Lost my bitcoin after I have installe electrum 4.0.0

[elsamba]

Hi.Yesterday I installed version 4 of electrum and made 2 transactions, the first one was successful but the second one I find the address of the recipient changed and the transaction performed. I have uninstalled version 4. Can anyone please tell me if it is possible to recover my bitcoins and if I run risks for other files in general on my pc. Thanks

[1714744821]

1714744821

[mocacinno]

Directly from https://electrum.org/#download:

Latest release: Electrum-3.3.4

Version 4 does not exist, so if you have installed version 4, you either misread the version number or you installed a fake version!

If you say that the address you were funding changed, and you funded an address you were not trying to fund, those funds are lost, the odds are pretty big you have a copy/paste virus installed on your pc, or you have a fake electrum version (as said before).

[elsamba]

ok I have just reinstalled this version. Can I do anything to recover my bitcoin?

[mocacinno]

ok I have just reinstalled this version. Can I do anything to recover my bitcoin?

Confirmed transaction cannot be reverted, unconfirmed transaction can potentially be cancelled by doublespending the inputs of the unconfirmed transaction and broadcasting the doublespending transaction to as many nodes as humanly possible. This is something that's really hard to perform for a non-technical person, and even if you succeed in creating a double spending transaction, the odds of getting your tx in a mining nodes' mempool are really, really, really small (so the odds of success are really low).
Even if the transaction is unconfirmed, most of the time it isn't even worth the effort to try to create a double spending transaction... Only if we're talking about a thefth of several thousands of USD worth of BTC it becomes something you can try as long as the tx wasn't confirmed.

I guess you should focus on what went wrong... When you say you reinstalled "this" version, which version do you mean? Where did you download it from? Did you check the signature?

Also, addresses that "magically" change are never a good sign... Is your pc clean? do you install software from unknown sources? Do you have a virusscanner running? Is your OS patched?

[joniboini]

ok I have just reinstalled this version. Can I do anything to recover my bitcoin?

You can't do anything, period. The only thing that you can do from this point is to ensure your computer is not infected with other viruses/malware which could potentially steal/hijack your clipboard. Do a clean install or wipe your hard disk if you can't be sure that there is no other malicious file except that Electrum file that you've just downloaded.

I feel sorry for your loss, please be careful next time and always verify the signature of every file that you downloaded from the internet.

[TopTort777]

To prevent others from same mistake, could you please write, where did you get this electrum 4.0.0 installation file?
Hope not by clicking a link from e-mail ?

[elsamba]

I had version 3.3.4 and at the end of the transaction it gave me a negative result with the error that we wanted the new version 4.0.0. then I downloaded it but I don't remember if I copied the message link or if I looked for it on google. Unfortunately I took a fake server

[HCP]

I had version 3.3.4 and at the end of the transaction it gave me a negative result with the error that we wanted the new version 4.0.0. then I downloaded it but I don't remember if I copied the message link or if I looked for it on google. Unfortunately I took a fake server

If you got that error message... then you certainly did NOT have version 3.3.4 installed. The vulnerability whereby a malicious server could create those fake update popup messages was patched in version v3.3.3. It had previously been patched to make the link non-clickable in version v3.3.2. Unfortunately, you must have been using an older version that still allowed the popup

Sadly, as others have mentioned, your coins are gone

[Admant]

Same sad story here.
be careful!!
I am not expert, I got the same security update message and after few minutes my coins were gone.
The amount of the transaction and the address changed. 

The download site was electrumsky.com

Don't waste your time saying I am an idiot. I just want to help other people to avoid this phishing and to spread the alarm.
After 7 months this malware is still around stealing money!

As far as you know, is it enough to delete the app to be safe? (no need for a wallet anymore:( )

A.

[HCP]

You're not an idiot... you've just been tricked by nasty thieves using a very convincing social engineering attack

At this stage, it appears that the malware was simply designed to modify transactions to send all funds to the thieves... and doesn't appear to be installing any other malware like keyloggers or RATs etc... but there is no guarantee that this has not occurred. You can try running scanners like MalwareBytes or Spybot Search n Destroy etc...

If you want to be 100% sure, you're need to backup your data, then wipe/format the computer and reinstall your OS.

[pooya87]

After 7 months this malware is still around stealing money!

it is not 7 months, it has been years. and it is not just Electrum, this is a well known way of spreading malware by disguising it as a well known application that people use. and this method only affects people when they are lazy about verifying what they download which includes creating a web of trust and finding the right PGP public key to include in it and verifying the downloaded binaries. but since these steps aren't easy specially for the windows users, they tend to skip it altogether and end up infecting themselves like this.

