0.24 btc stolen from electrum wallet

[FDmitry82]

Good day. I am sorry, I know English badly. I will try to tell you through the translator. Yesterday, all of my 0.24 btc coins were stolen from my wallet. I saved them for so long, I wanted to go on vacation with children, and now everything. I am in complete despair, I do not know what to do. How can I return the coins?
I had this program for a long time, a separate computer on OS Mac. I don't even work on it.
I had only a password, but friends of my friends said that it was necessary to have a 2FA wallet. Now I understand that it was necessary to update the new file with 2FA protection.
How can I return the coins ((((((((

http://prntscr.com/nrpm7k

[1714486057]

1714486057

[1714486057]

1714486057

[mocacinno]

Sorry to be the barer of bad news, but if somebody stole your funds, they are gone...

As soon as the thief's transaction is confirmed, the odds of recovering your funds are ~0, that's the way the bitcoin protocol was built... It's trustless and immutable, there is no central bank that can roll back transactions... Sorry.

Best you can do is find out how you were robbed.

• Are you sure you're running an official version? Loads of fake electrum versions are floating around
• Are you running the latest version?
• Is your PC 100% spyware free?
• Are you sure the seed phrase isn't stored online?
• Are you sure nobody has physical access to the seed phrase
• Is your wallet password encrypted? Strong password?

Personally, i don't use 2FA on my electrum wallet. I find it expensive (since it's a paying thirth party plugin AFAIK... I have never used it so i have no experience).

[FDmitry82]

Sorry to be the barer of bad news, but if somebody stole your funds, they are gone...

Horrible((((
I forgot to say one more thing. Yesterday I installed the program from the official website 3.3.6. Prior to this, the old version was installed.

[mocacinno]

Sorry to be the barer of bad news, but if somebody stole your funds, they are gone...

Horrible((((
I forgot to say one more thing. Yesterday I installed the program from the official website 3.3.6. Prior to this, the old version was installed.

Aaah, this might be the cause... Did you check ThomasV's signature? A lot of fake electrum download sites are floating around. They try to make you download fake electrum versions that are built for stealing funds.

[FDmitry82]

Sorry to be the barer of bad news, but if somebody stole your funds, they are gone...

Horrible((((
I forgot to say one more thing. Yesterday I installed the program from the official website 3.3.6. Prior to this, the old version was installed.

Aaah, this might be the cause... Did you check ThomasV's signature? A lot of fake electrum download sites are floating around. They try to make you download fake electrum versions that are built for stealing funds.

As I wrote. I have a computer on the MAC and used it only on it. Here are just one made put a new version. Here is this site https://electrum.org/#download
How could they steal I really don't understand.
Already, developers began to suspect on this 

[mocacinno]

As I wrote. I have a computer on the MAC and used it only on it. Here are just one made put a new version. Here is this site https://electrum.org/#download
How could they steal I really don't understand.
Already, developers began to suspect on this  

Are you 100% certain you downloaded the binary from the link you posted?
Eventough there is no chance of recovering your funds, i'd still advise you to find out what went wrong in order to make sure your mac isn't infected. Do you still have the dmg file on your mac? If so, do you know how to check a signature or do we have to talk you trough this?

There are several attack vectors:

• Very old electrum versions (maybe the one you used to run before yesterday) used to have a vulnerability that allowed a thief to steal from a running electrum binary as long as the wallet was unencrypted
• You could have downloaded a fake electrum version that was programmed to immediately send all your funds to an attacker, or maybe send the xprv by a call-home function
• Your mac might be infected with a virus/backdoor/keylogger
• Somebody might have gotten their hands on your seed or an unencrypted wallet file

I've seen loads of people lose funds due to the use of several different wallets... In electrum's case, i've never had any reason to think the actual dev's (ThomasV) involvement. ThomasV is a public figure, he is known by his real name and has been a member of this community for a long time. All code he writes is open source and should be community vetted. He doesn't even compile all sourcecode for all os's by himself.

[yurij25]

Good day. I am sorry, I know English badly. I will try to tell you through the translator. Yesterday, all of my 0.24 btc coins were stolen from my wallet. I saved them for so long, I wanted to go on vacation with children, and now everything. I am in complete despair, I do not know what to do. How can I return the coins?
I had this program for a long time, a separate computer on OS Mac. I don't even work on it.
I had only a password, but friends of my friends said that it was necessary to have a 2FA wallet. Now I understand that it was necessary to update the new file with 2FA protection.
How can I return the coins ((((((((

http://prntscr.com/nrpm7k

Здapoвa! У мeня тoжe пpoпaли дeньги, я этoгo ищy bc1qcla39fm0q8ka8th8ttpq0yxla30r430m4hgu3x , +0.00188394 btc, a y тeбя нa кaкoй кoшeлeк oтпpaвилиcь??

