I have never heared about the "experience point" altcoin, but if you say the wallet has a lot in common with the BTC wallet, i assume you mean bitcoin core?

If so, it's normal not to see your balance while you're synchronising. During this phase, your client downloads, verifies and parses all blocks in the altcoin's blockchain. As long as the block(s) containing the transaction(s) funding the addresses managed by your wallet are not downloaded/verified/parsed, your balance will remain 0...

If "experience point's" reference client was forked from an old version of bitcoin core, it might be a non-HD wallet. In this case, you'll need a recent backup of your wallet.dat since all private keys are randomly generated and stored in the wallet.dat (there's a gap limit tough, IIRC, usually 100 private keys are pre-generated). If "experience point" was forked from a more recent bitcoin core version, there's a big chance the wallet is HD. In this case it doesn't matter how old the backup of the wallet.dat is, since a HD wallet only stores the master private key, and from this master private key all other private keys can be derived (so it doesn't matter how old the backup of the wallet.dat is, any backup will do...).

Some good advice? Well, backup your wallet.dat onto several media... If you're unsure wether your wallet is HD or non-HD: stop syncing and use a file recovery tool to attempt to restore the most recent version of your wallet.dat. The more recent the wallet.dat version, the bigger the odds the wallet contains as much potentially randomly generated private keys as humanly possible.

So basically: stop what you're doing, backup the wallet.dat, find out wether or not the wallet you're using is HD or not...
If it's HD and you're sure you have a backup of the correct wallet.dat: continue syncing and don't panick before the blockchain is completely sync'd
If it's not HD or you're not 100% sure you have a backup of the correct wallet.dat: use a file recovery tool and try to recover the last version of the wallet.dat

I have no problem allowing a relatively small subnet instead of a single ip if that would help?

@DireWolfM14, bob123's answer is completely correct
@bob123: I did miss that point in the disclaimer, altough i did warn people i could potentially be running a modified node, so the extreme cases of abusing the flaw *could* fall under this disclaimer item

Hi guys,

It seems the public electrum nodes are being DDos'ed pretty badly lately, so i tried to setup a private electrum node using electrs (https://github.com/romanz/electrs/) using nginx as an ssl endpoint and nginx's ngx_http_access_module module to automatically deny incoming connections EXECPT the ones i manually added to my whitelist.
I have no idear wether my setup will hold if it's being attacked to.

There are a couple of things you should realise before using my service:

• I need to whitelist your public ip, so if you use my service you'll have to send your ip to me (encryption available)
• My server keeps logs... I have no intention to start digging, but if i really wanted to, i could... And since i have your public ip, forum name, timestamps, potentially electr logs (see next point) i *could* do some heavy digging...
• I didn't edit the elecrs software, but there is no way for me to prove this... So you should progress under the assumption that i *could* be running a modified node
• By only connecting to one single node, i could distort the way you look at the network... I could easily block your access to the mempool for an unconfirmed transaction making it look like you didn't get payed. I could also delay your view on new blocks, or (in extreme cases) i could deliberately go with a forked chain so it looks like you got payed but in reality you didn't... I'm not planning on any of these things, but you should operate under
   the assumption you need to verify important transactions using a thirth party block explorer
• It's a free service, i don't accept any liability... If you lose funds, your wife, your house or even your health because of me, sorry, but i won't reimburse you!
• Even if you made a donation, i reserve the right to close this service at any time for any reason, or kick anybody from my server at any time for any reason without owing anybody an explanation

If you still want to connect to my private node, send your public ip to me using a PM. You can pgp encrypt  the address using my public key, available here => https://keybase.io/mocacinno/key.asc
or even use keybase's encryption utility directly => https://keybase.io/encrypt#mocacinno

You can find your public ip by using a service like this one: https://whatismyipaddress.com/

last remarks: i realise ip's can be spoofed... This is just a quick and easy sollution... Also, electr doesn't support setting a donation address (yet)... If you want to send a tip, you can find my tipping address in my bitcointalk profile (but a tip is not necessary at all!)

After you sent me a PM, i'll reply as soon as your ip is whitelisted... I'll also send you the address to connect to. Afterwards, you can connect to my node by using the cli:
./electrum-3.3.4.exe --oneserver --server=[address i'll send you in PM]:50002:s

You can also just open electrum, click on the icon in the right bottom corner, go to the "server" tab and enter my server's address and port 50002

I just visited the site and i was allmost tempted to open an account to answer some of the questions that are asked over there... People on that forum seem to ask completely newbie questions that go completely unanswered... I kinda feel sorry for them.