[Lucius]

It is sad that such things are still happening, but it only show that a good part of the Electrum users are still using outdated wallets, and they are completely unaware of the danger which comes from them. We can only assume that the number of such cases will increase because of bitcoin price is go up, and there is many users of bitcoin who open their wallets only in times when they see opportunity for profit. Unfortunately this is what the hackers are just waiting for.

[degenLove]

Does anyone with the worng electrum version tryied to run malwarebytes? did it found the malware?

thanks

[mocacinno]

Does anyone with the worng electrum version tryied to run malwarebytes? did it found the malware?

thanks

I have never installed a fake version, so i don't know wether malwarebytes will pick it up, however they are well aware of the problem and even know the hashes of some of the fake binaries... So i'd be supprised if they didn't scan for them...

https://blog.malwarebytes.com/cybercrime/2019/04/electrum-bitcoin-wallets-under-siege/

This being said, since electrum is completely open sourse, a malicious person can spin up hundreds of variants in no-time, so i wouln't rely on malwarebytes completely

[stomachgrowls]

Does anyone with the worng electrum version tryied to run malwarebytes? did it found the malware?

thanks

Why would risk to download the fake version? Detected or not by your AV it would be still risky to try it out.

Just for some information,my Eset do have false detection with it and it do deletes the entire electrum wallet(Legit one) showing Coinhive (not sure) Miner stuff? 

[HCP]

Does anyone with the worng electrum version tryied to run malwarebytes? did it found the malware?

That's the problem with these fake versions... they aren't your typical malware in that they don't do anything out of the ordinary as far as internet enabled apps go. Most of the malware/antivirus software relies on using heuristics to identify apps that do "dodgy" things, such as trying to access system directories/files or setting up rootkits or installing unwanted browser extensions etc.

However, these fake versions of Electrum simply send information (your seed) or auto create a transaction that sends all your coins to a specified address on startup. Neither of these things is able to be distinguished from "normal" internet activity for a "normal" internet-enabled application.

At most, they can identify the file hashes of the installers and blacklist those, but any minor modification to the installer will change the hash and render that method of identification useless.

Relying on antimalware or antivirus to identify "fake" versions of apps is not a great strategy. It requires that the devs of those apps 1. Know about the issue and 2. Have updated their app to look for it.

Meanwhile, you have a fairly robust system in verifying digital signatures that will guarantee that the file you downloaded is the official Electrum downloader. Learn how it works and do it EVERY time you download an Electrum update.

[f_lin]

Hi.Yesterday I installed version 4 of electrum and made 2 transactions, the first one was successful but the second one I find the address of the recipient changed and the transaction performed. I have uninstalled version 4. Can anyone please tell me if it is possible to recover my bitcoins and if I run risks for other files in general on my pc. Thanks

I had electrum 3.0.6 and try to send bitcoin and there was no response.
I had to restart my wallet a few times. Finally, I was able to but after I clicked send, a message pop up says my vision is a bit old I need to upgrade to newer vision.
I trusted the links because it comes from electrum wallet (3.0.6).  I wasn't any other website to download anything.

But after I upgrade to 4.0 all my bitcoin was gone.


Electrum wallet is a con

[TryNinja]

I had electrum 3.0.6 and try to send bitcoin and there was no response.
I had to restart my wallet a few times. Finally, I was able to but after I clicked send, a message pop up says my vision is a bit old I need to upgrade to newer vision.
I trusted the links because it comes from electrum wallet (3.0.6).  I wasn't any other website to download anything.

But after I upgrade to 4.0 all my bitcoin was gone.

Except that there is no Electrum 4.0

You got scammed because you downloaded a fake version of Electrum. That was an exploit that let some servers send fake messages to clients connected to them. You should ONLY download electrum from ELECTRUM.ORG (the ONLY legit website) and always verify the electrum files to make sure they are legit.

That was basically a social engineering attack. With Bitcoin, we don't trust. We verify.

[bob123]

I wasn't any other website to download anything.

Unfortunately you followed the URL in the message to a github repo which does not have any source code published, but just a single executable file.

And obviously you have downloaded and run this executable.


You might want to increase your level of awareness.
It is always recommended to verify the signature of the file you download. Only trust files signed by the developer of electrum.

[Pmalek]

Electrum wallet is a con

Sorry for your loss but don't blame the software developer for this.

Electrum is not the guilty party. Malicious servers were able to send fake messages instructing users to download fake wallets resulting in the loss of their bitcoins. This is what happened to you.

When Electrum became aware of this they made all versions older than 3.3.3 obsolete and they could no longer connect to Electrum servers. This was now changed to 3.3.4 as it seems.

Warning: Electrum versions older than 3.3.4 are susceptible to phishing. Do not download Electrum from another source than electrum.org, and learn to verify GPG signatures.

https://electrum.org/#download

If you had checked the official site or asked here before the problems occurred you could have saved your Bitcoins.