Bitcoin Forum

Below is what I am trying to do.

Let's say someone made a transaction and marked it as RBF. Then he bumped the fee and replaced the transaction with a new one. Now the first transaction is invalid. How to find the details of the first transaction (including hash, outputs, fee, etc.)?

I am looking for a block explorer that shows invalid transactions (more specifically, transactions that have been replaced by new transactions using RBF method) when I search the address.

I am not entirely sure, but i believe blockchair (https://blockchair.com/bitcoin/) still has those transaction indexed and shows them as invalid/replaced.
Blockcypher (https://live.blockcypher.com/) might be another alternative.

BTC.com will have those transactions marked as double spends.

Look at this transaction (https://www.blockchain.com/btc/tx/2f362caac5d3fa3a1cc586f5bdbb36bcfe6446cfc112eb1cb097d9669688204a). (The transaction isn't mine. I took it from this thread. (https://bitcointalk.org/index.php?topic=5279758.0))
The transaction has been replaced by another transaction (https://www.blockchain.com/btc/tx/31c444900939113ad1c57277fc2904b20f77e57f76f95eee45ec119e72a6342c) probably using RBF method.

Blockchain.com (http://Blockchain.com) does show the transaction when I search the transaction hash. But it doesn't show the transaction when I search the address. (It only shows the valid transaction).

I tried all three suggestion given above. None of them showed the invalid transaction even when I searched its transaction hash.

The suggested from bob123 is doesn't work to me either showing no result or transaction not found.


This one also doesn't work using the transaction posted above.

It seems it only works on blockchain.com when you are trying to search those addresses the invalid transaction doesn't show(They are totally gone except if you use the exact TX hash).

It seems I found another one that this transaction show as invalid and it gives better info about this transaction.
Look:
- https://bitaps.com/2f362caac5d3fa3a1cc586f5bdbb36bcfe6446cfc112eb1cb097d9669688204a

No explorer that I know shows that in detail but unlike blockchain who on the valid transactions shows no other info, blockchyper does so, I know that from experience as it happened to me also as a service I paid though recognize my RBF bump

For example:
https://www.blockchain.com/btc/tx/31c444900939113ad1c57277fc2904b20f77e57f76f95eee45ec119e72a6342c
vs
https://live.blockcypher.com/btc/tx/31c444900939113ad1c57277fc2904b20f77e57f76f95eee45ec119e72a6342c


So, at least it will show if the tx has been superseded, but you will have to manually check all tx from that address.

Thank you. This explorer shows the invalid transaction.
But the problem is that it's working same as blockchain.com.
For checking the invalid transaction, you must have the transaction hash. It's impossible to check the transaction without the transaction hash.


Great.
Seems that blockchyper can be used to find replaced transactions however it isn't exactly what I was looking for.
At least, blockchyper says that "transaction A had an attempted double-spent by transaction Y".
The problem with blockchyper is that it shows no information about transaction Y when I click on it.

So, if I want to check invalid transactions made by a certain address, I need to check all valid transactions of that address one by one in blockchyper and find transaction hash of invalid transactions.
Since blockchyper doesn't show detail of such invalid transactions, I have to enter the transaction hash given by blockchyper in blockchain.com or bitaps.

I guess you are trying to find available explorers or tools to detect addresses of potential double-spend scammers. You are creative but I am not sure it will actually work.

Reason can be if a scammer knows technically steps to do double-spend, that one likely use change address after each successful scam attempt. You can try to follow up scammer addresses and try to link them and discover scammer wallets. It is a long follow-up and complicated process and double-spend scammers are not amateur. :D

A few days ago, someone created a topic (https://bitcointalk.org/index.php?topic=5279758.0) regarding a double-spend scam.
The scammer made this transaction (https://www.blockchain.com/btc/tx/2f362caac5d3fa3a1cc586f5bdbb36bcfe6446cfc112eb1cb097d9669688204a) and then replaced it with this transaction (https://www.blockchain.com/btc/tx/31c444900939113ad1c57277fc2904b20f77e57f76f95eee45ec119e72a6342c) using RBF method. The second transation included same input and output.

I checked the scammer's address (https://www.blockchain.com/btc/address/1CKnhZmHzj45xdvvsAf3DbLWfYSX53NVMs). There were two other transactions made recently with the same input and output. I was just curious to know if those transaction have replaced other transactions as well.  But I couldn't find any block explorer that shows invalid transactions when searching the address.

