Transaction change vanished

[dude123]

Hi, I went to transfer one BTC from a wallet to another. I can now see afterwards that 99 BTC was also sent to another address (1PyDNpaHGaAxazG13Xa7sESVeQbympLrHw, transactionID: 724d1caf9cc4302d02564908fcbd1d47878732b6eb4da818a3495709d595944c).

I understand this to be normal behavior in the Bitcoined application as the other mysterious address is generated by the app and will just send the "change" back to me. But the 99 BTC seems to have vanish from my account, however the 1 BTC sent in the same block arrived just fine.

Weird thing is that the 99 BTC transaction is published under "Recent transactions" in the Bitcoined app. This is not standard for "change" transfers.

Anyone know what could have happened?

[1714151606]

1714151606

[1714151606]

1714151606

[1714151606]

1714151606

[Deafboy]

Have you closed your bitcoin-qt process forcefully in the time of transaction or later?
Bitcoin-qt messed with my labels in really weird way some time ago when I accidentally unmounted the USB drive with my wallet while bitcoin running.
It may be my mind tricking me, but I'm sure I have been thinking today if something like you have just described is possible to happen.

edit________
Now when I think about it, this doesn't seems to be that bitcoin-qt is just miss-interpretiing the wallet content. There shouldn't be 2 separate transactions if you have made just one.

[dude123]

There was something weird with this client some time ago..  starting the application would fail reporting and index fault or something similar. I closed the app, removed the *.dat files in the datadir, and rebuilt the indexes.

Other useful information might be that when I made the transfer the client was not fully up to date with the block chain. The client was online about 30 min after the transfer until I noticed the problem. At this time I turned it off (before rebuild was done).

This did however not cause any problems with the one BTC I sent.

[DannyHamilton]

There was something weird with this client some time ago..  starting the application would fail reporting and index fault or something similar. I closed the app, removed the *.dat files in the datadir, and rebuilt the indexes.

Other useful information might be that when I made the transfer the client was not fully up to date with the block chain. The client was online about 30 min after the transfer until I noticed the problem. At this time I turned it off (before rebuild was done).

This did however not cause any problems with the one BTC I sent.

Not sure what your problem is, but if it was my wallet, I'd do the following:

• Dump all the private keys out of the wallet
• Shut down the client
• Move wallet.dat to backup.wallet.dat
• Start up the client
• Import all the private keys from the previous dump into the new wallet
• Wait for the blockchain to get caught up

Just a suggestion.  It might not be your best option.

[Stephen Gornick]

Hi, I went to transfer one BTC from a wallet to another.

Do you mean that from your wallet you paid one of your own addresses from the same wallet?   Or are you saying you have two wallet files, sent from one to an address from the second wallet.dat?

If you are swapping wallet.dat files, you might want to launch the bitcoin-qt client with the -rescan.

[dude123]

I use two separate wallet.dat files (actually I have three).
To clarify the wallet issue.

#1) Pocket money wallet. (not mentioned before)
#2) Repository wallet.
#3) New repository wallet, to gather funds.

Earlier references has been sending from #2 and receiving in #3.

After this little mishap I was worried about my remaining 100BTC in #2, so I went to transfer them aswell to #3 .

This time I decided to send 99 of them, and to leave 1BTC just to see if I could repeat the problem. Worked like a charm, -99BTC was registered and the change of 1BTC was kept without a visible transaction (note: first sending machine is no longer in use as I am worried about viruses or similar).

So, now I was going to try the tips from DannyHamilton, so I installed a fresh bitcoin-qt client and copied an pasted in an early backup of the #2, and deleted the index files. Waited a few days for the rebuild. Guess what it came up with?

The history of transactions (all of them from now unknown addresses since this backup was so old) came up, but towards the end the same problem with the -1BTC followed by the -99BTC came in. And after that the latest transaction of -99BTC this time displaying also the corresponding change of -1BTC!  So, the problem was repeted, and the account is now empty.

Can it have something to do with that I have used different (in time) backups in the past, and switching between #1 and #2 in datadir's on same machine without rebuild? I might also have been using the #2 on more than one machine concurrently.

Latest Transaction-ID: 2705cbc8a9bbe0acf1bba1351ed2b0558ccad196f5c01a784386a305a749bc6d

[Raoul Duke]

I guess the real question you need to answer is: where we're those 99 missing BTC's sent?

[dude123]

I guess the real question you need to answer is: where we're those 99 missing BTC's sent?

..for the technicality of it I assume it is of equal interest.. or?

[Raoul Duke]

I guess the real question you need to answer is: where we're those 99 missing BTC's sent?

..for the technicality of it I assume it is of equal interest.. or?

You don't need to tell us. You need that answer yourself.
Start investigating the address where they went. Can you connect that address to some other address(es)? Use znorts blockchain parser, blockchain.info taint analysis, dump your wallets with pywallet and see if that address belongs to you, whatever is at your power.
I've never heard or seen a case where bitcoind or bitcoin-qt sent a tx on it's own without user input.

