Need help to understand where bitcoin transaction has gone

[inforbes]

Hello,
I am new with bitcoin and I need some help from experienced members.

I have a server with bitcoin core where we accept some payments and use bitcoin core as mercant.

The problem is that we have got an incoming transaction which we didn't see in our wallet.

Here is the hash of the transaction: 460c0dc70ef52fd66142d1798a1735b4613c9ffec478efe5997d1ede0d16f28a

In our bitcoin core through the bitcoin-cli command line I can see the following:

bitcoin-cli listtransactions 1K7Pci1re92vQuTSXbirmvQsmYMpXHQWbQ
[
  {
    "account": "1K7Pci1re92vQuTSXbirmvQsmYMpXHQWbQ",
    "address": "1K7Pci1re92vQuTSXbirmvQsmYMpXHQWbQ",
    "category": "receive",
    "amount": 7.02278014,
    "label": "1K7Pci1re92vQuTSXbirmvQsmYMpXHQWbQ",
    "vout": 1,
    "confirmations": 128,
    "blockhash": "000000000000000002ef00cf04d1a6197cd07d5b7826d2dc8cd8a86fd41d578f",
    "blockindex": 425,
    "blocktime": 1463303078,
    "txid": "460c0dc70ef52fd66142d1798a1735b4613c9ffec478efe5997d1ede0d16f28a",
    "walletconflicts": [
    ],
    "time": 1463299775,
    "timereceived": 1463299775,
    "bip125-replaceable": "no"
  },
  {
    "account": "1K7Pci1re92vQuTSXbirmvQsmYMpXHQWbQ",
    "category": "move",
    "time": 1463303102,
    "amount": -0.00007000,
    "otheraccount": "1M1LTHjc1JAcVfCoyhSkoP1VH8B9RLY8tg",
    "comment": "merchant fee"
  },
  {
    "account": "1K7Pci1re92vQuTSXbirmvQsmYMpXHQWbQ",
    "category": "move",
    "time": 1463303102,
    "amount": -7.02278014,
    "otheraccount": "1LBa3bAVF5RSfnFnm3sX1Zm5R8WU1J8xnK",
    "comment": "invoice forward"
  }
]

As I see funds were successfully moved to 1LBa3bAVF5RSfnFnm3sX1Zm5R8WU1J8xnK, which is correct, but on blockchain, for example, if I go here https://blockchain.info/address/1K7Pci1re92vQuTSXbirmvQsmYMpXHQWbQ I see that were sent to another address!

How to understand that, and how to find where these bitcoins have gone?

Any help will be appreciated, thank you very much!

[1715117555]

1715117555

[1715117555]

1715117555

[1715117555]

1715117555

[1715117555]

1715117555

[immangrace]

As I see on the Blockchain the funds from 1K7Pci1re92vQuTSXbirmvQsmYMpXHQWbQ were moved to 1DdRMtkX6e8g19HPYHTv2iaQRy2umwLcgj and 1Bs19mjGZnX9fFj2TQ78ApqFB6gfHKxfaM
If none of those addresses are yours, then you may have been hacked and the 7.02 BTC stolen from you. As I followed the transactions from 1DdRMtkX6e8g19HPYHTv2iaQRy2umwLcgj and 1Bs19mjGZnX9fFj2TQ78ApqFB6gfHKxfaM I saw the funds have been split and moved to many other addresses, none of them is 1LBa3bAVF5RSfnFnm3sX1Zm5R8WU1J8xnK present in the code you posted.
Check your code for vulneraibilities, you may be a victim of a hack.

[shorena]

As I see on the Blockchain the funds from 1K7Pci1re92vQuTSXbirmvQsmYMpXHQWbQ were moved to 1DdRMtkX6e8g19HPYHTv2iaQRy2umwLcgj and 1Bs19mjGZnX9fFj2TQ78ApqFB6gfHKxfaM
If none of those addresses are yours, then you may have been hacked and the 7.02 BTC stolen from you. As I followed the transactions from 1DdRMtkX6e8g19HPYHTv2iaQRy2umwLcgj and 1Bs19mjGZnX9fFj2TQ78ApqFB6gfHKxfaM I saw the funds have been split and moved to many other addresses, none of them is 1LBa3bAVF5RSfnFnm3sX1Zm5R8WU1J8xnK present in the code you posted.
Check your code for vulneraibilities, you may be a victim of a hack.

Nah, look at this line

Code:

    "otheraccount": "1LBa3bAVF5RSfnFnm3sX1Zm5R8WU1J8xnK",

The address 1LB has change addresses accociated with it, thats all.

@OP an "account" is not the same as an address. A blockchain explorer has no knowledge of your local accounts, so it cant display them properly.

