(Help!) Blockchain.info - Transaction change moved to unknown address

[Janju]

I'm not sleeping because of a possible bug in the wallet blockchain info.

I keep my BTCs in a cold wallet, which I enter the PK in the option of importing addresses from Blockchain.info, and transfer the desired amount to the exchange, moving the rest to another cold wallet that I create with bitaddress, I've been doing this for a while and I've never had problems.

To track the balance, I always enter the public key in blockchain.info (Watch Address), this time I saw that there was a 'Private Key' field on the screen below the Watch Address, allowing me to move my bitcoins right there, without having to import them.

I entered the private key in the field below the public key of Watch Address, put the exchange address and the amount that I want to send, imagining that the change of the partil spend, should go to the main wallet.

https://i.stack.imgur.com/A76xC.png
PK field

However, the balance that was in the paper wallet: https://blockchain.info/en/address/1AXXCct4QATf2UdX92piw1AA2As8AoZaoM, was moved to change address: https://blockchain.info/en/address/1KfTVrLG376B7SYb1bA6NnY7KyK825T72B, which had 2 outputs, one for the exchange (1PjcZKMFR8wkFjoMAE2aoVfSeB5xHwVLdu) and another for herself (Change).

https://i.stack.imgur.com/lSVH2.png
Outputs

But, this address does not have a private key (1KfTVrLG376B7SYb1bA6NnY7KyK825T72B), is appearing as Watch Only in Blockchain, I understand that it should be moved to main wallet address containing the change funds.

https://i.stack.imgur.com/TOa8R.png
Watch Only Change Address

I have already tried to use the tool: https://iancoleman.github.io/bip39/, as described in this post: https://bitcointalk.org/index.php?topic=2162043.0, which shows all addresses generated by the seed of blockchain.info, I find some of the retroactive outputs of this change, but not the 1KfTVrLG376B7SYb1bA6NnY7KyK825T72B.

I tried to email them through the request page, but I do not think they'll respond there.

The value is low but it's all my savings, thank you for all your help.

[1715162519]

1715162519

[1715162519]

1715162519

[1715162519]

1715162519

[1715162519]

1715162519

[1715162519]

1715162519

[Potato Chips]

However, the balance that was in the paper wallet: https://blockchain.info/en/address/1AXXCct4QATf2UdX92piw1AA2As8AoZaoM, was moved to change address: https://blockchain.info/en/address/1KfTVrLG376B7SYb1bA6NnY7KyK825T72B, which had 2 outputs, one for the exchange (1PjcZKMFR8wkFjoMAE2aoVfSeB5xHwVLdu) and another for herself (Change).

I'd like to clarify something, So this address 1 (1AXXCct4QATf2UdX92piw1AA2As8AoZaoM) is from your paper wallet? and the funds from it was moved to Address 2 (1KfTVrLG376B7SYb1bA6NnY7KyK825T72B). But when I saw Address 1 transactions from the block explorers the funds were sent to Address 3 (1LsLpbPNS2w98WnKbQ2MmubkQBWhxbPvrz .

• https://blockchain.info/en/address/1AXXCct4QATf2UdX92piw1AA2As8AoZaoM
• https://btc.com/1AXXCct4QATf2UdX92piw1AA2As8AoZaoM

And on this part, It seems that you entered Address 2's private keys to spend the funds and send it to an exchange so it means you have its private keys  
Is this address also belongs to a paper wallet?

I entered the private key in the field below the public key of Watch Address, put the exchange address and the amount that I want to send, imagining that the change of the partil spend, should go to the main wallet.


PK field

[Janju]

I'd like to clarify something, So this address 1 (1AXXCct4QATf2UdX92piw1AA2As8AoZaoM) is from your paper wallet? and the funds from it was moved to Address 2 (1KfTVrLG376B7SYb1bA6NnY7KyK825T72B). But when I saw Address 1 transactions from the block explorers the funds were sent to Address 3 (1LsLpbPNS2w98WnKbQ2MmubkQBWhxbPvrz .

Yes, the address 1AXXCct4QATf2UdX92piw1AA2As8AoZaoM is my paper wallet, and: 1LsLpbPNS2w98WnKbQ2MmubkQBWhxbPvrz is generated by BKinfo to send funds to the miners in 1ExXPXA6NxwnBpuzdJb68cCsRRKC5Cr3D1.

I believe that in the address 141rWhPaeSpTqn2YH1fw2WFnwhojQTERyp, the balance should have been sent to the exchange: 1PjcZKMFR8wkFjoMAE2aoVfSeB5xHwVLdu, and then to himself, with the remaining balance being moved to my standard wallet.

However: 1KfTVrLG376B7SYb1bA6NnY7KyK825T72B was created after him, which is showing as Watch Only, and I can not get the funds out.

Both 141rWhPaeSpTqn2YH1fw2WFnwhojQTERyp (External) and 1LsLpbPNS2w98WnKbQ2MmubkQBWhxbPvrz (Internal) were found by me in the tool: https://iancoleman.github.io/bip39/ with the seed provided by my wallet, but not 1KfTVrLG376B7SYb1bA6NnY7KyK825T72B.

