Compromised private key. How to change my private keys owner and active on Bloks.io?

[Rayezor]

Hello.

I am relatively new to using EOS and my Nano ledger. I made an account on fairy wallet and my account on bloks.io
I got a fake airdrop memo left in my feed and mistakenly put my private account keys into it. It sent back an error saying that the key is invalid but probably means they now have my key.

The memo left in my transaction history reads as follows:
Regìster in the Voìce and Claìm your Voìce tokens(1:0.9 ratio，1 Voìce≈0.2352 EOS) . Just visìt the short invitation link https://voice.com-register.online/

I am worried I will lose my EOS. What do I need to do? Try to change my private keys and if so how? Or do I just move my EOS out of the account to a new one or to an exchange? I would appreciate some guidance.

Ray.

[aaron]

The quickest way would probably be to deposit any tokens into an exchange or to create a new account.

You can change the keys on your account though, it’ll just take more steps than transferring anything of value off it. To change your keys you’ll need to:

• Generate new keys (possible in Anchor under Tools → Key Management) and back them up someplace safe.
• Load your OWNER private key into Anchor.
• Change your ACTIVE permission using your OWNER key (possible in Anchor under Tools → Permissions). You will click the Modify button next to ACTIVE and enter the PUBLIC key generated in the first step.
• Change your OWNER permissions using your OWNER key (possible in Anchor under Tools → Permissions). You will click the Modify button next to OWNER and enter the PUBLIC key generated in the first step.
• After both ACTIVE and OWNER are changed - remove your account from Anchor (since its using the old private keys) and set the account up in Anchor again using the new keys you backed up in the first step.

Like I said, it’s a somewhat complicated process to complete currently - but it’s possible. You can do most of this by logging into bloks.io or another web wallet using Anchor as well. The steps would be similar, but I don’t know them off the top of my head.

[Rayezor]

Hi aaron,

Thank you for your help. I have tried changing my active and owner key using newly generated keys from anchor but my ledger device denies the change. I have allowed the contract data on my device but it still does not let me change it. I have tried changing it on both blok.io and anchor. I also have made a new account on blok.io but have not found a good way to link it to my ledger. I have moved my funds to an exchange for now so at least I feel secure but I would like to get them back on my cold storage. Any other advice?

[aaron]

What exactly is the error from the Ledger when you try to change the keys?

[Rayezor]

Sorry for the late reply. The error I get from bloks is Ledger device: invalid data received (0x6a80) and I have attached the error from anchor below.

[mitsugirisan]

Hi Aaron,
I am getting the same error when trying to change the permissions.
I am on Ubuntu connected to my Ledger Nano S. Anchor 1.2.2 gives the following error. Contract Data is enabled on the Ledger.

Anchor 1.2.7 gives this one.

I am trying to change the keys as they might have been compromised.
Thanks

[mitsugirisan]

I restarted Anchor 1.2.7 and now it gives me the same error as the 1.2.2 version, asking to enable Contract Data on the ledger. The Contract Data option is already enabled.

[aaron]

This unfortunately is a side effect of the new Ledger app that was released in the past few months.

If you were to try changing your keys using bloks.io (without Anchor, directly logging in w/ Ledger), I think you’d run into the same issue.

There’s some more information about it here: Nano Ledger S (contract data enabled) - #6 by Raccoon

The fix is unfortunately out of our hands and the development team behind the Ledger app itself needs to correct the issue

[mitsugirisan]

Thanks Aaron. Will check that out.