[SOLVED] Help me recover 5 BTC and get 500 mBTC (~50$) reward

[coin_love]

(Mods, feel free to move this to the Technical Support forum)

The user who gives the hint that leads to the recovery of the 5 BTC will be awarded with 0.5 BTC.

I bought ~10BTC in April. I have used Bitcoin-Qt and a paper wallet. I recently wanted to move all my bitcoins to Coinbase.

I had the 10BTC from the paper wallet imported into Bitcoin-Qt back in April and had done a few tx from the client.

For some reason, I decided to import the paper wallet to Coinbase instead of doing a 10BTC tx from Bitcoin-Qt. Coinbase imported 4.91BTC succesfully.

I don't think the Bitcoin-Qt at this point had synced that paper wallet import and still showed ~10BTC balance. I went and made a 10BTC tx to Coinbase (it's the latest tx in the Bitcoin-Qt history).

This tx kept having 0 confirmations and never showed up in the blockchain. At this point, I realized the possibility of double spend as I had already imported 5BTC from the paper wallet to Coinbase. So having the 10BTC tx "fail" made sense, atleast I thought so.

But now I was stuck as Bitcoin-Qt showed 0 balance and I had only 5BTC of the 10BTC I own in Coinbase. 5BTC was still somewhere. My first idea was to remove the failed 10BTC tx and I used pywallet to remove it from wallet.dat and resynced Bitcoin-Qt. To my surprise, the tx was removed but Bitcoin-Qt kept showing 0 balance. This is weird, because after the tx removal the tx history should add up to a +4.9315 balance, and yet Bitcoin-Qt shows 0 balance.

The next realization was that for some unknown reason to me Bitcoin-Qt shows these two transactions as
-0.01 (see them here http://i.stack.imgur.com/fuwrU.png):
- https://blockchain.info/tx/ba8ae49fe114154b2e20a090d71070206525128f987245f2a011d1e676e86e75
- https://blockchain.info/tx/40c103b95170d4e5337985a39ca8105e910a8ee245dd4124412df1ce063a337f

When it seems, that they are actually worth ~5BTC combined. I then tried to find out where these transactions lead, but having looked through my email, mtgox, bitstamp and btce I still have no clue.

Bitcoin-Qt's full tx history http://i.stack.imgur.com/fuwrU.png

The paper wallet address 1Fr3pfbm41pDtqSiPeh2UYeX2mvZXq15bi.

I should mention that I did update the Bitcoin-Qt client from whatever version I had since April to 0.8.5 beta inbetween all of this.

Finally, the questions:
- Why is Bitcoin-Qt showing only -0.01 for the two transactions?
- Any ideas what could have happened and how it would be possible to recover the 5BTC?

Please let me know if I can provide any further details. Thank you.

[1714877352]

1714877352

[1714877352]

1714877352

[bardi.harborow]

My question is do you own any of:

1VtaJTXABVbrZKxFYPXUg3iGMS5mxBXxB
19Q7GdwnxGsU884weFNKmZYfuCeKoczUiG
1B7EwTocYkkg1fKZGSjYUJbtBjnz1pqViL
1NRYDFxtYCwHXam32yFAn8kpiWfdx4XefX

The client has been known to do weird things and sweep money out to other addresses, like when you have addresses that were generated using the flawed bitcoin random number generator. Are you sure that your computer is virus free. Make sure your wallet is encrypted! Mind PMing me with all the addresses you own and I will try and see if I can trace the money somewhere.

[coin_love]

Hi and thank you for giving it a shot!

How do I know if I own an address? It's safe to assume I know nothing about Bitcoin. :-)

19Q7GdwnxGsU884weFNKmZYfuCeKoczUiG and 1B7EwTocYkkg1fKZGSjYUJbtBjnz1pqViL are in Bitcoin-Qt's saved addresses list, does this help anything? Other than that, I currently don't have a clue what are these transactions. Could I have created another address within the Bitcoin-Qt and transferred the money there? The -0.01 net balance for these transactions would then perhaps make sense. Or, it might have been a transfer to some service, but I already checked my email, mtgox, bitstamp and btce.

As for 1VtaJTXABVbrZKxFYPXUg3iGMS5mxBXxB and 1NRYDFxtYCwHXam32yFAn8kpiWfdx4XefX (which seen to lead to the missing 5BTC), I unfortunately don't have a clue at the moment.

It's worth noting that the two -0.01 tx end up to 1VtaJTXABVbrZKxFYPXUg3iGMS5mxBXxB and 1KASMYinhnBUmk64RhZPJEFicfHqfNXBrS, which in total contain ~5 BTC, so there's hope!

I'm 99% sure I'm virus free as I'm running Mac OS X without torrent software installed.

