Missing receiving address in my bitcoin wallet

[BitMaxz]

Malwarebytes just detected a threat and the file again is the Electrum wallet

That's the threat : https://prnt.sc/pumzht

Have you just scanned the folder of Electrum and detected this exploit?
You need to scan the whole PC to find the infected file.

Can you try to scan the whole PC with Kaspersky Total Security maybe this one will detect more than Malwarebytes they have a 1-month free trial and make sure to update the database first before you scan the whole PC?

Let's see if it can detect more suspicious files if they detect they will automatically quarantine the infected file.

[1715384681]

1715384681

[1715384681]

1715384681

[1715384681]

1715384681

[1715384681]

1715384681

[Abdussamad]

Abdussamad, yes, the address is the same.

That's the blockchain transaction link :  https://www.blockchain.com/btc/tx/0ddca07771e20587b00a1685702f1be13c2748832fa8c835040cdc2c3001ab33

When I check the address later, I saw that the payment left the address 2 sec after it's received: https://bitref.com/1P24xfd96qvMzLN81qxNhgPn2pm8Efa5AG

If I understand the blockchain correct, the payment is sent to address : 3Ksti3jfX7Vb6FUZW4mWZbazyFcAeyjkCy   and that address isn't my address. Actually, I didn't see the payment in my wallet at all.

You said previously that all the addresses in your electrum wallet begin with 1 yet this address begins with 3. Did you not notice this difference when pasting the address into your email? It's a pretty big difference.

edit: also could this address be from some website or exchange you were using at the time?

[Lucius]

Have you just scanned the folder of Electrum and detected this exploit?
You need to scan the whole PC to find the infected file.

He did scan more than just Electrum folder, and he posts the link on the first page: https://prnt.sc/ptqd3s

But since he himself admits he has limited knowledge about all this (including formating disc), finding the cause of this incident is quite uncertain and very likely difficult to solve. My advice would be to backup everything you need from your computer (pictures, videos, documents) and take it to someone who will do the disk formatting and installation of the new operating system.

Then the computer should be protected with antivirus/antimalware/firewall, and used in a manner appropriate to the computer on which cryptocurrency is used. This means that such a computer is your personal bank, no torrent or porn should be mixed with very sensitive information such as private keys, coins address/s or seeds.

[DireWolfM14]

You said previously that all the addresses in your electrum wallet begin with 1 yet this address begins with 3. Did you not notice this difference when pasting the address into your email? It's a pretty big difference.

edit: also could this address be from some website or exchange you were using at the time?

I wonder if he actually meant this address: 1P24xfd96qvMzLN81qxNhgPn2pm8Efa5AG.

According to blockchain that address received a payment, and instantly broadcast this transaction:
0ddca07771e20587b00a1685702f1be13c2748832fa8c835040cdc2c3001ab33

According to blockchair the the same transaction was confirmed about an hour and half after the payment:
0ddca07771e20587b00a1685702f1be13c2748832fa8c835040cdc2c3001ab33

also could this address be from some website or exchange you were using at the time?

I was thinking the same thing, maybe the OP was trying to multi-task and succeeding about as well I do when I try.

[BitMaxz]

He did scan more than just Electrum folder, and he posts the link on the first page: https://prnt.sc/ptqd3s

But since he himself admits he has limited knowledge about all this (including formating disc), finding the cause of this incident is quite uncertain and very likely difficult to solve. My advice would be to backup everything you need from your computer (pictures, videos, documents) and take it to someone who will do the disk formatting and installation of the new operating system.

Then the computer should be protected with antivirus/antimalware/firewall, and used in a manner appropriate to the computer on which cryptocurrency is used. This means that such a computer is your personal bank, no torrent or porn should be mixed with very sensitive information such as private keys, coins address/s or seeds.

I didn't notice that he posted this image except the one that shows the file infected.
It looks like the Malwarebytes detected 26 infected file which I think the reason why he is suffering from this clipboard virus.

@GerGys
If you don't know how to format your PC I can help you but first, follow what Lucius suggested above backup all important files first including wallet files before you PM me.

[HCP]

I didn't notice that he posted this image except the one that shows the file infected.
It looks like the Malwarebytes detected 26 infected file which I think the reason why he is suffering from this clipboard virus.

No... it is showing a bunch of "Potentially Unwanted Programs" aka PUPs... these are NOT necessarily viruses or trojans or malware... but annoying things that you may or may not want on your PC... vast number of these tend to be "Browser Helpers" or toolbars etc.

The super confusing part in all this is that the OP said he already tried copy/pasting multiple bitcoin addresses since this incident and they all copy and paste just fine... I've never seen a clipboard hijacker that only works "once" and then stops working??!?

[Pmalek]

The super confusing part in all this is that the OP said he already tried copy/pasting multiple bitcoin addresses since this incident and they all copy and paste just fine... I've never seen a clipboard hijacker that only works "once" and then stops working??!?

The clipboard virus might have been flagged and deleted by his Malwarebytes AV in the meantime that is why he was able to copy/paste the correct address when instructed to try it out.

[DireWolfM14]

The super confusing part in all this is that the OP said he already tried copy/pasting multiple bitcoin addresses since this incident and they all copy and paste just fine... I've never seen a clipboard hijacker that only works "once" and then stops working??!?

The clipboard virus might have been flagged and deleted by his Malwarebytes AV in the meantime that is why he was able to copy/paste the correct address when instructed to try it out.

If you follow the OP's timeline this seems like the most plausible scenario.  It's hard to point to any one thing that caused this, the proper trouble shooting steps were taken out of sequence, in my opinion.  It's unfortunate because it would have been nice to help the OP figure out exactly what caused his issue so he can avoid it in the future.  As it is, this might happen to him again if he continues downloading and installing software the way he's been.

[HCP]

Yes, but if you look at OPs 2nd post in this thread... he states he copy/pasted several addresses just fine... This was well before any mention of downloading/installing/running any AV/anti-malware software:

- I did copy-paste a few of the addresses from the list, by your advice, and everything looks fine. I got the same addresses in the txt

For the clipboardjacker to simply stop working is not something I've encountered before... not saying it isn't possible. Perhaps some malware author got clever and created a version that tries to avoid detection by only changing every "1 in X" addresses...