Bitcoin Forum

I have a wallet.dat from 2015 i wad investing and i know i hvae 12bitcoin .
I store it in Dropbox since 12/11/2015 . Some one hack my account in Dropbox
And i copy the wallet.dat to my usb and delet it from Dropbox.
Today I download bitcoin core and try to find is it been hacked and stole my bitcoin or not.
It say i need to wait more than 7 days to syc !!!!!
Now i cant wait and i want to know if he stole my bitcoins or not !
And i eant to know if i Encryption my wallet.dat can he still open it or its to late !!!
How can I transfer my bitcoins to any wallet and i said any wallet and just forgot it for 1  more year.

Any help will be Appreciated. 

Means you have a wallet.dat file with you, If the encryption is enabled then it is quite impossible for him to crack the password of your file as it uses high sha256 iterations which makes it difficult for the hacker to crack it until the password is not too easy.

When i see that my Dropbox was hacked I download the wallet.dat
And then encrypte the wallet.dat in bitcoins core .
I open wallet.dat in bitcon core then i encrypted then store it in usb.
But know i want to know if he stole the bitcoin or not !
And how can i see my balance without waiting the syc.
Can I transfer my bitcoins to bitcoin abc or electrum without syc !
Its 2015 wallet.dat.

If you encrypted it after a hack then I doubt it will have any btc in it. Encryption doesn't work like this. Sorry for that but most probably you lost all your bitcoins. wait, let me check if there is an easy way to do that. Until try to Upload your wallet file here although, I know they only support aes.json format now- https://blockchain.info/wallet/import-wallet

I think your Bitcoins are lost, as you are saying that you encrypted your wallet after downloading it, The encryption won't magically apply on the hackers wallet file, Do you have the address on which you had 12 BTC? It's the only way to see if your bitcoins are there or not. If you don't have the address on which you received the BTCs then your only option is to wait out and let the sync complete. Also it is your fault for storing an un-encrypted version on dropbox. Never upload your wallet files online. SMDH!

The waleet.dat
Its not supported  ?

Can i just open it with bitcoin abc or electrum !!!!

Can't you import your wallet to electrum? Then you wouldn't have to wait for bitcoin core to sync.

And if you know your addresses, then you can check their balance in a block explorer, for example in blockchain.info

As far as i know the wallets don't work that way, each wallet software creates the wallet.dat file differently, you can't import a bitcoin core wallet to electrum and vice versa. So your only option is to check the address which had your 12 BTC's or just be calm and wait out the sync time.

Its my mistake .

Where can i find the address !
All i want is to know if he stole it or not ! And if i have time
I will transfer the balance to other wallet

you can list your addresses while your wallet is still syncing... Just open the debug window (or start from cli) and type

this should give you a list of accounts, then type

then, you can look up these addresses on a block explorer like blockchain.info

I'm pretty sure that the wallet will not have any bitcoin in it if it has been compromised but for your satisfaction, you can try this method to check -

Open Bitcoin-Qt and click help - Debug - console and use code
It will help you to get all your addresses.
Copy Each address one by one and check on - blockchain.info/address/<yourbitcoinaddress>
If you are able to find bitcoins in any address then use this command in console -
Then Install Electrum from here https://electrum.org/ and import it to transfer bitcoins

IIRC, the "listreceivedbyaddress 0 true"  command will only work AFTER the blockchain was sync'ed up to the point where the funding tx was confirmed. "getaddressesbyaccount """ will list all addresses belonging to the default account, the OP can then import these addresses as watch-only addresses in electrum, or he can look them up on an explorer.

You're right about the dumpprivkey tough... If he finds unspent outputs, it is solid advice to dump the private key, import it in electrum and spend the unspend outputs as soon as possible to fund an address generated by a new, secure wallet :)

Its rescanning when i replace the new wallet.dat  with my old walled.dat
I will tell you when it’s finished.

Thanks everyone for the help.
And i delet the file wallet from Dropbox and from my laptop
And stored it in usb.

Like others have stated before me: if a hacker hacked your dropbox and downloaded your wallet.dat, it no longer matters if you delete your wallet, encrypt it, move it... If the hacker hasn't already spent your BTC, you NEED to create a new, clean, encrypted wallet using a verified wallet software like core or electrum, then you need to create a new address using this new wallet, and then you need to empty your old (possibly hacked) wallet, and never use it again...

It show nothing. !
Just

{}

Which command did you try?

It show in bitcoin core
Last transaction
+5.00000

+7.00000

Is that mean its still here !

If your wallet is not yet completely sync'ed, it's possible the spending transaction are not yet visible. In other words: unless your wallet is completely sync'ed, it's still possible those +12 BTC might still "disapear" when the syncing continues.

Did you read my previous question? You gave a command output, but didn't say which command you ran to get that output. Is is possible to show us which command you executed?

Both command show nothing !

15:13:20

listaccounts


15:14:24

{
}

So, we're talking about the commands:
and


That's strange, you should see the following:
This should show you that account "" currently has a balance of x.xxxxxxxx BTC. This balance only includes unspent outputs that were found in the blocks that are currently synced. If your wallet is still syncing, the balance can be incorrect.

