Bitcoin Forum

Bitcoin => Bitcoin Technical Support => Topic started by: dhenson on April 21, 2013, 09:22:06 PM



Title: I think I was just robbed (edit... I wasn't robbed. Victim of my own ignorance)
Post by: dhenson on April 21, 2013, 09:22:06 PM
Please tell me it isn't so, and if it is, please tell me what I did wrong, how this could have bee avoided.

1) I saved an offline version of btcaddress.org to generate an offline wallet.
2) I created a linux pen drive boot stick and installed ubuntu to my computer as a dual boot.
3) I installed bitcoin via the following method: (http://www.distrogeeks.com/install-bitcoin-qt-ubuntu/)
4) I copied my wallet.dat to my ubuntu partition (mounted the windows partition)
5) I attempted to perform a .1 btc transfer to my offline address 17JyyT1V4XzQoJ8Y6vHvXSEe9YLrSLbCzv
6) logged back over to windows to check the status and noticed that my original address had been drained (19YNvp4fxQWonc7NVjzA2QEzFy9MsBkUSE )
7) I quickly logged back over to ubuntu to attempt a double spend (in the hopes that it would invalidate the initial transaction. (not sure if this was a valid thing to try or not)

Am I hosed?  What happened?

edit... it's worse than I thought.  They drained my other address to. (1NMjGzpJxAseMJ7cng3yCuYtL2XZgjpeK9)

FML


Title: Re: I think I was just robbed
Post by: bitcoinminer on April 21, 2013, 09:29:46 PM
https://blockchain.info/address/19YNvp4fxQWonc7NVjzA2QEzFy9MsBkUSE

Looks like it was sent to 17JyyT1V4XzQoJ8Y6vHvXSEe9YLrSLbCzv



Title: Re: I think I was just robbed
Post by: davidpbrown on April 21, 2013, 09:34:00 PM
btcaddress.org leads to a default looking GoDaddy address. Sounds like user error.

If you want a new wallet, perhaps just move the existing one and bitcoin-qt will create a new one.

Also, windows.. when you have Ubuntu to hand.. replace user.


Title: Re: I think I was just robbed
Post by: dhenson on April 21, 2013, 09:34:54 PM
Are you saying I'm just reading it wrong and my second send to my offline wallet was legit?

I can hardly type this as my hands are shaking so bad.


Title: Re: I think I was just robbed
Post by: dhenson on April 21, 2013, 09:35:44 PM
sorry, bitaddress.org not btcaddress.org


Title: Re: I think I was just robbed
Post by: kiko on April 21, 2013, 09:39:00 PM
The rapid timing would suggest a key-logger was just waiting for you to enter your passphase.

How long had it been since you last unlocked that wallet?


Title: Re: I think I was just robbed
Post by: bitcoinminer on April 21, 2013, 09:39:59 PM
Are you saying I'm just reading it wrong and my second send to my offline wallet was legit?

I can hardly type this as my hands are shaking so bad.


https://blockchain.info/address/1NMjGzpJxAseMJ7cng3yCuYtL2XZgjpeK9


Title: Re: I think I was just robbed
Post by: davidpbrown on April 21, 2013, 09:41:49 PM
When you send BTC the remainder goes to a new address. The wallet holds upto ~100 addresses for transactions. Perhaps you're just reading it wrong.

bitcoinminer's reply looks clear enough.


Title: Re: I think I was just robbed
Post by: dhenson on April 21, 2013, 09:42:46 PM
The rapid timing would suggest a key-logger was just waiting for you to enter your passphase.

How long had it been since you last unlocked that wallet?

This was the first time I had unlocked the wallet on Ubuntu.  The thing is, I haven't browsed with that install at all.  The only way it could have an infection is if the bitcoin install I used had an infected source.

Was that not the official repository? (bitcoin/bitcoin)


Title: Re: I think I was just robbed
Post by: Liberty Payout on April 21, 2013, 09:43:00 PM
It looks like the balance is indeed in your offline wallet.


Title: Re: I think I was just robbed
Post by: dhenson on April 21, 2013, 09:43:50 PM
When you send BTC the remainder goes to a new address. The wallet holds upto ~100 addresses for transactions. Perhaps you're just reading it wrong.

bitcoinminer's reply looks clear enough.

