Bitcoin Forum

Good day. I am sorry, I know English badly. I will try to tell you through the translator. Yesterday, all of my 0.24 btc coins were stolen from my wallet. I saved them for so long, I wanted to go on vacation with children, and now everything. I am in complete despair, I do not know what to do. How can I return the coins?
I had this program for a long time, a separate computer on OS Mac. I don't even work on it.
I had only a password, but friends of my friends said that it was necessary to have a 2FA wallet. Now I understand that it was necessary to update the new file with 2FA protection.
How can I return the coins ??? ((((((((

http://prntscr.com/nrpm7k

Sorry to be the barer of bad news, but if somebody stole your funds, they are gone...

As soon as the thief's transaction is confirmed, the odds of recovering your funds are ~0, that's the way the bitcoin protocol was built... It's trustless and immutable, there is no central bank that can roll back transactions... Sorry.

Best you can do is find out how you were robbed.

• Are you sure you're running an official version? Loads of fake electrum versions are floating around
• Are you running the latest version?
• Is your PC 100% spyware free?
• Are you sure the seed phrase isn't stored online?
• Are you sure nobody has physical access to the seed phrase
• Is your wallet password encrypted? Strong password?

Personally, i don't use 2FA on my electrum wallet. I find it expensive (since it's a paying thirth party plugin AFAIK... I have never used it so i have no experience).

Horrible((((
I forgot to say one more thing. Yesterday I installed the program from the official website 3.3.6. Prior to this, the old version was installed.

Aaah, this might be the cause... Did you check ThomasV's signature? A lot of fake electrum download sites are floating around. They try to make you download fake electrum versions that are built for stealing funds.

As I wrote. I have a computer on the MAC and used it only on it. Here are just one made put a new version. Here is this site https://electrum.org/#download
How could they steal ??? I really don't understand.
Already, developers began to suspect on this  :'( :'( :'(

Are you 100% certain you downloaded the binary from the link you posted?
Eventough there is no chance of recovering your funds, i'd still advise you to find out what went wrong in order to make sure your mac isn't infected. Do you still have the dmg file on your mac? If so, do you know how to check a signature or do we have to talk you trough this?

There are several attack vectors:

• Very old electrum versions (maybe the one you used to run before yesterday) used to have a vulnerability that allowed a thief to steal from a running electrum binary as long as the wallet was unencrypted
• You could have downloaded a fake electrum version that was programmed to immediately send all your funds to an attacker, or maybe send the xprv by a call-home function
• Your mac might be infected with a virus/backdoor/keylogger
• Somebody might have gotten their hands on your seed or an unencrypted wallet file

I've seen loads of people lose funds due to the use of several different wallets... In electrum's case, i've never had any reason to think the actual dev's (ThomasV) involvement. ThomasV is a public figure, he is known by his real name and has been a member of this community for a long time. All code he writes is open source and should be community vetted. He doesn't even compile all sourcecode for all os's by himself.

Здapoвa! У мeня тoжe пpoпaли дeньги, я этoгo ищy bc1qcla39fm0q8ka8th8ttpq0yxla30r430m4hgu3x , +0.00188394 btc, a y тeбя нa кaкoй кoшeлeк oтпpaвилиcь??

Google translator
Hey Ya! I also lost money, I'm looking for this bc1qcla39fm0q8ka8th8ttpq0yxla30r430m4hgu3x, +0.00188394 btc, and which wallet did you have ??

yurij25, OP case is about Electrum wallet, this is a reason why is it posted here. In this case, but also in your case bitcoin is almost completely lost. When I say almost, this is mean that you and OP can get your coins back only if this hacker is arrested, coins seized and you to be able to prove that you are one of the victims.

The address you are posted is currently empty, but in 2 months this hacker is move 258 BTC through this address. This is not small amount in fiat value ($1.3 million), so I suggest you to try start some action in order to find as many victims of this hacker with the aim of launching an international investigation.

You can start from here, one more user is report same bitcoin address : https://bitcointalk.org/index.php?topic=5129118.0

This is English board, please use english Language instead.
You can't return you fund, I thing you downloaded Electrum phising site before when seed know by hacker, 2fa are useless on this case.
you don't tell exact time when it's gone. I things not yesterday when you open electrum wallet.

