Bitcoin Forum

Hi, Please help as I am new to Bitcoin and Electrum Wallet. On Sunday 29 October at 08:58 I received funds that I had transferred from another wallet in my Electrum Wallet. I could see the Amount and Balance which was correct. I assumed the funds are now safely in the wallet. However on Sunday 29 October at about 23:45 the funds were Sent from my wallet and my balance is now zero. I did not send the funds myself. Can someone please explain what happened and where my funds were sent to?

Thank you and Best rgds

It's really hard to determine exactly what happened here, but if you really can confirm that your funds were spent from your Electrum wallet, then at face value, your private keys were compromised, wallet accessed, and funds sent out.

1. Is your Electrum fully synced (Large green button on bottom right screen), and balance shown in bottom left corner is zero? Then your wallet is indeed empty.
2. Can you see the transaction listed in your wallet? If you click on it to view the transaction on block explorer, do you recognise any of the addresses associated with the tx?
3. If you can share the tx ID here, we can help determine some things, but likely not recover the funds, if (1) is confirmed.
4. Does anyone else besides yourself have your Electrum seed and/or encryption pass?

If (1) is confirmed, and you answered no to (4), then someone somehow stole your seed and/or pass. The best thing to do right now is perform a full scan of your device. Ensure it is clean and safe before creating a new wallet and/or changing your password.

Hi buwaytress

Thank you very much for your response. Answers follow below.

1. Yes the wallet is fully synced and the large green button is on the bottom right screen. Also the balance on bottom left is zero.

2. Yes I can see the transaction listed.I do not however recognise any of the addresses. I sent the funds from my Cryptopay wallet to Electrum wallet.

3. The TX ID is 029f70aaeb6d99cd4b9cd3d53f28667e77b2cc109b84a70bcea037b428cce9c2

4. No, no one has my Electrum Seed or encryption pass

I have done a scan of my PC and found no malware, viruses etc

Any help would be greatly appreciated. I tried to insert a screenshot here but unable to do so. I click on Insert Image button but then it just displays http://

Best rgds

Have you installed any alt coin wallets or otherwise, possibly questionable software lately? Problem being that malware that isn't "off-the-shelf" often avoids detection by most antivirus software. To be honest I'd consider wiping my hard drive and re-installing my operating system at that point.

Unless someone else you know had direct access to your device I'm afraid those coins are gone for good.

There must be a leaked which your bitcoin could be stolen in this case;
1. This is your address: 113Eab3eyWW4wfdpeZ3rNgD2gLWtDU84Gr ??
2. This is the address of the thief: 13y2Ct6ee6E7s6y7qK9z798oktVfb1jJ1R ??

You said;
1. have sent the funds from Cryptopay wallet to Electrum wallet
2. On Sunday 29 October at 08:58 I received funds that I had transferred from another wallet in my Electrum Wallet. I could see the Amount and Balance
    which was correct

But, after check on your address 113Eab3eyWW4wfdpeZ3rNgD2gLWtDU84Gr there is no any amount received on 29 October, instead of 27 October > BTC0.0165 received from 36TEeqDrHnMFz9izKjgJipquvooJ7iTDa7

Hi HeRetik and error08

Firstly thank you for your response.

HeRetiK - No, I have not installed any other wallets nor any other software. I downloaded the Electrum software from https://electrum.org/#download and selected the Windows Standalone Executable file and installed from there. I am the only one with access to my laptop.

error08 - I initiated the transfer on the 27 October but I only saw the funds in my wallet on the 29 October at ab
out 11:00 when I logged into the wallet. Another transaction then appeared in the History list at 23:45 and that was the one where the funds were transferred out of the wallet.

It was a small amount - $95 so not a big deal. I am just now wary of using Electrum again.

Thank you both for your responses.

I am sorry for your loss.
But, it really makes me curious; how could it happen. Even though we know the funds unlikely to recover.
However, I've been using electrum wallet for months, for most of my bitcoin in electrum. Never have a single problem with it.
That's why this mystery should be solved, at least we know how did this happen, just for precaution act.

I also feel sorry for you men. But based on what I've seen, maybe you are not that too careful, because someone just got inside in your account. This should be a lesson for all of us. If there is only a way to recognize the thief, I'll do my best. But I'm afraid there isn't. Be careful next time brother, so it won't happened again. And also try to make a new account.

Just making an advice. :)

I think this is the danger of our digital wallets if it lacks a tough security feature. Anything is the net can be hack so having a good digital wallet is something to be treasured.  I felt sorry for you man... This is a danger really if our digital wallet cannot be registered after all.  Just like that... can you not trace where it was sent to... when... and how...  What I know is that you can view your transaction history.  So, I hope you can trace it and have it back soon....