^^ I really hope this is what it is.

I'd much rather be a stupid noob, than a broke stupid noob.


Title: Re: I think I was just robbed
Post by: charleshoskinson on April 21, 2013, 09:45:25 PM
I created a lecture in my course to discuss backing up your wallet without losing your money:

https://www.udemy.com/bitcoin-or-how-i-learned-to-stop-worrying-and-love-crypto/

I'd recommend checking it out. Backing up your wallet shouldn't be hard.


Title: Re: I think I was just robbed
Post by: bitcoinminer on April 21, 2013, 09:45:29 PM
Yeah there are coins in the addresses you've posted.  I suggest using the blockchain explorer in the future.  We have enough panicked "I've lost all my BTC/Money" threads on this board already.


Title: Re: I think I was just robbed
Post by: prof7bit on April 21, 2013, 09:53:22 PM
you did this with a copy of the same wallet dat. The old client on windows with the old copy of the wallet file just did not yet notice that you had moved BTC around with the copy of the same wallet file on the Ubuntu machine.

Rescan the wallet on the Windows machine and everything will be ok again.

Moving wallet files between different clients always leads to these kinds of confusions. After that you need to run it with -rescan to bring the seemingly wrong wallet in sync with the new reality again.


Title: Re: I think I was just robbed
Post by: scintill on April 21, 2013, 09:56:37 PM
Assuming the "thieve accounts" are just OP's change addresses, it makes me wonder if the pseudonymous features should be made "opt-in": by default, you only have one address and the client always spends change back to that one.  Having multiple "accounts" that only get used once and change every time you make a transaction is too foreign of a concept for the lay user.  And with current client behavior and transaction graph analysis it doesn't even afford much anonymity.

The "wallet copy" aspect as prof7bit mentioned may have also played into this.


Title: Re: I think I was just robbed
Post by: Elwar on April 21, 2013, 10:15:26 PM
I thought the same thing when I checked my address (in my sig). I saw that 12 BTC was moved. I freaked out.

Then I remembered that I paid for my hosting service from my BTC client. This sent about 13 BTC out, paid the .6 for the hosting service and returned the 12 or so BTC to a different address (the change).

Bitcoin does this on purpose to mix your addresses to help with anonymity.

Using a single address is not how it was designed to work.

To remedy this I went into my client and sent the full amount in my wallet back to my vanity address.

I usually use the few BTC I have on MtGox for spending but that day Gox was lagged up so I had to load my vanity address up to do the spending.


Title: Re: I think I was just robbed
Post by: dhenson on April 21, 2013, 11:04:15 PM
Just to put this to bed, and to allay any fears of new to bitcoin people reading my terror filled lesson.  I have all of my Bitcoins.

I was unaware of the fact that the bitcoin client auto sends the remainder to a different address.

Thank you to all who helped and sent PM's of concern.  The bitcoin community although seemingly arrogant and gruff at times has a good heart and helps when needed.

Again, thank you and all is well.


Title: Re: I think I was just robbed
Post by: bg002h on April 21, 2013, 11:13:41 PM
Just to put this to bed, and to allay any fears of new to bitcoin people reading my terror filled lesson.  I have all of my Bitcoins.

I was unaware of the fact that the bitcoin client auto sends the remainder to a different address.

Thank you to all who helped and sent PM's of concern.  The bitcoin community although seemingly arrogant and gruff at times has a good heart and helps when needed.

Again, thank you and all is well.

Strong work all. We have a good community. Glad your coins are safe. Now you've got a good story to tell...a story with a lesson too! I made the same mistake in my early days.


Title: Re: I think I was just robbed
Post by: Loozik on April 21, 2013, 11:36:14 PM
When you send BTC the remainder goes to a new address.

Newbie here. Let's assume I have 3 addresses and 10 bitcoins are in only one (two others are empty). Does it mean that when I send 1 BTC to a friend of mine, 9 bitcoins will be automatically sent to either of the remaining addresses of mine?

Thanks


Title: Re: I think I was just robbed
Post by: bg002h on April 22, 2013, 12:03:52 AM
When you send BTC the remainder goes to a new address.

Newbie here. Let's assume I have 3 addresses and 10 bitcoins are in only one (two others are empty). Does it mean that when I send 1 BTC to a friend of mine, 9 bitcoins will be automatically sent to either of the remaining addresses of mine?