I wonder if blockcypher will keep that now replaced transaction viewable permanently, or whether it will removed from their database at some point. Does anyone have the hash of a historical RBF transaction to hand so we can see if it is still viewable?

The most consistent way to keep a record of all attempted double spends or transactions being replaced by RBF is going to be to run your own node.

I just made a google search and found following transactions.

Transaction 1 (https://live.blockcypher.com/btc/tx/6870363afb94f9d716d29b2c83a2c76ea0f8c244642151a13b803de09cabf7f5/) (10 months ago)
Transaction 2 (https://live.blockcypher.com/btc/tx/e67257fdc5aba101fe993f160ecba38a76b636039d332ac6e79673ea9c6d15f3/) (2 years ago)
Transaction 3 (https://live.blockcypher.com/btc/tx/cb316977cb5b5ca121b69279d9496f1db356533b4de45707aa2e9122b3d9911d/) (4 years ago)
Transaction 4 (https://live.blockcypher.com/btc/tx/d554f26d134e0ff87329cb89205a105ba6f01a8bf7a7ef2638bc9840fd5f4609/?txid=d554f26d134e0ff87329cb89205a105ba6f01a8bf7a7ef2638bc9840fd5f4609) (5 years ago)

Seems that blockcypher keeps the transaction hash of replaced transactions forever.
The problem is, even if the transaction has been made today, blockcypher doesn't show details of replaced transactions. It only shows the transaction hash.

Yeah, so after a poke around multiple different block explorers, I can't find any which still have the details of those old replaced transactions. Seems if you want to keep a record of these, you'll have to run your own node and specifically record them.

Tracking the change address isn't going to help too much because: - the attacker will likely change the transaction's outputs (if he is smart enough) / - the wallet he uses assigns a unique change address for each new transaction.
Also, it won't work when the attacker replaces an unconfirmed parent and not the transaction you have.

I have the hash of a ~3 months old transaction that was replaced and it doesn't appear on any blockexplorer even blockcypher. So, they don't have records for invalid transactions older than that anyway.
Funny thing, on my Electrum wallet it shows as Local and the balance didn't change after it got dropped from the mempool!

https://i.imgur.com/bpW8eB9.jpg

Usually on Electrum "Local" means transactions which you have created and saved, but have not yet been broadcast. It would seem in your case you did broadcast it, but it was later dropped, and so returns as "Local" to give you the option of broadcasting it again if you wanted (although obviously you can't if you've since spent those inputs). Electrum wallets always include local transactions when updating their balances. If you no longer need that transaction to be saved, then you can safely delete it and your wallet balance will return to normal.

No, it's not a local transaction I created my self and didn't broadcast :)
Someone else sent it to my wallet. It first appeared like this when it was still unconfirmed:
https://i.imgur.com/dIk0J1w.jpg

The sent amount was reflected on the balance tab. Then, when he replaced it (actually, replaced its unconfirmed parent) its status was changed to "Local" whilst the balance remained the same.

As you can see on the history tab on the previous image, I don't even have enough balance to create and broadcast that transaction.

Ahh, that's interesting. I've never had an incoming transaction be replaced on Electrum before, so I wasn't aware the client did that.

A quick search of the GitHub reveals this: https://github.com/spesmilo/electrum/issues/5473

The explanation from SomberNight (one of the Electrum devs) is that your client received the transaction from the server it was connected to, saved it, and when the server dropped the transaction (because it was replaced in your case), it then shows up as "local" in your client.

He also confirms what I've said above though - you can simply delete it.

Even if you enter the hash of an invalid transaction made 1 hour ago, you will get error.
Blockcypher doesn't show details of invalid transactions.
If you enter the hash of a valid transaction that has replaced another transaction (which is now invalid), blockcypher only displays a message saying that there was another transaction trying to spend same inputs. Blockcypher keeps this information forever. (Read this post (https://bitcointalk.org/index.php?topic=5281042.msg55353554#msg55353554).)

Some other block explorers will show you recent replaced transaction as invalid with all the details. At least blockchain.com does that but after 3 months at least, it will dissapear from their databases.

Here is the id for the transaction am talking about:
1af23156cb81558ed314eee016647cdbba36ad128b8d7a3c0d27f289bee2dfae

If you check it on blockchain.com, you will see that the transaction doesn't exist.
But here is how it looked like back then:
https://i.imgur.com/Uyuj0Zy.jpg