I had never heared about https://github.com/romanz/electrs, but after looking into it, it seemed like a nice service to setup since it didn't require me to enable txindex and reindex all blocks (i use my node as a lightning backend, so i don't want to stop it for an extended period of time).

I'm currently running electrs and it's building an index, i've setup nginx as reverse proxy and i've setup a manual ip whitelist in nginx so i can block every connection exept the manually whitelisted ones... So if the indexing is finished, and the server starts properly (i can't make any promises), i'll be able to offer a private electrum server in a couple of hours.

Do note the following restrictions apply:

• The server will only run for as long as there's a need for a private electrum server. As soon as the DDos'ing stops, the server goes down
• No guarantees for uptime or load whatsoever... I can take the service down at any moment i want without warning
• No other guarantees either.. Either use my service or don't, but if you do: do not complain!
• You'll need to trust me... You'll be connecting to my service directly AND you'll need to send me your public ip since i'll have to add it to the whitelist (don't post your ip in this thread... Use privnote or encrypt it using pgp and send it to me using a PM and ONLY after i've announced the server to be up and running)

I realise ip's can be spoofed, but this setup was the easyest one i could come up with...

Confirmed transaction cannot be reverted, unconfirmed transaction can potentially be cancelled by doublespending the inputs of the unconfirmed transaction and broadcasting the doublespending transaction to as many nodes as humanly possible. This is something that's really hard to perform for a non-technical person, and even if you succeed in creating a double spending transaction, the odds of getting your tx in a mining nodes' mempool are really, really, really small (so the odds of success are really low).
Even if the transaction is unconfirmed, most of the time it isn't even worth the effort to try to create a double spending transaction... Only if we're talking about a thefth of several thousands of USD worth of BTC it becomes something you can try as long as the tx wasn't confirmed.

I guess you should focus on what went wrong... When you say you reinstalled "this" version, which version do you mean? Where did you download it from? Did you check the signature?

Also, addresses that "magically" change are never a good sign... Is your pc clean? do you install software from unknown sources? Do you have a virusscanner running? Is your OS patched?

Directly from https://electrum.org/#download:


Version 4 does not exist, so if you have installed version 4, you either misread the version number or you installed a fake version!

If you say that the address you were funding changed, and you funded an address you were not trying to fund, those funds are lost, the odds are pretty big you have a copy/paste virus installed on your pc, or you have a fake electrum version (as said before).

If the DDos attack continues, we can probably setup a private electrumX node for bitcointalk users... It's all written in python, so it shouldn't be that hard to add some authentication so non-invited users cannot connect. But usually those attacks don't continue that long...

I'm with Abdussamad on this one...
But my main point was twofold:

• FIRST and foremost: we can't blame the OP... He's a victim here, and i think he deserves our sympathy. He fell for a scam and lost money, everything we say is meaningless to him. The only one we can really blame for any scam is the scammer. Sure, he might use vulnerability's in order to scam his victim, but in the end it's his choice to take something that doesn't belong to him/her.
• SECOND point: the OP was victimized because he followed a popup leading him to a wrong website where he downloaded a fake electrum version. All this was possible because he ran an outdated electrum version, followed a popup that prompted him to go to an unofficial webpage and didn't check the signatures of the files he downloaded... I think he has the right to warn people about this, but i think he's sending the wrong message... If he would have made a post with the title: "warning, always check electrum's signatures, i lost xxx BTC by using a fake version" I would have agreed with him 100%, but if he makes a post driving people away from one of the better SPV desktop wallets i have to disagree with him

Now, in hindsight, i have to agree that the initial vulnerability that allowed a malicious node to send a message to it's connected users was bad... Electrum is free and open source, over it's lifetime a couple vulnerability's have been found, and all have been fixed in a reasonably short time. Other wallets will surely also have vulnerability's to.

I still recommend everybody to store his/her funds in either an airgapped wallet, a properly generated paper wallet or a hardware wallet and only use desktop wallets for storing a couple hundred bucks worth of crypto (at most). I'd also keep recommending people never to use online wallets, exchange wallets or casino wallets. My recommendation for using electrum as a desktop wallet will not change, however i have started issuing warnings for people to always double check from where they download electrum and double check the signature before running any electrum binary...