Okay, First check your CryptoPay if there is still balance. Some of the web wallet -- most of them honestly will send your balances to another address for security purposes. You said that you are just new to electrum therefore here is my answers on the possible scenario.
(Again, this is just my opinion and i think what possibly happened).
1. You sent from CryptoPay to your electrum wallet.
2. You saw the balance.(Maybe the transaction was not verified therefore the sending from CryptoPay to your electrum wallet was cancelled).
3. The Balance of your CryptoPay bitcoin address was sent to another wallet ( probably CryptoPay's "security wallet").
4. You still have the balance on CryptoPay BUT on that exact address it will not show (on the blockchain) that you have still balance.

---

I assume that:
>Your CryptoPay's  Bitcoin address (on the block explorer) will not show your balance.
>Your CryptoPay's Web Wallet will still show your balance, you can still spend it ( if there will be no errors on this transaction)
>Your Electrum wallet showed the balance yet it was not yet verified [ it may happened that the transferring of Your CryptoPay's balance to their secure wallet was done at the same time with you which causes double spend which the first verified one will be processed first)

---

My Questions are
1. what is your CryptoPay's Account Balance as of now?
2. what is your CryptoPay's Bitcoin Address?
3. What is your Electrum's Wallet Address?

Thank you to all those that responded. I am generally very careful when on the net and have checked my laptop with anti virus and malware scanners but nothing found on laptop.

rjbtc2017 -

1. Cryptopay account balance is now 0.0929 (This is funds that I transferred into Cryptopay yesterday from another source so that is correct). No sign of the finds transferred to Electrum

2. Cryptopay address is 3EL14BoZCDXBmV65uCGAawXAZZxvnvZwN7

3. Electrum address is 1MREVrSRXyFbnbt4c6X5YdqDHQnFJHnW7Q

I will wait and see if it eventually pops up in Cryptopay

Thank you once again to all

Okay this is weird.
>your CryptoPay Address(3EL14BoZCDXBmV65uCGAawXAZZxvnvZwN7)
has : Final Balance   0.10993723 BTC   (which you can see on https://blockchain.info/address/3EL14BoZCDXBmV65uCGAawXAZZxvnvZwN7)
>Electrum Wallet (1MREVrSRXyFbnbt4c6X5YdqDHQnFJHnW7Q) Doesn't have any TRANSACTIONS
>on the transaction: https://blockchain.info/tx/029f70aaeb6d99cd4b9cd3d53f28667e77b2cc109b84a70bcea037b428cce9c2
113Eab3eyWW4wfdpeZ3rNgD2gLWtDU84Gr was used to send bitcoin to 13y2Ct6ee6E7s6y7qK9z798oktVfb1jJ1R
which possibly a secure wallet of cryptopay before sending it to the electrum address.
>The Possible Problem i can see here is that cryptopay already deducted that to your account on cryptopay and failed to send that to your electrum. Call the CryptoPay technical service personnel to guide you on what to do for the lost bitcoin.

Hi rjbtc2017

Thank you. I will contact Cryptopay right away. Will let you know what their response is.

Have emailed Cryptopay support and awaiting their response

Just received a response from Cryptopay. They say the funds was not sent to them. So I guess the Electrum Wallet was hacked. Lesson well learnt and I hope others will learn from this experience as well.

Thanks to all who responded!

You'll just let it slide? as what i've said your CryptoPay Bitcoin Address has 0.10993723 BTC but the recorded on their web is  0.0929BTC . Cleary they

deducted the BTC you are supposed to send but you didn't received for some apparent reason ( that i assume that the transaction was cancelled

because of double spending --again i assume this might be wrong).

contact them again and ask them why you didn't received any funds while your Bitcoin address didn't send any amount and also didn't received any

amount as per BlockChain Records and also as per blockchain records, you still have  0.10993723 BTC on your cryptoPay's Bitcoin address.

Do not let it slide.

Hi rjbtc2017

Gosh, that slipped my mind. I will definitely contact them again right now..

Wait, can i ask is there any info on your electrum wallet GUI? like details of the coins sent? can you screenshot it?
maybe the address that you posted here were the second address on your electrum application.
Can you look for Electrum Address tab and Find the "Used Address" caption and Paste here the address, maybe we are misunderstanding your post.

I made screenshot but am unable to post it here. How do I do that? I tried the Insert Image but it's not working

upload it on imgur and then post it using this code

https://falcone73.imgur.com/all/?third_party=1

Hope this is right..

Its shocking to hear.I have been using Electrum wallet for the past two years.I have not encountered such issues till now.Electrum wallet was the best of its kind.

