Missing receiving address in my bitcoin wallet

[GerGys]

Lucius, yes, I am using Electrum version 3.3.3. It seems I have "non-genuine version" of what? I downloaded the Electrum wallet from the official website a long time ago and because some problems with my previous laptop, I restored the wallet on new laptop, with the seeds.

I understand, that removing threats isn't the best solution, but just trying to find the best decision for now. Because I am worried not to lose all my btc in the wallet.
I understand, that formatting of the disk and clean install of OS is the best option, but I will need time to see how to do that, because I am not familiar with that.
That's why I am asking if the MB quarantine is a solution, until I find info about the formatting.

[1714057439]

1714057439

[1714057439]

1714057439

[o_e_l_e_o]

As an aside, Electrum versions before 3.3.4 no longer sync as a security precaution, so even if you had used the correct address, you still wouldn't see the funds in your wallet until you updated Electrum.

My mistake. It's versions before 3.3.0 which wont sync, but versions before 3.3.4 which are vulnerable to a fake phishing message.

To upgrade, simply back up your wallet files, uninstall your current version of Electrum, download and verify the most recent version (3.3.8) from electrum.org, and then install.

[GerGys]

o_e_l_e_o, how to update the Electrum wallet?

I receive fund there and don't have problem, because the payments are not direct. Only this one (the missing one, with the problem) was a direct payment.
I know, that the formatting is the best solution, but will need time to find info how to do that. Until then I think to use Malwarebytes running and will update the wallet. Is that a solution for now?

[DireWolfM14]

Locate your wallet files (usually they are in /<user>/appdata/roaming/electrum/wallets/) and back them up on a clean thumb drive.
Go to https://electrum.org/#download and download the latest version for your OS, and corresponding signature file.
Follow these instructions to verify the download: https://bitcoinelectrum.com/how-to-verify-your-electrum-download/
Uninstall your old version of electrum.
Install the new version of electrum.
Restore your wallet files to the directory where you found them.

If you are concerned that your current wallet might have been compromised, you should create a new seed, and move all your funds to the new wallet.

If you're suspicious that your system has been compromised, I recommend you reinstall your OS on a freshly partitioned hard drive.  Relying on anti-virus and anti-malware programs is a risk, in my opinion.  A risk I would not be willing to accept. 

[RapTarX]

Locate your wallet files (usually they are in /<user>/appdata/roaming/electrum/wallets/) and back them up on a clean thumb drive.

This is one of the way you can update.
Unless you have something important on the wallet like an labels of addresses, you can just store the seed key and uninstall the electrum and download it as DireWolfM14 showed. Then, instead of creating new seed, restore this one. This is more simple however, if your metadata is important, then back up of the wallet file is mandatory.

[GerGys]

Thank you all for the help and advice! I really, really appreciate it.

I understand, that I lost that transaction (with the problem). But now the most important is to keep my wallet safe.

[HCP]

I didn't use Malwarebytes before and if I understand the info correct (because English isn't my native language), when I add a certain file or program to MalwareBytes quarantine, I will be the only one person with an access to them, correct?

Generally, once a file is "quarantined"... even YOU won't be able to access them. That's the entire point of quarantine. The antimalware/antivirus software attempts to prevent ANY access to try and prevent any payload from being executed.

To access the files after quarantining them, you would need to "restore" them first.


When you look at all the addresses displayed in your Electrum "Addresses" tab, do you see ANY address that begins with the same 4 or 5 characters as the address you pasted: "1P24x..."?

If so, try copy/pasting THAT address again and see if it gives you the same or different address.

But now the most important is to keep my wallet safe.

Part of that would be trying to identify how you got infected in the first place... and perhaps modifying your computer behaviour. No dodgy websites (porn/torrents etc)... be careful what you download/install...

Consider moving your crypto/wallet stuff to a completely separate (offline) system etc... or investing in a hardware wallet.

[GerGys]

HCP , no, I don't have any address that begins with ""1P24x". The sender always paying with a direct payment to my btc wallet and I always doing the same : open my wallet - go to Receive tab - copy the btc address there - paste it at the email.
I don't have problems when I receive btc payments through my website.