Sorry for you loss, but for now, as far as i know, electrum does remain one of the safest SPV desktop wallets. Recommanding people to move away from electrum might be driving them towards inferior wallets.
The main problem here is that you downloaded a fake electrum version from a scammer. He used a known vulnerability in a previous electrum version that allowed him to send you a message when you connected to his node... This issue has been fixed in more recent versions, this doesn't mean the software is guaranteed 100% vulnerability-free, but i don't think there's a guarantee like that with any of the free software you use...

You're the victim here, so i won't be victim-blaming. You got scammed and i really feel sorry for you... But think about it like this: if a nigerian prince send you an email asking for $1000 promising he'll send $1000000 back, will you do this without verifying anything about his story just because you have a phone, he has a phone and he knows you phone number? Well, you downloaded a version of electrum just because somebody sent you a message telling you to do this. Granted, the message looked pretty convincing, but so does the story told by the "real" nigerian prince

Bitcoin is money, don't trust anybody, verify all signatures, never give away your private keys, use encryption and strong (unique) passwords whenever possible, keep your pc clean,...

Seems like your transaction confirmed  

In case you ever want to do a cpfp with bitcoin core qt the next time you run into problems:
*warning*: I don't use the QT wallet, and i don't wanted to stop my daemon, so i used an altcoin wallet for this semi-walktrough... I hope their QT gui layout is the same as bitcoin core's. I also didn't have any unspent outputs i could work with...
- go to settings
- open options
- go to the wallet-tab
- enable: "coin control features" and "spend unconfirmed change"
- click on the send tab
- click on the button under the title "coin controll features" that lets you select your inputs
- select the unconfirmed unspent output you received as change from the hanging transaction and one second confirmed unspent output (you'll need this second unspent output to have sufficient funds for a big enough fee... If the change is/was sufficient, you could have done a rbf instead of a cpfp)
- it doesn't matter which address you fund with this CPFP transaction, as long as you manually pick a fee that's calculated with the following formula: (new fee) >= (((fee for fast confirmation of hanging tx) + (fee for fast confirmation of CPFP transaction) ) - (fee already payed for the hanging transaction))

You can use this tool for a fee estimation of both the hanging and the cpfp tx: https://coinb.in/#fees

nope, the change is insufficient to pull off a succesfull rbf. Even if he uses all change, the fee would only be bumped to ~3-4 sat/byte, which is insufficient at the moment.

@OP: i've had a rather busy day today, so i haven't answered you (yet), if nobody else explains how to do a CPFP by tomorrow, i'll try to schedule some time to make a small walktrough and post it in this thread

As long as you're sure you've got the correct seed phrase written down, and backupped the wallet files, not much could happen. (in reality, the seed phrase alone suffices, but it's never a bad idear to have a fallback).
Worst case scenario, you can restore your wallet from seed, or use the backupped wallet files...

But an upgrade like this should work out-of-the-box. If you're unsure, you can even download electrum on a clean, second pc and restore the wallet from seed without removing the original wallet from the original pc.

BTW: do verify the signature of any electrum binary you download, a lot of fake electrum download sites are popping up lately!

Well, there's a distinction between being able to create unsigned transactions, creating (or signing) signed transactions, broadcasting transactions and making sure those transactions are confirmed.

Once can easily create a cold storage setup, walktroughs are available for core, electrum and samurai (apparently... I haven't checked out the links in this topic). With a cold storage setup, one creates an unsigned transaction on an ONLINE machine, uses a medium to transfer said transaction to the cold storage device and sign it.
At this point, one can THEORETICALLY move the signed transaction back on a storage device and send the device to a big miner in an offline fashion... Theoretically, a miner *could* run his mining farm offline, but he'd have to have an online machine that builds a mempool and receives the latest blocks, each time a new valid block was received, the mining pool operator would have to download the block and the top 1Mb (without witness data) of his mempool onto a stick and transfer it to his offline mining pool... If he would succesfully find a header whose sha256d hash is under the current target, the operator would have to transfer the result back to the online machine to broadcast the new, valid block... So this whole setup is completely theoretically and not usable in reality. And even with this setup, the transaction would eventually have to end up in a block that's broadcasted to the network, or it would remain unconfirmed (even unknown) forever.

