funds immediately leaving electron wallet after receiving from TestNet faucet

[BitMaxz]

Why would you generate your wallet from brain wallet this is already discuss here it is not safe to generate from brain wallet.
If you want to generate a safe wallet then let the Electrum generate a wallet for you.
Let see if you can still experience that issue after you generate wallet from Electrum and receive testnet coins from faucet.

It shows that I'm a newbie :-)
Thanks

If you think that you are not a newbie what is the purpose of creating this thread? Is that for merit?

[angelo1oc]

Merit?
What do you mean?

No, I have over 30 years of experience developing software, it just I just started with blockchain, and the only way I know to learn it's just by doing.
this is why I'm doing the wallet from scratch (almost, I'm using the NBitcoin library, but I'm planning to replace it as soon as I have a stable wallet)

[NotATether]

Am I missing something with this procedure?

You have to check the authenticity of the Electrum download using GPG. There is a guide for doing that at https://bitcointalk.org/index.php?topic=5240594.0

If you did not verify the Electrum binary's authenticity, then you probably have a fake copy and that is probably why you are losing coins instantly. I always check that all the GPG signatures match before using a new version of Electrum.

[BlackHatCoiner]

If you did not verify the Electrum binary's authenticity, then you probably have a fake copy and that is probably why you are losing coins instantly. I always check that all the GPG signatures match before using a new version of Electrum.

Which is pretty weird, because thieves aren't known for stealing testnet bitcoins.

I'm afraid you've just generated your private key improperly. Did you try out some brainwallet, or used a locking script which has a publicly known unlocking script? There are some bots that search for known private keys in the mempool and withdraw any sent coins immediately.

[hosseinimr93]

Which is pretty weird, because thieves aren't known for stealing testnet bitcoins.

Right. With stealing testnet coins, the hacker actually warns about using a fake version of electrum. No hacker would do that.

Did you try out some brainwallet, or used a locking script which has a publicly known unlocking script? There are some bots that search for known private keys in the mempool and withdraw any sent coins immediately.

OP already said that he/she generated the private keys through a brainwallet and used so simple words. See this post.

[pooya87]

Which is pretty weird, because thieves aren't known for stealing testnet bitcoins.

I wonder how much it costs to run something like that 24/7. Maybe it could be run on some sort of free VPS service considering that running such a "bot" shouldn't take up that much resources. All it takes is a list of keys, a tx signing library and a remote SPV server (like Electrum nodes) to subscribe to and listen for incoming transactions to "steal". There is no need for blockchain or blockheaders, wallet history, etc. either.

[BlackHatCoiner]

[...]

But it largely depends on this known list. Does it include all locking scripts whose unlocking scripts are known? Does it contain all addresses whose private keys are revealed, such as known brain wallets? Does it contain bitcoin-key-words, such as all block hashes, transaction IDs etc.? Does it contain predictable private keys such as k=1, k=2, k=3 etc.? From those, how large is the predictable private key range? It could be [1, 2^32]. Increase the exponent by 1, and you've approximately doubled the work. Then, you have a full node that must run 24/7.

A good bot should have some good infrastructure.

[BlackHatCoiner]

Weird, but not that surprising. In past, there are shady ICO/airdrop which give people worthless token in exchange for Bitcoin testnet.

What's weird? Worthless token can be exchanged equally with another worthless token. 

That's good point, but i expect you could run such bot that with pruned node to lower operational cost. ZeroMQ also could be used to notify new transaction on mempool to your own script/application, which eliminate the need of wallet.dat which contain lots of address.

Exactly. You don't need to handle the entire chain, only enforce the consensus rules on mempool transactions, which requires to have verified the entire chain.

[pooya87]

I'm theorycrafting here but I don't see any reason to actually run a full node (or pruned node) because the goal is to monitor the mempool not to verify blocks or transactions or even keep the mempool, relay stuff, etc.
Worse case scenario is that you receive an invalid transaction and when spending that the nodes reject your tx.

[BlackHatCoiner]

[...]

Theoretically speaking too, I think that if you don't run a full node, it is bound to have some troubles sooner or later. As far as I know, Bitcoin nodes have a banlist of "misbehaving nodes", which are nodes that relay invalid transactions and/or spam the mempool. An attacker could try to have your bot blacklisted by blacklisting his own node, which can happen by just feeding the mempool with invalid or valid but already made transactions. If your bot doesn't verify transactions, it's going to broadcast them repeatedly.