Bitcoin Forum

Hello,

I'm a newbie on BTC world. About 1 year ago i bought a small quantity (~ 0.033) just to learn more about it.

Somedays ago i decided to sell it and get the money back. I used Electrum to send the BTC to the address below :

33gpwt9uSxf6vh5Cw1osfmJ8HN18Y6ciyy

I'm pretty sure i typed the correct address (actually i pasted it), as i'm not a computer noob. But the BTC never reached this address and somehow Electrum shows another address on its log :

3CqJDvCfA7AAtzbPDyWE1jby1uxTzzeGHH

I'm on a Mac, and my machine probably is not infected with any viruses, i suppose.

Here is the transaction ID :

20d0c70d9e88b1e774b91bc1766dd41e4858e6ff42222186347e7ba5b00bb9ef

Am i scammed ? How can i track what happened ?

Thanks

I'm really not sure here, but from your description, it looks like the type of malware that replaces your pasted addresses with the hacker's wallet address. What wallet were you using in the first place by the way? We're going to need a bit more information.

I always used Electrum, the BTC was there since i bought it, last year.

You should try now and copy the bitcoin address and after paste the bitcoin address here to see if it is changed and infected with malware or you already reinstall OS? And on what exchange you send the bitcoin?

On the transaction id you posted the bitcoin is already sent to another address

https://www.blockchain.com/btc/address/1Az15AVnmEupwyisso8Qok8NUEG1kaPbBz

You buy and withdraw all 0.033 bitcoin at once?

Yup, 33gpwt9uSxf6vh5Cw1osfmJ8HN18Y6ciyy was never used.
The rest is a bit messy.


Where is it showing this? Because:

3CqJDvCfA7AAtzbPDyWE1jby1uxTzzeGHH
actually sent a tx worth 0.031 , exactly
20d0c70d9e88b1e774b91bc1766dd41e4858e6ff42222186347e7ba5b00bb9ef

Do you have any info about:
1Az15AVnmEupwyisso8Qok8NUEG1kaPbBz (https://www.blockchain.com/en/btc/tx/20d0c70d9e88b1e774b91bc1766dd41e4858e6ff42222186347e7ba5b00bb9ef)

seems like there's only two possibilities? 1) you copied the wrong adress 2) malware
the adress is unused from before. where did you copy the first one from anyway?

Check your computer for malware using software like malwarebytes(if it's available for Mac) or some anti-virus program.
Most likely you have sent the coins to another address.

I already tried it, when i paste the correct address, it remains correct on Electrum interface.

I sent the BTC to a brazilian company called Mercado Bitcoin, it's one of the main players of this business in Brazil.

They claim they did not receive the BTC and indeed the address Electrum shows in the log is another...

Hey  look may be its copy paste problem.. but you should  first  your computer. DO you install any antivirus?  Because  sometimes some antivirus softwares are also scam and  they may damage  your files.. so be careful..

I don't have any AV software on my machine.

Is the Electrum app trustable ? I downloaded from https://electrum.org/#home

Yes. As long as you've indeed downloaded the software, and installed the correct, and untampered installer. I'm still leaning towards malware here, assuming you're 101% sure that it isn't a copy-paste error. While Mac's are a lot less prone to viruses compared to Windows devices, it still ain't impossible.

What could i use to check my Mac for this kind of malware ?

At any point did Electrum ask you to update? There have been cases of hackers sending update messages through Electrum and if users follow it they install a compromised version.

https://cryptopotato.com/electrum-wallet-hacked-over-900k-got-stolen-in-a-phishing-attack/

Likely you got scam, (sorry for that). I am suspecting your keyboard was hacked (under control of hackers) during transaction of bitcoin from your wallet. During copy or paste you have done mistake unconsciously. That's why always need double check address when you are going to send bitcoin. Bitcoin should not go to wrong address if it wasn't hacked. Yea, you lost it forever since crypto-currency irreversible.

