Double spending problem. Is my money stuck?

[ChaosGen]

Hi,

could someone please help me to understand what's going on?

I've tried to send some bitcoins using Armory from my wallet. I've had a ton of difficulties with broadcasting transactions using it. But finally I've had some success doing that. But after broadcasting succeded, the transactions themselves didn't happen (were not confirmed). I'm completely confused and trying to understand what's going on.

Here's the first transaction.

1. On 25th of April I'm receiving 3.12 BTC to the address: 122YiteUPtjafPyYFm5oZrRjYFLFcwjoSP

https://blockchain.info/tx/ff8f026460ca1832d4890b2f396c9c2436f2a0f438e13266b037c1b08de743b5

2. Yesterday at 3:13 AM I'm trying to send all my BTC to 159v4oUqV2ztrcT4wTGhkLG6DqLN7frbET:
https://blockchain.info/tx/d76bb69d13af24b2a1c5b7c7b02431b4cc45e462eba9692ce390576b16e1cf5c

I've generated the transaction using Armory and broadcasted it using blockchain.info. Everything was fine. It got accepted by the blockchain and I was waiting for it to be confirmed.

3. Yesterday at midnight I've checked the transaction status and saw double-spend there. Then I detect this transaction: https://blockchain.info/tx-index/248925562
It was made at 16:48 yesterday. And I'm quite sure that I didn't make it since I was talking on the phone at the moment. But Armory was opened. So I have the several question about it.

a) Does this mean that my PC is hijacked? Or could this be that Armory somehow broadcasted some old transaction that I was trying to make?
b) It sends to two addresses: 1M9uxj7qayx8kEcEZd8NX8Hx4uKFxVQfLD -> 0.007 BTC,  13FDNGKc6y6Y7aD3s3bheWsBBx8Dis8XBi -> 13FDNGKc6y6Y7aD3s3bheWsBBx8Dis8XBi. Estimated BTC transacted is 0.007BTC. The second address is listed my wallet's "Change addresses". So as far as I understand this one is mine. But I have no idea who does the first address belong to.

Also. The transaction was relayed by IP which belongs to New Jersey, USA. I personally live in Ukraine. So this tells me that the transaction wasn't made from my PC. But how can this be possible? Does that mean that someone hijacked my private key and basically owns my money now?

4. There's one more transaction. Which I've made today a couple of hours ago. I thought that since there was a double spend then it means I can use my money again. But it appeared not to be the case. I've made another transaction and it showed double spend once again:
https://blockchain.info/tx/6778c2fec5aa097793b710fe09365db2c8310924d01c336d38fa832ed1065a9a


Any help is highly appreciated. I'm a complete noob in this thing and I'm not quite understanding what's going on.

So the most important question is what should I expect next and how can I send my BTC to the address I needed? Will one of transactions be eventually confirmed? Or will there be any kind of another resolution?

Thank you very much for help.

[1714045245]

1714045245

[1714045245]

1714045245

[1714045245]

1714045245

[1714045245]

1714045245

[achow101]

3. Yesterday at midnight I've checked the transaction status and saw double-spend there. Then I detect this transaction: https://blockchain.info/tx-index/248925562
It was made at 16:48 yesterday. And I'm quite sure that I didn't make it since I was talking on the phone at the moment. But Armory was opened. So I have the several question about it.

The time that is listed is not necessarily the time that the transaction was made and broadcast. That time is just the time that blockchain.info received the transaction.

a) Does this mean that my PC is hijacked? '

Possibly. Double check that your computer does not have any malware on it.

Or could this be that Armory somehow broadcasted some old transaction that I was trying to make?

Possible but unlikely. If it were, you should see those transactions in your transactions list. Did you attempt to make transactions since the time that you received the Bitcoin specifically at 122YiteUPtjafPyYFm5oZrRjYFLFcwjoSP? If you did, did you receive any error when you made those transactions and then tried redoing the transaction?

Also. The transaction was relayed by IP which belongs to New Jersey, USA. I personally live in Ukraine. So this tells me that the transaction wasn't made from my PC. But how can this be possible? Does that mean that someone hijacked my private key and basically owns my money now?

The IP address which blockchain.info lists is completely meaningless. It is just the IP address of the node which relayed the transaction to them, not the IP address of the node that first broadcast the transaction.

So the most important question is what should I expect next and how can I send my BTC to the address I needed? Will one of transactions be eventually confirmed? Or will there be any kind of another resolution?

Only one of your transactions will be able to confirm. There is no way to "cancel" them. The only thing you should do is to wait and stop making transactions until one of these three confirms. If you control the addresses which are receiving the Bitcoin or the address is to someone (or service) that you intended the Bitcoin to go to, then everything is fine. If you do not recognize any of the addresses, it is likely that your computer has been compromised.

[ChaosGen]

Did you attempt to make transactions since the time that you received the Bitcoin specifically at 122YiteUPtjafPyYFm5oZrRjYFLFcwjoSP? If you did, did you receive any error when you made those transactions and then tried redoing the transaction?

I did. I think I've tried to send those money for like 20 times or so. And always either got tx broadcast timed out error or no error, but transaction didn't apper at blockchain.info.

