Lost all my bitcoin on the day of the fork in bizarre turn of events

[Mcbilliam]

This is a puzzler...

I'll start from the beginning. I use coinbase to buy bitcoin  Using a credit card. Knowing of the upcoming fork I decided to transfer the entire balance 0.13 BTC to my Jaxx mobile wallet because I could shapeshift to a different currency on the go if bitcoin price crashed on the go. This is exactly what happened. Watching the bitcoin price plummet I shapeshifted the full balance to ETC which was stable and rising a little. After I woke up the next day I noticed that my transaction was not confirmed. After a full day without confirmation some balance appeared back in my wallet, still with the transfer unconfirmed this is when I went straight to my coinbase account, scanned the QR code address and transferred the full balance back. That was on Sunday when the fork was supposed to happen. Those 0.13 BTC never arrived and I've no idea why. The Jaxx and coinbase support were fully useless which is why I thoight I'd consult some actual experts on here. I still have my 12 word password. I used this to recover my Jaxx wallet on a different device to see if it worked and kept logging on to check if the BTC turned up over the next week. To this day I don't know if it was the shapeshift or the transfer where it was lost. The transaction is now sitting at successful and I can see my bitcoin sitting in some address. Another point to note is that on November 12th was the date where I hit send from my Jaxx to coinbase. Yet on my Jaxx wallet it's split into two transactions on the 15th and 17th basically at the exact times I logged in to my recovery account on my laptops. I'm not too worried about this aspect but it is odd. Just like a delayed bank transfer I assume??

Here are the two (yes two, idk why it wasn't just one) outgoing transactions

29b66c0581d32625a68207b3c43317ce3c26244cf290acf36dc4a2a76647f466

631b800a2cb41b34213603efbdf02518387d30f4171431b35e72a103158c3aa0

Were they lost in the shapeshift? Could they have been transferred to the incorrect recipient address? My coinbase one has changed since so I can't really confirm this. It currently says it's this

14BguFGySJrEDTdmuggfZ7qH7gucSaDZgF




Any ideas? Goes without saying that anyone who helps me get my bitcoin back would be rewarded for their efforts

[1715031367]

1715031367

[1715031367]

1715031367

[1715031367]

1715031367

[1715031367]

1715031367

[morbius55]

I presume you haven't opened any of the coin base phishing emails going around?

[buwaytress]

Would have pointed you to Jaxx support but you said they weren't helpful?

A little hard to diagnose but let's start at this point:
1. You sent all your BTC to your Jaxx wallet, correct? This was already confirmed as BTC in Jaxx before you ShapeShifted your entire BTC balance to ETC, correct?

If so, what was the Shapeshift BTC address you supposedly deposited to? If you have this, we can determine if it was indeed sent or not. Or the transaction ID that never confirmed.

2. You then transferred the entire BTC back into Coinbase. What was the deposit address for this? I find it strange that if you did indeed hit Send on Nov 12, you should have had a transaction broadcast already. That should also be in your Jaxx history

3. If there were 2 following transactions, these would have to be double spends or RBF if (2) happened - to my knowledge, not supported by Jaxx. Anyway, as morbius implies, if they coincided with the times you logged in, then it seems to be that your laptop is compromised.

[Mcbilliam]

First up, thanks for your replies.

I did a quick check of my emails and can't see any suspicious phishing type emails. The laptop I recovered my account to is my work laptop which I wouldn't think would be comprised as it's only used for engineering related work. If something was to be compromised I would suspect it would be more likely my phone if it had to be one of the two. A point to note is that I only recovered my Jaxx wallet on the laptop after a few days of this whole ordeal.

Moving on, I can confirm that the coinbase to Jaxx transaction went without interference:

https://live.blockcypher.com/btc/tx/05be8a383229ccd7b70edc54585cc4e146490608fd7b839428fd8cd069a16766

This was probably done 12 hours before the shapeshift attempt.

After the shapeshift took ages and with some funds reappearing in my account (shapeshift still unconfirmed) I did this Jaxx to coinbase transfer

https://live.blockcypher.com/btc/tx/05be8a383229ccd7b70edc54585cc4e146490608fd7b839428fd8cd069a16766

This comes up with nothing, which is kind of expected as I think this falls into the category of a double spend if I'm trying to transfer the funds when they've already been sent to shapeshift.