[coin_love]

Google/Chrome history from Apr 17th shows the following relevant searches I did:

16:08 searched "bitcoind"
16:09 visited "Running Bitcoin - Bitcoin - Bitcoin Wiki - bitcoin.it"
16:09 searched "bitcoind mac os x"
16:10 visited "Best BitCoin client on Mac OS X - Bitcoin Forum - bitcointalk.org"
16:15 searched "bitcoin clients"
16:15 visited "Choose your wallet - Bitcoin - bitcoin.org"
16:23 visited "Bitcoind - Bitcoin - bitcoin.it"
16:26 searched "bitcoind mac os x"
16:26 visited "http://multibit.org/"
19:14 searched "v7 import bitcoinqt"
19:14 visited "How to import private keys - Bitcoin - bitcoin.it"
(At this point the two tx happen)
19:35 1NRYDFxtYCwHXam32yFAn8kpiWfdx4XefX -1.37BTC
19:49 1VtaJTXABVbrZKxFYPXUg3iGMS5mxBXxB -3.56BTC

I believe the times are in EEST (UTC+3).

So if I'm analyzing this correctly, just before those two transactions (imports?), I was googling about importing private keys. Maybe this will hint off to the right direction.

[coin_love]

I'm upping the reward to 0.5 BTC. This is taking way too much of my time.

[coin_love]

Ah, I now recall what those two -0.01 were. I tried out satoshicircle and satoshibet and then immediately cashed out (they are the +0.00945727 and +0.008 transactions).

But now the question is, what happened to the other parts of these transactions:
https://blockchain.info/tx/ba8ae49fe114154b2e20a090d71070206525128f987245f2a011d1e676e86e75
https://blockchain.info/tx/40c103b95170d4e5337985a39ca8105e910a8ee245dd4124412df1ce063a337f

[michagogo]

What you need to understand is the concept of change addresses. A bitcoin transaction consumes one or more previous outputs (coins sent to you) as inputs. It's impossible to spend part of an input, the same way that you couldn't cut off a piece of a $100 bill for payment. You'd need to spend the entire $100 bill, and you'd get change back. The way this is handled with bitcoins is that the transaction that spends one or more previous input, if the wallet doesn't have "exact change", will have more than one output -- in other words, you're sending bitcoins to two different places. There will be an output in the amount that you sent, to the address that you specify, and there will be an output back to you, which is the difference between the outputs that you spent and the amount that you sent to somewhere else (plus the fee, if applicable). The output back to you is sent to an address that Bitcoin-Qt automatically generates, and is not shown to you. For that reason, with paper wallets, once you've imported the key into a wallet, that paper wallet should be considered useless and be destroyed, because once you spend even part of it, the remainder does not necessarily stay in the paper wallet, but is transferred to a client-generated change address. Change addresses that the client has generated will not be shown in the interface. If you'd like to confirm that a change address belongs to you, you can use the "validateaddress" RPC command in the debug console, which will return "isMine":"true" or something to that effect. I highly recommend that you read the wiki's article on change, https://en.bitcoin.it/wiki/Change, for more detailed explanation.

Now, to your situation.

It seems to me that your paper wallet was not funded all at once, but rather in several smaller transactions of a few bitcoins each. What happened here is that after you imported the key from the piece of paper into your wallet, when you sent the small transactions, it spent some, but not all, of the outputs controlled by the paper wallet's key. The remainder of those outputs were transferred into change addresses within your B-Qt wallet. Three outputs, in the amounts of 4.8926 BTC, 0.00945727 BTC, and 0.008 BTC, remained unspent. Those outputs were swept up by Coinbase, and transferred to them.

In the meantime, your client believed that it had ~10 BTC available to it -- ~4.91 from the paper wallet's key, and ~5 from the assorted other keys in the wallet, including those change addresses that I mentioned. Presumably the client was offline at the time that the key was swept by Coinbase, and subsequently was started, and then while it was still busy syncing and catching up to the network, the bitcoins were sent in a transaction to Coinbase. The client, not having been up-to-date enough to see the paper wallet key swept by Coinbase, didn't realize that those outputs were no longer unspent, and tried to spend them along with the other coins that it did have control over. This transaction was rejected and not relayed by other nodes, which see it as an invalid transaction, since it's trying to spend coins that have already been spent. Now, your client will continue to hold on to this transaction in its wallet and try to rebroadcast it periodically, to no avail. What you need to do is clear that invalid transaction. If you're willing to lose metadata (address labels, etc) attached to the wallet, you can start Bitcoin-Qt with the -salvagewallet flag, which will cause it to make a new copy of your wallet, transferring over only keypairs, and leaving behind everything else, which includes the transactions. At that point, it will perform a rescan, and scan the blockchain for any relevant transactions. Once that's done, it should show your correct balance. This is probably the easiest way to solve your problem. Other possible ways would include editing the wallet file (it's simply a BDB database) to remove the invalid transaction, or manually creating a transaction that will spend the outputs that are currently locked up in the invalid transaction.

[b!z]

open your wallet.dat and see if there is any btc in change addresses.

[escrow.ms]

go there  https://blockchain.info/wallet/import-wallet

Do drag and drop and import wallet.dat and check whats your current balance is, It will import all your bitcoin address and show how much funds are there. You don't need to wait for sync like in QT or anything else.

