Bitcoin Forum

Help to deal with the problem: I'd like to understand what happened - theft BTC or system error.
On the purse was the amount 12,89 BTC. When opening the wallet has failed, in which the wallet started synchronizing with the first block. After synchronization is complete, the balance of the purse 0,0009 BTC, there are two transactions, which I did not commit, to unknown address 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8т on the amount 12.8 BTC and 0,098 BTC.
How to determine: whether this address is the address of my wallet and not visible due to a system error, or the theft occurred, and this address belongs to a thief?
If this is a bug, what can I do to return BTC?

Do you have a backup of the wallet or private keys? Then you can see if the address was there.

Can you verify the address? It does not appear valid - and blockexplorer.com and blockchain.info agree it is not valid.

https://blockchain.info/address/1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t this is valid. If 1MbDk... is the unknown address you don't own, then you cannot do anything other than finding out how the hack might happenen.

At the end of the address is not allowed character for bitcoin address.

You might start bitcoin-qt with -rescan parameter to check for right ballance again

Correct. And you might as well give us the txid, so that we can check.

Sorry, address is 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t
ID af27d89fe3aacb6ac0721571ab1c3fc432696094d2984de35b949c72b7b8c135-000

Which is your address?

I dont understand how to find my address...
Unknown address is 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t
Start with parametr -rescan: without result, balance 0 BTC

You only had 3.47024406BTC in 1LWt1egbCEtjpKebNJLWzw2ztHfzo7qGfo.
Are these addresses also yours?
1ByxEhE82qZxABhtsaj3yDJoJ26LV1YNF5
1ErU6w2UkWrnWLt91YRzGTgFmBAC3LZ3EY
1LN9Zi1nWpNDnRHyJ2UacZdCtiVp3n2UrG

http://s019.radikal.ru/i616/1405/2b/e60dc9ba7aeb.png
I'm confused addresses... How can I determine my address?

Go to the third tab, or "Receiving" tab, and post a screenshot.

Did you ever delete your wallet.dat or did you reinstall Bitcoin Core?

wallet.dat - from backup
Yes, Bitcoin core - new, v0.9.1.0-g026a939-beta (64-bit)

Try importing your wallet.dat again...
You currently don't control 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t.

I have 4  backups from different dates. I tried another backup from other date... Result (transactions status - conflicted, and no mine):
http://s020.radikal.ru/i706/1405/cb/c4f69e284512.png
Balance - 0, starting with -rescan key

So did you got your funds back?

No he hasn't. I'm trying to help him.

Heathcliff, try all the backups and see if you have 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t in them.

One moment... Now I will try

Tested all the backup, the result is the same. The address does not appear anywhere
It seems to me that the problem arose after upgrading the bitcoin-core from version 0.9.0 to version 0.9.1. What do you think, does it make sense to try to download the older version?

No, it makes no difference. What is the last transaction you did? And I mean you.

My last transaction:

Cтaтyc: 197 пoдтвepждeний
Дaтa: 10.05.2014 14:05
Для: 178cXz5JiZenB8HRfMsdUvB3kRbjziopfA
Дeбeт: -0.0008 BTC
Кoмиccия: -0.0001 BTC
Чиcтaя cyммa: -0.0009 BTC
ID тpaнзaкции: e3cff66b3f64cdb44b1b934ba7e06d68b2bf191441581e4e4f48258451edfe21-000

I brought up the balances on my other purse

Were these addresses also yours?
1ByxEhE82qZxABhtsaj3yDJoJ26LV1YNF5
1ErU6w2UkWrnWLt91YRzGTgFmBAC3LZ3EY
1LN9Zi1nWpNDnRHyJ2UacZdCtiVp3n2UrG

This problem happened too much recently and im afraid to say your BTC gto stolen. im not sure but good luck

These addresses are not mine, I received BTC from 1ByxEhE82qZxABhtsaj3yDJoJ26LV1YNF5 and 1LN9Zi1nWpNDnRHyJ2UacZdCtiVp3n2UrG

I have no idea how that happened then. I was guessing that it was just a change address, but it isn't. PM DannyHamilton, he can help.

byt411,
Thank you very much for Your help and time!

By the way, is your wallet encrypted?

