[Solved] Bitcoins stolen from encrypted wallet? Or lost due to crash?

[hicks]

Hi guys,
it looks like some of my bitcoins were stolen, but it might be another problem, maybe due to a crash. Any help would be appreciated.
I used Bitcoin-qt, version (0.7) (don't remember precisely which version), with an encrypted wallet, Windows 7.

Sequence of events:
1. Last Saturday, with Bitcoin-qt, version (0.7), I transfer some bitcoins to Mt.Gox and sell them. I did not backup my wallet.dat at that time (but I still had an earlier backup). The client shows the correct amount of remaining bitcoins in my wallet.
2. Yesterday, Windows crashes. When I restart Bitcoin-qt, it complains that my wallet is corrupted and my blockchain, too. I make a copy of the corrupted wallet.
3. Since there is a new version of Bitcoin-qt, I update to the latest version (0.8 ), delete the bitcoin data directory (to get rid of the corrupt blockchains), put my old backup of the wallet (from before the transaction in 1.) in the data directory, download the blockchain from sourceforge and restart the client.
4. After it finishes synchronizing with the network, there is suddenly another transaction shown in the client, with almost the same, but slightly different amount of Bitcoins send to an unknown address (not my Mt.Gox account). The transaction happened at the very same time than my Mt. Gox transaction.

Were my Bitcoins stolen or is it a problem caused by my computer crashing and not having a recent backup of my wallet?
Is there a way to repair my wallet?

Any help is appreciated. Thanks!

[1715355911]

1715355911

[1715355911]

1715355911

[squidface]

sounds bad.

Go to blockchain.info and search for your mtgox transaction via either one of the addresses, or the transaction id, which you should be able to get from your client.

If the other amount to the weird address is part of that same transaction, then it was probably 'change' from the transaction coming back to a new address that was in your wallet.

If that's the case, you may have lost the key for that address when the wallet got corrupted in the crash, and so now the client can't see those coins as belonging to you. You may still be able to recover it from the corrupt wallet file though. Search around on here, there's info about how to do it. There's some tool you can download.

If it's a different transaction, then my guess is that your windows machine was compromised, and someone got your wallet passcode when you typed it in to do the gox transaction. They then straight away used it to get your coins. Is everything gone, or is it some weird amount? If there's anything left, I would guess that's not what happened. An attacker would take the lot.

I would never run a bitcoin client on a windows machine that is connected to the network and in active use. It's just too risky.

Hope you get your coins back.

[hicks]

Thanks for the info. I used blockchain.info and it is from the same transaction (I posted the transaction id, and on the right hand side, following the green arrow I see these two addresses).
I will now try to recover the key for that address. Is https://bitcointalk.org/index.php?topic=11331.0 a good start for learning how to do so?

[squidface]

Looks promising, and probably worth a shot.

I haven't had to do it myself so not sure what the best way to do it is. Someone else might have some comments, and it might be worth searching around a bit more.

Just make sure you don't delete or overwrite any wallet.dat's at any point, corrupt or otherwise.

good luck!

[hicks]

squidface, I was able to recover my 4 bitcoins. Thanks for the advice! If you PM me a wallet address, I'll send you a little thank you.

[squidface]

Thats good news bro!

address in my profile now.

how's the crash eh? crazy shit.

[legster]

The 1st 4 bitcoins I bought I stored at zenwallet.org an online wallet. Now I cant access them - is the site hacked? Is there a way to get them back? (I now don't store bitcoins on any online wallets)