Thanks
Or to a new one you didn't even know existed in your wallet (there are many change addresses pre-computed in your wallet). Some have lost money by not understanding this concept and only having backups of the addresses they knew about. The way these change addresses were pre-computed was changed in bitcoinqt to make this less of a problem.


Title: Re: I think I was just robbed
Post by: scintill on April 22, 2013, 12:05:36 AM
Just to put this to bed, and to allay any fears of new to bitcoin people reading my terror filled lesson.  I have all of my Bitcoins.

Glad to hear it.  You might want to edit the title of the topic so that people know it's resolved.


Title: Re: I think I was just robbed
Post by: ErebusBat on April 22, 2013, 12:06:20 AM
Can the OP change the post title?  We have enough stigma of bitcoin is full of thieves with confusion of posts like this.


Title: Re: I think I was just robbed
Post by: Loozik on April 22, 2013, 12:33:24 AM
When you send BTC the remainder goes to a new address.

Newbie here. Let's assume I have 3 addresses and 10 bitcoins are in only one (two others are empty). Does it mean that when I send 1 BTC to a friend of mine, 9 bitcoins will be automatically sent to either of the remaining addresses of mine?

Thanks
Or to a new one you didn't even know existed in your wallet (there are many change addresses pre-computed in your wallet). Some have lost money by not understanding this concept and only having backups of the addresses they knew about. The way these change addresses were pre-computed was changed in bitcoinqt to make this less of a problem.

Geee, it will take a lot of time before I understand even basic peculiarities of Bitcoin-Qt. There are many guidelines like backing up wallets, etc, but without first understanding the background mechanics / logic behind these guidelines, a non-tech poor English speaking newbie like myself can potentially get into troubles.

Is there an easy-to-understand tutorial of all / some of these intricacies?

Thank you.


Title: Re: I think I was just robbed
Post by: charleshoskinson on April 22, 2013, 12:35:59 AM
https://www.udemy.com/bitcoin-or-how-i-learned-to-stop-worrying-and-love-crypto/


Title: Re: I think I was just robbed
Post by: Loozik on April 22, 2013, 01:01:52 AM
https://www.udemy.com/bitcoin-or-how-i-learned-to-stop-worrying-and-love-crypto/

Thank you.

This website either has problem with password management or does not allow browsers with cookies disabled (I added this website to a exception list or I am proving myself to be a non-techie - so many attempts of password reset and all failed.

BTW, if the situation described by the thread originator happens to me, how do I find the hidden address in my wallet and how do I find the private key assigned to this address (using Bitcoin-Qt)?

Thanks


Title: Re: I think I was just robbed
Post by: charleshoskinson on April 22, 2013, 01:16:41 AM
Generally all the info is contained within the wallet.dat file. I really wouldn't recommend digging for the private key. Instead just backup your wallet and then encrypt the backup using AES crypt and a strong password. Store the encrypted backup on dropbox or some other service. You'll have the best of both worlds. Access and security


Title: Re: I think I was just robbed
Post by: Loozik on April 22, 2013, 01:33:46 AM
Generally all the info is contained within the wallet.dat file.

The guy here https://bitcointalk.org/index.php?topic=5324.msg79436#msg79436 says only private keys are stored in the wallet.dat file: ''The wallet only contains the private keys you use to spend your coins''.

If he is right, by opening wallet.dat file, I would find many (about 100) private keys (only keys). How would I know which key opens the specific address to which the remaining 9 BTCs were send? I do realize this question may seem and probably is stupid. Just let me know and I jump into ''Newbie'' forum.

Instead just backup your wallet and then encrypt the backup using AES crypt and a strong password.

By the ''wallet'' you mean wallet.dat file or something else / something additional?


Title: Re: I think I was just robbed
Post by: charleshoskinson on April 22, 2013, 01:39:50 AM
Quote
Generally all the info is contained within the wallet.dat file.

The guy here https://bitcointalk.org/index.php?topic=5324.msg79436#msg79436 says only private keys are stored in the wallet.dat file: ''The wallet only contains the private keys you use to spend your coins''.

