Missing receiving address in my bitcoin wallet

[GerGys]

Hello,

yesterday I had to give my electrum bitcoin wallet receiving address to a guy to send me a certain amount in btc.
I copy-paste the receiving address from my btc wallet.
Today that guy sent me the blockchain link, where I see, that he sent the payment and that transaction is confirmed.
But I don't have it my wallet balance and the problem is, that I don't see the receiving address in my addresses list.
What could be the reason for that?
Yesterday I just copy-paste the address from the wallet, today that address isn't there and of course, the transaction isn't in my balance there also.
Please, help me with some advice what could be the reason for that and what should I do about it?
I did that before - copy-paste a receiving address - but didn't have that kind of problem before.
Thank you in advance!

[nc50lc]

There's no way to remove an address from an Electrum wallet.
Some may be invisible due to gap limit but if it was already displayed in the "receive" tab, it should also be available in the "address" tab.

I'll just list two possible scenarios on what might have happened:

• Case1: There might be a clipboard-hijacking malware/virus that changed the copied address.
  To try if this was the case, copy one of your address and paste it in any text box;
  if the result is the same, this might not be the case. (try to copy-paste 10 different addresses)
• Case2: There may be two or more Electrum wallet in your wallet directory and you copied an address from the other wallet;
  Try to check using Electrum menu File->Open if there's another wallet file in the list.

Are you sure that it was the same address that you've sent him?

[GerGys]

Thanks for the reply, nc50lc!

- I did copy-paste a few of the addresses from the list, by your advice, and everything looks fine. I got the same addresses in the txt

- I did check the directory and see only one wallet.

As I said, I didn't have that kind of problem before. The guy, who sent me the btc, did that before and I was doing exact the same action like yesterday - open my wallet, go to "Receive" and copy the address there.
Today, when I saw, that I don't have the transaction in my balance, I checked all addresses in my list very, very careful and didn't find that address at all there. That's very weird...
Is it possible the receiving address to expire? If it's possible a certain btc receiving address to expire at all?

[nc50lc]

Today, when I saw, that I don't have the transaction in my balance, I checked all addresses in my list very, very careful and didn't find that address at all there. That's very weird...
Is it possible the receiving address to expire? If it's possible a certain btc receiving address to expire at all?

There's no some sort of expiration date of addresses (not exclusive to Electrum),
in fact, Electrum is (HD) Hierarchical Deterministic and will produce the same set of addresses even if you deleted the wallet file and restore from seed given the right derivation path.
There are some cases of clipboard hijacking that is a direct attack or platform-specific and maybe this was the case.

Also, about my question above, how sure are you that the sender sent it to the same address that you've sent him?
Did you checked the 1st and last few characters of the address that you pasted?
there's a possibility that the sender is lying.

[GerGys]

What do you mean with "clipboard hijacking"? I am sorry for asking, but I don't know what is that.

About your question - I compared the address in the email (I provided the receiving address by email yesterday) and the address in the blockchain link, and they are the same.

Here is the blockchain link : https://www.blockchain.com/btc/tx/0ddca07771e20587b00a1685702f1be13c2748832fa8c835040cdc2c3001ab33

Btw. I just checked the address on Google and check what I see about the address :  https://bitref.com/1P24xfd96qvMzLN81qxNhgPn2pm8Efa5AG    What does it mean? How the money came there and 2 min later are gone?

Sorry if I am asking a stupid questions!

[nc50lc]

So 1P24xfd96qvMzLN81qxNhgPn2pm8Efa5AG is supposed to be the address in your receive tab? Yes?
But the fact that the UTXO was already spent strongly indicates that there's someone else who's in control of that address.

What do you mean with "clipboard hijacking"?
-snip-
Btw. I just checked the address on Google and check what I see about the address :  https://bitref.com/1P24xfd96qvMzLN81qxNhgPn2pm8Efa5AG    What does it mean? How the money came there and 2 min later are gone?

1. It's a virus or program that can alter your machine's clipboard (where the copied files were stored) to change the paste result,
it usually looks for possible bitcoin addresses and change it to his address, the most latest ones even generates the same few first and last characters of the original address to fool the victim.

2. With enough programming skills, anyone can program a "forwarder" that can send bitcoins right after the specified addresses received bitcoins.
And the way that the destination address 3Ksti3jfX7Vb6FUZW4mWZbazyFcAeyjkCy had been receiving funds from different addresses looks similar to a hacker's forwarding address.

Based from your reply, the sender can't be the culprit.

[GerGys]

Thanks for the reply, nc50lc!

Yes, 1P24xfd96qvMzLN81qxNhgPn2pm8Efa5AG is the address, which I copy-paste.
Yes, as I can see when I checked the address, the btc is spend 2 sec after it's received.