The second command should give you the following output;

listaccounts

show nothing ?

Looks like you deleted the wrong wallet.dat file accidentally. Please share screenshots.

here are screenshots from my wallet, you should see something similar, especially if you see a balance of +12 BTC

http://www.mocacinno.com/screencaps/listaccounts.png
http://www.mocacinno.com/screencaps/listaccounts.png

And the second command

http://www.mocacinno.com/screencaps/listaccounts2.png
http://www.mocacinno.com/screencaps/listaccounts2.png

Right, you need to provide screenshots in order to see if you made it right or not and so they can help you to solve your problem better. You still need to wait the sync finish before appearing all the detailed transactions. Just follow they instruct you to do and let's see if you can recover your btc, hope so.

can you please tell me how to but screenshot in this form ????? :'( :'( :'( :'( :'(

http://

Most people use some sort of image host like imgur or tinypic... Just create screenshots, make sure they don't display any sensitive data (like private keys, seed phrases, passwords, xprv's, passwords,...) then upload them to a free hotlink image host.
Those hotlink hosts usually even give you the BBcode you can copy/paste directly into bitcointalk.

Try this command, it will help you to convert wallet into human readable form only when the wallet has an address or addresses. 

that what say


16:06:00

dumpwallet "c:\walletdump.txt"


16:06:01

Error: Please enter the wallet passphrase with walletpassphrase first. (code -13)

you encrypted your wallet... You need to unlock it before you can dump the private keys

replace "your unlock phrase" with the actual password, and 3600 by the number of seconds you want your wallet to be unlocked.
Btw, only dump your wallet on a clean, secure machine, and never ever share the content of the dumpfile, not even partially!

You are doing something wrong it is working fine for me see

18:43:30

dumpwallet c:\walletdump.txt


18:43:31

{
  "filename": "c:\\Program Files\\Bitcoin\\walletdump.txt"
}


Oh, no Please remove those quotes from there.

i did dump file
and get alot of data with address ?

If it worked, the file c:\walletdump.txt should contain lines like this
[private_key] timestamp reserver=1 # addr=[address]

or for a HD wallet:
[private_key] timestamp reseve=1 addr=[address] hdkeypath=[derivation_path]

you can potentially just download electrum, create a new wallet (chose the option to create a wallet using private keys) then copy/paste the private keys into the wizard's textarea.

It doesn't matter if most of the private keys belong to a private key/public key/address that is unfunded.
PS: only do this on a clean machine
PS2: like i said before: if there are unspent outputs (if the balance > 0), make a new wallet and empty out the old one.

Check when they are created - e.g xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 2013-12-25T11:54:44Z reserve=1 # addr=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

KzR4nP8Ybvr6PrkiSUxxxxxxxxxxxHxxxxxxxxxxx 2015-06-27T14:44:33Z change=1 # addr=1EB5xxxxxxxxxxxHxxxxxxxxxxx


date
2015 and i have also
2017  :'( :'( :'( :'(

This command will only dump the private keys, timestamps and addresses managed by your wallet. The fact that there is a new private key added in 2017 *could* mean nothing (on the other hand, it *could* mean a change address was added, and your funds *might* have been stolen).
Just import the private keys into electrum and find out for sure...

Good luck!

BTW: i'd personally not even post part of the private key... For example, the last characters of the private key in WIF format are a checksum, so if you post the first letters, you make a hacker's life much easyer (he doesn't have to brute force those first letters, and he can just forget about the last characters to, so he only has to find the middle part of the private keys).

do i need to copy all privte key ? or just one ?

all, you don't know which address was funded... So just import all private keys.
You can use notepad++ in column mode to clean up the dump file, or you can execute a macro to create a clean list of private keys.

Just don't try to import more than 50 private keys into an electrum wallet at a time... From experience i know that importing +50 private keys at once might cause the import process to lag.

Import all the address into Electrum, to do that copy all private key and sweep them into electrum.
You can use notepad++ or other text editors to make the task easy using HTML tricks
Let me know if you need help in this regard.

lectrum frezz the stop

then not responding ?

How many private keys did you try to import at once?

i try 50 also frez  :'( :'( :'( i will wait for bitcoin to syc and hope he did not have time to stole anyhing

After i add all private key. What i do next !

Check if the electrum wallet shows any balance. If not, then the funds are stolen and you can't do anything about it, but if it shows balance then you can transfer them in a paper wallet or make an account online on web wallet like blockchain.info and transfer them there to keep them safe from hackers.

You can also tip me some BTC if I helped you - 1May3TVRzjg2cYut5Pn1uJzKFWk9MjyHNH  ;)

Do i need to upload all private keys to see the balance !

Wait, a solution for you.
Remove all the private keys(keep a copy for yourself as backup) from their and send me all the BTC address, I can check them for balance with my bitcoin checking tool. Let's see how lucky or unlucky you are today. won't take more than 3-5 minutes.