Negative balance after restore

[engineer304]

I am using armory wallet on Windows 7. During the initial install of Armory, I made a paper backup, as well as a copy on a thumb drive.

I later completed a few transactions with no problem.

Unrelated to bitcoin I had a crash and was unable to successfully launch Windows and had to re-install the operating system.

Upon restoring the Wallet and allowing the block chain to download, my balance was in the negative.

I thought perhaps something went wrong with the install of the wallet and/or restore, so I uninstalled and reinstalled armory and bitcoin core.

The problem remains.

Any help or advice is greatly appreciated.

[1715565541]

1715565541

[1715565541]

1715565541

[1715565541]

1715565541

[goatpig]

Try Help -> Rebuild and Rescan

[engineer304]

Thank you. I have done that.

My Balance now shows zero, and it appears as though the funds have been sent to a change address.

Is there a way to recover them?

[goatpig]

Start Armory. Pick User -> Expert Mode

Go to your wallet's properties dialog, click on the figure next to Addresses Used.

Pick an amount to extend the address chain with then click compute. It will rescan the wallet, then you should see your balance.

[engineer304]

"Pick an amount to extend the address chain with then click compute. It will rescan the wallet, then you should see your balance."

I'm not sure I follow you here.

I have changed the mode to expert, when I click the "Wallet Properties" button a new window opens which lists all of the addresses. Highlighting any address does nothing. If I highlight an address and right click I see a context menu with options such as " Copy Address" "Display Address QR Code", etc.

I don't see any way to "Pick an amount to extend", nor do I see anything labeled "compute".

Perhaps I've missed a step?

[goatpig]

https://imgur.com/olqpnjf

[Carlton Banks]

Which Armory version is being used? Extend address chain option wasn't always available, I think it was only added recently.

[goatpig]

Which Armory version is being used? Extend address chain option wasn't always available, I think it was only added recently.

It predates the time I started working on Armory. You can only get to this dialog if you turn on the Expert user mode, which is set to Advanced by default.

[engineer304]

Thank you. That imaged helped me to find the right place.

I extended the number of address used and clicked compute. I waited for the scan to complete and the balance is zero.

In the transactions log, I can see a transaction that seems to take the funds from my wallet and send it to a different address (change address I assume?)

I note the time and date stamp for that transaction is the date and time I restore my wallet from backup.

[engineer304]

I am using Armory 0.93.2

[Carlton Banks]

Which Armory version is being used? Extend address chain option wasn't always available, I think it was only added recently.

It predates the time I started working on Armory. You can only get to this dialog if you turn on the Expert user mode, which is set to Advanced by default.

Really? Well, what I meant to say was "I only noticed this was there recently..." . I'm sure there used to be a "Compute Wallet Open Speed" option in place of this option, but maybe that was a really long time ago

[goatpig]

In the transactions log, I can see a transaction that seems to take the funds from my wallet and send it to a different address (change address I assume?)

The transaction log does not display outputs funding change addresses. It is likely what you are seeing is an actual transaction moving your funds.

[engineer304]

In the transactions log, I can see a transaction that seems to take the funds from my wallet and send it to a different address (change address I assume?)

The transaction log does not display outputs funding change addresses. It is likely what you are seeing is an actual transaction moving your funds.

Here is the info in my transaction log:


Sender
Non-Standard: 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy
Script Type
Sig+PubKey33

and just underneath that is another transaction

Non-Standard: 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy
Script Type
Sig+PubKey65

After these two are transaction that I recognize

and lastly at the bottom of the log is

Non-Standard: 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy
Script Type
Sig+PubKey33


In this case we are not talking about a huge sum, but as I am considering using bitcoin more in the future I need to understand how it could be that my funds were taken/moved outside of my wallet.

I am using an encrypted OS, I encrypted my wallet using dice-ware passwords (7 random words).  Apparently this is not enough.  What else do I need to be doing to protect my funds in future?

[goatpig]

Those coins were sent to an address starting with 3. That's a P2SH address. Armory only uses P2SH addresses for lockboxes right now. If you moved your money to a lockbox, you need to give that lockbox backup to Armory. If you do not have the backup, you need to recreate the Lockbox with the addresses you used.

Otherwise, you need to investigate who has access to your private keys.

[engineer304]

Those coins were sent to an address starting with 3. That's a P2SH address. Armory only uses P2SH addresses for lockboxes right now. If you moved your money to a lockbox, you need to give that lockbox backup to Armory. If you do not have the backup, you need to recreate the Lockbox with the addresses you used.

Otherwise, you need to investigate who has access to your private keys.

Thanks for the reply. The info is helpful.

I haven't created any lockboxes (that I know of), I haven't gotten that far just yet to know how to do it or what they are used for.

I haven't given my private keys to anyone, and based on the strong password I used to encrypt my wallet assumed no one else could get my private keys. Evidently I was wrong.

One thing I will add is that I visited a bitcoin faucet site to see how they work and maybe get a few "free" stoshi. Is it possible that using one of those sites has compromised my security? I was thinking it was safe as I only used a receiving address on the site.

I'm still reading and researching to try to figure out where I went wrong, as I don't want to repeat this mistake and end up loosing a larger amount of funds that wouldn't be so easily written off.

[goatpig]

I'm stupid. The transaction history you posted is invalid. Can you give me the transaction hash instead? If you do not want to post this data publicly, pm me instead, or create a support ticket. Say goatpig sent you, I'll take care of it on that end.

I'm still reading and researching to try to figure out where I went wrong, as I don't want to repeat this mistake and end up loosing a larger amount of funds that wouldn't be so easily written off.

Do you use cold storage or just a regular encrypted wallet?

[engineer304]

I'm stupid. The transaction history you posted is invalid. Can you give me the transaction hash instead? If you do not want to post this data publicly, pm me instead, or create a support ticket. Say goatpig sent you, I'll take care of it on that end.

Do you use cold storage or just a regular encrypted wallet?

I sent you a PM.

When I look at the transactions that I recognize, I am able to see the TX hash. When I try to see the Tx Hash for the problem transaction, I am unable.

I am using a regular encrypted wallet.