1. What can I do about that clipboard hijacking? I mean, should I check my computer for some virus? If yes, how to do that?
Does it mean, that all my btc addresses in my btc wallet can get the same problem? Or it happened only when I copy-paste the address?

Yes, I think that the sender isn't the culprit.

[GerGys]

Which one to use to remove the virus : Reimage, SpyHunter 5, or Malwarebytes?
What do you recommend?

[TGD]

Which one to use to remove the virus : Reimage, SpyHunter 5, or Malwarebytes?
What do you recommend?

Malwarebytes is my personal recommendation. It's good to remove malware in your computer which is the main reason why many crypto user are being hacked. That's also my company security application for our computer. That's better than mcafee anti virus.

[GerGys]

Is there a free version of Malwarebytes?

[o_e_l_e_o]

What operating system are you using? You should be running a full antivirus scan with the software of your choice, as well as installing and scanning with malwarebytes as a minimum, but the only way to be sure you are completely safe would be to format your hard drive and reinstall your OS.

Does it mean, that all my btc addresses in my btc wallet can get the same problem?

Clipboard malware cannot steal your bitcoins on its own. All it can do is change the address you copy and paste, meaning you either send the wrong receiving address to someone else (as you did here), or you enter the wrong address when you are trying to send bitcoin. As long as you double and triple check the address against the source (i.e. your wallet or the person giving you an address, not something else you've copy and pasted), you will not fall victim to it.

Having said that, if you are infected with this malware, you could also very well be infected with more serious malware which could steal your coins in other ways. You might want to look in to hardware wallets as a safer method of storing and sending your coins.

Is there a free version of Malwarebytes?

https://www.malwarebytes.com/mwb-download/

[TGD]

Is there a free version of Malwarebytes?

Free version has a limited feature. It's better to avail premium license. There is some crack version of it but I suggest to buy the official license to support the developer.

Malwarebytes didn't guarantee 100% protection and no anti virus can do that. It's better to reformat your hard disk same as the advice of @oeleo then install malwarebytrs after reformat to make sure that your computer is totally free from malware.

Maybe you download too much file on the internet without antivirus installed or you click porn ads that automatically download a malware file. 

[khaled0111]

@ElectrumSupport, read the post just above yours, it is clear that his problem is not caused by the clipboard hijacker malware.
Either his device is compromized or someone else has access to his wallet (private keys)

[GerGys]

I just installed the free trial version of Malwarebytes and run it.  I got 26 detections. Check the image here. Should I click on "Quarantine" button? I am asking that, because I see there also the Electrum wallet setup exe

As I said, that's the first time when I got that kind of problem. I often receive btc payments, but not as a direct payment (like this one with the problem), but through my websites and don't have any problems. That make me think, that it's a Clipboard malware.

[GerGys]

Sorry, I don't know how to add an image here

[GerGys]

Here is the image:

https://prnt.sc/ptqd3s

[o_e_l_e_o]

Electrum gets flagged as a false positive by malwarebytes. As long as you only downloaded from the official site - electrum.org - and verified the download by following these instructions (https://bitcoinelectrum.com/how-to-verify-your-electrum-download/), then that is nothing to worry about.

25 other detections is a massive issue, though, although the ones visible on your screenshot all seem to be from the same piece of malware. Honestly, if I was that infected I would just reformat.

[GerGys]

Thanks for the reply, o_e_l_e_o !

Yes, the wallet is downloaded from the official website.
Thanks for the advice about the reformat. I will do that for sure later in the time.

So, should I add the other 25 detections to the MalwareBytes quarantine ?

I didn't use Malwarebytes before and if I understand the info correct (because English isn't my native language), when I add a certain file or program to MalwareBytes quarantine, I will be the only one person with an access to them, correct?

[o_e_l_e_o]

Malwarebytes does sometimes have false positives (as with Electrum), but if you don't recognize the software it is flagging up as suspicious, then yes, I would quarantine it.

[Lucius]

GerGys, do you use Electrum version 3.3.3? I also use Malwarebytes (Premium version), but I don't remember MB ever detecting Electrum as something dangerous (in your case GenericMalware). In this case, you seem to have a non-genuine version, but such false versions usually empty the entire wallet the moment they are installed.

You should consider proactive security measures for your PC, which means that the emphasis is on prevention, not as it is now with you in removing threats. I agree that the safest option at this point is formatting of your disk and clean install of OS.

I recommend you do at least two more things, try to make a full scan with MB in safe mode (check how to enter a safe mode for your PC), and also try to scan with good antivirus. My recommendation is Norton Security: https://in.norton.com/downloads

Regarding MB quarantine, only you have access to those files, and you can restore them at any time.