Bitcoin Forum

Hello,

I just did a transaction using my Electrum wallet and I believe I may have been a victim of stolen Bitcoins and if so, this isn't the first time its happened as I've done hundreds of other transactions in the past with Electrum. Anyway, I am using their desktop version (3.0.5) with 2FA and a password generated by a bcrypt password generator which is impossible for anyone to get a hold of. Anyway, below is the information I am in question about:

TX ID https://blockchain.info/tx/5296267a73bf273ee5f5d8d1402921b7158f2efdf3182110eeac3e6bd676fdc8

I used Electrum's "Max" option to send everything I had available in my balance plus being able to cover the fee which was a total of $13 and change meaning the receiver would be getting $12.86 as shown in the transaction. However, after 6 confirmations, the receiver is indicating he only received $6 of the $12.86. Checking the transaction information, I noticed the missing amount was sent to another address which I did not send to. I checked my "changed addresses" to see if it was mine and all of mine begin with a '3'. I did check the "Replaceable" option when sending the Bitcoin and also have the setting "Propose Replace-By-Fee."

His address I sent to: 1MWye3qBQr61UxNZ4VEn5ctb5sDwSRZoCi

Random address missing amount was sent to: 1Nz91fvCf483rZfCAbpDq3KUqoDfxTxDNr

Electrum shows the transaction is done and has gone through and so does Blockchain.

Can someone please explain what happened here?

Thanks!

It's unlikely an attacker wouldn't steal all funds, but would leave half.

In my opinion, the most likely scenario would be a mistake made by you: somehow you sent 0.001BTC to 1Nz91fvCf483rZfCAbpDq3KUqoDfxTxDNr, and the remainder of your balance to 1MWye3qBQr61UxNZ4VEn5ctb5sDwSRZoCi. How this happened and where the unknown address came from, I can't tell you.

Update: ranochigo's scenario is more likely.

Your coin was probably not stolen. If you're using 2FA in Electrum, extra charges could be incurred. Electrum relies on a third party TrustedCoin for them to provide the 2FA for them. Costs are incurred for every transaction to cover their server costs. See: https://api.trustedcoin.com/#/electrum-help.

As long as you're getting the codes from them, your transactions would cost extra to make. If you want to remove the fee completely, you can restore from seed. IMO, the 2FA isn't worth it, considering that it is paid.

As ranochigo has explained, this is because you decided to use 2FA.

TrustedCoin (the 2FA service) requires you to pre-pay a fee for future transactions.  If you are configured to pre-pay for the next 20 transactions, then they charge a fee of 0.00005 BTC PER transaction for a total fee of 0.001 BTC.  You had used up all your pre-paid transactions, so when you tried to send this transaction and it was submitted to them for signing, TrustedCoin subtracted out the 0.001 BTC fee for the next 20 transactions that you will send in the future.

TrustedCoin offers a discount if you to pre-pay for the next 100 transactions 0.000025 BTC PER transaction for a total fee of 0.0025 BTC (total fee is higher, but you don't need to pay again for the next 100 transactions, so fee per transaction is lower)

Note:
2FA does NOT protect you if someone else gains access to your Electrum seed (since that person could just restore without 2FA).