If you would pay somebody by creating a transaction spending unspent outputs funding your address with an airgapped setup and give this transaction to the receiver but asking him to never broadcast the transaction, the receiver would never be sure he got payed correctly, since you can always create multiple transactions spending the same unspent outputs. It's only when a transaction is included in a valid block, and this block becomes part of the blockchain, the transaction becomes immutable and the receiver is sure you cannot "steal" his funds anymore... So just sending signed transactions between hardware devices without broadcasting might be theoretically possible, but completely worthless (in bitcoin terms)

@nc50lc: i had never heared about a maximum increment... I have to admit i have only used rbf once (altough most of my transactions are opt-in rbf)...

I've just read bip125 again: https://github.com/bitcoin/bips/blob/master/bip-0125.mediawiki but i don't see a +4sat/byte maximum increment specified here either. Could you point me to the correct documentation?

Here's the raw transaction in hex format:

Use google, or Vod's thread to search for free services that allow you to rebroadcast a bitcoin transaction (there are dozens of these services), copy the transaction above and rebroadcast it

The theory behind this action: if you create a transaction, it is broadcasted to the nodes in the network. Some of these nodes are owned by mining pool operators. The mining pool operator picks the highest fee transactions (in sat/byte) from the mempool of his node to fill the block he's trying to solve.
The default setting of a node is to remove unconfirmed transaction from it's mempool after x hours (my node is set to 10 days). So after these x hours, most mining nodes won't have your unconfirmed transaction in their mempool anymore... Unless you re-broadcast it to the network
This theory also shows there is no need to rebroadcast to often... Once every 2-3 days should be sufficient

I completely agree with Pamoldar, but felt there was insufficient emphasis on the following sencence:

Don't do ANYTHING before you VERIFIED the seed phrase... You can even download and verify the portable version of electrum and install it on a different, clean PC without deinstalling the old version in order to test the seed phrase...

yup... that fee is way to low:

https://coinb.in/#fees

At this moment, to have a decent chance of your tx ending up in one of the next couple of blocks, a fee of 9768 is advised, your transaction has a fee of 501 satoshi's.

Will it eventually confirm? Probably... But you'll have to keep rebroadcasting the raw, signed transaction and hope the original sender doesn't doublespend the input of this transaction in a new transaction with a much higher fee...

What can you do yourself? Well, you can either pay a big mining pool to include your transaction, or perform a CPFP... In a CPFP you use the unconfirmed unspent output funding your address in a new transaction with a much higher fee... If a miner wants to add the very high fee of this new transaction to the coinbase reward of the block he's trying to solve, he also has to add the low fee transaction whose output was used in the high fee transaction...

The problem is that the change sent to your change address is only 2376 satoshi's, so that's the maximum amount you can increase the fee with... So if you do a RBF, the maximum fee for the rbf transaction is 0.00001103 + 0.00002376 = 0.00003479. This bump would increase the odds of your transaction ending up in a block, but not by that much... The fee would still be to low for a fast confirmation!

Also, like i said before, if you bump the fee up to 0.00003479, you no longer have the option to do a CPFP...

Personally, if i would have your problem, i'd be in one of these 2 situations:
1) there's a sense of urgency... You're paying somebody else and you cannot contact this person to explain the situation.
Sollutions:

• Do a CPFP
• Find a mining pool operator and pay him
• expert, small odds of success: but you can also double spend the input in a brand new (non-rbf) transaction but use more unspent inputs so  you can pay for a much higher fee... The problem is that most nodes would reject this transaction, especially if sent within 2 days after the initial tx was broadcasted

2) there is no sense of urgency... You're moving funds between wallets, or you're paying somebody you can contact and explain the situation
Sollutions:

• Keep rebroadcasting the tx and wait it out
• Bump the fee up to 3479 satoshi's and keep rebroadcasting the tx and wait it out
• Do a CPFP
• Find a mining pool operator and pay him
• expert, small odds of success: but you can also double spend the input in a brand new (non-rbf) transaction but use more unspent inputs so  you can pay for a much higher fee... The problem is that most nodes would reject this transaction, especially if sent within 2 days after the initial tx was broadcasted