I didn't visit any porn/torrents websites.

About "moving your crypto/wallet stuff to a completely separate (offline) system" - I don't know how to do that and some advice will be helpful.

[HCP]

HCP , no, I don't have any address that begins with ""1P24x". The sender always paying with a direct payment to my btc wallet and I always doing the same : open my wallet - go to Receive tab - copy the btc address there - paste it at the email.
I don't have problems when I receive btc payments through my website.

Perhaps you just have one of the "original" clipboard malwares that didn't try and use "similar" replacement addresses and simply just pasted a completely different BTC address.

Although, the fact that you said that it doesn't seem to be doing it any more (copy/pasting is currently transferring the correct address right?) might indicate that this isn't even the reason why you ended up with an incorrect address.

Perhaps you didn't actually copy the address from Electrum correctly and, for whatever reason, already had that address on your clipboard (from a different app/website? )

About "moving your crypto/wallet stuff to a completely separate (offline) system" - I don't know how to do that and some advice will be helpful.

Essentially, you use a completely separate computer that is not connected to the internet or ANY network. You install Electrum on it... and create your wallet with seed/private keys.

You would then use another computer that is connected to the internet... and install what is known as a "Watching only" version of your wallet on it. This enables you to see addresses/transactions/balance etc... but you are not able to spend/sign transactions as it doesn't contain any private keys. Refer: https://electrum.readthedocs.io/en/latest/coldstorage.html

The workflow is then... create unsigned transaction on ONLINE computer... transfer unsigned transaction (via USB) to OFFLINE computer... sign the transaction with the private keys (after checking it is all correct!)... then transfer signed transaction back to the ONLINE computer and broadcast it.

It's obviously a lot more work, but is also a lot more secure. However, it wouldn't necessarily prevent your particular scenario unless you take the time to double check and confirm all the transaction details (amounts+addresses etc) BEFORE you sign/broadcast.

What it does do is reduce the chances of any malware on your online computer from being able to access your wallet/private keys/seed etc.


Hardware wallets essentially make this setup redundant, as they achieve the same goal but in an arguably more streamlined, easy to use manner.

[Abdussamad]

There was another user who had a similar problem and he discovered that it was due to remote desktop protocol (RDP) or teamviewer type programs. These let a remote computer modify his clipboard and so he was only affected when that RDP/teamviewer software was running and he copy pasted addresses. Do you use software like that?

[GerGys]

Abdussamad, I don't have teamviewer type program and didn't use teamviewer. But I just checked the Remote Settings and saw, that "Allow Remote Assistance connections to this computer" option was enabled (I don't know why). I disabled it. Thanks for the advice!


HCP, yes, I copy-pasted (in txt) a few addresses from my Addresses list and everything was fine.
But I didn't try yet to test a direct payment to my btc wallet (to be honest, I'm afraid to do that). Maybe I should test with a small amount. But today I got a btc payment through my website and everything is fine.

[Lucius]

GerGys, did you scan your PC in safe mode with Malwarebytes and that antivirus which I have recommended to you in a previous post? I am asking this because some malware is much easier to be removed from the system if you scan in safe mode.

Since you say that your Remote Settings was enabled, there is a possibility that you have something very malicious on your computer, maybe some type of remote access trojan, and these things are most effectively resolved by formatting the disk. If you are not ready to format the disc, do you have a smartphone (Android 5+) on which you can install Electrum? There is a direct link on Electrum site for mobile version.

[DireWolfM14]

But I just checked the Remote Settings and saw, that "Allow Remote Assistance connections to this computer" option was enabled (I don't know why).

That option is enabled on Windows by default.  It doesn't matter, because you would have to manually start a "Remote Assistance" session to grant anyone access to your computer.  If you haven't used that feature then that's not your issue.

HCP, yes, I copy-pasted (in txt) a few addresses from my Addresses list and everything was fine.
But I didn't try yet to test a direct payment to my btc wallet (to be honest, I'm afraid to do that). Maybe I should test with a small amount. But today I got a btc payment through my website and everything is fine.

