Bitcoin redirected from my address as soon as it was sent to me

[amaclin]

One question, you also had said previously that you had imported some keys. Was this one of them?

definetely he used compromised private key. no doubts

[1714748894]

1714748894

[1714748894]

1714748894

[1714748894]

1714748894

[1714748894]

1714748894

[cr1776]

One question, you also had said previously that you had imported some keys. Was this one of them?

definetely he used compromised private key. no doubts

Obviously.

The question is (and was) where he got them and why he imported them?

[amaclin]

The question is (and was) where he got them

I am sure he is unable to remember this.
I'll try to google for the private key later, may be I'll find the answer.

and why he imported them?

Humans do strange things regulary.
Climb bins and drag into the house dirtiest and used things.

[lotusexpeditor]

I don’t know if the is the right list, but I hope someone can advise.

In the early hours of this morning I sent 1.01 BTC from my Xapo wallet to the address 12iocUthp58E72ZksRmToDFPfM1WCPKv91. This is an address in my Bitcoin Core wallet, running on my laptop, for which I control the private key. My client had been running all day and the blockchain was synced and up-to-date.

The instant that this amount was received into the above address (before the transaction was even confirmed) the entire amount was then sent to another address 1aa5cmqmvQq8YQTEqcTmW7dfBNuFwgdCD which I have never heard and do not have the private key for, something which I did not think was possible.

What the hell happened and where is my Bitcoin?

Hi from the future,

The private key (0004d30da67214fa65a41a6493576944c7ea86713b14db437446c7a8df8e13da) for the 12iocUthp58E72ZksRmToDFPfM1WCPKv91 (Compressed Legacy Address) was appeared in the bitaddress.org source code as a Test Address. I found your forum post while auditing this source code;

https://github.com/pointbiz/bitaddress.org/blob/72aefc03e0d150c52780294927d95262b711f602/src/ninja.unittests.js#L555

You probably generated this address in a improper way. Sorry for your loss :/

[Cricktor]

First I thought, why does someone (necro?) bump an almost eight year old thread, but actually your finding is a good contribution to the mystery of the origin of the compromised private key OP used in his wallet. A total mystery to me is why someone would import a publicly known private key into his wallet and very likely OP did just that. That's beyond sanity...

The security of a private key is based on its randomness. Something that is published and thus known and findable or derived from something known or findable is the opposite of secure. Human brainwallets were shown to be mostly a failure. Private key from known data are a failure, too.