Here's the bad part. Following th Jaxx support advice I reset my cache data in an attempt to resolve the stuck transaction. This deleted all my transaction history, until that is i recovered the account on my laptop. So I don't have the shapeshift transfer info. My Jaxx to coinbase doesn't appear on the transfer history either, I only have those details from my emails with Jaxx support. So at this point I create the laptop Jaxx backup. I log in a bunch of times to unconfirmed transfers and then on the 15th and 17th at the very time I log into my laptop Jaxx to check the status I have two sent transactions (when my account balance read 0 how was I able to send these). This is why I suspected that these two transactions were delayed from Sunday and not phishing. If you look at the addressess in the original message you can see the BTC sitting there. I feel if it was a hack then it would be spent or part of a larger value perhaps.

Anything else you guys need?

Again thank you for the support

[achow101]

Moving on, I can confirm that the coinbase to Jaxx transaction went without interference:

https://live.blockcypher.com/btc/tx/05be8a383229ccd7b70edc54585cc4e146490608fd7b839428fd8cd069a16766

This was probably done 12 hours before the shapeshift attempt.

After the shapeshift took ages and with some funds reappearing in my account (shapeshift still unconfirmed) I did this Jaxx to coinbase transfer

https://live.blockcypher.com/btc/tx/05be8a383229ccd7b70edc54585cc4e146490608fd7b839428fd8cd069a16766

These two transactions are the same...

This comes up with nothing, which is kind of expected as I think this falls into the category of a double spend if I'm trying to transfer the funds when they've already been sent to shapeshift.

Here's the bad part. Following th Jaxx support advice I reset my cache data in an attempt to resolve the stuck transaction. This deleted all my transaction history, until that is i recovered the account on my laptop. So I don't have the shapeshift transfer info. My Jaxx to coinbase doesn't appear on the transfer history either, I only have those details from my emails with Jaxx support. So at this point I create the laptop Jaxx backup. I log in a bunch of times to unconfirmed transfers and then on the 15th and 17th at the very time I log into my laptop Jaxx to check the status I have two sent transactions (when my account balance read 0 how was I able to send these). This is why I suspected that these two transactions were delayed from Sunday and not phishing. If you look at the addressess in the original message you can see the BTC sitting there. I feel if it was a hack then it would be spent or part of a larger value perhaps.

Anything else you guys need?

Again thank you for the support

When you open your Jaxx wallet, what do you see (perhaps post a screenshot)? What are the addresses and txids involved here?

If your transactions never confirmed, then your Bitcoin is not lost and they are in your wallet. If one of your transactions did confirm, then the Bitcoin is with whoever you sent the Bitcoin to (Coinbase or Shapeshift).

[Mcbilliam]

http://i44.photobucket.com/albums/f5/Kerr_McWilliam/IMG_0824_zpsejiz756n.png

Hopefully one of those worked.

The transactions are confirmed as you suggested. It seems it just hasn't arrive at my coinbase address and I don't know why it wouldn't have as I scanned the QR code to my account.

[Mcbilliam]

Coinbase changes addresses as you'll know.

Here are a list of mine in the past. It looks as if the recipient address of my bitcoin was none of them. How would this have happened? 1, I somehow scanned the wrong QR code? 2, I was infact a victim of a phishing hack? 3, that address has something to do with the original shapeshift attempt.

Each account on Coinbase is a collection of addresses. New addresses are automatically generated for each payment on Coinbase and stay associated with your account forever (so it is safe to reuse them).
 
bitcoin address

Address   Label   Created   
1CvWXwVowhRFi4TbU6miFvZcrNGT64T9Au
3 minutes ago   Details

14BguFGySJrEDTdmuggfZ7qH7gucSaDZgF
about 19 hours ago   Details

16frfsCefQ8G6GGXM7dYfvgbHvw7woLS1v
12 days ago   Details

1AtAYxjLetGrHVpDRbdnSpPnA3o5ohTNUE
15 days ago   Details

1FHk5w9E5A1Rkjc1AZK3ymQu7u5aQUCpzs
15 days ago   Details

178t7tUH8GpsQYVjmcGQXUTLWZzJNrXnqG
17 days ago   Details

14Jo7d32rcWxzUV1x6Z5zPm6EPFsntLiBZ
17 days ago   Details

1NBgUecvmWRGQ3xNSBQQU3WHeYQQEZZKwi
17 days ago   Details

1FnnCerMTsnKs9niAqZfudGWdnhEn74QeB
17 days ago   Details

1DvQP5Ei7h9t2ZHF29bo4sCN3PLRird7nx
4 months ago   Details

[achow101]

Hopefully one of those worked.