[dude123]

So would it be correct to assume then that none of the following addresses are in any of your wallets?

1Eqa6sSFGLFhQjLxtRYWnXR6CmfiUc6mvm
1LGA66yPNQaPv3Sz3nwn9YYYtpPmgZHvQt
1FhCSRsFp7W6k7yJjAgb7ngwb8hMBvgrWe
17LiejvHX7VARRyExcyBY5v4U4C8u6YLmb
1dzTZRnEDimEXUKbN8biK1yzm7toA4eee
1ACmBiVZRN5ka3MtC8Pu76CMr3bJtg2dqA

No, they are not listed in the transaction history or my receiving addresses in the GUI.  Where are they from?

[Stephen Gornick]

The history of transactions (all of them from now unknown addresses since this backup was so old) came up, but towards the end the same problem with the -1BTC followed by the -99BTC came in. And after that the latest transaction of -99BTC this time displaying also the corresponding change of -1BTC!  So, the problem was repeted, and the account is now empty. [/quote

Now I'm confused.  You said the 99 went in transaction 724d1caf9cc4302d02564908fcbd1d47878732b6eb4da818a3495709d595944c:
 - http://blockchain.info/tx-index/34640934/724d1caf9cc4302d02564908fcbd1d47878732b6eb4da818a3495709d595944c

So from that transaction I see that the 1 BTC went to 1NNdZiBH3yLsBSxrdVrJRptaj99hQwvbKy:
 - http://blockchain.info/address/1NNdZiBH3yLsBSxrdVrJRptaj99hQwvbKy

But that 1.0 BTC amount hasn't been spent since that transaction.  And that address later had another 99 BTC sent to it, so it now holds 100 BTC.

Have you tried launching the Bitcoin-Qt from the command line with -rescan?

 Bitcoin-Qt -rescan

[dude123]

But that 1.0 BTC amount hasn't been spent since that transaction.  And that address later had another 99 BTC sent to it, so it now holds 100 BTC.

Have you tried launching the Bitcoin-Qt from the command line with -rescan?

Correct, 1 BTC and then 99 BTC was sent to t1NNdZiBH3yLsBSxrdVrJRptaj99hQwvbKy, which ends up in wallet #3. They arrived fine.

Haven't tried the -rescan command on wallet #2, but removing the index files should do the same, right?

Going to try the dump private keys thing as later on today.

[deepceleron]

Hi, I went to transfer one BTC from a wallet to another. I can now see afterwards that 99 BTC was also sent to another address (1PyDNpaHGaAxazG13Xa7sESVeQbympLrHw, transactionID: 724d1caf9cc4302d02564908fcbd1d47878732b6eb4da818a3495709d595944c).

I understand this to be normal behavior in the Bitcoined application as the other mysterious address is generated by the app and will just send the "change" back to me. But the 99 BTC seems to have vanish from my account, however the 1 BTC sent in the same block arrived just fine.

Weird thing is that the 99 BTC transaction is published under "Recent transactions" in the Bitcoined app. This is not standard for "change" transfers.

Anyone know what could have happened?

Analysis

1. The transaction sending the money looks normal, but only if you had just the 100BTC payment as your balance and not received any other smaller payments to any other wallet addresses that could have been used to send 1BTC.

2. When a transaction that involves "change" happens, you do not see it in the client at all, you would only see the 1BTC being sent and your balance would remain at 99BTC.

So this means one of a few scenarios I can envision:

1. Your wallet is messed up, a reserve pool address (one of 100 hidden addresses that Bitcoin pre-creates) that should be in your wallet was used for change but the client couldn't recognize the returning payment,

2. You are using an altered version of Bitcoin or other malware client that sends it's change to a bad person, either obtained by a bad download link or something altering the official client

3. There is some new malware clever enough to replace unencrypted wallet.dat reserve pool addresses with it's own, laying in wait to get change when they are used.

4. You screwed up somewhere with all your wallet file swapping. (most likely)

Something else sent the "change" address two more payments of .1 BTC the next day which do not look at all like change.

Where do we go from here?

1. Verify that you are using the official Bitcoin application or discover if it is some unofficial altered bastardized version you were tricked into downloading and using. We must check the program hashes to see if the files are the official unaltered client. These instructions are for Windows.

Authenticity of files can be checked with MD5, available as a download here: http://www.etree.org/md5com.html#download - put the downloaded file into your C:\Windows directory so it can be used from any other directory (linux will already include md5sum).