Google translator
Hey Ya! I also lost money, I'm looking for this bc1qcla39fm0q8ka8th8ttpq0yxla30r430m4hgu3x, +0.00188394 btc, and which wallet did you have ??

[Lucius]

yurij25, OP case is about Electrum wallet, this is a reason why is it posted here. In this case, but also in your case bitcoin is almost completely lost. When I say almost, this is mean that you and OP can get your coins back only if this hacker is arrested, coins seized and you to be able to prove that you are one of the victims.

The address you are posted is currently empty, but in 2 months this hacker is move 258 BTC through this address. This is not small amount in fiat value ($1.3 million), so I suggest you to try start some action in order to find as many victims of this hacker with the aim of launching an international investigation.

You can start from here, one more user is report same bitcoin address : https://bitcointalk.org/index.php?topic=5129118.0

[50 Cent]

Пpивeт. Hикoгo мы yжe пoxoжe нe нaйдeм.
Пocмoтpи кapтинкy пpикpeплeннyю, тaм ecть aдpeca, нa кoтopыe yшли мoи мoнeтки.

This is English board, please use english Language instead.
You can't return you fund, I thing you downloaded Electrum phising site before when seed know by hacker, 2fa are useless on this case.
you don't tell exact time when it's gone. I things not yesterday when you open electrum wallet.

[yurij25]

Good day. I am sorry, I know English badly. I will try to tell you through the translator. Yesterday, all of my 0.24 btc coins were stolen from my wallet. I saved them for so long, I wanted to go on vacation with children, and now everything. I am in complete despair, I do not know what to do. How can I return the coins?
I had this program for a long time, a separate computer on OS Mac. I don't even work on it.
I had only a password, but friends of my friends said that it was necessary to have a 2FA wallet. Now I understand that it was necessary to update the new file with 2FA protection.
How can I return the coins ((((((((

http://prntscr.com/nrpm7k

Димoн пoчeмy нeт, мoжнo вepнyть эти дeньги чepeз pacчeтныe кoмпaнии BTC, Блoкчeйн, oни жe зaнимaютcя пepeвoдaми! B любoм cлyчae oни мoгyт зaблoкиpoвaть кoшeлeк и вepнyть дeньги влaдeльцy нa ocнoвaнии дoкaзaтeльcтв. Cкpиншoты этo дoкaзaтeльcтвo мeждy влaдeльцeм дeнeг и cpaнным мoшeнникoм!!!!!!

Google translator
Dimon why not, you can get this money back through the BTC settlement companies, Blockchain, they are also engaged in translations! In any case, they can block the wallet and return the money to the owner on the basis of evidence. The screenshots are proof between the owner of the money and the shameful scam !!!!!!

[mocacinno]

Google translator
Dimon why not, you can get this money back through the BTC settlement companies, Blockchain, they are also engaged in translations! In any case, they can block the wallet and return the money to the owner on the basis of evidence. The screenshots are proof between the owner of the money and the shameful scam !!!!!!

Blockchain (the company) does NOT have the power to block wallets or return funds... This is not how bitcoin works.
The best blockchain can do is reimburse you with blockchain's money... But they won't do this unless maybe if you have a strong case that it was blockchain's fault you lost your funds due to a vulnerability on their end... Maybe they can technically block the attacker's ip from using their wallet, but the funds would still be lost.

Only a centralised exchange/wallet that does not give you access to your own private keys can roll back INTERNAL transactions (transactions between two wallets from the same centralised provider)

[sergio87]

Hello. Such cases: I decided to cash my btc (my address is 1JLavuCEKfhXMmWiDHjZzfAUcrca5XK3sS). There are not many of them (0.00284581), but all mine honestly earned on cranes. I use the official electrum wallet, and when I tried to withdraw, I got an error "update for better security", the link led to the official website, so it was updated without a doubt. Next, I launched a fresh wallet, but  framed another scammers address similar to mine (1LVEsHyEGnpxG8yrcpREWfHoxA6xjoMt3r) and all my satoshi went there. On the transition (14f456e9e3c02b63673ce31b21eaa12c0e06ae789b9209b311b362bf21451557) I saw that the movements are active, which means they will still be deceived. I understand that there's nothing to be done, just sharing information.  As it turned out, the download link led to the scam site - ( electrumstart(point)net/#download ).  Be vigilant!  

