Disappearing Wallet -- was Seemingly my wallet was hacked -- Solved!

[CalicoChris]

in fact, while I was browsing here taking a look at sandboxie.

Can you tell me what to do and how to find that hacker.  I have a backup from yesterday, private keys exported, Multibit latest version.  Computer has firewall, soft and hardware ... Opened the software wallet to see 0 balance and no existing wallet.

What's next?

[casascius]

There is no way to find the hacker.  I am sorry for your (presumed) loss.  I say presumed since perhaps you weren't really hacked and am just commenting taking your comment about being hacked at face value.

Use paper wallets for your bitcoin storage.  I have never heard of anyone having a single bitcoin stolen from a paper wallet.

Meanwhile, here's to hoping you still have your bitcoin and just don't know it.

[CalicoChris]

Well, I hope so - that I have my bitcoin ... but I don't see any evidence. 

What will happen if I restore and synchronize?   

 

[rarkenin]

Nothing, probably. An "address" stored in your wallet is simply the set of keys needed to release BTC transfers from it. If someone stole a copy of your housekeys, and stole your jewelry, getting a copy of those housekeys from another safe storage location(i.e. standard bank safe deposit box) and opening your house with THOSE keys isn't going to magically restore your jewelry.

[CalicoChris]

Nice Analogy ... one feels a little lost and totally stupid you know and the thinking processes disappear.  Anyway, I'll have to survive.  Believe me, this coin of mine is gone.  No footsteps left behind although I am still looking.   

So I guess the new killer app for bitcoin besides an exchange that is halfway reliable ... is a secure wallet.   At least they have not yet stolen my fiat bank account ... Going to paper?  with this software sophistication?  Dammit! 

Thanks for the help anyway. 

[casascius]

I don't think it's been established that his coins have been taken.  Evidence of the coins being taken would be seeing the address on blockchain and seeing the coins have been spent.

I don't use MultiBit nor do I know enough about it to say what to do.

[DannyHamilton]

- snip -
Believe me, this coin of mine is gone.
- snip -

Just curious, how did you decide that the coins are gone?  Why are you certain that it isn't just an issue with MultiBit?

[CalicoChris]

I have contacted multibit to see if it could possibly be a software issue.     

I was busy doing research on this forum, to cold store that wallet.  I looked at the wallet to check something, and closed it .... I read some more on here ... perhaps half an hour ... and looked again to look at the help files.  And there was no wallet, and there were no transactions, and there was no bitcoin address ... and there was nothing - balance 0 BITCOIN.  Multibit software sans wallet.  There is no .wallet file anywhere to be found.  Of course, I've got private keys in a backup.  I restore those and there is still nothing.  The software connects fine ... it is online ... It synchronizes fine but it does not replay the blockchain because the wallet is gone.  No, I did not delete it by mistake ... been in software for many years.     

I of course messed about a little ... to see if I had lost my mind ... but seemingly my mind is intact and my wallet and coins are gone.

https://blockchain.info/unspent?active=1LVRoNFddLmBpt7n2MFVUWqt5u5vFghstZ&format=html

So, how can I be more sure?  (grins).    I'd really like to know whether to cry in my beer or just drink it.   





 

[grue]

1. dump all your addresses (if possible, dump all the hidden "change" addresses as well)
2. go to blockexplorer/blockchain.info and check for any OUTGOING transactions that were made

[CalicoChris]

Nothing outgoing as yet.  
Done all the security stuff.  In fact, I'm even on a backup internet connection - I'm not even physically connected currently to the main router.  I cut everything!  I dropped everything!.  Checked logs, checked firewall, soft and hard logs ... could not see anything out of wack. 

I'll keep watching the blockchain and see what multibit has to say. 

Strange stuff ... only spoke on here about bitcoin - the rest was all private.  Yesterday asked some newby type questions about a Multibit upgrade.  We actively look after our security, hard and soft.  We're not security unconscious.  I knew that wallet needed to go cold, even though there is not massive amounts in there.  For having a non-cold wallet, I upped other security measures.  Strange stuff!     

[DannyHamilton]

That link you posted:

https://blockchain.info/unspent?active=1LVRoNFddLmBpt7n2MFVUWqt5u5vFghstZ&format=html

Shows 27.26794131 BTC in unspent outputs at that address?  How much do you expect that address to have?  I doubt that a thief would only take a portion of the balance and leave the other 26 BTC sitting there.

I'm really not sure that you've had anything stolen.

How many addresses do you have in MultiBit right now?

How much bitcoin do you think you should have right now?

If you look up each of your bitcoin addresses at blockchain.info, do they all show the balance that you expect?

[CalicoChris]

One address in multibit - very simple. Other addresses online and not at issue here.   

Blockchain balance is as you say ... 27.26794131 BTC in unspent outputs.

I have not seen anything go out.  Perhaps because I saw it so fast .. and reported it here so fast?  If it is a software problem, well, that we can fix yes.   But so far, no fixing has worked.  We'll wait for multibit to say their say.  I'm happy that I am not in their shoes ... if someone came to me for tech support on this, I would be really suspicious.     


 

[jim618]

I have mailed CalicoChris with some suggestions about wallet recovery.

As previous posters have commented, the BTC at the 1LVR address has not been moved so it looks like the private key has not been compromised.

[DannyHamilton]

CalicoCris,

The bitcoins are clearly still associated with the 1LVR address, therefore nobody has taken any of your bitcoins.

Please change the title/subject of this thread so as to avoid confusing others.

[CalicoChris]

So the case of a 'hacked wallet' changed into the case of a disappearing wallet.  With jim618's recovery suggestions I have my bitcoin back.  

Basically created a new wallet and this time created it on an external disk - so, no hot wallet any longer.  The method to import private keys is a little fiddly, but eventually it worked fine and my wallet is now restored with all of my bitcoin.  

Now I can drink that beer!  

Backup!  Daily!  Don't be lazy like I was and just accept your wallet software.  Learn it .. play with it, so that you know it, where it puts stuff and what it calls things and so on.

Great Tech Support from Jim618 and thank-you all.