BTC sent to an unknown address. shows "unspent"

[maxxoutt]

Completely BTC illiterate.  But yesterday I copied and pasted the vendor's BTC address into my electrum wallet and sent funds.  He hasn't received them, and when I search the TXID, there are 2 outputs created; one is my change address, then the other is an address that neither of us recognize.  I checked my computer by copy and pasting other addresses to see if I had malware that would change them, and they didn't change.

The funds say "unspent".  So what do you think happened?  And why did it create 2 outputs, one of them being mine?  Any suggestions on what to do?

Thanks in advance, and sorry for my lack of knowledge.  I can post the TXID but I don't know if that is cool to do.

[jackg]

Does it show a negative on the transaction and is it negative the amount you meant to sent?

It could be that you've accidentally sent the funds to yourself and then it'd show - 0.00001 to account for fees (or close to that).

Can you take a screenshot of the wallet?

[HCP]

If you open the transaction in Electrum (double click in transaction history... or right click and select details)... what colour are the 2 outputs?

One should be yellow (your change address)... what colour is the other one? If it is Green, it's one of your addresses and you're somehow sent funds to yourself. If it has no highlighting, then it is an external address.

The funds say "unspent".  So what do you think happened?  

"unspent" simply means that outputs created by the transaction have not been spent by whomever received them.

And why did it create 2 outputs, one of them being mine?  Any suggestions on what to do?

2 outputs is fairly normal when you have "change"... You can't "break" an input... you have to spend the whole thing. Much like having a $20 note in your pocket and trying to spend $1... you have to give the person the whole $20 and they'll give change. Same in bitcoin... you have 0.01 and need to spend 0.002? then the person gets 0.002 and you get 0.008 back to your "change address".

read this for more: https://en.bitcoin.it/wiki/Change


One last thing to check... what version of Electrum are you running? If it is 4.0.0, then it's a fake version. I vaguely recall seeing issues where these fake versions would change the address that funds were being sent to.

[maxxoutt]

If you open the transaction in Electrum (double click in transaction history... or right click and select details)... what colour are the 2 outputs?

One should be yellow (your change address)... what colour is the other one? If it is Green, it's one of your addresses and you're somehow sent funds to yourself. If it has no highlighting, then it is an external address.

The funds say "unspent".  So what do you think happened?  

"unspent" simply means that outputs created by the transaction have not been spent by whomever received them.

And why did it create 2 outputs, one of them being mine?  Any suggestions on what to do?

2 outputs is fairly normal when you have "change"... You can't "break" an input... you have to spend the whole thing. Much like having a $20 note in your pocket and trying to spend $1... you have to give the person the whole $20 and they'll give change. Same in bitcoin... you have 0.01 and need to spend 0.002? then the person gets 0.002 and you get 0.008 back to your "change address".

read this for more: https://en.bitcoin.it/wiki/Change


One last thing to check... what version of Electrum are you running? If it is 4.0.0, then it's a fake version. I vaguely recall seeing issues where these fake versions would change the address that funds were being sent to.

version 3.3.4
When I open details, the input is green, then there are 2 outputs, one is yellow, the other is not any color.  How would I find out if I sent it to myself?  Wouldn't I see an incoming transaction.  Thanks for your help on this.  Giving me hope!

[maxxoutt]

Does it show a negative on the transaction and is it negative the amount you meant to sent?

It could be that you've accidentally sent the funds to yourself and then it'd show - 0.00001 to account for fees (or close to that).

Can you take a screenshot of the wallet?

yes it says - before the number and it is red. how do I obtain them if I sent to myself?

took a screen shot trying to figure out how to attach lol

[TryNinja]

took a screen shot trying to figure out how to attach lol

Upload it to imgur.com and post the URL of the image here.

Where did the user sent you his address? Are you just assuming that the address shown isn't the one he sent you (because he told you so), or did you really check this? (e.g by looking at the message/email/etc where he sent you the address).

[maxxoutt]

Does it show a negative on the transaction and is it negative the amount you meant to sent?

It could be that you've accidentally sent the funds to yourself and then it'd show - 0.00001 to account for fees (or close to that).

Can you take a screenshot of the wallet?

https://imgur.com/a/lVZ3YKY

[DireWolfM14]

version 3.3.4

There was a malicious version being spread around last year that was labeled "3.3.4" if I remember correctly.  Where did you download your version of electrum?

