Compromised PoE Accounts: Stolen Items and Hacked Accounts - Discussion and Leads

"

Renalon#7054 wrote:

If you are paranoid, you can try to lock your account when you log out
the idea is that you need to use a proxy to log in to the game or you can ask a friend to do it, this will lock your account and you will receive an email with the following content:

"Your Path of Exile account has been locked because someone attempted to log in from a location that you don't typically play from

To play again, you'll need to type or paste the following access code into the game client after logging in:"

this seems like abuse so the risk is on you

what do you think about this idea?

p.s. English is not my main language

In theory this is not a bad idea. But if this works, only testing will show. You don't know if your account is only "locked" on the side of login process (preventing the player to login on the regular way through the client), or if it's fully disabled from any interaction/access on their servers (what i doubt).

If it really has something to do with slipping into an account by manipulating data after a trade interaction, like passing another userID or token on a second game client open, it might still work for them to clear your account.

I recently had a short conversation with one of the chatters on Twitch, who claimed to know how this happens (we definitely believe him). I also "reached out" to a person close to the hacker. And both of these individuals said that it is quite easy to gain access to another account and all you need is to open a trade window with this person.

After these conversations, I decided to look at the game log file (it is located in the logs folder where the game is installed). There I found two interesting things:
- the log file indicates the IP+port of the server to which you connect each time (namely, to the server where the "victim's" hideout is located)
- the variable "Client-Safe Instance ID" is written to the log file. As I understand it, this is a unique player+hideout ID. Based on my observations, only the "me+hideout" ID is logged, but it is possible that the thieves somehow get the ID of another player (for example, by memory address via CheatEngine).

I'm not saying that the thief uses this variable to hack, but if you want to protect your accounts, DO NOT OPEN the trade window with suspicious users.
I already wrote to support about this information a few days ago, but as expected - no answer.

I've been following this thread for a while and I have to ask: how many of you play SSF? Does this wave of theft also affect SSF players?

"

CaffeinatedFog#0188 wrote:

I've been following this thread for a while and I have to ask: how many of you play SSF? Does this wave of theft also affect SSF players?

By the way, a very good question. If there are no victims of SSF, then there are obviously some manipulations in the regular leagues. (Although it is quite possible that the hacker is such a SSF, ugh and just leaves))

people that pushed hard since start get punished by hackers, GGG how much time will be silent? I know it's not much people that played alot and farm alot. But we are wasting our time and scary about loosing progress. I cant start play again because GGG stil dont do anything to secure my account. I will be hacked again and again since game have weakness to security.

"

bestmaster1996#5421 wrote:

At this point, the silence itself has become one of the worst answers for us. I believe it will gradually erode trust over time.

This exploit is catastrophic enough to a game to where you think it would have been addressed day 1....2....3....12..."vacation" or not. Not only has it not been address but not even a single word about it from GGG. Maybe disable trading? Maybe release a statement that they are even looking into it.

Nope nothing... Let's let the general public keep blaming the victims instead meanwhile people have proof of their stolen items on the official trade market.

I don't want to hear any blizzard slander from a Poe player that's for sure. The lack of care from devs regarding this is insane

Actually, nvm.

"

CatLikeThief#2728 wrote:

Actually, nvm.

did you find your answer in some other comment on the post ? :p if not feel free to ask maybe we can help / your insight about the situation is always apreciated

It's been 14 days since I wrote to support. I honestly don't think anything else will happen. If something were to happen then it would probably be far in the future when it wouldn't matter anyway because I don't play the game anymore and I've looked for something else. It's really disappointing how GGG treats its players here and simply ignores them when it comes to problems like this