Димoн пoчeмy нeт, мoжнo вepнyть эти дeньги чepeз pacчeтныe кoмпaнии BTC, Блoкчeйн, oни жe зaнимaютcя пepeвoдaми! B любoм cлyчae oни мoгyт зaблoкиpoвaть кoшeлeк и вepнyть дeньги влaдeльцy нa ocнoвaнии дoкaзaтeльcтв. Cкpиншoты этo дoкaзaтeльcтвo мeждy влaдeльцeм дeнeг и cpaнным мoшeнникoм!!!!!!

Google translator
Dimon why not, you can get this money back through the BTC settlement companies, Blockchain, they are also engaged in translations! In any case, they can block the wallet and return the money to the owner on the basis of evidence. The screenshots are proof between the owner of the money and the shameful scam !!!!!!

Blockchain (the company) does NOT have the power to block wallets or return funds... This is not how bitcoin works.
The best blockchain can do is reimburse you with blockchain's money... But they won't do this unless maybe if you have a strong case that it was blockchain's fault you lost your funds due to a vulnerability on their end... Maybe they can technically block the attacker's ip from using their wallet, but the funds would still be lost.

Only a centralised exchange/wallet that does not give you access to your own private keys can roll back INTERNAL transactions (transactions between two wallets from the same centralised provider)

Hello. Such cases: I decided to cash my btc (my address is 1JLavuCEKfhXMmWiDHjZzfAUcrca5XK3sS). There are not many of them (0.00284581), but all mine honestly earned on cranes. I use the official electrum wallet, and when I tried to withdraw, I got an error "update for better security", the link led to the official website, so it was updated without a doubt. Next, I launched a fresh wallet, but  framed another scammers address similar to mine (1LVEsHyEGnpxG8yrcpREWfHoxA6xjoMt3r) and all my satoshi went there. On the transition (14f456e9e3c02b63673ce31b21eaa12c0e06ae789b9209b311b362bf21451557) I saw that the movements are active, which means they will still be deceived. I understand that there's nothing to be done, just sharing information.  As it turned out, the download link led to the scam site - ( electrumstart(point)net/#download ).  Be vigilant!  

P.S
FORGIVE FOR MY ENGLISH, WRITING THROUGH TRANSLATOR.

You've been hacked if you installed the phishing link from the popup window to update the latest Electrum.
You can not recover them back you installed a fake Electrum wallet.

The original URL is electrum.org, not electrumstart or something.

Much better to uninstall the wallet or install a clean OS again before you install a new Electrum wallet.

There is no other way to reverse them bitcoin is not the same as paypal.

Чтo ты имeeшь ввидy цeнтpaлизoвaнный oбмeн/кoшeлeк, этo кoшeлeк или кaкoй-тo caйт??

Google translator
What do you mean centralized exchange / wallet, is it a wallet or some website ??

Centralized exchanges like Binance or Coinbase(As sample) if you have these wallets you don't have access to your private keys where you can import the wallet to another wallet like Electrum or Bitcoin-qt and see all transaction records.

Яcнo я oтпpaвлял c кoшeлькa Electrum из-зa eгo мoбильнocти, нo бeзoпacнocть y нeгo пpocтaя!!!!!

Google translator
Clearly, I sent from the Electrum wallet because of its mobility, but its security is simple !!!!!

What do you mean by security is simple?

If you installed the fake Electrum from a phishing site it is not their fault there are times that wallet can be hack in some ways or tactics. That is why we always need to learn how to protect our wallet for any malicious software or website.

Does it look like you can't accept your lose?

@yurij25
It was explained to you in the past that bitcoin transactions can't be reversed and you keep suggesting how it is possible. Once a transaction is confirmed on the blockchain that is it. The only person that can send it back is the person in control of the private keys for that address.

It is not Electrum's fault that you installed a fake wallet. You were simply not careful and fell for the tricks of a scammer. It is sad but it happens. Learn from the mistake and accept the facts how they are in order to improve the safety of your funds.

google translate
 I can not agree with you.
It was in the official wallet (!) That the message was updated. Naturally, the address of the site was not indicated, I later extracted it from the history. The task of developers to close such vulnerabilities. The notification probably came from the block check servers, and who monitors and checks them. What work has been done to inform users about the existence of such vulnerabilities and to combat it. There is a fake site address, someone is paying for hosting and domain, maybe there is a chance to identify the perpetrators or at least their geography. There is a transcription address, following the block chain you can set the approximate damage and the scale of fraud. Unfortunately, most users do not have the knowledge and capabilities. This is a problem for both users and developers, and we need to fight it together!