[b!z]

and while you're on blockchain.info, don't use the shared send unless you want to lose your btc again

[coin_love]

What you need to understand is the concept of change addresses. A bitcoin transaction consumes one or more previous outputs (coins sent to you) as inputs. It's impossible to spend part of an input, the same way that you couldn't cut off a piece of a $100 bill for payment. You'd need to spend the entire $100 bill, and you'd get change back. The way this is handled with bitcoins is that the transaction that spends one or more previous input, if the wallet doesn't have "exact change", will have more than one output -- in other words, you're sending bitcoins to two different places. There will be an output in the amount that you sent, to the address that you specify, and there will be an output back to you, which is the difference between the outputs that you spent and the amount that you sent to somewhere else (plus the fee, if applicable). The output back to you is sent to an address that Bitcoin-Qt automatically generates, and is not shown to you. For that reason, with paper wallets, once you've imported the key into a wallet, that paper wallet should be considered useless and be destroyed, because once you spend even part of it, the remainder does not necessarily stay in the paper wallet, but is transferred to a client-generated change address. Change addresses that the client has generated will not be shown in the interface. If you'd like to confirm that a change address belongs to you, you can use the "validateaddress" RPC command in the debug console, which will return "isMine":"true" or something to that effect. I highly recommend that you read the wiki's article on change, https://en.bitcoin.it/wiki/Change, for more detailed explanation.

Now, to your situation.

It seems to me that your paper wallet was not funded all at once, but rather in several smaller transactions of a few bitcoins each. What happened here is that after you imported the key from the piece of paper into your wallet, when you sent the small transactions, it spent some, but not all, of the outputs controlled by the paper wallet's key. The remainder of those outputs were transferred into change addresses within your B-Qt wallet. Three outputs, in the amounts of 4.8926 BTC, 0.00945727 BTC, and 0.008 BTC, remained unspent. Those outputs were swept up by Coinbase, and transferred to them.

In the meantime, your client believed that it had ~10 BTC available to it -- ~4.91 from the paper wallet's key, and ~5 from the assorted other keys in the wallet, including those change addresses that I mentioned. Presumably the client was offline at the time that the key was swept by Coinbase, and subsequently was started, and then while it was still busy syncing and catching up to the network, the bitcoins were sent in a transaction to Coinbase. The client, not having been up-to-date enough to see the paper wallet key swept by Coinbase, didn't realize that those outputs were no longer unspent, and tried to spend them along with the other coins that it did have control over. This transaction was rejected and not relayed by other nodes, which see it as an invalid transaction, since it's trying to spend coins that have already been spent. Now, your client will continue to hold on to this transaction in its wallet and try to rebroadcast it periodically, to no avail. What you need to do is clear that invalid transaction. If you're willing to lose metadata (address labels, etc) attached to the wallet, you can start Bitcoin-Qt with the -salvagewallet flag, which will cause it to make a new copy of your wallet, transferring over only keypairs, and leaving behind everything else, which includes the transactions. At that point, it will perform a rescan, and scan the blockchain for any relevant transactions. Once that's done, it should show your correct balance. This is probably the easiest way to solve your problem. Other possible ways would include editing the wallet file (it's simply a BDB database) to remove the invalid transaction, or manually creating a transaction that will spend the outputs that are currently locked up in the invalid transaction.

Thank you for your lovely and approachable explanation.

I started the client with `/Applications/Bitcoin-Qt.app/Contents/MacOS/Bitcoin-Qt -salvagewallet`. It's still syncing with the network, but it looks promising as it's now showing a +4.9315 balance!

Just to make sure: The balances in the wallet and in the Coinbase are now completely separate and I'm free to spend them however I wish?

I'd gladly pay you the 0.5 BTC award. Could you kindly provide a payout address?

[michagogo]

Yep, that's right -- at this point, the displayed wallet balance in B-Qt will be the true balance of the wallet, and what was displayed by Coinbase.com was right all along. Glad I could help!13i77gSPKeNmkYYHfM4VyW5SDkK3odcezt is an address of mine. Thank you! (and remember: at this point, the paper wallet should be considered useless and destroyed. If you want to use a paper wallet, make a new one.)

[coin_love]

Thank you so much. Here's the reward as promised https://blockchain.info/tx/a66b1f9a4dc0de28ce0353af15a78a12b4d174a3a2c7a0675b3efbf0610ddbae.

[coynzer]

When I saw the thread title I thought it's just another "lost my wallet" or "lost my wallet password" thread which are usually hopeless and the "SOLVED" tag just indicates that the user has been explained to how he cannot get his BTC back and accepted his fortune.
But surprise, surprise!

I am really happy for you that it came out like this. Reading this story made my day a bit brighter!

[monbux]

When I saw the thread title I thought it's just another "lost my wallet" or "lost my wallet password" thread which are usually hopeless and the "SOLVED" tag just indicates that the user has been explained to how he cannot get his BTC back and accepted his fortune.
But surprise, surprise!

I am really happy for you that it came out like this. Reading this story made my day a bit brighter!

...  Good For you?