Only one of your transactions will be able to confirm. There is no way to "cancel" them. The only thing you should do is to wait and stop making transactions until one of these three confirms. If you control the addresses which are receiving the Bitcoin or the address is to someone (or service) that you intended the Bitcoin to go to, then everything is fine. If you do not recognize any of the addresses, it is likely that your computer has been compromised.

Well, I control addresses that I've explained in 2 and 4, but I don't control both addresses in 3. The first one that receives 0.007 BTC is unknown to me. The second (which receives ~3BTC ) is listed in my Armory's change addresses. Does that mean that I control it?

Are you sure there's nothing can be done about the situation and I will basically lose money if the transaction from 3 will be confirmed? Is there a possibility to double-spend it once again with like 10x fee maybe?


Also. Is this a bad sign that this site accepts only the 3rd transaction ID (addresses from which I don't control) and says that it cannot find the transaction when I input IDs from 2 and 4? https://www.mocacinno.com/feecheck.php?txid=4f17cbc42bf09afd0f0246eb88700b4b4c9229ba4c7d8560b2f143b7028b590b

[ChaosGen]

Also.  If we assume that my PC is compromised, is there anything I can do right now to prevent the hijacker from creating new transactions from my wallet?

[achow101]

I did. I think I've tried to send those money for like 20 times or so. And always either got tx broadcast timed out error or no error, but transaction didn't apper at blockchain.info.

Which versions of Armory and Bitcoin Core are you using? Can you also post the armory log files (armorylog.txt and dbLog.txt)?

Well, I control addresses that I've explained in 2 and 4, but I don't control both addresses in 3. The first one that receives 0.007 BTC is unknown to me. The second (which receives ~3BTC ) is listed in my Armory's change addresses. Does that mean that I control it?

Yes, you control that address as it is a change address.

Did you attempt to make a transaction of 0.007 BTC since April 25th?

Are you sure there's nothing can be done about the situation and I will basically lose money if the transaction from 3 will be confirmed?

Since you control the change address, you will at worst lose 0.007 BTC.

Is there a possibility to double-spend it once again with like 10x fee maybe?

Yes, but I wouldn't recommend it since you already have multiple conflicting transactions.

Also. Is this a bad sign that this site accepts only the 3rd transaction ID (addresses from which I don't control) and says that it cannot find the transaction when I input IDs from 2 and 4? https://www.mocacinno.com/feecheck.php?txid=4f17cbc42bf09afd0f0246eb88700b4b4c9229ba4c7d8560b2f143b7028b590b

No, not bad at all. That site uses Bitcoin Core in the background and if it receives a transaction which conflicts with another in its mempool, that conflicting transaction will be rejected. What happened here is that it received the 3rd transaction first thus it rejected and did not keep the other two transactions.

Also.  If we assume that my PC is compromised, is there anything I can do right now to prevent the hijacker from creating new transactions from my wallet?

If they have a copy of your wallet file and the password, then there is nothing you can do. However, I think it is unlikely that your computer is compromised. Rather I think the issue lies in Armory doing something wrong because of multiple broadcast failures.

[ChaosGen]

Okay. I finally remembered it!

I think that this 3rd transaction is the donation that I've made. But I've made it on 30th of April. And apparently somehow it was broadcasted only yesterday. The bad thing is that it has only 3.8Sat/byte fee. Will it actually ever be confirmed with such a tiny comission? Again, you saying that there's no way to accelerate it, right?

Which versions of Armory and Bitcoin Core are you using? Can you also post the armory log files (armorylog.txt and dbLog.txt)?

I've posted it here:
https://bitcointalk.org/index.php?topic=1902693.msg18948807#msg18948807

[achow101]

I think that this 3rd transaction is the donation that I've made. But I've made it on 30th of April. And apparently somehow it was broadcasted only yesterday.

Transactions can be rebroadcast. It possible that someone rebroadcast that transaction after it had been "forgotten" by the network.

The bad thing is that it has only 3.8Sat/byte fee. Will it actually ever be confirmed with such a tiny comission?

It can confirm, but I think it is unlikely.

Again, you saying that there's no way to accelerate it, right?

You could make another double spending transaction but include a much much higher transaction fee. However, since one of your transactions contains an ok transaction fee (still quite low, but way above the minimum), such a double spend may not work.



You should upgrade to Bitcoin Core 0.14.1.

[ChaosGen]

Thank you very much for help. But it's still not quite clear for me what to do next, since I see a kind of a contradiction within what you're saying.

1. You're saying that I shouldn't redoublespend since I already have multiple conflicting transactions and it might not work since one of the transactions has a somewhat okay fee.
2. Still you're saying that transaction #3 with 3.8Sat/Byte fee will probably not ever be confirmed.

Does that mean that if I do nothing then the most likely scenario is that transaction #4 with 150 Sat/Byte fee will be confirmed first (out of three other txs) within several days?

[achow101]

Thank you very much for help. But it's still not quite clear for me what to do next, since I see a kind of a contradiction within what you're saying.

1. You're saying that I shouldn't redoublespend since I already have multiple conflicting transactions and it might not work since one of the transactions has a somewhat okay fee.
2. Still you're saying that transaction #3 with 3.8Sat/Byte fee will probably not ever be confirmed.

Does that mean that if I do nothing then the most likely scenario is that transaction #4 with 150 Sat/Byte fee will be confirmed first (out of three other txs) within several days?

Yes.

Only one of those transactions can ever confirm, not that one will confirm first.