In your original post you said that you copy and pasted your receiving address, how did you share it with the person who was to send you the payment?  Did you email it to him, use a messaging app, social media..?

[GerGys]

Lucius, no, I didn't scan the PC in safe mode, but I will do it. Thanks for the advice!

DireWolfM14, I sent the receiving address via email. This person always doing a direct btc payments to me and I always email him the address. Today I received a btc payment through my website and everything was fine. I also sent a btc payment about 20 min ago and everything was fine again.
Hope it was just a onetime problem!
But, of course, it doesn't mean that I should not protect my PC. I am thinking to format the disc, but will need time to find an info how to do that. I think also I should update the Electrum wallet, but also will need time to read how to do that.

[Abdussamad]

emails you sent are stored in the send folder of your email client/website. so do confirm that the address was the one where the coins were sent.

[GerGys]

Abdussamad, yes, the address is the same.

That's the blockchain transaction link :  https://www.blockchain.com/btc/tx/0ddca07771e20587b00a1685702f1be13c2748832fa8c835040cdc2c3001ab33

When I check the address later, I saw that the payment left the address 2 sec after it's received: https://bitref.com/1P24xfd96qvMzLN81qxNhgPn2pm8Efa5AG

If I understand the blockchain correct, the payment is sent to address : 3Ksti3jfX7Vb6FUZW4mWZbazyFcAeyjkCy   and that address isn't my address. Actually, I didn't see the payment in my wallet at all.

[RapTarX]

If I understand the blockchain correct, the payment is sent to address : 3Ksti3jfX7Vb6FUZW4mWZbazyFcAeyjkCy   and that address isn't my address. Actually, I didn't see the payment in my wallet at all.

You have sent the address through email? Right? Now check the email if you have sent this address or not. If you have sent this one (which isn't own by you), then you have been infected with copy/paste malware which have changed your actual address into this one.
Or, if you have sent a correct address which is from your wallet, there's two possible case may happen-
1. The sender device have been infected with copy/paste malware.
2. The sender intentionally sent on his address. (which is unlikely since you had some previous deals).

Check your mail and confirm if it's the mistake from your side.

[o_e_l_e_o]

So at some point between your wallet and sending the email, the address has changed to a different one. As far as I can see there are three possibilities here, provided you are using a genuine version of Electrum (which you say you are):

You previously had the incorrect address on your clipboard, didn't actually copy your own address (just think you did), and then pasted the incorrect address in to the email.
You have malware which meant that although you copied the correct address, you pasted the incorrect address in to the email. I would repeat the exact same steps you performed before to see if this is reproducible. Copy the same address you did before, and paste it in to the same email provider.
Your email is compromised. What email provider are you using? It's possible if someone else has access they could edit any emails you try to send, or even recall emails you have already sent and replace them with their own.

I would think the second is by far the most likely, especially considering malwarebytes is giving you 25 potential positives on a scan. It's just a bit strange that it isn't reproducible (although it might never be now if malwarebytes as quarantined the offending malware).

As always, before hitting send on any transaction or communication, you should be double checking your address against the source (in this case, your Electrum wallet).

This topic would be worth a read: How to lose your Bitcoins with CTRL-C CTRL-V

[GerGys]

Malwarebytes just detected a threat and the file again is the Electrum wallet

That's the threat : https://prnt.sc/pumzht

[o_e_l_e_o]

As I said before, the legitimate version of Electrum often gets flagged as a false positive by malwarebytes and other anti-virus software

You can see a response to this issue on the Electrum github here: Electrum binaries flagged by some antivirus (false positive) #3198

You can also search this forum or reddit and see plenty of posts describing that exact issue.

That's not to say you should just ignore it, as you may have actually downloaded a fake version of Electrum. What you should do is to ensure you only ever download from electrum.org and nowhere else, and verify your download by following these steps (https://bitcoinelectrum.com/how-to-verify-your-electrum-download/) prior to installing it. If you do both these things, then you can safely ignore any threats detected by malwarebytes.