Electrum wallet just disappeared after a transaction

[Luks82]

Hi, new here
My problem, i installed electrum wallet, and created a wallet. I bought some bitcoins at Coinbase, and i tried to send them to my electrum wallet. My surprise, when Coinbase said transaction was complete, i went to have allok at electrum wallet, and it showed a first attemp not confirmed, and a second attempt confirmed, but my wallet reflects 0. Suddenly, electrum wallet went off, and when i restarted it, my wallet junt went out, i cant find it anywhere. Someone can help me, please?
Thank you.

[1715041360]

1715041360

[1715041360]

1715041360

[1715041360]

1715041360

[Rath_]

-snip

Where did you download Electrum from and what operating system do you use? You should have access to 12 words which were given to you during wallet creation. With them you will be able to recover your wallet. Answer my questions before doing that.

[Luks82]

Hi and thank you,
i just did what you said not to do
i recovered the seed with the 12 words.... and made a copy of the wallet, but i dont know why it happened, some phishing attemp?
should i do something else to secure it?

[jackg]

Where'd you get your copy of electrum?

It could've just been a fatal unhandled exception at run time and it probanly was if it came from a legitimate source.

[Luks82]

yes, sorry, i forgot to say that, i downloaded it from official page

[jackg]

yes, sorry, i forgot to say that, i downloaded it from official page

Definitely? As in you typed electrum.org?

[AdolfinWolf]

Hi and thank you,
i just did what you said not to do
i recovered the seed with the 12 words.... and made a copy of the wallet, but i dont know why it happened, some phishing attemp?
should i do something else to secure it?

Well, is your money still there? If so, it might just be your hard drive / other hardware that is failing you, or a corrupt operating system.

If your money is gone, you are likely infected, either a trojan, keylogger, or perhaps you downloaded a malicious version of electrum.

In both cases it would be smart to either update your HDD/do some virus scans and perhaps a factory reset. Again, you've given us very little information, so i neither know what the issue is, i do know you should be very careful with storing more money on that device.

Can you maybe follow this guide and check if your download of Electrum is legit? https://bitzuma.com/posts/how-to-verify-an-electrum-download-on-windows/

[Luks82]

Yes, it maybe just went off, but strange thing is my wallet disappeared... thank you for your advice!

[Luks82]

Is it possible that due a first failed attempt to verificate the transaction, a secondary transaction was made?
i see in my wallet now that i received the BTCs, but now its another order wich i didnt made, but this one in sending the money out...
this looks bad isnt it?

[OmegaStarScream]

Is it possible that due a first failed attempt to verificate the transaction, a secondary transaction was made?
i see in my wallet now that i received the BTCs, but now its another order wich i didnt made, but this one in sending the money out...
this looks bad isnt it?

It's starting to become difficult to understand what's the issue here but It definitely looks like someone has access to your wallet/computer.

Is the transaction from Coinbase to Electrum the only one you made yourself? If so, please provide us with the receiving address (you can find that by going to your Coinbase transactions history).

[DireWolfM14]

Is it possible that due a first failed attempt to verificate the transaction, a secondary transaction was made?

That's not quite how bitcoin works.  Each block that includes your transaction counts for one confirmation.  I'm not exactly sure what you mean the first transaction failing.  If your wallet software crashed, that has no affect on the blockchain transaction that you initiated with Coinbase.

i see in my wallet now that i received the BTCs, but now its another order wich i didnt made, but this one in sending the money out...
this looks bad isnt it?

If you login to your Coinbase account, and click on the "portfolio" tab, on the right you'll find a column with your recent transactions.  Click on the most recent one, then click on "view transaction.  That will send you to a blockchain explorer.  In your Electrum software, on the history tab, right click on the incoming transaction, and select view on blockchain explorer.  The transaction IDs should be the same.  

[Luks82]

Sorry, maybe im not explaining myself very well, english is not my mother language...
So, there is one transaction, from Coinbase to Electrum Wallet, then it happened something, including my electrum wallet crash, while this transaction was being made. When i managed to open electrum again, my wallet was gone, so i recovered it with the 12 words phrase. At that moment it showed me another transaction, from my electrum wallet to an outer wallet... this is the hash if you want to have a look a23c5255ea0b2a92fcefacc552fd4e5f530710ac7cb54eb7a2391e4124e16a0e
And this is my wallet with this two movements  https://www.blockchain.com/btc/address/1LCtHWuQvRG7SFvxsXZ8aXhiLYSoQXXDBd
As i remember, while i was checking the transaction status i saw this other movement, but i thought it was part of the show...
Seems like i've been pissed and Phished in this show.

[Luks82]

Just now, Malwarebytes blocked an attemp to connect to exs.ignorelist.com by the electrum 3.3.8 installer, saying its an exploit.... think we got the problem, and someone stole my money...

