Lost Bitcoines In A Transaction to Coinbase

[Findingnemo]

But I guess it is possible to see all the generated address in their account by logging into their desktop site.

Is this possible? I have no idea since I have never and will never own a Coinbase account, but if they do indeed show a list of all your previous deposit addresses then it should be trivial for OP to check if the address he sent coins to - 1Q6Boa9VQxxcCCNDKK1dennXSud1m5ALAc - is indeed associated with his Coinbase account or not.

Yes it is possible, and it can be seen only if user logged into their account and redirect to : https://www.coinbase.com/addresses

So they can see all the previous address used for deposit in the past since the account creation.

[OscarRu]

But I guess it is possible to see all the generated address in their account by logging into their desktop site.

Is this possible? I have no idea since I have never and will never own a Coinbase account, but if they do indeed show a list of all your previous deposit addresses then it should be trivial for OP to check if the address he sent coins to - 1Q6Boa9VQxxcCCNDKK1dennXSud1m5ALAc - is indeed associated with his Coinbase account or not.

Yes it is possible, and it can be seen only if user logged into their account and redirect to : https://www.coinbase.com/addresses

So they can see all the previous address used for deposit in the past since the account creation.

So I have these in front of me now, and sadly the listed bitcoin address does not match '1Q6Boa9VQxxcCCNDKK1dennXSud1m5ALAc', hence I must have sent it to a wrong address right? All I can remember is that it was generated by Coinbase and that i copy and pasted it.

[Findingnemo]

So I have these in front of me now, and sadly the listed bitcoin address does not match '1Q6Boa9VQxxcCCNDKK1dennXSud1m5ALAc', hence I must have sent it to a wrong address right? All I can remember is that it was generated by Coinbase and that i copy and pasted it.

So your device is infected with clipboard malware which used to replace the destination address you copied with the address injected by the hacker. Your device might be having the issues now as well so the only option is to reflash the OS or reset to factory settings to avoid this atleast in future.

[o_e_l_e_o]

-snip-

So, that's certainly a possibility. However, looking at the onwards transaction, it looks much more like an exchange or service consolidating many inputs rather than the wallet of a scammer who has sent out clipboard malware. OP, could you have copied this address from somewhere else? Another exchange? A gambling site or sportsbook? Even a web wallet could consolidate deposits from multiple customers.

Check any other accounts you were using around the same time as this deposit was made, if you still have access to them. If not, then I would agree that this could be an atypical clipboard malware, and it would be worth reinstalling your OS to ensure your safety moving forwards.

[khaled0111]

I am not sure about this as I didn't dig deep enough.. But it looks like the sent coins (or coins that were linked to them at one point) ended up on one of Binance's hot wallets (1NDyJtNTjmwk5xPNhjgAMu4HDHigtobu1s)!

@op, do you have, by any chance, a Binance account? You can check your email to see if you've ever received a confirmation email from their part.

[hosseinimr93]

The address OP's coins sent to belongs to this wallet.
The fifth address of the list (1KwRzmWAX1bX82us1G5uHzC8U5JorQEkPC) has been posted in following reddit thread.

All my BTC stolen from Electrum Wallet

Since both addresses (the one posted in reddit thread and the one posted here in this thread) probably have a same owner, it's likely that it's the same story.

To OP:

Did a pop-up message ask you to update electrum? If yes, what did you do?
What was the version of electrum?

[OscarRu]

To OP:

Did a pop-up message ask you to update electrum? If yes, what did you do?
What was the version of electrum?
[/quote]

It was version 3.0.6 when I originally downloaded it, im not sure if it asked me to update.

I crashes now when I put in my password, which is odd, as when I put in a wrong password it prompts the message; 'wrong password', yet when I put in the right password it closes.

Anyways, I re-downloaded Electrum and now it's working fine, though I can't seem to find out for certain if I updated the program at any point

[HCP]

Sounds like you might have downloaded one of the "fake" Electrum versions that steals your coins... The likely reason for it crashing when the "correct" password was entered would be that the wallet file have become corrupted or the "fake" version was trying to prevent you from seeing that your coins had been stolen...

Given that it works with a fresh install, I'd suspect that it's more than likely that the "fake" version was the source of your issues

All of this is rather moot at this point... given that the evidence found by hosseiminr93 would indicate that your coins were indeed "stolen". At this point, there really isn't anything you can do to recover those coins

[OscarRu]

Hello,

So finally some updates...

After months, I heard back from Coinbase today with the following reply;

"Dear Mr. ...,

Thank you for your patience. Please excuse the delay in getting back to us.