I suspect that you have been hacked and the bitcoins are stolen and gone.  If I'm correct, then the thief seems to also control the following addresses:

1BcVNE8cYrHz6B6ECnJTgArTTTzzPw6tHw (where he received 0.1 BTC from 1KjGrZXG25UTHUFVdPJMEQFEqMsvyAsaie on 2014-05-07 15:34 UTC)

1LXFmDPtQmBHSVoQLSP17xU8Fztd75yusR (where he received 0.02026933 BTC on 2014-05-07 15:33 UTC)

1HJD4K4C2GwBLkARjQwqsdyaFbRVFu1jgc (this the the final address that your bitcoins were sent to.  They were held in 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t for 3 days from 2014-05-08 10:35 UTC until 2014-05-11 13:58 UTC when they were transferred to this address along with the 0.12026933 BTC from the other two addresses)

Please load up the original wallet (the one that has the two transactions that made your bitcoins disappear).

Then in the "Help" menu, choose "Debug Window".

In the "Debug Window", choose "Console".

Then enter the following four commands:


I believe that you'll find that the first three commands will return:

"isvalid" : true

and

"ismine" : true

The last one will almost certainly return

"ismine" : false

If so, and if you did not intentionally send to 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t then a thief gained access to the private keys in your wallet.  Did you protect your wallet with a strong password?

18:53:12

validateaddress 1Cy21mnkUMvZdJW4rDe7Z5ey9sbcZhzzfL


18:53:12

{
"isvalid" : true,
"address" : "1Cy21mnkUMvZdJW4rDe7Z5ey9sbcZhzzfL",
"ismine" : true,
"isscript" : false,
"pubkey" : "028ac26a7c31b1cbcecd5b9db3912181501f72e43baea4eb831e4e0cb24824b438",
"iscompressed" : true
}


18:54:40

validateaddress 1FYS8yVDbGxaz8xkBsb53TQQ1jPrcYC17y


18:54:40

{
"isvalid" : true,
"address" : "1FYS8yVDbGxaz8xkBsb53TQQ1jPrcYC17y",
"ismine" : true,
"isscript" : false,
"pubkey" : "0251cb9e2c6d7036df4f172df0793cc9c618b7d036833eea115db4ceb3861a7ae9",
"iscompressed" : true
}


18:54:54

validateaddress 1GJ5Yy7SjDo1Bjgtqr4tPhGTu3Kz9mfkZ5


18:54:54

{
"isvalid" : true,
"address" : "1GJ5Yy7SjDo1Bjgtqr4tPhGTu3Kz9mfkZ5",
"ismine" : true,
"isscript" : false,
"pubkey" : "02008283a25965c101eae73044bc6b919f1623055464d225a6890f1cabdaefb701",
"iscompressed" : true
}


18:55:11

validateaddress 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t


18:55:11

{
"isvalid" : true,
"address" : "1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t",
"ismine" : false
}

The password is very complex (13 characters, including letters of different case, numbers and symbols). The password is not repeated anywhere, is used only in the wallet

That is valid, the original one shows as:


Which is not valid.


I suspect that you've been hacked too.

So I assume it was a keylogger? I searched google and heathcliff posted on a russian forum that his wallet was encrypted with a password of 12 characters or something.

Yes!
On the Russian forum is the message " пapoли бoлee 12 знaкoв" (translate - passwords for more than 12 characters). Their 13  :)

One moment. When upgrading to version 0.9.1 appeared similar message
http://s52.radikal.ru/i138/1405/3f/aec7e6cf4357.png
Translate:
Database blocks corrupted. To rebuild the database blocks right now?

After the rebuild appeared transaction.

Rem.: The program downloaded from the official site...
P.S.This screenshot was received when trying to install the old version of the program. But he is the same... Very strange circumstances...

I thought so too... The system is installed Avast Internet Security, I also scanned the computer itself Avast and two anti-virus scanners (DrWeb & avz from Kaspersky Lab). Keyloggers not found!

To the best ability that we can, I think we've confirmed that the 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t is not a change address.

There is a transaction in the blockchain that sends to both 1Cy21mnkUMvZdJW4rDe7Z5ey9sbcZhzzfL and 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t.

Therefore, it looks like 1Cy21mnkUMvZdJW4rDe7Z5ey9sbcZhzzfL is the change address (since it returns "ismine" : true) and 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t is the address that was actually sent to.

Since both addresses received in the same transaction, and 1Cy21mnkUMvZdJW4rDe7Z5ey9sbcZhzzfL is in the wallet.dat, it looks like you have the correct wallet.dat.  I don't think you are going to find 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t in any backups.

At this point, unless any other evidence turns up, I don't think you'll be able to recover these bitcoins.

As for how it happened, I really don't know.  It seems pretty certain that a thief managed to get access to your unencrypted wallet.dat from somewhere.  A keylogger installed on your computer would be the first guess.  A trojan that waits for you to type your password and then steals the unencrypted content would be another possibility.  Have you imported the wallet.dat file (or private keys) into any other wallets?