When I open details, the input is green, then there are 2 outputs, one is yellow, the other is not any color.  How would I find out if I sent it to myself?  Wouldn't I see an incoming transaction.  Thanks for your help on this.  Giving me hope!

The one highlighted in yellow is your change address, those coins are still in your wallet.  The one lacking color is an external address, and doesn't belong to your wallet.  Since the wallet already contained the coins, you wouldn't see an incoming transaction for the change wallet, just the one transaction that sent the coins from the input transaction.

I can post the TXID but I don't know if that is cool to do.

The only reason not to is if you're concerned about your privacy, but since you already posted a screen shot we now know how much bitcoin you had in your wallet.  Based on that screen shot it looks like a significant portion of you coins went to that unknown address.

[maxxoutt]

took a screen shot trying to figure out how to attach lol

Upload it to imgur.com and post the URL of the image here.

Where did the user sent you his address? Are you just assuming that the address shown isn't the one he sent you (because he told you so), or did you really check this? (e.g by looking at the message/email/etc where he sent you the address).

I'm certain that I did not send it to his address.  I just don't know what the address is that it did send to.  But based on the screen shot does that tell you anything?  I suspected that I may have sent it to myself, because that was the only explanation I could think of.  I tried copy/pasting other emails into my wallet and they did not change.  If there were malware wouldn't I have seen it change?

If I did send it to myself, what could I do?  Also, is there a way for me to find the address I sent it to within my addresses?  I checked already my addresses and could not find it in there.  thanks

https://imgur.com/a/lVZ3YKY

[TryNinja]

I tried copy/pasting other emails into my wallet and they did not change.  If there were malware wouldn't I have seen it change?

In most cases, yes. But what if the malware actually identifies when you make a payment and just "destroys" itself to avoid detection? I have never seen this before, but it's not an impossible scenario.

Also, most Electrum fake wallets tend to send your whole balance to a random address after you open it, but not only the coins were only sent when you actually did the transaction, but part of your coins are still there. So I'm not sure if that's the case.

If I did send it to myself, what could I do?  Also, is there a way for me to find the address I sent it to within my addresses?  I checked already my addresses and could not find it in there.  thanks

What you can do to know if the address you sent the coins to is owned by you is open the console tab ("View -> Show Console" to enable it) and run:

ismine("ADDRESS HERE")

If it returns true, you own this address. If not, then you don't. Try this with both output addresses shown in the transaction.

And where did you download Electrum from?

[maxxoutt]

I tried copy/pasting other emails into my wallet and they did not change.  If there were malware wouldn't I have seen it change?

In most cases, yes. But what if the malware actually identifies when you make a payment and just "destroys" itself to avoid detection? I have never seen this before, but it's not an impossible scenario.

Also, most Electrum fake wallets tend to send your whole balance to a random address after you open it, but not only the coins were only sent when you actually did the transaction, but part of your coins are still there. So I'm not sure if that's the case.

If I did send it to myself, what could I do?  Also, is there a way for me to find the address I sent it to within my addresses?  I checked already my addresses and could not find it in there.  thanks

What you can do to know if the address you sent the coins to is owned by you is open the console tab ("View -> Show Console" to enable it) and run:

ismine("ADDRESS HERE")

If it returns true, you own this address. If not, then you don't. Try this with both output addresses shown in the transaction.

And where did you download Electrum from?

Ok I'll try that.  I downloaded from electrum.org I believe.  I've successfully sent and received before recently.

Wait ok I searched the TXID details and it says "previous output address" and that address is listed in my "input" for that transaction, and that address ALSO is my receiving address.  So what does that mean?

[maxxoutt]

I tried copy/pasting other emails into my wallet and they did not change.  If there were malware wouldn't I have seen it change?

In most cases, yes. But what if the malware actually identifies when you make a payment and just "destroys" itself to avoid detection? I have never seen this before, but it's not an impossible scenario.

Also, most Electrum fake wallets tend to send your whole balance to a random address after you open it, but not only the coins were only sent when you actually did the transaction, but part of your coins are still there. So I'm not sure if that's the case.

If I did send it to myself, what could I do?  Also, is there a way for me to find the address I sent it to within my addresses?  I checked already my addresses and could not find it in there.  thanks

What you can do to know if the address you sent the coins to is owned by you is open the console tab ("View -> Show Console" to enable it) and run:

ismine("ADDRESS HERE")

If it returns true, you own this address. If not, then you don't. Try this with both output addresses shown in the transaction.