First this transaction has been processed upon checking the given transaction ID.
https://www.blockchain.com/btc/tx/20d0c70d9e88b1e774b91bc1766dd41e4858e6ff42222186347e7ba5b00bb9ef

But the destination address seems different from the given above address on OP.
https://www.blockchain.com/btc/address/1Az15AVnmEupwyisso8Qok8NUEG1kaPbBz

This wallet got the 2 transactions totally you can check there and my words and thought on this. Believe YOU GOT SCAMMED because of wallet or keyboard hacking.

He seem firmed that he pasted the correct address, I'm also suspecting that he's a victim of that typical malware of changing the bitcoin address after copy pasting it.

If not, someone prolly knows his seed and logged in, then sent it to that stealers address.

Looks like there is one answer from other users that keeps on popping.
You made a mistake or a virus.
Now, you said it was just a small amount and I doubt you can get it back.
So get over it and start like a brand new buyer.
Clean up your MAC with any probable applications that might be the culprit for what happened.
Because I doubt it is Electrum behind it. I have been using that for quite some time before and didnt have any problem even once.

There are two ways that everyone is thinking of the style on how his bitcoins got by another person. And that's the two things that I've mentioned and others earlier.

I forgot that it can also be a mistake on his part that he might input the seed to a kind of form or sheet that the hacker has full control of that ended the hacker to gain access to his seed.

It looks likes your system has been infected which is often the case when a address you paste suddenly changes post sending, since you’re not using antivirus I would recommend using it. Also what version of Electrum Desktop wallet are you using, cause Electrum had asked it users to update it’s wallet to latest version from it’s official site post the hack. The coins you have send are lost forever, it’s sad but you need to learn from this and take precautions for next time.

Links:

https://hackernoon.com/10-tricks-hackers-use-to-hack-your-cryptos-82fc8a0a1bfe

https://cointelegraph.com/news/phishing-attack-on-electrum-wallet-nets-hacker-almost-1-million-in-hours-report

Are you sure you had downloaded Electrum from a genuine source? It might also be that you had downloaded an infected version of Electrum which changed the address by itself when sending bitcoins.
Also if this is not the case then the most probable scenarios are either your pc was infected with copy paste malware or you had pasted a wronf address by yourself which I don't think you would have done.
If possible post the source from where you had downloaded the Electrum wallet.

Then there is a great chance that it was a malware or a virus.
It is not new in crypto currency there are plenty of incidents like this.
You should really make sure that your computer or gadget that you are using for crypto transactions are always safe .

What makes you think Macs are safe? Apple? Ask them to refund your lost bitcoins and see how well it goes...

No, if you wanted to be safe, you should have booted with a live Linux distro. This has all the signs and tells of a typical address replacing malware.

Also, you could have used the preview button to double check, and triple check you were pasting the correct address in case it was a genuine mistake.

I still don't know what happened. I downloaded Electrum from it's official site and i'm sure i pasted the correct address. The most likely situation i can think is a downloaded an infected Electrum app from its official site. I'm not a newbie in computers, actually i'm a software developer with more then 20 years of experience.

That's a very bad experience. I lost all trust on this and will never more buy BTCs, better leave my money on the usual investments :p

No don't call the above posted number OP. Electrum doesn't have a help desk. No idea what service that is for. The user who posted the number - Gloria4u has negative trust so be cautious.

I highly doubt that... especially if you can verify the digital signature... did you verify the digital signature (https://bitcoinelectrum.com/how-to-verify-your-electrum-download/)? ???

Given that you're "a software developer with more than 20 years experience", verifying the digital signature shouldn't take you more than a few minutes.

Such statements and questions do not reflect a person who has 20 years of experience in software developing. Although some claim that using of antivirus / firewall / antimalware is useless, someone like you should know that this is not the case.

If you are 100% sure that you download from official site, then you are victim of probably clipboard malware which change recipient's address. But since you have completely unprotected device, there are other possibilities how hacker can get in your device, maybe you have remote access trojan.