May be your private keys would have been stolen by any malware or else,there is no such chance of happening.

Or your bitcoin transaction from cryptopay would not have got confirmed and so,it would have returned to cryptopay's security wallet itself.

You would have to make it clear that whether you saw thebtc which cryptopay has sent you showed in electrum wallet as unconfirmed or verified.

That would make a big difference.

Just received an email from Cryptopay. My query has been forwarded to their Tech Team and they will get back to me once they have investigated the issue..

Hi fanbeila, there was a green tick next to the listed transction. I assumed that meant funds were verified?

I posted a screenshot at https://falcone73.imgur.com/all/?third_party=1

I really think you have given the new receiving address and not the old one

This is not right falcone, Goto imgur and then first click the new post then upload the image, when the image is uploaded right click the mouse then left click "copy image address" then paste it here.

https://i.imgur.com/YVG4t6s.jpg

https://i.imgur.com/gngVthD.png

https://i.imgur.com/mXCFnTt.jpg

Hope it's right now

I think you'll find the OP has posted the incorrect Electrum address (1MREVrSRXyFbnbt4c6X5YdqDHQnFJHnW7Q) and the incorrect Cryptopay address (3EL14BoZCDXBmV65uCGAawXAZZxvnvZwN7)... Probably because they've gone to the "receive" tabs in both apps and been given new "unused" addresses.

For the record, as previously stated, the TransactionID for the outgoing transaction from OPs Electrum wallet was:
 029f70aaeb6d99cd4b9cd3d53f28667e77b2cc109b84a70bcea037b428cce9c2 (https://blockchain.info/tx/029f70aaeb6d99cd4b9cd3d53f28667e77b2cc109b84a70bcea037b428cce9c2)

This transaction, shows the 0.0165 going from OPs address
113Eab3eyWW4wfdpeZ3rNgD2gLWtDU84Gr to 13y2Ct6ee6E7s6y7qK9z798oktVfb1jJ1R (thief's address?)

The original 0.0165 came from: 36TEeqDrHnMFz9izKjgJipquvooJ7iTDa7 in transaction:
 7d13233cfbc4aaeb56c3b3eed1b46a970acea00750fbeb2b93e9b731c10acc5c (https://blockchain.info/tx/7d13233cfbc4aaeb56c3b3eed1b46a970acea00750fbeb2b93e9b731c10acc5c)

As for how this happened, the OPs computer is most probably compromised... Either the wallet+password got stolen or the seed and/or private key was exposed (exported and/or stored digitally?)...

Perhaps the OP downloaded one of the fake Electrums? Did you download from https://electrum.org/#download ? ???

https://i.imgur.com/YVG4t6s.jpg

My friend,both the transactions have been verified and confirmed.

Hi HCP and ladydark

Thank you for your replies.

HCP - Yes I did download from https://electrum.org/#download From that page I downloaded the Windows Standalone Executable and immediately installed it. I had at first copied the seed only to a Word document. I would estimate that after an hour or so I wrote it down on a piece of paper and put it in a safe place. I also then deleted the word document.

ladydark - am waiting on Cryptopay to get back to me. They said they would investigate from their side to try and establish what happened. They at least agree that the balance on blockchain and balance in Cryptowallet is different and will try and establish the reason..

Well, it's possible that by storing your seed in digital form on your PC that it has been compromised. Seeds and private keys should never be stored digitally unless they are encrypted and even then only if proper precautions are put in place to ensure no 3rd party access is possible.

It is possible to recover deleted files... But that's some serious hacking effort for 0.0165 BTC... Even with the huge increase in BTC value... That's only ~$120.

The address the coins were sent to has collected some 1.57+ BTC so far... But the address doesn't seem to show up in any other "my coins have been stolen" threads that I can see...

In any case, the only way for that outgoing transaction to have occurred (if you didn't send it), is that someone has access to the private key for the 113E address.

Do you have TeamViewer or any other remote access software installed?

Hi HTC

No, I do not have TeamViewer or any other remote software installed.

I think someone really accessed your computer/laptop and used it to send the Bitcoin, but you should ask cryptopay to investigate about this matter. That's the only thing i can say for now, You should keep an eye on these keep sending follow ups to cryptopay technical.

Someone have your passphrase or your computer was hacked. Sorry for your loss

I will definitely keep pestering Cryptopay until I get a satisfactory answer.. Thanks guys..

Hi, Can someone please tell me if I am reading the attached file correctly. It is a screenshot of the blockchain explorer at bitaps.com

From what I can see my understanding is that on the blockchain my Balance is 0.10993723 BTC. However on Cryptopay my balance is 0.0929 BTC.

