Bitcoin Forum

Hi,
Can you help me please.
I bought bitcoin on coinbase, I transfer this bitcoin to my electrum wallet. I receive the bitcoin but after few hours, electrum transfer all received bitcoin without my autorisation to an unknow adress beginnig with bc1...
For further information, i used electrum version since 2019.
Now i tried to restore my wallet with the last version with my seed, but the balance is always 0.
How I can get my bitcoin back please ?

Sounds like either a compromised software installation or computer.

Have you downloaded anything suspicious recently? How did you download your Electrum? Did you verify and check its authenticity?

No, sure nothing. If I create a read wallet with this address bc1q..... I see the bitcoins since the transfer always on this address.
I am a begginer, but I think perhaps it is a probleme with adress sigwit, bech 32 or something like that, or incopatibility between coinbase and electrum.

Check the transaction history on Electrum to be certain that you received the coin and that if the received coin has been transferred from your address to another address.

If the coin is transferred to another address, your wallet has been compromised or you installed a compromised wallet.

I will advice you to download Electrum wallet from https://electrum.org and verify its signature (https://bitcointalk.org/index.php?topic=5240594.msg54223763#msg54223763). Format your device of malware and reinstall your computer OS to make it new again and be careful of malware and people.

Thank you for your reply.
I always used a soft from electrum.org
But I don't know how to verify a signature.
I think the bitcoin are not stollen, because they are always store on this adress  bc1...
I can give you the transaction number of received btc from coinbase and the not wanted transfer :

reveive from coinbase : eebcbf5a8917bdd01b62e91efcf5dce1d90533f5c54a20d2931f7e3c164a8d24
transfer not wanted : 5602e4b208771b8acb484b3c9c54a851666e85f2267621a9e5ee7a710210772a

No.

If you are sure that you downloaded electrum from the official website, either your computer is compromised or someone had access to your seed phrase.


The link to the guide was already posted by Charles-Tim.
[GUIDE] How to Safely Download and Verify Electrum [Guide] (https://bitcointalk.org/index.php?topic=5240594.msg54223763#msg54223763)


If you are not the one who made the outgoing transaction, your bitcoin has been stolen.

I go with @charles-Tim that either there has been a phishing on your account where by Your coin is sent to a different wallet. Which if true your coin is lost already. Another might be Malware issue, and to be certain it is a real electrum wallet you need to verify GPG signature.

This link might help https://bitcoinelectrum.com/how-to-verify-your-electrum-download/ (https://bitcoinelectrum.com/how-to-verify-your-electrum-download/)

There is no incompatibility within any of the addresses. Any incompatibility would've resulted in a failed transaction and in no circumstances would Electrum initiate a transfer to any other addresses for you. It is natural that you can see the funds with a watch-only wallet because the funds aren't moved from that address but you won't be able to spend it without the key.

The only two plausible reasons would be either you forgot about a transaction that you've made or if your wallet is compromised, with the latter being far more likely.

ah ok, I will try to verify gpg signature tonight.
But I tried to restore the wallet on 2 different computer and 3 mobil phone, but it is always the same.
I think there is another reason, because I have 3 purchase like that, and all the bitcoin transfer on bc1 adress are not spend since begining of may, i can see it when I create a read wallet with this adress bc1 :

bc1q4tjunthvhp6c6hqun6yylvy0hewqp4fkgpplde
bc1qcgcv84x7q7dj6nqptee9yekhf2nw7dgq74newl

how i can check this address if are not mine ?

It's either that your wallet or computer is compromised, either somebody else got access to the seed words of your wallet - either when they were generated, either from where you store the backup of the phrase (storing in email, cloud, desktop is not safe). If one recovered your wallet on any device in the world, he could easily spend your funds (i.e. transfer them under his control).

It doesn't matter the money stays on that specific wallet address. If it's not an address under your control, or, even easier, if it's a transaction you didn't do, then your money is stolen.



In Electrum, go to Console tab (you may need to View->Console) and type:

When I copy paste your code @NeuroticFish on the console, the answer is "false"

---

What informations I can give you to check this 4 transactions (2 receive from coinbase and 2 not wanted)

[moderator's note: consecutive posts merged]

Don't overthink it.
It's normal for hackers to keep the funds untouched until they gained enough balance.
Since the transfers aren't that large, it will be wasteful to spend those right away.

I anderstant that, thank you for your answers guys.

