Bitcoin Forum

What happened: A friend who is a local btc trader got scammed of over $2,000 which happened through the blockchain.info wallet, and this has been said to be a trick going on for a while now with users using Blockchain.info wallet

How it happened: Around 9PM (local time), he was contacted by a seller and he provided the seller his address: 12L4gWyMS4WVmj1r3FMpJC7G62Mkg3rr9u (https://blockchair.com/bitcoin/address/12L4gWyMS4WVmj1r3FMpJC7G62Mkg3rr9u) and after some minutes the seller messaged him, claiming he had sent the coin which was from this address: 1FPSehskR9XLzeobn1uofotz3Ssuws33Yi (https://blockchair.com/bitcoin/address/1FPSehskR9XLzeobn1uofotz3Ssuws33Yi) ^{Screenshot 1}, and when the buyer checked his Blockchain wallet he received the notification of the incoming tx, After about 30 minutes later the tx was still yet to have any confirmation but the incoming tx was still available in his blockchain so the buyer paid him after and assumed the network was just slow with confirmations (he didn't check the transaction in the blockchain network, just on his wallet). Some 15 minutes later he checked again and the incoming transaction notification from his Blockchain wallet had disappeared like nothing had happened.

Based on the time, I think this was the said transaction: 857bf6a1a3daca7d2f3e9be98e37b4d22ff97f477e515bacbc30c2f9bd492c44 (https://blockchair.com/bitcoin/transaction/857bf6a1a3daca7d2f3e9be98e37b4d22ff97f477e515bacbc30c2f9bd492c44) or there is a transaction before this from the seller's address (which got cancelled after broadcasting, If that's even possible), but I saw there were several shady recurring transactions between the seller's address and 1MpS8Go7VesjzLs7rVab37Bs2D2ivsMMA2 (https://blockchair.com/bitcoin/address/1MpS8Go7VesjzLs7rVab37Bs2D2ivsMMA2)

The explanation above is as far as I know but I can get more information upon request; I just want to know what actually could have happened here, is it possible that the transaction was broadcasted with a very low-fee to delay confirmation and was altered later on, hence the initial notification on the Blockchain.info wallet.

https://i.imgur.com/drkC5GD.jpg

PS: I don't know if this is the right section for this thread or B&H, but since the last part of the post could contain some technical details and I believe this is the best section to get a detailed reply... Mods are free to move as they see fit.

Many transactions were confirmed in this address today:
https://blockchair.com/bitcoin/address/12L4gWyMS4WVmj1r3FMpJC7G62Mkg3rr9u

Please check again. I guess you were not scammed. (This tx  (https://blockchair.com/bitcoin/transaction/16cee2003418ea45c011d8bd6a32b603a2890e07484ac68d07af087743b92dbb)alone with 17 confirmations has about all the btc you bought (near 2k usd).

 But that is certainly strange as the user made many small transactions of 0.05 0.06 0.04 and so on... Maybe he used a mixer?


You should not use Blockchain.com wallet, especially for such high amounts.

I recommend that you immediately download Electrum.org wallet and move your coins to that wallet. And buy one hardware wallet now (ledger nano or trezor.

You don't seem to get it.

1. This wasn't me but a close person That doesn't matter.
2. All other transactions are valid and but not from the said seller
3. The transaction happened yesterday not today
4. The amount sent from the seller is ~0.26687032 (which doesn't exist in the receiving address)
5. The was no recorded transaction on the blockchain from 1FPSehskR9XLzeobn1uofotz3Ssuws33Yi to 12L4gWyMS4WVmj1r3FMpJC7G62Mkg3rr9u

If this 857bf6a1a3daca7d2f3e9be98e37b4d22ff97f477e515bacbc30c2f9bd492c44 (https://blockchair.com/bitcoin/transaction/857bf6a1a3daca7d2f3e9be98e37b4d22ff97f477e515bacbc30c2f9bd492c44)
the transaction you are talking about is not sending on this address 12L4gWyMS4WVmj1r3FMpJC7G62Mkg3rr9u.

And that transaction is already confirmed of almost 109 confirmation.

If this is the address of your friend 12L4gWyMS4WVmj1r3FMpJC7G62Mkg3rr9u then he has been tricked by making a double spend. There's no way to recover them.

How did he get this TXID?
Can you ask him to check the transaction TXID again? The TXID above might be different(if you can still get the old TXID).

It looks like the seller performed a double spend fraud and scammed your friend.

Here is the scenario;
1. First transaction that was sent to your friend has a lower transaction fee, so before it even had a single confirmation your friend sent the seller money (HE should have never sent any money before at least 1 confirmation)

2. On realizing he has received money even before the transaction was confirmed, seller decides to Create a new transaction to another addresses with a higher fee which gets confirmed faster and makes the previous transaction invalid

That could explain the missing TX ID in the blockchain

Your friend received what he paid for  but not from the address he expected?
The seller might have used a mixer or a different wallet. Probably a mixer  as there were many small transactions.

I don't any sign of scam here. He just scrambled his bitcoins in different addresses

Of course I know, I just wanted to get a clearer picture of what happened.


I got the TX ID myself based on the time the seller claimed to have sent the coin to his address, and the next tx he got that was confirmed.


I guess that's what happened, which explain the recurring transactions between the seller's 1FPSehskR9XLzeobn1uofotz3Ssuws33Yi and 1MpS8Go7VesjzLs7rVab37Bs2D2ivsMMA2



Nope, he received funds from other persons... none(probabbly, a double spent tx as BitMax and Bitcoin_Arena both supposed) from the seller.

Is there any reason why he didn't deal with the seller directly using Localbitcoins or any other escrow trading platform of the same calibre?
Such a sad scenario could have been avoided because the escrow service first gets hold of the bitcoins even after the money is sent to the seller. Even if the seller refused to release the bitcoins,  a dispute would resolve the issue.

I'm not sure he knows about that, but after he claimed he paid the seller after almost an hour simply because the blockchain transactions has been very slow all day long and he wasn't anticipating a foul play.

Great lessons are sometimes learnt the bitter way, I'd say.

Thanks to everyone!

There is a commonly held -- but false -- belief that "double spent" unconfirmed transactions can't be propagated across the network, and that mining pools will reject them, based on node policy. This has often been repeated around here, even by people who should know better.

In this case, the network and BTC.com mining pool obviously didn't care.

These words of wisdom from Satoshi are still relevant today:


Someone receiving bitcoin and waiting for a block confirmation before releasing payment doesn't really need to use escrow.

That is the mistake right there. :-\

As always, until you have at least one confirmation, then there is nothing even remotely close to a guarantee that the funds will arrive.

It sounds like a simple double spend attack... and with the current state of the network over the last day or so, it would be relatively easy to send a 1 sat/byte transaction, and then force through a 50 sat/byte transaction.

There are some very odd transactions going to/from that 1FPSehskR9XLzeobn1uofotz3Ssuws33Yi address... it just seems to be recycling funds between that and 1MpS8Go7VesjzLs7rVab37Bs2D2ivsMMA2 ??? Unfortunately, I suspect that there may be a few more victims of this particular scammer :( :-\

That's the mistake, but the lesson has been learnt now, I'm sure.


I'm afraid so too, but I hope my friend was only one gullible enough to pay him before at least confirmation.

I'm locking the thread now, thanks for the help.