The question is, where is the PK of the 1KfTVrLG376B7SYb1bA6NnY7KyK825T72B? BKinfo, is showing this like Watch Address.

I can't find him in the BIP44 keys.

[Potato Chips]

Yes, the address 1AXXCct4QATf2UdX92piw1AA2As8AoZaoM is my paper wallet, and: 1LsLpbPNS2w98WnKbQ2MmubkQBWhxbPvrz is generated by BKinfo to send funds to the miners in 1ExXPXA6NxwnBpuzdJb68cCsRRKC5Cr3D1.

I don't know much about the technical parts in bitcoin mining but I'm pretty sure it doesn't go that way. Yes, Aside from the block reward, they also get to keep the transactions fees of the particular block they'd solved but it's just as simple as sending them to an address of their choosing.

I believe that in the address 141rWhPaeSpTqn2YH1fw2WFnwhojQTERyp, the balance should have been sent to the exchange: 1PjcZKMFR8wkFjoMAE2aoVfSeB5xHwVLdu, and then to himself, with the remaining balance being moved to my standard wallet.

According to block explorer's, You've used the outputs (funds) of address 1KfTVrLG376B7SYb1bA6NnY7KyK825T72B to send some bitcoins to the exchange.
(Reference: https://blockchain.info/tx/7b506a1623eb4edc0d10b221c8abc84e2f1c8b59b425cde566dc16b7c25bbdf3).

So this clearly doesn't happen and I don't see the exchange address from 141rWh......Ryp transactions either

However: 1KfTVrLG376B7SYb1bA6NnY7KyK825T72B was created after him, which is showing as Watch Only, and I can not get the funds out.

Both 141rWhPaeSpTqn2YH1fw2WFnwhojQTERyp (External) and 1LsLpbPNS2w98WnKbQ2MmubkQBWhxbPvrz (Internal) were found by me in the tool: https://iancoleman.github.io/bip39/ with the seed provided by my wallet, but not 1KfTVrLG376B7SYb1bA6NnY7KyK825T72B.

From my understanding address 1KfTVrLG376B7SYb1bA6NnY7KyK825T72B isn't from your  HD wallet in blockchain.info right? If yes then it won't show up no matter how many times you try as imported addresses are not included in your seed.

The question is, where is the PK of the 1KfTVrLG376B7SYb1bA6NnY7KyK825T72B? BKinfo, is showing this like Watch Address.

I've said this in my previous post but Isn't that address the one you're talking about below?:

I keep my BTCs in a cold wallet, which I enter the PK in the option of importing addresses from Blockchain.info, and transfer the desired amount to the exchange, moving the rest to another cold wallet that I create with bitaddress, I've been doing this for a while and I've never had problems.

To track the balance, I always enter the public key in blockchain.info (Watch Address), this time I saw that there was a 'Private Key' field on the screen below the Watch Address, allowing me to move my bitcoins right there, without having to import them.

I entered the private key in the field below the public key of Watch Address, put the exchange address and the amount that I want to send, imagining that the change of the partil spend, should go to the main wallet.


PK field

[Janju]

First of all, sorry for my bad english

Let's summarize the question, whenever I want to spend my funds from the cold wallet, I import them into the blockchain info, which goes to the standard wallet, and after sending how much I want somewhere, I create another cold wallet in bitaddress and send these funds back, just using the blockchain info to 'spend' them.

I always import the public key of the address created to view my balance as Watch-Address, this time being 1AXXCct4QATf2UdX92piw1AA2As8AoZaoM, then I noticed the PK field below the public address as in the picture below, and the same exists in the GitHub project, is not a malware or something else:

https://i.stack.imgur.com/A76xC.png

Then I inserted the exchange address: 1PjcZKMFR8wkFjoMAE2aoVfSeB5xHwVLdu, and I sent a portion of the balance, imagining that the change would go back either to 1AXXCct4QATf2UdX92piw1AA2As8AoZaoM or to the main blockchain wallet.

I believe that the outputs generated at the change address 1KfTVrLG376B7SYb1bA6NnY7KyK825T72B should be at 141rWhPaeSpTqn2YH1fw2WFnwhojQTERyp that is part of the HD wallet.

In fact this 1KfTVrLG376B7SYb1bA6NnY7KyK825T72B does not exist in the following paths: m/44'/0'/0'/0 (External Default Wallet), m/44'/0'/0'/1 (Internal Default Wallet).

Last internal address with funds (141rWhPaeSpTqn2YH1fw2WFnwhojQTERyp):
https://imageshack.com/a/img924/4746/mXx5Gw.png

Last external address with funds (1LsLpbPNS2w98WnKbQ2MmubkQBWhxbPvrz):
https://imageshack.com/a/img924/4808/WnYgFt.png

This address 1KfTVrLG376B7SYb1bA6NnY7KyK825T72B was imported by blockchain as WatchOnly without your private key, I'm thinking of doing a brute force on the seed and looking for it until I understand how they generate a change address.