[DireWolfM14]

Sorry, maybe im not explaining myself very well, english is not my mother language...
So, there is one transaction, from Coinbase to Electrum Wallet, then it happened something, including my electrum wallet crash, while this transaction was being made. When i managed to open electrum again, my wallet was gone, so i recovered it with the 12 words phrase. At that moment it showed me another transaction, from my electrum wallet to an outer wallet... this is the hash if you want to have a look a23c5255ea0b2a92fcefacc552fd4e5f530710ac7cb54eb7a2391e4124e16a0e
And this is my wallet with this two movements  https://www.blockchain.com/btc/address/1LCtHWuQvRG7SFvxsXZ8aXhiLYSoQXXDBd
As i remember, while i was checking the transaction status i saw this other movement, but i thought it was part of the show...
Seems like i've been pissed and Phished in this show.

I think you have had your money stolen, and it sounds like you downloaded a malicious version of Electrum.

Just now, Malwarebytes blocked an attemp to connect to exs.ignorelist.com by the electrum 3.3.8 installer, saying its an exploit.... think we got the problem, and someone stole my money...

Only download Electrum from here: https://electrum.org/#download
And learn to verify the download, here's a tutorial: https://bitcoinelectrum.com/how-to-verify-your-electrum-download/

I don't know how secure your computer is, but there may be some other malware installed.  I'm of the philosophy of better safe than sorry, so you may want to nuke your OS and reinstall it from scratch.

[TryNinja]

Just now, Malwarebytes blocked an attemp to connect to exs.ignorelist.com by the electrum 3.3.8 installer, saying its an exploit.... think we got the problem, and someone stole my money...

I believe this server could be one of the ones which used to send fake messages to the users connected to them, telling the user to download a fake (and infected) update of the wallet[1].

You probably downloaded an infected Electrum from a fake website (or your PC is already infected). From where did you download it? Go to your download history or browser history and see the exact website where you downloaded it from.

[1] https://hodlister.co/server-verification.txt

[Lucius]

Just now, Malwarebytes blocked an attemp to connect to exs.ignorelist.com by the electrum 3.3.8 installer, saying its an exploit.... think we got the problem, and someone stole my money...

MB sometimes block Electrum servers, but this does not have to mean that it is a real danger, only a false warning. As DireWolfM14 is say, you probably download fake version of Electrum - and you do that by using Google search and pick first result from the top which in most case is paid add used by hackers to scam you and others.

Coinbase is send coins to your Legacy address -> 1LCtHWuQvRG7SFvxsXZ8aXhiLYSoQXXDBd (https://www.blockchain.com/btc/address/1LCtHWuQvRG7SFvxsXZ8aXhiLYSoQXXDBd) then hacker is send this coins to bc1q03u7xehrht5ha7vgss8ulu3umlk5lzqt3z0yt2 (https://www.blockchain.com/btc/address/bc1q03u7xehrht5ha7vgss8ulu3umlk5lzqt3z0yt2) and it seems he was very busy in last few days - total balance moved through that address was 0.67187460 BTC.

Check your browsing history, try to find link to that Electrum site from where you download wallet - post it here by using option Insert Code so we can report it and take that site down.

Edit :

I believe this server could be one of the ones which used to send fake messages to the users connected to them, telling the user to download a fake (and infected) update of the wallet.

I don't think server is a problem, other user is report same server blocked by MB - but he was definitely confirmed that Electrum is downloaded from official site. I leave little chance that both cases have something to do with the server in question.

Downloaded Malwarebytes after it happened and ran a scan - only some PUPs but the realtime protection detected 2 things afterwards: Malicious site "exs[dot]ignorelist[dot]com pointing to electrum-3.3.8.exe and qualified as an exploit and endthefed[dot]onthewifi[dot]com pointing to electrum-3.3.8.exe qualified as "Phishing", so this might be a lead even if I don't see what a server can do to cause this.

[TryNinja]

I don't think server is a problem, other user is report same server blocked by MB - but he was definitely confirmed that Electrum is downloaded from official site. I leave little chance that both cases have something to do with the server in question.

I said that because I found the URL in this list: https://hodlister.co/server-verification.tx

But apparently its market as "are working as expected" (which I missed and only read "there are still some false-positives of scam servers detected as legitimate:", thinking the url is one of them), so you are probably right.

[Spotily]

Just now, Malwarebytes blocked an attemp to connect to exs.ignorelist.com by the electrum 3.3.8 installer, saying its an exploit.... think we got the problem, and someone stole my money...

Same dude i got the installer in the official website of electrum.

[Abdussamad]

all those claiming to have gotten electrum from the official website should go to their browser history and confirm the exact url they downloaded from. there are many fake sites that look official and legit.

[Spotily]

all those claiming to have gotten electrum from the official website should go to their browser history and confirm the exact url they downloaded from. there are many fake sites that look official and legit.

I think this is not the fake website.
https://i.imgur.com/xdrayE5.png