[inforbes]

As I see on the Blockchain the funds from 1K7Pci1re92vQuTSXbirmvQsmYMpXHQWbQ were moved to 1DdRMtkX6e8g19HPYHTv2iaQRy2umwLcgj and 1Bs19mjGZnX9fFj2TQ78ApqFB6gfHKxfaM
If none of those addresses are yours, then you may have been hacked and the 7.02 BTC stolen from you. As I followed the transactions from 1DdRMtkX6e8g19HPYHTv2iaQRy2umwLcgj and 1Bs19mjGZnX9fFj2TQ78ApqFB6gfHKxfaM I saw the funds have been split and moved to many other addresses, none of them is 1LBa3bAVF5RSfnFnm3sX1Zm5R8WU1J8xnK present in the code you posted.
Check your code for vulneraibilities, you may be a victim of a hack.

Nah, look at this line

Code:

    "otheraccount": "1LBa3bAVF5RSfnFnm3sX1Zm5R8WU1J8xnK",

The address 1LB has change addresses accociated with it, thats all.

@OP an "account" is not the same as an address. A blockchain explorer has no knowledge of your local accounts, so it cant display them properly.

What do you mean? Can you pls explain?

Can you also help me  on how to see al outcoming transactions in bitcoin-cli interface?
Are there any commands to see only outcoming transactions, so that I can find all the spents from wallet.

[DannyHamilton]

Nah, look at this line

Code:

    "otheraccount": "1LBa3bAVF5RSfnFnm3sX1Zm5R8WU1J8xnK",

The address 1LB has change addresses accociated with it, thats all.

@OP an "account" is not the same as an address. A blockchain explorer has no knowledge of your local accounts, so it cant display them properly.

What do you mean? Can you pls explain?

An "account" in bitcoin core is like a bank account.  When you deposit cash at the bank, they don't set aside those specific currency notes just for you.  They all get mixed together in the vault.  When you withdraw cash, you most likely will get cash that someone else deposited.

Bitcoins that are received at an account are not locked to that account in any way, and bitcoins that are sent from an account may have been received at a different account.  It is even possible for an account in Bitcoin Core to have a negative value if you have enough bitcoins in some other account to cover the difference.

An address is not the same thing as an account.  You can name an account anything that you want in Bitcoin Core.  If you name an account with the same name as an address that also exists in your wallet, then you are probably going to confuse yourself, since you'll lose track of when you are looking at the account with that name, and when you are looking at the address.

When you use the "move" command, you don't actually move any bitcoins at all.  All you do is subtract a value from one account register in the wallet, and add the same amount to a different account register.  All the bitcoins still remain at the address they were originally sent to.

When you send bitcoins from an account, the wallet subtracts the value from that account's register, and then sends some bitcoins from the wallet without any concern about which account the bitcoins were received at.

Block explorers (such as blockchain.info) don't have access to your wallet, so they don't know what you named your accounts, or what value each account has registered in your wallet's accounting system.  All they know about is addresses.  So when you see a transaction in a block explorer, it is telling you about addresses, not accounts.

Can you also help me  on how to see al outcoming transactions in bitcoin-cli interface?
Are there any commands to see only outcoming transactions, so that I can find all the spents from wallet.

Doesn't this work?

Code:

bitcoin-cli listtransactions

[inforbes]

Thank you, for the explanation, I got it. But I still don't understand one thing - how these funds could be sent to another addresses from my bitcoin wallet, and how I can find some info about them in my bitcoin core on the server.

Listtransactions show me all transactions, and as this is a working server, the number of transactions is rather huge, it is difficult to find what I need.

[inforbes]

To explain better

This is address history - https://blockchain.info/address/1K7Pci1re92vQuTSXbirmvQsmYMpXHQWbQ

I can see that 7 btc has arrive on that address, which belongs to MY bitcoin core.
I have generated this address to accept payment. And as I see, they were sent then to another address, but I didn't sent them!
How can I find where funds have been sent from my bitcoin core?

[DannyHamilton]

To explain better

This is address history - https://blockchain.info/address/1K7Pci1re92vQuTSXbirmvQsmYMpXHQWbQ

I can see that 7 btc has arrive on that address, which belongs to MY bitcoin core.

Yes, this appears to be a transaction that includes an output that was received by your wallet.

Additionally, it appears that these two transactions sent an output to your wallet as well:
https://blockchain.info/tx/d585b5b1956087d81eda927c6f1252f33f9996b7cb6c382f5bf0cb72d5c7733a
(0.01781508 BTC received)

https://blockchain.info/tx/3eead73f114d5341beb2414b5ceb56834c808ab487fc30ed44821eb149403606
(0.17736702 BTC received)

as I see, they were sent then to another address, but I didn't sent them!
How can I find where funds have been sent from my bitcoin core?

I suspect that your wallet DID send them, and that you are still failing to understand how the wallet and account system works.

If you did NOT send them, then you have been hacked, and someone has stolen the private keys from your wallet and stolen your bitcoins. If that were true, then I would expect that ALL of your bitcoins would be gone.  Since only those three outputs were spent, I suspect that you created the transaction:
https://blockchain.info/tx/f676877a635801a2861fa411c42720bf34c12ccdbceea38c1aaf37d98d8fbd0d

And that you simply don't remember creating it.

Try this command with your wallet and see if the result reminds you of when you sent the transaction:

Code:

gettransaction f676877a635801a2861fa411c42720bf34c12ccdbceea38c1aaf37d98d8fbd0d