If he is right, by opening wallet.dat file, I would find many (about 100) private keys (only keys). How would I know which key opens the specific address to which the remaining 9 BTCs were send? I do realize this question may seem and probably is stupid. Just let me know and I jump into ''Newbie'' forum.

Quote from: charleshoskinson on Today at 01:16:41 AM
Instead just backup your wallet and then encrypt the backup using AES crypt and a strong password.

By the ''wallet'' you mean wallet.dat file or something else / something additional?

I walk through the process of backing up and encrypting the your wallet in my course. If you are having trouble viewing it, then I'll be happy to email you the video. Just PM me. And yes I am referring to the wallet.dat file. It contains lots of information. You'll have to contact the vendor to get specifics about how the data is stored. I haven't looked at the source code. That said, it is my understanding that your private keys are stored in the wallet.dat. This is confirmed by blockchain's import service only requiring the wallet.dat file to import your wallet to their cloud.



Title: Re: I think I was just robbed
Post by: Raoul Duke on April 22, 2013, 01:42:01 AM
Generally all the info is contained within the wallet.dat file.

The guy here https://bitcointalk.org/index.php?topic=5324.msg79436#msg79436 says only private keys are stored in the wallet.dat file: ''The wallet only contains the private keys you use to spend your coins''.

If he is right, by opening wallet.dat file, I would find many (about 100) private keys (only keys). How would I know which key opens the specific address to which the remaining 9 BTCs were send? I do realize this question may seem and probably is stupid.

Code:
dumpprivkey <btcaddress>


Title: Re: I think I was just robbed (edit... I wasn't robbed. Victim of my own ignorance)
Post by: dhenson on April 22, 2013, 01:44:56 AM
Title changed.  Again, thank you Bitcoin community for all of your assistance in this simple misunderstanding.  I remain a 100% believer in Bitcoin.  Long live Satoshi!

lls ftw.


Title: Re: I think I was just robbed (edit... I wasn't robbed. Victim of my own ignorance)
Post by: Loozik on April 22, 2013, 01:47:51 AM
OK. This conversation overwhelmed my circuits  ;D

I am going back to the Newbie forum to look for historical threads for non-techies.

Thanks for your tries to enlighten me.


Title: Re: I think I was just robbed (edit... I wasn't robbed. Victim of my own ignorance)
Post by: Loozik on April 22, 2013, 02:09:17 AM
One last question, hoping you do not mind it. I just read that apart from a wallet and addresses in it there are also accounts in the wallet: https://en.bitcoin.it/wiki/Accounts_explained

When a portion of bitcoins is spent from a specific address from a specific account within a wallet, the remaining amount is resent to an address within the same account or is resent to an address within a different account?

Thanks


Title: Re: I think I was just robbed (edit... I wasn't robbed. Victim of my own ignorance)
Post by: ErebusBat on April 22, 2013, 02:30:52 AM
One last question, hoping you do not mind it. I just read that apart from a wallet and addresses in it there are also accounts in the wallet: https://en.bitcoin.it/wiki/Accounts_explained

When a portion of bitcoins is spent from a specific address from a specific account within a wallet, the remaining amount is resent to an address within the same account or is resent to an address within a different account?

Thanks
Accounts are a logical unit within BircoinQt so you can group your transactions or easily see who paid.  If you don't know what they are then chances are that you don't need them. 

One thing I have not seen anyone here mention is ongoing backups.  You must continually backup the bitcoin qt wallet or it is possible you can lose coins.  The reason is because of change addresses, if the ui has to generate a new change address that wasn't in your previous backup then your previous backup is as good as gone.

Read up on it.


Title: Re: I think I was just robbed (edit... I wasn't robbed. Victim of my own ignorance)
Post by: Loozik on April 22, 2013, 03:06:22 AM

I am putting together some short videos to answer these questions.  My production is not great and the sound is a little low (I am workin on that stuff).  I am trying to keep them as short as possible so people can get what they need quickly.  Here is the one called "Anatomy of a Bitcoin Wallet"

http://millybitcoin.com/anatomy-of-a-bitcoin-wallet/ (http://millybitcoin.com/anatomy-of-a-bitcoin-wallet/)



Finally someone who produces videos aiming at explaining practicalities - this is what I needed :)

BTW, the videos can be longer. They are not boring. What is boring are 20 - 40 minute movies on how bitcoin will change the world and on the theory. They are all the same.