Missing outputs. Core shows different balance than block explorer and Electrum

[Tryptohash]

Hello everyone.

A friend of mine has very irritating problem which I am going to outline below.

He has been using Bitcoin Core and kept his BTC on Core during 1st August hard fork. After the hard fork on 2nd of August it stopped syncing and this state continues up to this day. Since I've never encountered such a problem I decided the best way was to extract private keys and create wallet in Electrum. We also managed to recover his BCH also in Electron Cash. After inserting all keys into Electrum we realised that something is not quite right.

It turned out that balances that Core and Electrum displayed are not matching.
Core:       2.395BTC
Ethereum: 0.991BTC
What is even more worrying is that block explorer shows around 0.991BTC which is the amount Electrum presents. My friend says that the after this split he didn't transfer any funds and Core presented the same balance before the fork and after it stopped syncing.

I was digging into the subject, because it's almost uncanny that there was such a whopping difference and I found a transaction that concerned me.
https://blockchain.info/pl/tx/cb39028a8880a0b38b72edf39ed3c9637adef891fc403b4ab75929f8c924b374
From where we checked he actually send 1.92BTC, but he doesn't recall the second output (1.08961509 BTC). Core also doesn't show that output and because of that the balance was wrong for almost 10 days! It looks like somebody stole his funds.

1. What could cause Core to display wrong balance even?
2. What output is that 1.08961509 BTC? It is surely no transaction fees

Please help.
Best regards,
Tryptohash

[1715693416]

1715693416

[cr1776]

Perhaps it is a change address and you didn’t get ALL the keys from his Bitcoin Core wallet?

There are instructions all over to export all keys (including change addresses) such as:
https://bitcoin.stackexchange.com/questions/4632/how-can-i-export-all-my-private-keys-using-bitcoind

[aleksej996]

Hello everyone.

Hello.

After the hard fork on 2nd of August it stopped syncing and this state continues up to this day.

Weird bug, have you tried restarting Bitcoin Core? Maybe delete the peers.dat file in the data directory. Always try restarting the computer when you have any bug.

I was digging into the subject, because it's almost uncanny that there was such a whopping difference and I found a transaction that concerned me.
https://blockchain.info/pl/tx/cb39028a8880a0b38b72edf39ed3c9637adef891fc403b4ab75929f8c924b374
From where we checked he actually send 1.92BTC, but he doesn't recall the second output (1.08961509 BTC). Core also doesn't show that output and because of that the balance was wrong for almost 10 days! It looks like somebody stole his funds.

That seems like good news to me. If someone stole the funds, he would have created a new transaction probably, instead of waiting for your friend to send one and then piggyback on it. This is also a default behavior of Bitcoin Core to create the change address and send the remaining funds to it, as you can't just not send bitcoins from the specified inputs in the transaction, otherwise they will be counted as the mining fee, don't want to bother you with to much detail tho. The point is that you should go to Bitcoin Core and then click on Help->Debug window->Console and type:

Code:

dumpprivkey "18bVb8yd8iFBe977eK2Q3Qdaz9jc6pBFRC"

That will give you the private key of that address and you will have your coins.

Please help.
Best regards,
Tryptohash

I hope I did, enjoy your coins, feel free to send me some at the address on my profile
Best regards,
Aleksej

[HCP]

It's a change address... and it sounds like your friend has only exported the keys for the "Receiving Addresses" listed in his wallet.

You can locate ALL the addresses that contain coins (including change addresses) in Bitcoin Core by using the "listunspent" command in "Help -> debug window -> console"... once you have all the necessary addresses, use the "dumpprivkey" command in the console to get the private keys and then import them all into Electrum.

Your friend should then see the correct balance.

[Tryptohash]

Enormous thanks to all of you. Just when I read the words "change address" I realized what was missing from my story.