with account (memo) 6000104

The exchanges will be able to retrace these to a person’s account. Stacksonchain.com may be able to trace what other addresses on the chain used these account memo’s and if any of them have BNS names on them.

Kind regards

2 Likes
#16

Hello,

I summarized my activities in STX wallet.

I bought STX coins in Upbit exchanger of South Korea for the first time, I bought coins at 18th, 28th April and 24th May, 17th June, In South Korea there is no function of stacking, I moved coins to Binance exchanger, moving date is respectively 19th and 25th May, 18th June.

I stacked coins in Binance pool, the date was 19th, 25th and 26th May, and 27th July, 28th August, but I found the rewards are so small from binance stacking, so I decide to move coins to Hiro wallet,
I create Hiro wallet at 7th June, and I wrote down 24 seed phrases in the paper, I kept it in my cabinet.

And I am not sure there is no problem to transfer coins from binance, I transfered only 100 STX coins at first time, I checked 100 coins were successfully transferred, I did transfer more STX coins from binance to Hiro wallet.

At 7th June, with the help of fridger, I stacked coins in friedger’s pool in the first time.
I stacked coins by on your own method in Hiro wallet for desktop version with 2 cycles, and then stacked all coins at 19th August with 6 cycles from Sep. 1st to 25th Nov.

I installed Xverse mobile version at Sep. 1st, I did not find any problems to connect it with Hiro wallet. I installed Xverse in the site of https://www.xverse.app/,

I did not find any problems in Xverse system, please refer to attached install process, and due to security policy of Xverse, I can not capture screen shot, I did log in by bio-verification method(By fingerprint). I tried to stack in Xverse, but it is failed because it was not allowed to stack coins with same address of wallet(My coins were already stacked in Hiro wallet for desktop version).

You can refer to my activities screen shot of wallet.

If you have any questions, please let me know.
I really need community help to solve this matter.
image
image
image
image
image
image

#17

Hello Dear,
I am not sure how this happen but I think one probable thing that I can see is the secret key got compromised. But how?
So I just wanna ask with respect if you are the only user of your cabinet where you put your writing secret key on paper?
Someone gets access to your computer or smartphone at work as well as home?

IDK but it seems you are crypto user for long time. So you know some tips already. But I am asking because those things can happen to everyone without knowing.

Thank You for your understanding.

#18

Hello,

i got message from xverse support center, they talke to me they compensate 153k coins to me,
this is fraud, right?

i think there are people who is watching our forum site and stacks site.

I want to highlight this matter with community.

#19

Hello dear,

First, I am only one who use my cabinet, and I am only person who is investing cryptocurrency in my office, even though someone in office does not know what is seed phrase.

Even though I would be very cautious to handle these kinds of matter, of couse I can not guaranteed 100% for protecting my devices.

Those coins are just like of my blood, and I can not sleep with several days because I believe in STX ECO system continuously, that is why I am holding STX coins with big lost.

In conclusion, we can not guarantee 100% for both parties, I would ask that team investigate more closely this hacking accident.

Hello Yukan,

As you suggested, I will absolutely cooperate with your investigation for my devices.
Anytime is o.k from my side, please let me know your available time.

It would be highly appreciated from my side if STX community and team would involve more actively
for this hacking accident.

HS Jung.

#20

Hello,

There are scammers everywhere
Xverse team will never reach out to you directly with such a statement.
Be careful and stay safe out there.

Currently, there is not much to do with the issue since everything is non custodial and No one can access secret keys apart from the owner.

I am sorry for that.
However, you can still process with the solution @Werner1 proposed above

Thank You for your understanding.