On the blockchain there is a transaction of 0.0170000 BTC which I assume was sent to my Cryptopay wallet. That balance however is the one that is not reflected in my Cryptopay wallet.

Can I assume that the 0.017000 was sent to Cryptopay but it is not reflecting in Cryptopay yet? I'm assuming this because all the transactions on the blockchain are related to my Cryptopay wallet. My Cryptopay wallet address is 3EL14BoZCDXBmV65uCGAawXAZZxvnvZwN7

https://i.imgur.com/774j7OT.jpg

Your assumption seems correct.

The final balance of 3EL14BoZCDXBmV65uCGAawXAZZxvnvZwN7 is 0.10993723 BTC.

The Cryptopay balance of 0.0929 BTC fits the transaction of November 2nd.

The two transactions of 0.0038 BTC in and out, sent on August 23rd and September 8th respectively, cancel each other out.

Which leaves 0.017 BTC sent on October 27nd unaccounted for.


Got any response from Cryptopay so far?

Hi HeRetiK

Thanks for the response. The last response from Cryptopay was yesterday when the Support lady informed me that she does see the outstanding amount on the blockchain. I had sent her a screenshot too. She said she would forward my issue to their Tech Team and would get back to me as soon as they have let her know what is going on. That was late yesterday afternoon. Now being the weekend I think I will probably only hear from them again on Monday. If I have not heard from Cryptopay by mid afternoon I will contact them again.

Will update as soon as I have an outcome.

Received the following response from Cryptopay:

I have received an answer from the Tech Team. Please be informed that the total balance of the BTC address in Blockchain is a sum of all transactions (input and output). It can't match with the balance of your Cryptopay wallet. It's another amount.
Please contact the Support Team of your Electrum wallet regarding this issue. They should find the address your funds were sent to.

Not sure I understand exactly what they are saying

They're claiming that the balances displayed on Blockchain.info (and other block explorers) don't show your account balance... I suspect this is because they're doing weird accounting and moving BTC around after they credit your account on their system.

If you look at blockchain.info (https://blockchain.info/address/3EL14BoZCDXBmV65uCGAawXAZZxvnvZwN7), you see: Total Balance (which is the sum of ALL Bitcoin that have ever been received to that address) and the Final Balance (which is what the CURRENT balance of the address is at this moment in time).

"Your" address: 3EL14BoZCDXBmV65uCGAawXAZZxvnvZwN7 (https://blockchain.info/address/3EL14BoZCDXBmV65uCGAawXAZZxvnvZwN7) is currently showing:

Total Balance = 0.11373723 BTC
Final Balance = 0.10993723 BTC

That "Final Balance" is made up of 0.017 from this transaction (https://blockchain.info/tx/bc6f3b0130a22f74d2a0a36ebaecf6a4c2ad4300ea8122621996c0e323090801) and 0.09293823 from this transaction (https://blockchain.info/tx/547e9e175456e656db4ab5e5710b5c178ab2ff1b120d914c3f8bc4e249c60bf0).

Therefore, the amount in your wallet *should* be 0.10993723, unless CryptoPay is doing something retarded like re-using deposit addresses for multiple accounts and simply tracking payments using their own database, which I suspect is what is happening... as the funds that you sent to your Electrum wallet originally where sent from address: 36TEeqDrHnMFz9izKjgJipquvooJ7iTDa7 in this transaction (https://blockchain.info/tx/7d13233cfbc4aaeb56c3b3eed1b46a970acea00750fbeb2b93e9b731c10acc5c)... so I'm guessing that you cannot rely on the balances that are being displayed by blockchain.info for your deposit addresses, as CryptoPay are doing weird, confusing things.

At the end of the day... I still think you are chasing the wrong thing... you sent coins from CryptoPay to Electrum (https://blockchain.info/tx/7d13233cfbc4aaeb56c3b3eed1b46a970acea00750fbeb2b93e9b731c10acc5c), they showed up in Electrum wallet... and then they got sent from Electrum wallet somewhere else (https://blockchain.info/tx/029f70aaeb6d99cd4b9cd3d53f28667e77b2cc109b84a70bcea037b428cce9c2)... so it would appear they have been stolen due to your Electrum wallet being compromised, not lost within CryptoPay's weird accounting system.

AFter reading the full conversation it is clear that your electrum wallet is compromised and their is something problem with you computer or electrum wallet downloaded file. So it is much better that if you want to use electrum wallet then just download a new copy and just move on with it. What ever lost it just think that you have learnt a lesson of not properly using the downloaded file. So better just format your system and reinstall the operating system and then download again the electrum software and reinstall it and use it .

Many thanks HCP and equator. I have now written it off and moving on.