P.S
FORGIVE FOR MY ENGLISH, WRITING THROUGH TRANSLATOR.

[BitMaxz]

Hello. Such cases: I decided to cash my btc (my address is 1JLavuCEKfhXMmWiDHjZzfAUcrca5XK3sS). There are not many of them (0.00284581), but all mine honestly earned on cranes. I use the official electrum wallet, and when I tried to withdraw, I got an error "update for better security", the link led to the official website, so it was updated without a doubt. Next, I launched a fresh wallet, but  framed another scammers address similar to mine (1LVEsHyEGnpxG8yrcpREWfHoxA6xjoMt3r) and all my satoshi went there. On the transition (14f456e9e3c02b63673ce31b21eaa12c0e06ae789b9209b311b362bf21451557) I saw that the movements are active, which means they will still be deceived. I understand that there's nothing to be done, just sharing information.  As it turned out, the download link led to the scam site - ( Phishing link deleted ).  Be vigilant!  

P.S
FORGIVE FOR MY ENGLISH, WRITING THROUGH TRANSLATOR.

You've been hacked if you installed the phishing link from the popup window to update the latest Electrum.
You can not recover them back you installed a fake Electrum wallet.

The original URL is electrum.org, not electrumstart or something.

Much better to uninstall the wallet or install a clean OS again before you install a new Electrum wallet.

There is no other way to reverse them bitcoin is not the same as paypal.

[yurij25]

Google translator
Dimon why not, you can get this money back through the BTC settlement companies, Blockchain, they are also engaged in translations! In any case, they can block the wallet and return the money to the owner on the basis of evidence. The screenshots are proof between the owner of the money and the shameful scam !!!!!!

Blockchain (the company) does NOT have the power to block wallets or return funds... This is not how bitcoin works.
The best blockchain can do is reimburse you with blockchain's money... But they won't do this unless maybe if you have a strong case that it was blockchain's fault you lost your funds due to a vulnerability on their end... Maybe they can technically block the attacker's ip from using their wallet, but the funds would still be lost.

Only a centralised exchange/wallet that does not give you access to your own private keys can roll back INTERNAL transactions (transactions between two wallets from the same centralised provider)

Чтo ты имeeшь ввидy цeнтpaлизoвaнный oбмeн/кoшeлeк, этo кoшeлeк или кaкoй-тo caйт??

Google translator
What do you mean centralized exchange / wallet, is it a wallet or some website ??

[BitMaxz]

Чтo ты имeeшь ввидy цeнтpaлизoвaнный oбмeн/кoшeлeк, этo кoшeлeк или кaкoй-тo caйт??

Google translator
What do you mean centralized exchange / wallet, is it a wallet or some website ??

Centralized exchanges like Binance or Coinbase(As sample) if you have these wallets you don't have access to your private keys where you can import the wallet to another wallet like Electrum or Bitcoin-qt and see all transaction records.

[yurij25]

Чтo ты имeeшь ввидy цeнтpaлизoвaнный oбмeн/кoшeлeк, этo кoшeлeк или кaкoй-тo caйт??

Google translator
What do you mean centralized exchange / wallet, is it a wallet or some website ??

Centralized exchanges like Binance or Coinbase(As sample) if you have these wallets you don't have access to your private keys where you can import the wallet to another wallet like Electrum or Bitcoin-qt and see all transaction records.

Яcнo я oтпpaвлял c кoшeлькa Electrum из-зa eгo мoбильнocти, нo бeзoпacнocть y нeгo пpocтaя!!!!!

Google translator
Clearly, I sent from the Electrum wallet because of its mobility, but its security is simple !!!!!

[BitMaxz]

Яcнo я oтпpaвлял c кoшeлькa Electrum из-зa eгo мoбильнocти, нo бeзoпacнocть y нeгo пpocтaя!!!!!

Google translator
Clearly, I sent from the Electrum wallet because of its mobility, but its security is simple !!!!!

What do you mean by security is simple?

If you installed the fake Electrum from a phishing site it is not their fault there are times that wallet can be hack in some ways or tactics. That is why we always need to learn how to protect our wallet for any malicious software or website.

Does it look like you can't accept your lose?

[Pmalek]

@yurij25
It was explained to you in the past that bitcoin transactions can't be reversed and you keep suggesting how it is possible. Once a transaction is confirmed on the blockchain that is it. The only person that can send it back is the person in control of the private keys for that address.

