You should definitely note down the seed phrase on paper. You can get it via the wallet menu > seed.

Just install electrum using the installer version and see if it opens your wallet by default or not.

If it doesn't then see if the wallet file is in the same directory as your standalone/portable electrum executable that you are currently using. Rename it to default_wallet and move it to the electrum wallet directory:

http://docs.electrum.org/en/latest/faq.html#where-is-my-wallet-file-located

First of all you don't need to photograph your computer screen. You can take a picture of it using the print screen button on your keyboard. That'll copy a screenshot to the clipboard and you can then paste that into an image editor, save it and upload it.

So what happens when you try to restore the old 2fa wallet? Do you get an error message? How many words are there in the seed of this old wallet? What version of electrum did you use to create this wallet?

In addition to restoring your old wallet on the second PC i.e. the clean PC you should have created a new wallet and then moved the bitcoins from the old wallet to an address in the new wallet. The old wallet was compromized so keeping bitcoins in it was no longer safe.

because your wallet was also on the PC with the malware. all malware needs is the seed. doesn't matter if they get it on PC A or PC B

As soon as you receive money to an address it becomes public. All it takes is one transaction. When a transaction confirms it gets incorporated into the blockchain and stays there forever. So that's why you should not reuse addresses because people can track your finances if you do that.

Learn why using a unique address per transaction is a good idea: https://bitcoinelectrum.com/frequently-asked-questions/#why-does-electrum-give-me-a-different-address-everytime

Learn to use the receive tab properly to get a new address everytime: https://bitcoinelectrum.com/how-to-use-the-electrum-receive-tab/

Bitcoin is not an anonymous currency so if you're trying to stay anonymous then don't use bitcoin. Use something else.

so he has malware on his system and he just fed it more coins. sad. should have diagnosed the earlier problem first before sweeping his casc private key. sorry for your loss op.

You're cascius coin still has bitcoins in it so if you have the private key for that you can get that money back.

As for the 3K address where is that from? What does it say in your electrum wallet window title bar?

Why don't you look up the cascius coins' address on a block explorer site and see whether it still has funds in it or not? See if those addresses are in your USB wallet.

If all the money has been sent from the address then see if the destination address is in your electrum wallet (this would be a private key sweeping transaction).

Block explorer would be a site like blockchain.info

Finally there is one last thing you can try but you have to do this offline. Open the site bitaddress.org and disconnect from the net. Go to wallet details tab and enter your cascius coin private key(s) there. For each private key you should get two addresses one for the compressed public key and one for uncompressed public key. Save those addresses in a text file for future reference. See if any of those addresses are in your electrum wallet.

Before going online again close the bitaddress.org tab and then your browser. You can run your browser once you've gone online again.

Alternatively you can do all of the above using a live cd. Bitaddress.org is just one self-contained file and can be saved on a disk for offline usage.

I said private key not public key. Any one private key + the MPK = whole wallet compromized. There is no reason to believe any of the OP's private keys have been exposed. Just saying that exposing the MPK is not entirely risk free.


No that's not the case. Electrum maintains backward compatibility with old seed formats. The MPK would be of the old type too.

@Numerous64: You haven't answered the question HCP posed about familiar addresses. Can you bring the address tab into view with ctrl+a and see if any familiar addresses are listed there?

Also please answer the question I posed above regarding sweeping vs. importing.

Did you sweep private keys or import them? I don't think the option to sweep private keys was there 2 and half years ago.

If you imported them then a restoration from seed would not restore the imported private keys.



For a 2.5 year old wallet it'll be the old style hexadecimal MPK rather than a bip32 xpub. It's worth a try though. We can create a watch-only wallet and see if there are any transactions.

Ah your wrong about the privacy leak though. The MPK is normally not revealed to electrum servers so exposing it is a big privacy leak. It also has security implications. If any of his private keys were to leak too then his entire wallet could be compromized.

since you have a good idea what the password is you can try this script to brute force the rest for you:

https://github.com/gurnec/btcrecover/

Assuming you have the latest version of electrum i suggest you restore from seed:

https://bitcoinelectrum.com/restoring-your-standard-wallet-from-seed/

If that doesn't do it either then you have the wrong seed. Perhaps for a different wallet than the one you sent coins to. Sorry for your loss.

You need the seed words. You an grab them via wallet menu > seed. That's the "private key" for your entire wallet.

Good point HCP

did you send bitcoins from the old wallet to the new one? coz you have to do that.

Yes but the labels will not be restored. To restore those too save a copy of the wallet file via file menu > save copy. Alternatively enable the labels plugin so that your encrypted labels are uploaded to a third party server:

https://bitcoinelectrum.com/how-to-use-the-electrum-label-sync-plugin/

Yes but it's not an email account it's a bitcoin wallet. Money is at stake and because bitcoin transactions are irreversible there is nothing that can be done if your coins are stolen. If you expose your seed on a public computer or a compromised computer then your funds will be stolen. So use your own devices only. And understand that the more devices you use your seed on the greater the likelihood of theft.


You have to use electrum.

You can use old addresses but not generate new addresses. Bring the addresses tab into view with ctrl+a to see all your old addresses. Another way to bring this tab into view is via view menu > show addresses (electrum 2.9.3) or wallet menu > addresses (<2.9.3).

If you want to create more addresses then create a new standard electrum wallet and move all your money there:
https://bitcoinelectrum.com/creating-an-electrum-wallet/

yeah that's a bug. it only exports one of the two keys.

there's more than one private key behind every address in a multisig wallet. there are 3 out of which you need any 2. if you had the seed you'd have no problem because that contains information for 2 private keys. as it is you don't have the seed. you have the wallet file which contains only one private key. the other one is held by the company that verifies the google auth code i.e. trusted coin. they won't sign your transactions until and unless you show knowledge of the google auth code. so you have neither the seed nor the google auth code. as a result your coins are gone. lost.

next time write down the seed.