Bitcoin Forum
February 19, 2018, 10:56:16 PM *
News: Latest stable version of Bitcoin Core: 0.15.1  [Torrent].
 
   Home   Help Search Donate Login Register  
Pages: [1]
  Print  
Author Topic: What EXACTLY happened here? Thoroughly confused.  (Read 220 times)
petrafan007
Newbie
*
Offline Offline

Activity: 4
Merit: 0


View Profile
December 03, 2017, 04:52:35 PM
 #1

Alright, so I was one of those unfortunate souls that (stupidly) provided my 12 word seed to btgwallet when bitcoingold.org posted it as a link on their site (and previously said it was safe). I'm joining a group/foundation who is trying to find out what legal options they may have (either against the theif, if we can find them or Bitcoingold). Part of the task is determing exactly what bitcoin address(es) were used in the transaction to steal my bitcoin. So, this point of this post is NOT help with finding who stole my bitcoin but on how to PROVE it was stolen.

First, here is a screenshot of my Jaxx Wallet:

http://josephcavallaro.ipage.com/btctrans.png

As you can see, I have what appears to be BTC being ADDED to my wallet.
When I click on the transaction and look at the transaction details, it shows TONS of addresses on the left and than (I think) the scammers wallet on the right.

https://live.blockcypher.com/btc/tx/e6fc6917c4809f5ccfd1e345d1e7e09f716b0bb0f50d371c6f5494e931c6a968

So, looking at this, how can I tell exactly what happened? My gut tells me my wallet was used a mixer or to launder the stolen BTC THROUGH (many other people were victims of this).

I only lost about ~0.52 worth of BTC...and surprisingly, they left about .064 BTC in my wallet, which I quickly moved to another wallet as soon as I saw what happened.

Notice AFTER I transferred my remaining BTC out ( which ended up being .05918 BTC)... there were STILL transactions that took place on my seed after!

I wish I could understand what the hell is going on. Most importantly, how do I find out MY address on this particular transaction so that I can sign it.

Thanks!
1519080976
Hero Member
*
Offline Offline

Posts: 1519080976

View Profile Personal Message (Offline)

Ignore
1519080976
Reply with quote  #2

1519080976
Report to moderator
1519080976
Hero Member
*
Offline Offline

Posts: 1519080976

View Profile Personal Message (Offline)

Ignore
1519080976
Reply with quote  #2

1519080976
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1519080976
Hero Member
*
Offline Offline

Posts: 1519080976

View Profile Personal Message (Offline)

Ignore
1519080976
Reply with quote  #2

1519080976
Report to moderator
DarkStar_
Legendary
*
Online Online

Activity: 882
Merit: 1108

Offering an Escrow Service | bit.ly/DScrow


View Profile WWW
December 03, 2017, 05:28:48 PM
 #2

The thief sweeped many of the wallets he hacked at the same time. The long list of inputs are probably addresses that belong to other people he stole from, and he is creating a large transaction to reduce the number of inputs he has to deal with in the end to save on fees. You can find a list of your addresses using these steps, and then compare to see which ones were used in that transaction. Afterwards, you can sign from the address that was stolen from.

kahc
Member
**
Offline Offline

Activity: 126
Merit: 10


View Profile
December 03, 2017, 05:59:57 PM
 #3


If enough people report that address as scam. That should be proof enough.
http://bitcoinwhoswho.com/address/1DVhaBdbp5mx5Y8zR1qR9NBiQtrgL9ZNQs
malikusama
Sr. Member
****
Offline Offline

Activity: 490
Merit: 270

I am wearing nothing


View Profile
December 03, 2017, 06:55:58 PM
 #4

What i have concluded that the link posted in bitcoingold.org was manipulated by the hacker, or he may have redirected that link to his own link where you have provided you 12 word seed and he easily got access to your wallet. That's what actually happened according to me, i think bitcoingold.org is responsible for all this.
ImHash
Hero Member
*****
Offline Offline

Activity: 630
Merit: 500

segwit=lower fees


View Profile
December 03, 2017, 08:21:06 PM
 #5

Not a technical issue of bitcoin, You were greedy and blinded by it, You diden't even think before giving away your entire wallet to someone else. Did you think that you are gonna get them free coinz and have fun? No such a thing as free lunch. I sold some of my BTG the first day of fork on yobit Cheesy

Would review 100 posts/day for quality check for $10/day
HCP
Hero Member
*****
Offline Offline

Activity: 518
Merit: 594

<insert witty quote here>


View Profile
December 04, 2017, 03:45:02 AM
 #6



As you can see, I have what appears to be BTC being ADDED to my wallet.
When I click on the transaction and look at the transaction details, it shows TONS of addresses on the left and than (I think) the scammers wallet on the right.

https://live.blockcypher.com/btc/tx/e6fc6917c4809f5ccfd1e345d1e7e09f716b0bb0f50d371c6f5494e931c6a968

So, looking at this, how can I tell exactly what happened? My gut tells me my wallet was used a mixer or to launder the stolen BTC THROUGH (many other people were victims of this).
Firstly (because blockcypher looks horrible for large transactions): https://blockchain.info/tx/e6fc6917c4809f5ccfd1e345d1e7e09f716b0bb0f50d371c6f5494e931c6a968

So, are you saying that "1DVhaBdbp5mx5Y8zR1qR9NBiQtrgL9ZNQs" address is actually contained in your wallet? if you look through all your addresses, do you see this address?

If so, it would indeed appear that the thief has attempted to move the stolen funds through your wallet (1 minute gap between all the funds going in and going out) to try and cover their tracks maybe?

If you can't see your addresses in Jaxx easily, given that your wallet is already compromised, just use https://iancoleman.io/bip39/

Put your seed in, I think Jaxx uses a derivation path of m/44'/0'/0', so if you just click the BIP44 tab, you should see all your addresses/keys. Have a hunt through those looking for the "1DVhaB..." address.


Pages: [1]
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!