False Alarm: Encrypted Wallet - Bitcoin NOT stolen!!

[lsutiger]

You may find this interesting, how I got ripped off  . Has anyone else seen this happen?

This happened to me on a Windows 7 box that has NAV up-to-date and running.  

You can look at my address https://blockchain.info/address/1H2prJvN6AnTCVzwdCjTj6h5AeBzzZdzLU and see the sequence of events.

I decided to "roll the dice" and gamble a couple of bucks with the site SatoshiDICE the night of 4/6/2013.

In the first transaction I went into my Bitcoin Wallet and paid .035 BTC to SatoshiDICE.... only when it showed up in blockchain.info, it had TWO payees in the transaction:

https://blockchain.info/tx/3e6d0b84d154382010d4d877581e497deb21cd49fec6deebae6cfe2a4a407cb6

I thought "well perhaps that is the .005 transaction fee I added as the default - although it looks a little high".  I immediately got a meager payout from SatoshiDICE, so I decided to gamble a second time with .05 BTC again to SatoshiDICE... this time it calculated the full amount in my wallet and cleaned me out:

https://blockchain.info/tx/aaee510f75f9b2c8a103236bb56171f35183fc61fda95ff4990ddac1807917f0

Here is the kicker - I have an encrypted Bitcoin wallet.  I was careful to cut and paste the address of SatoshiDICE.  It prompted me for the passphrase and confirmed "do you want to send .05 BTC to1dice97ECuByXAvqXpaYzSaQuPVvrtmz6" and I confirmed - and the second address  18wFiMnmBUGq3fNQgo17hzCL58KWj9dz3A was added BEHIND THE SCENES with 0.9495 BTC being sent to the thief.  

The 0.9495 BTC transaction does *not* show up in my Bitcoin wallet at all.  Just the transactions I entered and a zero balance - which doesn't add up in the user interface.

I have Norton 360 installed and running on this system. Just finished a full scan and it found nothing.

I'm thinking there is a nasty trojan I may have picked up from installation GPU viewer or some other small app that is a) smart enough to covertly add transactions after I type my bitcoin wallet decryption and b) do the math to figure out how much it can steal.  It took every last bitcoin fraction.

So - this has been an interesting experiment.  I lost $140 and some change - but I'm glad I didn't have much else in that wallet.

I think I'm going to have to rebuild this system (strip off Windows and reload with Linux).





Mod. Note: Changed title to reflect reality. -psy

[Akka]

Dude, that's change. https://en.bitcoin.it/wiki/Change

Learn how Bitcoin works.

[nobbynobbynoob]

If it's just change, why would the OP's client subsequently indicate a zero balance?

[lsutiger]

That is exactly what I'm doing... learning.

So - thanks for the reply.  The last sentence explains quite a bit. 

"However, the GUI in the default client does not display them in the address book."

[threeip]

That is exactly what I'm doing... learning.

So - thanks for the reply.  The last sentence explains quite a bit. 

"However, the GUI in the default client does not display them in the address book."

Change is important to learn, as someone;

-redeemed a 100BTC private key
-sent 10BTC to different address
-deleted his wallet and lost his change, thinking it was still on his private key..

[DannyHamilton]

So based on what I'm seeing, I assume you are using the Bitcoin-Qt wallet.

Is the wallet completely caught up with synchronizing the blockchain?

If not, let it get caught up before investigating further.

If so, are you saying that the Bitcoin-Qt wallet is reporting your balance as 0 BTC?

If not, then the outputs you see in the links you provided are the "change" from the transaction, and nothing is hacked or stolen.

If so, then it is possible that your wallet is damaged/corrupted, and you may need further assistance in recovering the funds.

[lsutiger]

Solution -

I added the two addresses to my address book.  They then showed up in the tab "receive coins".  Now my balance on the home page of the Bitcoin Wallet shows my full balance.

Thanks again guys for pointing me in the right direction.  I was pissed.  Now I'm happy.

[DannyHamilton]

My Bitcoin QT wallet shows my balance  is 2.1BTC but why does this blockchain say my final balance is only 0.28BTC?? :

http://blockchain.info/address/1M5wTt8Xo7NZuqbPzmoRYZ4ozwPxi6C91T

Blockchain.info does not show the balance of a wallet, it shows the balance of a Bitcoin Address (in this case the address 1M5wTt8Xo7NZuqbPzmoRYZ4ozwPxi6C91T).  A wallet can have multiple addresses. The wallet adds up all the balances of all the addresses that the wallet it keeping track of for you and show that total as your balance.  You have additional addresses ("change" address) in that wallet that you don't know about.  Here are some of the "change" addresses that your wallet is currently tracking for you:

1ADfJ5mnNtQqb8xWPDG5Tt1w6M6zW3P7ev
1ByvM3P3KrpC9cGnF56u5k8M8K6rs3eQWM
1L9G84ZD8UCcFHM4MuGFAzA2G4LEGnsBSd
1KtJLjzAuy4yakQhkmuYbh2PgxfBBPKwmt
1C76XSYUDqwbbj7dceZsnUyeC1tvmGZcqH

What am I missing? If Bitcoin QT Wallet balance says 2.1 then why does blockhain say it's 0.28... did satoshidice take the balance with the transaction above? (1)

No, your wallet sent that balance to a "change" address that it is tracking.