It is not Electrum's fault that you installed a fake wallet. You were simply not careful and fell for the tricks of a scammer. It is sad but it happens. Learn from the mistake and accept the facts how they are in order to improve the safety of your funds.

[sergio87]

Hello. Such cases: I decided to cash my btc (my address is 1JLavuCEKfhXMmWiDHjZzfAUcrca5XK3sS). There are not many of them (0.00284581), but all mine honestly earned on cranes. I use the official electrum wallet, and when I tried to withdraw, I got an error "update for better security", the link led to the official website, so it was updated without a doubt. Next, I launched a fresh wallet, but  framed another scammers address similar to mine (1LVEsHyEGnpxG8yrcpREWfHoxA6xjoMt3r) and all my satoshi went there. On the transition (14f456e9e3c02b63673ce31b21eaa12c0e06ae789b9209b311b362bf21451557) I saw that the movements are active, which means they will still be deceived. I understand that there's nothing to be done, just sharing information.  As it turned out, the download link led to the scam site - ( Phishing link deleted ).  Be vigilant! 

P.S
FORGIVE FOR MY ENGLISH, WRITING THROUGH TRANSLATOR.

You've been hacked if you installed the phishing link from the popup window to update the latest Electrum.
You can not recover them back you installed a fake Electrum wallet.

The original URL is electrum.org, not electrumstart or something.

Much better to uninstall the wallet or install a clean OS again before you install a new Electrum wallet.

There is no other way to reverse them bitcoin is not the same as paypal.

Hello. Such cases: I decided to cash my btc (my address is 1JLavuCEKfhXMmWiDHjZzfAUcrca5XK3sS). There are not many of them (0.00284581), but all mine honestly earned on cranes. I use the official electrum wallet, and when I tried to withdraw, I got an error "update for better security", the link led to the official website, so it was updated without a doubt. Next, I launched a fresh wallet, but  framed another scammers address similar to mine (1LVEsHyEGnpxG8yrcpREWfHoxA6xjoMt3r) and all my satoshi went there. On the transition (14f456e9e3c02b63673ce31b21eaa12c0e06ae789b9209b311b362bf21451557) I saw that the movements are active, which means they will still be deceived. I understand that there's nothing to be done, just sharing information.  As it turned out, the download link led to the scam site - ( Phishing link deleted ).  Be vigilant!  

P.S
FORGIVE FOR MY ENGLISH, WRITING THROUGH TRANSLATOR.

You've been hacked if you installed the phishing link from the popup window to update the latest Electrum.
You can not recover them back you installed a fake Electrum wallet.

The original URL is electrum.org, not electrumstart or something.

Much better to uninstall the wallet or install a clean OS again before you install a new Electrum wallet.

There is no other way to reverse them bitcoin is not the same as paypal.

google translate
 I can not agree with you.
It was in the official wallet (!) That the message was updated. Naturally, the address of the site was not indicated, I later extracted it from the history. The task of developers to close such vulnerabilities. The notification probably came from the block check servers, and who monitors and checks them. What work has been done to inform users about the existence of such vulnerabilities and to combat it. There is a fake site address, someone is paying for hosting and domain, maybe there is a chance to identify the perpetrators or at least their geography. There is a transcription address, following the block chain you can set the approximate damage and the scale of fraud. Unfortunately, most users do not have the knowledge and capabilities. This is a problem for both users and developers, and we need to fight it together!

[Pmalek]

google translate
 I can not agree with you.
It was in the official wallet (!) That the message was updated. Naturally, the address of the site was not indicated, I later extracted it from the history. The task of developers to close such vulnerabilities. The notification probably came from the block check servers, and who monitors and checks them. What work has been done to inform users about the existence of such vulnerabilities and to combat it.

The problems have already been rectified. Since version 3.3.3. Electrum no longer shows any messages to users and if you are using a version older than 3.3.3. you can no longer connect to Electrum servers!

They have also warned users about the phishing messages on their github but the problems is that people don't read these or any other instructions until it is too late.

To users: when you broadcast a transaction, servers can tell you about errors with the transaction. In Electrum versions before 3.3.3, this error is arbitrary text, and what's worse, it is HTML/rich text (as that is the Qt default). So the server you are connected to can try to trick you by telling you to install malware (disguised as an update). You should update Electrum from the official website so that servers can no longer do this to you. If you see these messages/popups, just make sure you don't follow them and that you don't install what they tell you to install. The messages are just messages, they cannot hurt you by themselves.

Read this: https://github.com/spesmilo/electrum/issues/4968