What EXACTLY happened here? Thoroughly confused.

[petrafan007]

Alright, so I was one of those unfortunate souls that (stupidly) provided my 12 word seed to btgwallet when bitcoingold.org posted it as a link on their site (and previously said it was safe). I'm joining a group/foundation who is trying to find out what legal options they may have (either against the theif, if we can find them or Bitcoingold). Part of the task is determing exactly what bitcoin address(es) were used in the transaction to steal my bitcoin. So, this point of this post is NOT help with finding who stole my bitcoin but on how to PROVE it was stolen.

First, here is a screenshot of my Jaxx Wallet:

http://josephcavallaro.ipage.com/btctrans.png

As you can see, I have what appears to be BTC being ADDED to my wallet.
When I click on the transaction and look at the transaction details, it shows TONS of addresses on the left and than (I think) the scammers wallet on the right.

https://live.blockcypher.com/btc/tx/e6fc6917c4809f5ccfd1e345d1e7e09f716b0bb0f50d371c6f5494e931c6a968

So, looking at this, how can I tell exactly what happened? My gut tells me my wallet was used a mixer or to launder the stolen BTC THROUGH (many other people were victims of this).

I only lost about ~0.52 worth of BTC...and surprisingly, they left about .064 BTC in my wallet, which I quickly moved to another wallet as soon as I saw what happened.

Notice AFTER I transferred my remaining BTC out ( which ended up being .05918 BTC)... there were STILL transactions that took place on my seed after!

I wish I could understand what the hell is going on. Most importantly, how do I find out MY address on this particular transaction so that I can sign it.

Thanks!

[1715634352]

1715634352

[1715634352]

1715634352

[1715634352]

1715634352

[DarkStar_]

The thief sweeped many of the wallets he hacked at the same time. The long list of inputs are probably addresses that belong to other people he stole from, and he is creating a large transaction to reduce the number of inputs he has to deal with in the end to save on fees. You can find a list of your addresses using these steps, and then compare to see which ones were used in that transaction. Afterwards, you can sign from the address that was stolen from.

[kahc]

If enough people report that address as scam. That should be proof enough.
http://bitcoinwhoswho.com/address/1DVhaBdbp5mx5Y8zR1qR9NBiQtrgL9ZNQs

[malikusama]

What i have concluded that the link posted in bitcoingold.org was manipulated by the hacker, or he may have redirected that link to his own link where you have provided you 12 word seed and he easily got access to your wallet. That's what actually happened according to me, i think bitcoingold.org is responsible for all this.

[ImHash]

Not a technical issue of bitcoin, You were greedy and blinded by it, You diden't even think before giving away your entire wallet to someone else. Did you think that you are gonna get them free coinz and have fun? No such a thing as free lunch. I sold some of my BTG the first day of fork on yobit

[HCP]

As you can see, I have what appears to be BTC being ADDED to my wallet.
When I click on the transaction and look at the transaction details, it shows TONS of addresses on the left and than (I think) the scammers wallet on the right.

https://live.blockcypher.com/btc/tx/e6fc6917c4809f5ccfd1e345d1e7e09f716b0bb0f50d371c6f5494e931c6a968

So, looking at this, how can I tell exactly what happened? My gut tells me my wallet was used a mixer or to launder the stolen BTC THROUGH (many other people were victims of this).

Firstly (because blockcypher looks horrible for large transactions): https://blockchain.info/tx/e6fc6917c4809f5ccfd1e345d1e7e09f716b0bb0f50d371c6f5494e931c6a968

So, are you saying that "1DVhaBdbp5mx5Y8zR1qR9NBiQtrgL9ZNQs" address is actually contained in your wallet? if you look through all your addresses, do you see this address?

If so, it would indeed appear that the thief has attempted to move the stolen funds through your wallet (1 minute gap between all the funds going in and going out) to try and cover their tracks maybe?

If you can't see your addresses in Jaxx easily, given that your wallet is already compromised, just use https://iancoleman.io/bip39/

Put your seed in, I think Jaxx uses a derivation path of m/44'/0'/0', so if you just click the BIP44 tab, you should see all your addresses/keys. Have a hunt through those looking for the "1DVhaB..." address.