Then the address is not yours. Sorry, but it's what I've been expecting. :(


I'm not sure what you want us to check. We don't know what addresses are in your wallet. We can check if the transactions are processed and if they have confirmations, they are final and cannot be reverted.


I'm not sure what you've done wrong, I don't know if it's your computer that's infected, if it's your wallet that it's a malicious clone, or you didn't store your wallet's seed safely.
What I am almost sure is that somebody has stolen your money.

..Maybe you consider acquiring a hardware wallet, keep its seed backup always offline; it should make this kind of events less likely to happen...

thank you @NeuroticFish, I will do that and buy a nano S.
I am really a beginner, and i thought I have done something wrong with the adress and the compatibility with coinbase regarding the adress segwit native and others because I don't understand that.

There is nothing like address is not compatible, you can send bitcoin from any bitcoin address type which starts from 1, 3 or bc1, you can also receive bitcoin from any of the listed bitcoin address type. You just need to be careful of malware and attackers, including people around you which can compromise your wallet.

You will find the OP of this thread interesting: Good topics on security and privacy (https://bitcointalk.org/index.php?topic=5239098.0)

Thanks you @Charles-Tim, for the information, that's where I had my doubts.

There was a phishing attack on electrum wallets where a popup got people to download software that was a scam wallet which sent funds to the scammer group.

Depending on when you downloaded your wallet in 2019, you might've fallen victim to this as normal electrum servers started blocking electrum clients connections to stop being ddosed (there mightve been some normal nodes still running too though and you just got unlucky).

Depending on your level of security you might want to try to use a different computer when dealing with bitcoin wallets from now on, reinstall your os to wipe apps you don't need or trust or just start uninstall ing things that might've compromised your system.

Antivirus may be good for retrospective cleansing too (they might not pick up malware as soon as it drops but they'll be able to get it later - eg wait a week or two before installing an update on software).

If you downloaded Electrum last 2019 around January there is a big possibility that you are using Electrum version 3.3.3 which is vulnerable to any phishing attack and possible Electrum 3.3.3 notified you to update it with the latest version with a link and downloaded a fake Electrum.

If you click that link before and installed it then the Electrum wallet you are using is the fake one if you deposit any amount of the fake wallet all of them will be forwarded automatically to another BTC address that is not yours.

Do you remember what Electrum version did you use before?

Since it's clear your PC has malware on it I strongly advisd you to re-install the operating system with another copy of Windows (or Linux).

Stop using the seed phrase which is compromised and is being stolen from, and create a new wallet for your transactions.

It is possible that the malware has came from not a fake Electrum copy, but from one of the generic "bitcoin stealing" malwares on cracked software/games and pirated movies sites.

Buying hardware wallets will not give you 100% security, especially if you do not learn how Bitcoin works. Even if you use HW, you should know that you are still at risk of something called clipboard malware and that you should always check the coin address on the hardware wallet screen and compare it with the coin address to which you send your transaction. The other thing is that backup (12 or 24 words) is much more important than HW itself, because anyone who comes into possession of those words can steal everything you own.


It is very possible that exactly what many have described happened to you, and the forum warned about this danger at the end of 2018.

Electrum vulnerability allows arbitrary messages, phishing (https://bitcointalk.org/index.php?topic=5090097.0)     

@novamims
Your Electrum wallet appears to be old or you have deliberately chosen legacy addresses as your withdrawal address was 1Dymcvrnqrt54VrvdihSv4hDt1ZqV7wYLj

Do you use your wallet on multiple devices (same wallet based on same mnemonic seed words)?
Have you setup your wallet before your "stolen" withdrawal on some other device? (I don't mean your subsequent attempts to restore your wallet after your funds have been transfered from 1Dymcvrnqrt54VrvdihSv4hDt1ZqV7wYLj to bc1q4tjunthvhp6c6hqun6yylvy0hewqp4fkgpplde by whoever.)
Have you saved e.g. a photo of your mnemonic seed words on a device which is connected to the internet?

I can't recall that you provided information if the address 1Dymcvrnqrt54VrvdihSv4hDt1ZqV7wYLj is derived from a mnemonic seed wallet. (Though, quite likely.)
If it is and if you stored your mnemonic seed words digitally but unencrypted somewhere, you should consider your whole wallet compromised. (I assume there are no funds left as you wrote that after a wallet restoration there's 0 BTC in it and you're not missing any other funds.)