No, I did not import keys

that must suck, the rat must be FUD, maybe i can help you out if u got skype

Read the thread before posting, his coins were definitely stolen.

It is essential that you at least run Linux if you're dealing with crypto. Windows is complete malware-filled trash and you just can't protect youself from it - antivirus programs are frequently not detecting them. Sorry to say, but it seems that your BTCs has been stolen.

You are right. Now I also think that was a steal. And I understand - Bitcoins not return ...
Linux ... One word - late.

In conclusion - thank you all for your participation and your time.

P.S.  If anyone have an idea on how to return the stolen - will be grateful (in PM)

If they are stolen you wont get them back. Scan with malwarebytes and hijackthis ,try to figure out how you got hacked,infected.  Any remote administration tool installed ? RDP,VNC,TW etc...

I also lost my BTC :'(

Tell us your story.

Damn localbitcoins i just lose 3.5 btc my account was hacked and can't login to see other transaction.

my money was send from this wallet 1NUi7FYqUfk7Xmx15h7KWZEwfi2hEKpdLn to this one 1Jme6DcnyuRbVKcsDXTsgFbpkUzPtsR7Bc after few mins he send again to this wallet 14hkTLRiar9RXLhWc8sJTohBhG4pbXXG2S. It's any way to block, freze that wallet please let me know.

 

https://blockchain.info/address/1Jme6DcnyuRbVKcsDXTsgFbpkUzPtsR7Bc   
https://blockchain.info/address/14hkTLRiar9RXLhWc8sJTohBhG4pbXXG2S 


also i don't have 2 verification on my wallet how he get my password i think is very sick site now is down for 10 hours and they say that localbitcoins had no problem and user are responsible for the lose.

Well, you are responsible. All bitcoin transactions are irreversible, and we cannot "block" or "freeze" a wallet. It's your own fault.
Why didn't you set up 2FA? The hacker could've put some keylogger on your system, stolen your cookies and whatnot. Also, why store your bitcoins on a web service?

It is your own fault. It's time your learnt that this world is harsh and cruel.

I'm sorry , but you cant do anything . Just use a better protection in the future.

You should have setup 2 factor. It is impossible to "block" or "freeze" the address since its peer to peer. You should also try to put a stronger password. Try to scan for malware, virus or keyloggers in your computers and phones.

Are you sure this isn't just movement of coins within localbitcoins?  When you deposit coins at localbitcoins they are going to move them all over the place, into cold storage, out again, send them off to someone totally unrelated to you.  That would be normal.  When you deposit BTC into an account they are not in a wallet.  Do you understand the difference between a deposit account and a wallet?

From:

https://blockchain.info/address/14hkTLRiar9RXLhWc8sJTohBhG4pbXXG2S

They were sent here:

https://blockchain.info/address/16R14EH4v8A9GPXkAAP8gcMFBA8oxA8nbY

Which looks to be one of the main localbitcoin holding addresses (2566 transactions, Total Received 278,020.31459056 BTC, Final Balance 281.94472817 BTC)

Wait for the site to come back up and see if they still have your coins.

srry to hear man once lost my btc when somebody hacked my cryptsy account and exchanged coins too cheapest price too BTC and cashed out now have 2fa was stupid off me
well lesson learned ...

You should really start reading everything. It is not even clear that OP lost anything but rather missunderstood who localbitcoins and wallets work.

Yes, madtune only has two identical posts.

https://bitcointalk.org/index.php?action=profile;u=332334

In both he claims to have lost his BTC but I am not so sure.

madtune, if you are still there, now that localbitcoins is back up everyone is just dying to know:  are your BTC still there or not?

After my lose all my coins on localbitcoins i found what happen. Was an XSS attack made by trader/seller he was used  XSS atack after/when he release bitcoins from escrow. After that coins was send in new wallet to BTC-E.com account. So i will never use localbitcoins.com again and never do business
online. face - face cash in hand and offline wallet's is GOD of security. FU LOCALBITCOINS they know about this bug since 2013 and still working till today.

I call FUD.

Which other URL was involved in the XSS attacK?
How do you know it was a XSS in the first place?
How do you know the localbitcoins knows about this bug since 2013?
How can your coins be gone after release from escrow?
Thats exactly what escrow is for, you only release the coins when the other side did their part of the deal.

If it was an unknown address you don't own, then you cannot do anything. Maby just try to find out how the hack might happenen. :(

Yes,
I am very sad for your money, but this seems like it is a hack or something like this. Hope you will find the thief.
BR

This is why bitcoin will fail in the long run, it is not save.