Then open a cmd prompt and do this:

C:\>cd "\Program Files (x86)\Bitcoin"

C:\Program Files (x86)\Bitcoin>md5sum bitcoin-qt.exe
c2d2af1bd1fe0dd7f80af352a3be1fd1 *bitcoin-qt.exe

C:\Program Files (x86)\Bitcoin>cd daemon

C:\Program Files (x86)\Bitcoin\daemon>md5sum bitcoind.exe
248fb133ade47991fdb96f607ff5eecf *bitcoind.exe

These are the values for v0.7.1, if you have this version and different values you have a problem!

Then the next thing we must do is find the wallet that has (hopefully) the address 1PyDNpaHGaAxazG13Xa7sESVeQbympLrHw. If the various wallets are unencrypted, I would install python and use pywallet to dump all the addresses in every wallet file and backup you have, and locate and secure the address and it's private key.

[dude123]

Something else sent the "change" address two more payments of .1 BTC the next day which do not look at all like change.

Yes, that was actually me from an online wallet testing to see if those showed up somewhere for some reason. They didn't of course.

Thanks for all the tips, I will work on checking the hashes..

[dude123]

The machine sending the 99 BTC losing the 1 BTC was running v0.7.0Beta, giving the results:

0800981efc79096f2e23e4f0e928cd5d *bitcoin-qt.exe
393afc1d8f937e05eb20c8a9bb3dea1f *bitcoind.exe

Can't find any info about what they should be..

Note: The wallet used here was a backup from a few months ago (same on the first transaction that got messed up), due to system re-installment the client responsible for creating that wallet is no longer available for hash checking, unfortunately.

I will continue with dumping the keys.

[deepceleron]

The machine sending the 99 BTC losing the 1 BTC was running v0.7.0Beta, giving the results:

0800981efc79096f2e23e4f0e928cd5d *bitcoin-qt.exe
393afc1d8f937e05eb20c8a9bb3dea1f *bitcoind.exe

Can't find any info about what they should be..

Note: The wallet used here was a backup from a few months ago (same on the first transaction that got messed up), due to system re-installment the client responsible for creating that wallet is no longer available for hash checking, unfortunately.

I will continue with dumping the keys.

All Bitcoins are "beta", those are the correct checksums for v0.7.0 release client.

Good luck finding the address & key, it should be in some wallet.dat file or earlier backup if the wallet wasn't lost or extremely corrupted, especially if you haven't sent over 100 transactions using one wallet. One thing that can make for an unreliable backup is if you tried to copy the wallet.dat while Bitcoin was still running, even as a tray icon. If the address pool was exhausted, more reserve keys will be created by Bitcoin that may only be in the current wallet or recent backups.

[DannyHamilton]

Something else sent the "change" address two more payments of .1 BTC the next day which do not look at all like change.

Yes, that was actually me from an online wallet testing to see if those showed up somewhere for some reason. They didn't of course.

Disregard my earlier messages (I've deleted them).  They were based on the understanding that you were not intentionally sending to 1PyDNpaHGaAxazG13Xa7sESVeQbympLrHw. Now that you've explained otherwise, it becomes obvious that the addresses I listed belong to the online wallet.

[deepceleron]

So this means one of a few scenarios I can envision:

1. Your wallet is messed up, a reserve pool address (one of 100 hidden addresses that Bitcoin pre-creates) that should be in your wallet was used for change but the client couldn't recognize the returning payment,

There is one other option that can be tried on the computer with the wallet that sent this payment (and should have received change), but it will require first upgrading the Bitcoin client to version 0.7.1:

Bitcoin version 0.7.1 is now available from:
  sourceforge.net/xxx/ (it's released now at http://bitcoin.org)

This is a bug-fix minor release.

New features
------------

-salvagewallet command-line option, which moves any existing wallet.dat
  to wallet.{timestamp}.dat and then attempts to salvage public/private
  keys and master encryption keys (if the wallet is encrypted) into
  a new wallet.dat. This should only be used if your wallet becomes
  corrupted, and is not intended to replace regular wallet backups.

Better detection and handling of corrupt wallet.dat and blkindex.dat files.
  Previous versions would crash with a DB_RUNRECOVERY exception, this
  version detects most problems and tells you how to recover if it
  cannot recover itself.

After closing Bitcoin and making another wallet.dat backup, you can install the latest Bitcoin release. Then start Bitcoin-qt with this command-line option which will do an aggressive search to recover unreadable Bitcoin wallet addresses and restore them to a new wallet file, and then search the blockchain for any missing payments to wallet addresses:

cd \Program Files (x86)\Bitcoin
bitcoin-qt -salvagewallet -rescan

[Raoul Duke]

The 100 change adresses pool also gets deleted/flushed and replaced with new addresses when encrypting the wallet. Probably not relevant, but good info to know about.

[dude123]

OK, so no use in trying to get the keys from the backups from pre-encryption time then.

Ran "bitcoin-qt -salvagewallet -rescan", but I get "Cannot initialize keypool" error message. Tried several times. Found no helpful information by googling it...