And where did you download Electrum from?

Ok I ran the console. 
The address where the coins are showing to be now: False
The other output address (my change address): True
The address that says "previous output address) on the txid details: True

Well here, I don't have much other option so here is the TXID if that helps you help me.  thanks all
6e935f5dc1f271924c6e51a7ec7f4a6dea65dd74c91d8fd7c63b5182648f46dc

[Abdussamad]

So 1FbhSvzFQAYm2FTUjJeRB366N8ap3TgwWa is not the intended recipient's address? If it's not then the coins are gone. I suggest you think back on what you were doing when you sent this payment. Maybe consult your browser's history. Did you copy addresses from other sites like exchanges? Could be this address belongs to some other site you were surfing at the time.

[maxxoutt]

So 1FbhSvzFQAYm2FTUjJeRB366N8ap3TgwWa is not the intended recipient's address? If it's not then the coins are gone. I suggest you think back on what you were doing when you sent this payment. Maybe consult your browser's history. Did you copy addresses from other sites like exchanges? Could be this address belongs to some other site you were surfing at the time.

No this was the only thing I had done.  Why do you think it is that the "previous output address" for this transaction is actually my receiving address?

[DireWolfM14]

You said you copied and pasted the address into Electrum, how did you obtain the address?  Was it presented to you on the vendor's website, or was it sent to you through email or some other messaging method? 

Are you sure the vendor is legit, and they aren't lying to you about not receiving the payment?

[nc50lc]

In most cases, yes. But what if the malware actually identifies when you make a payment and just "destroys" itself to avoid detection? I have never seen this before, but it's not an impossible scenario.

Based from the previous unsolved "changed recipient address" issues here, it's possible.
Eg: Re: Something not right. "P.S."

No this was the only thing I had done.  Why do you think it is that the "previous output address" for this transaction is actually my receiving address?

I suggest you to do what Abdussamad had suggested first, then if the address is the same, answer DireWolf's question.
They've asked to find the possible scenarios, namely: [1] It's clipboard hijacking or [2] a Scam.

[Abdussamad]

So 1FbhSvzFQAYm2FTUjJeRB366N8ap3TgwWa is not the intended recipient's address? If it's not then the coins are gone. I suggest you think back on what you were doing when you sent this payment. Maybe consult your browser's history. Did you copy addresses from other sites like exchanges? Could be this address belongs to some other site you were surfing at the time.

No this was the only thing I had done.  Why do you think it is that the "previous output address" for this transaction is actually my receiving address?

Because that's where the coins were sent previously. Then you spent them in this transaction. If you don't get it then just ignore that.

What matters is where the coins were sent and apart from 0.003138 btc being sent back to your wallet as change the rest were sent to that 1Fb address.

[maxxoutt]

Yea really frustrating, as it was like $1000 sent.  I checked my entire hard drive and no trace of it other than my searches yesterday.  The fact that the details on the txid still says "not spent" does that mean no one has moved them from the wallet?  So does it just sit in the random wallet forever?  Does the wallet have to belong to someone?

I'm 99.9% sure the vendor wouldn't scam me.  I know him well, and we have ongoing business together.  Is there a possibility that that address goes to a wallet of his that he isn't aware of or something?  If it were malware or a scam wouldn't it be marked as "spent" by now 2 days later?

[DireWolfM14]

Yea really frustrating, as it was like $1000 sent.  I checked my entire hard drive and no trace of it other than my searches yesterday.

That is frustrating.  I hope you can figure it out, but I'll ask again, how did the vendor send you the address?

The fact that the details on the txid still says "not spent" does that mean no one has moved them from the wallet?

Correct.

[khaled0111]

Does the wallet have to belong to someone?

It can't be just a random wallet as each address has a checksum and if you change any character it will be invalid.
Since you use Electrum, it will not allow you to send to an invalid address. So yes, that address must belong to someone.

I'm 99.9% sure the vendor wouldn't scam me.

Don't be so sure. The only way to verify this is by going back to the message where he sent you the receiving address and compare it to 1FbhSvzFQAYm2FTUjJeRB366N8ap3TgwWa.
If it is not the same then you must have copied it from somewhere else. Since the coins haven't been moved yet then its owner doesn't know about it which reduces the chances of him being a scammer.