With the help of the transaction hash that you have attached to us, it is possible to publicly trace the route that the transaction has taken, which is also visible to you.

https://www.blockchain.com/btc/tx/ab7cc44f2916ccf0bdd45e95b089b66518344281bea059761b6b1bb56d6db4fb

The specified recipient address of the transaction is 1Q6Boa9VQxxcCCNDKK1dennXSud1m5ALAc.

Each transaction on the blockchain is irrevocable, the correct entry of the recipient address is the responsibility of the user.

If you have any further questions, please feel free to let us know."


Now all this is literally saying is, "there is nothing we can do... Good day sir"

Though, is there really nothing I can do, given the blockchain information at hand?

Does this perhaps look like I fell into a scam, as some people have quoted, and thus getting in touch with the authorities would be to no avail, given how the Blockchain works?

I'd be even willing to pay someone to help me retrieve these funds. Initially I had hoped that I had mistakenly sent my fund to another Coinbase address, though this does not seem to be the case, and now I am a bit downtrodden.


Sincerely appreciated everyone's help thus far though, thank you all.

[Lucius]

Does this perhaps look like I fell into a scam, as some people have quoted, and thus getting in touch with the authorities would be to no avail, given how the Blockchain works?

Given all the answers I read in this thread, we could very likely conclude that your transaction did not have its destination in the Coinbase wallet, but that you were a victim of clipboard malware or a fake Electrum wallet. You can try to report the whole thing to the police, but given the time that has passed and the complexity of finding the real owner of that address, the chances of a positive outcome are really minimal.

[Pmalek]

Now all this is literally saying is, "there is nothing we can do... Good day sir"

That's exactly what they are saying, sorry!

Though, is there really nothing I can do, given the blockchain information at hand?

In terms of getting your coins back, your chances are slim. There is no centralized authority or customer support in Bitcoin that can help you and Coinbase can't do anything either because the coins were never deposited in one of their wallets either. Use this bad experience as a learning opportunity download software from official sources and verify its authenticity. 

Does this perhaps look like I fell into a scam, as some people have quoted, and thus getting in touch with the authorities would be to no avail, given how the Blockchain works?

Looking at the info hosseinimr93 found, it looks like you were a victim of a scam, yes. Finding a person behind a bitcoin address is a difficult task otherwise people wouldn't use Bitcoin. If the scammer sent those coins to an exchange where he performed KYC, it would be doable. But the exchange will never give you that information. You would have to get law enforcement involved and the sum that went missing is simply not worth it. It's around $800 worth of bitcoin. The cost of trying to recover it and finding the culprit could be bigger. Like Lucius said, too much time has passed. 

[hosseinimr93]

Given all the answers I read in this thread, we could very likely conclude that your transaction did not have its destination in the Coinbase wallet, but that you were a victim of clipboard malware or a fake Electrum wallet.

Yes, Seems that OP is victim of the vulnerability in versions older than 3.3.4 and was deceived by the arbitrary message displayed when broadcasting a transaction.
According to this post , he was using the version 3.0.6 before the update.
And as OP was probably scammed in the same way as that Reddit thread, I think he/she updated electrum through the link displayed by a dishonest server.  

[o_e_l_e_o]

Yes, Seems that OP is victim of the vulnerability in versions older than 3.3.4 and was deceived by the arbitrary message displayed when broadcasting a transaction.

Not necessarily. OP states he remembers copy and pasting the Coinbase address and creating the transaction. The malicious Electrum wallets did not wait for the user to create a transaction, and simply swept all the funds as soon the wallet was opened. It sounds more likely the OP either copied the wrong address from somewhere, or it was clipboard malware, rather than Electrum malware.

After poking around a bit more on the blockchain, some of the funds from the transaction which swept the address 1Q6Boa9VQxxcCCNDKK1dennXSud1m5ALAc end up on Bitstamp through the following chain of transactions:

https://mempool.space/tx/ce1cef757536327cee8ef5f8a5a452f46e90aa1eb4eaada1eaad49454faf5760
https://mempool.space/tx/c545b162ecad5e8b5d320964587bd3cd0e09e4e22097ca0a460d261d46f78c29
https://mempool.space/tx/e0d290721225f5eba1bf5d51ee81fe4131db890294604f968e058f34005a949b

Ending at address 36uwFSav1wadZMf7nWzg9SJg8RLFtUzmob, which is known to belong to Bistamp (or at least, it was, but hasn't been used in over a year).

I don't think you can do anything useful with this information, unless there is any chance at all you actually copied an address from a Bitstamp account by mistake, rather than a Coinbase account?

[Abdussamad]

The malicious Electrum wallets did not wait for the user to create a transaction, and simply swept all the funds as soon the wallet was opened.

Unless he had a password set. In that case the software waits until you try to spend bitcoin and enter the password to do so and then it steals from you.