The transactions are confirmed as you suggested. It seems it just hasn't arrive at my coinbase address and I don't know why it wouldn't have as I scanned the QR code to my account.

What are the addresses and txids of the top two transactions in that screenshot? Are those transactions confirmed or unconfirmed?

[Mcbilliam]

Both Confirmed now.
Nov 15th
Sent from:
1HMDo8fih7i4tNM1YnoBGYwgp9YXAousz7

Sent to:
3ATq4854DnkFoAMhKP5FTUCeJeHXgvWjYK

Transaction ID:
631b800a2cb41b34213603efbdf02518387d30f4171431b35e72a103158c3aa0

Link:
https://live.blockcypher.com/btc/address/1HMDo8fih7i4tNM1YnoBGYwgp9YXAousz7/



Nov 17th
Sent from (it has 4 that make up 0.0454BTC?):
17YKecbVdYVHjDuuh74dftd9mwF7ftbS4F
1D9zz1LdJmSYPf7tQo5YKXoEPoDWfK5puh (Again?)
13fCjUnvjfC2LrKc5aAdf3mcCL8QotccvD

Sent to:
3DhDTgW6G5CFaqbtK2UFGBJFkQk6sGkC63

Transaction ID:
29b66c0581d32625a68207b3c43317ce3c26244cf290acf36dc4a2a76647f466

Link:
https://live.blockcypher.com/btc/tx/29b66c0581d32625a68207b3c43317ce3c26244cf290acf36dc4a2a76647f466/

[achow101]

What are the addresses 3ATq4854DnkFoAMhKP5FTUCeJeHXgvWjYK and 3DhDTgW6G5CFaqbtK2UFGBJFkQk6sGkC63 for? Whatever they are, your coins are associated with those addresses. If those are addresses from an exchange, then go to their respective exchanges and your coins will be there.

[Kakmakr]

Just want to play Devil's advocate here for a second. Jaxx support's advice was to reset your cache data. <which would be a normal response if you were a tech support, but what if they knew that it would remove all traces of the transaction on your side>?

Do you Copy&Paste Bitcoin addresses at all? Some Malware detect when you Copy Bitcoin data and then they replace your data with their Bitcoin address. <Do a test to eliminate that scenario>

[Mcbilliam]

It is unknown to me what those recipient addresses are for, which is why it's hard to bang my drum about about if either the shapeshift failed or the coinbase transfer failed in some way. I assume there's no way of investigating this further?

I didn't in this instance copy and paste the bitcoin address, I used the shapeshift inbuilt feature in Jaxx and then a scan of the qr code for coinbase. Testing this however it did not change when I copied and pasted

[Flat.E]

Your btc are at shapeshift, conversions don't go through if deposit does not confirm within 48 hours, the conversions were cancelled.
https://shapeshift.io/txstat/3ATq4854DnkFoAMhKP5FTUCeJeHXgvWjYK
https://blockchain.info/address/3ATq4854DnkFoAMhKP5FTUCeJeHXgvWjYK
https://shapeshift.io/txstat/3DhDTgW6G5CFaqbtK2UFGBJFkQk6sGkC63
https://blockchain.info/address/3DhDTgW6G5CFaqbtK2UFGBJFkQk6sGkC63

Make a ticket at shapeshift support.

[Flat.E]

How has this worked out, any success?
I wonder btw if shapeshift sorts this things out by themselves if one would not ask, had to take this route myself twice already with them.

[Mcbilliam]

Sorry for the late reply. I logged a ticket with shapeshift as suggested and although they took a few days to get acknowledged to me it was an incredibly quick, "we will issue a refund back to your address". So in answer to your question, they would have only done this once prompted because it was over 2 weeks since it reached them. I'm over the moon to have it back and appreciate all input and ideas from the replies I got on this request for help

[Flat.E]

Any ideas? Goes without saying that anyone who helps me get my bitcoin back would be rewarded for their efforts

Well,  ....

[Flat.E]

Thanks man, received, most generous! 

[Mcbilliam]

No problem mate, thanks again for the help. I really didn't know how much to send but hopefully that will buy you a couple drinks to say thanks