Find a way to see the location of address and transaction done by, that may help to find that person who theft coins.

Thanks

The BTC is gone, it sucks but that's the truth man.

You get 0.5 BTC if you can help me, doesn't matter how easy/hard it is for you...


I have two "Win7 Ultimate" VM's where I store my BTC's and other cryptos. MXC1 is my safe, where I store the bigger amounts in their wallets. MXC2 is the VM from which I do all the little transfers.
Because I had time, I rebuilt a new "Master" (Win7 Ultimate), installed all the wallets and left them synchronize. They did not finish, not enough time.
During that I sent my BTC's from the safe (MXC1) to MXC2. After that I shutdown MXC1 and transferred my BTC's from MXC2 to the new "Master", where I could see them after a while.
So, MXC2 and the Master, still synchronizing, where running while my machine crashed, because I played around with sgminer.
After reboot of my PC, and restart of the two VM's MXC2 and Master, I could not see my BTC's anywhere...
In MXC2 I found a "wallet.dat.err 044" or something like this. I renamed it to wallet.dat and started the wallet. It did not show up my BTC's. Then I stopped.
I still have the old MXC1 VM.

I'm happy to pay 0.5 BTC for my stupidity, if I get the rest back :-)
I don't know enough about bitcoin/blockchain to help myself :-(

Export the private keys by using dumpprivatekey and import them into electrum.

Sorry for stupid question. How do I do that ?

I don't know what a public and/or private key is.... (as many others)

Which wallet do you mean? MXC1, MXC2 or Master. Or the MXC2 with the err extension?


I installed Electrum. At startup it is asking me:

- Create new wallet
- Restore an existing wallet from its seed
- Create a watching-only version of an existing wallet

...what should I choose ?

Make a backup of each of those wallet.dats, now.

You can try them one by one by putting them in the bitcoin app data folder. Once Bitcoin Core starts it will work with whatever wallet.dat is present in that folder. Give it time to start and also to stop. Check in the task manager if you are unsure if it is still running.


Do you know which address holds the coins that you want to recover?

Step-by-step instructions for working on a single address here:
http://computriks.com/en/bitcoin-export-private-key

For working on a whole wallet.dat look into pywallet http://www.devtome.com/doku.php?id=pywallet

It is somewhat more complex though.


I doesn't need to be Electrum. Once you have your keys and a properly working Bitcoin Core again, you can import private keys there.

http://computriks.com/en/bitcoin-import-private-key



As a side note: Having different wallets running on the same machine within VMs does not add any safety, IMHO.

Newar....?

I don't know the address who holds my coins. I never messed around with addresses, ....till today. Now I have to :-(
The last successful transfer I did was from MXC2 to Master. The coins showed up at the Master, but then while still waiting for confirmations, the PC with the VM's crashed.
MXC1 was not running then.

1. transfer from MXC1 to MXC2 = BTC's arrived
2. shutdown VM MXC1
3. transfer from MXC2 to new Master = system crash after a few minutes.
4. after restarting all 3 VM's and wallets:


MXC1: "verifying blocks" since about 10 minutes
MXC2: "verifying blocks" since about 10 minutes
new Master: 0 BTC, I see one "payment request" I created for MXC2 to transfer the coins.

Do I have to dl the blockchain first before searching for the privat key?
Which wallet would you try first?
Do I look  for one or more addresses...?

I'm reading the wiki about the whole thing while waiting for your response ;-)


reply to your single note: I hardly ever start the Master VM, and never use it for tranfers to external wallets. Does this make sense, or not...?

All wallets are synced now:

MXC1: I see all transactions i did.

MXC2: I see all transactions i did, including my last (missing) one from MXC2 to Master.

Master: no transactions.

If I use "dumpprivkey (Bitcoin address)" I get a response, but just for the "received with" transactions. Unfortunately my transfer from MXC2 to Master is a "sent to" transaction.

What do I have to look for ?

Please help...

Let's do one thing at a time. Before we start, have you backed up all your wallet.dats?


I thought you had the blockchain already? You said you were using Bitcoin Qt (Core)? To see your transactions the blockchain needs to up to the date of when you did your last transactions at least.

I would try the "Master" wallet.dat first. See what you get out of it.



If you can see this, it should also show you the addresses involved and a transaction ID. Is this the case?


Regarding the VMs: I don't think it matters how often you start them. The data is sitting "there" on your hard drive all the time. You don't say if and which parts of your system are encrypted.

Ah, okay.  :)

How about that last transaction? In MXC2 right click on the ("last, missing") tx and "Show transaction details"

YES it is the case.