The problems have already been rectified. Since version 3.3.3. Electrum no longer shows any messages to users and if you are using a version older than 3.3.3. you can no longer connect to Electrum servers!

They have also warned users about the phishing messages on their github but the problems is that people don't read these or any other instructions until it is too late.


Read this: https://github.com/spesmilo/electrum/issues/4968

You can't, you were a victim of fraud. The message you saw was a trap sent by phishers and you downloaded and installed a fake wallet to steal your coins.

Never trust the internet, or your computer, especially with money or privacy. Double check first if its true or you are getting lied.

Internet is not a safe playground, it is dangerous, VERY dangerous. Apple is not going to protect you either, do not trust companies.

Your money is lost. Some people have lost millions, because they did not took due precautions, they didn't double/triple check before touching the software, or made sure to use a secure computer with a secure OS to handle large amounts of money.

In Bitcoin, all transactions are final.

---

This is false. Translate this:

In Bitcoin, all transactions are final.

---

There is a warning in the official Electrum page since version 3.3.3. This is not an attack to Electrum, but against users. Electrum cannot stop thieves from convincing you to download their fake software, if you do not put the smallest effort to investigate things BEFORE bad things happen. Electrum cannot police the world. This is not Electrum fault.

Of course a collective effort could be made to report such incidents, and exchanges or online services might agree to help freeze the funds if the thieves try to use their service.

You are not the only one, many people fall pray by internet thieves, because they exploit the weak human nature when the software is good.


This is the same as if you are going to the bank with your money to make a deposit, but the street is blocked because someone parked a large truck in the way. While you are waiting, an unknown person approaches you, shows you a Bank card and informs you he represents the bank, that you could trust your money to him. AND you decide to hand over your money, thinking he is honest. Then you never see your money or the individual ever again.

This is what a phisher does.


How are we going to stop people in the world to stop falling to the tricks of phishers? We try and try to warn people, but there are millions who never bother until its too late.

B кaкoй кoмпaнии paбoтaют эти peбятa кoтopыe кoнтpoлиpyют зaкpытыe ключи??

Google translator
In which company do these guys work who control the private keys ??

One of the bitcoin slogans is "be your own bank"...
YOU should controll your OWN private keys... If you fall for a scam there is NO central bank you can complain to, there should be nobody controlling your keys but yourself.
There are a couple online wallets, but if you use them you are trusting them instead of yourself.

In your case, the only one you can actually blame is the scammer who took your money... You can (and should) go to the police, but you should realise they cannot give your money back and they can not force anybody to give you your money back... No central authority and confirmed transactions are virtually irreplaceable (unless you own billions of dollars worth of asic's)

there are no company. bitcoin isn't a company.

There is no company or institution controlling Bitcoins or your private keys.
Only you and the people who know your private keys can move them from the associated addresses. Electrum doesn't know your keys either.
You have to understand that Bitcoin is not like your bank. Someone can't just block your bitcoin wallet or take your bitcoins from you.  

Maybe you should show us where the heck is this “infected” code. After all, everything is freaking public. You know that, right? I’m still waiting for your virus proof in the other thread btw. ;)

He's telling the truth, They are infecting people by the mass... I have proof I'm compiling it all now... I've spent the last hour removing it from my main PC

Sure  ::)

Maybe you should stop blaming other and admit that you downloaded a fake version  ::)

You can't even properly download the correct version, but have proof that the original electrum is malicious. Sure.  ::)




Then you're doing something wrong  ;D

Check the signature of the wallet you downloaded and compare with what it should be. You will notice that you most likely have a fake wallet.
You can find instructions how the verify the signatures on the download page on the official site.

Here is ThomasV's signature:
https://raw.githubusercontent.com/spesmilo/electrum/master/pubkeys/ThomasV.asc

i am pretty sure he has downloaded like me the fake version of electrum wallet from GitHub .. and thats how lost funds .i have myself a big lost, but to say truth i am pretty sure admins or workers from electrum wallet behind .. because i got a window to download wallet directly in wallet ! .

funds are gone for sure ...

No... It wasn't the "admins or workers". Unfortunately there was a "bug" in the Electrum code that meant that a "bad" server could return any message it liked to a client and include links. Scammers found the bug and then exploited it to send phishing messages advertising the fake versions from fake github sites :-\ This bug was then patched to prevent the phishing messages from being displayed.

Refer: https://github.com/spesmilo/electrum/issues/4968


Unfortunately, yes... that much is certain :(