I get an address out of the wallet on Master. Is this the privat address of that wallet ?

I really appreciate your help...

No worries.


It starts with a "1"? That is your address, not the private key.

Before you go further check that the tx actually went through. So copy the receiving ("Master") address from your "last, missing" MXC2 tx and paste it into any of these sites:

http://blockr.io/
http://live.insight.is/
https://blockexplorer.com/

[/quote]




Yes, got that. Got a privkey from last received transaction on Master.


.....keep going, please....

Before you go further check that the tx actually went through. So copy the receiving ("Master") address from your "last, missing" MXC2 tx and paste it into any of these sites:

http://blockr.io/
http://live.insight.is/
https://blockexplorer.com/
[/quote]


Yep, at block.io I get 147 confirmations.
I see the same address in my Master wallet  in the "payment request".......Ahaaaaa....

Ok, let me clarify:

Your receiving address for the "last, missing" transaction to "Master" shows 147 confirmations on blockr?
You see that address in "Master"?
Is your "Master" Bitcoin (QT) Core blockchain fully synced?

Then you should see your coins in "Master".

You then should also be able to export your private key for that address, if you still wish to do that.

Yes. (...to "Master" shows 147 confirmations)
Yes. (...that address in "Master"?
No, sorry, Master is not fully synced yet.

Do I have to wait for that...?

Ok, wait  :)

Or if you are in a hurry, you could now get the private key to that address as described earlier and import it in another wallet software of your choice. If you use a lightweight one like Electrum that was suggested earlier the coins should be available to you to spend quicker, depending on how far your "Master" Bitcoin (QT) Core is synced of course.

Master is still 70 weeks behind.

If I delete the wallet.dat in the old MXC1, where the blockchain is already synced, can I do that importing into that new generated wallet ?

Not that I'm in a rush, but this way I use what I have learned now...


...and I could transfer your 0.5 BTC sooner :-)

Unless you are very much concerned about anonymity, I wouldn't recommend deleting wallet.dats. Better back them up or rename to i.e. wallet_old_MXC1.dat etc.

Yes, Bitcoin Core will use whatever wallet.dat it finds in its app directory. So if you copy "Master" wallet.dat in the MXC1 machine it will use that. If you already have Bitcoin Core running, remember to wait until it has shut down completely before start renaming, copying and re-starting with another wallet.dat

...bloody hell, they show up in MXC1 !!!!!

Can I transfer them now to Master, which is still synchronizing, and see them in the next minutes ?


What was my mistake ? Was it because I moved wallet. dat to a wallet which is not fully synchronized ?

Is that BTC address in your profile correct ?
Should I first do a small test ?

You will see them in Master once it has the blockchain up to that block where the transaction was confirmed.


If I remember it all correctly... Your "mistake" was to "play with a mining application" and running multiple VMs stressing your PC whilst you had Bitcoin QT Core running (which can be a resource intensive application by itself). The result was that the VM crashed and corrupted your wallet.dat. So we started thinking the problem was with that file corruption. But as it turns out, yes, it was a synchronisation issue, thankfully that corruption had no effect on your coins. Remember that you are responsible for your bitcoins and they are valuable to us bitcoiners. Don't do too many things at the same time that could corrupt your wallet.dat and make regular backups.

Another thing to remember is that your coins are not actually on your PC, for example as files or anything like that. Rather the private keys that control them are on your PC. Some more in-depth info is here: https://en.bitcoin.it/wiki/Transaction

Yes, I stuffed it up in the first place.

The 3 BTC's are moving now from MXC1 to MXC2. After that get's confirmed your job is done.


And you did it like a pro. I really appreciate your help. You where very nice to an idiot who has himselve to blame.

You are a good guy :-)

Now I know what that "HERO MEMBER" means :-)



But again, is it ok if I transfer you 0.5 BTC to the address in your profile ? (Last chance ;-)

cheers, MAX

No worries. I'm glad it worked all out and you got control over your coins again.

I'm just another bitcoin user. The "Hero" etc. are simply numbers counting up. Not necessarily an indicator of who to trust or amount of knowledge somebody has, as you will undoubtedly find out if you stick around here.  :)

Thanks again for your offer for a tip. You can send to the address in the profile or to the one I mentioned in the PM.

Great job Newar!
I initially  thought the guy got hacked. You are alot more patient then I am hehe.
Good to see a happy ending for everyone.

...yes he is patient. And for that.....



I just transferred 50'000'000 Satoshis to NEWAR as promised  !!!!



That will get you some beer's over the summer :-)
Enjoy it :-)

cheers, MAX

Thank you very much!  ::beercheers::