Bitcoin not arrived / Ledger S / Electrum / Help me.

[bob123]

For me it looks now like he is / was not the owner of the adress.
What you think?

That's what i think too.

>> ismine("bc1qj50q40uugqq23pz2nxgey3u2f0lphy3ls4x567")
false

This confirms the assumption that your friend is not in control of the address.

He dont want to steal something from me, also no one ist infected.

Well, he obviously gave you an address which does not belong to his hardware wallet.
So he either..
1) gave you a different address on purpose,
2) is infected with some kind of malware (e.g. clipping board changing malware) or
3) copy/pasted the wrong address.

[HCP]

I can see the other transactions on the watch only wallet, so i guess 99,9% he was / is not the owner of this adress. Thats my only explanation at the moment. I think he logged into ledger, clicked on „revieve“, then he put unlocked the ledger, copied the adress BUT dont confirmed it on the ledger in the last step, so the adress was not confirmed for him. Do you know what i mean? I have no other ideas now. I tried everything you told me.

If the address on the ledger device screen, matched the address he was shown in Ledger Live, then he should be "OK".

Note that clicking "approve" on the device doesn't actually do anything... It is just there as a sort of trigger to try and make the user take the time to actually double check that the 2 addresses do in fact match. You don't need to click approve to be able to receive coins.

You can in fact get a "receive" address from Ledger Live without even having the device connected, although this is NOT recommended (as you cannot confirm that Ledger Live is giving you the correct address! )

[nc50lc]

nc50lc
-snip-
For me it looks now like he is / was not the owner of the adress.
What you think?

The address in question is bc1qj50q40uugqq23pz2nxgey3u2f0lphy3ls4x567 and you've tried to send bitcoins to it three times.
The second and third attempts were a waste of funds.

My initial question is still unanswered, as the matter of fact, you can potentially solve this by answering them,
unless he already cleaned his PC or the malware is designed to self-destruct after a period of time.

Quoting myself:

Do you have a log of your conversation where this address is written?
If so, confirm all of the characters if they are the completely the same.
-snip-
Perhaps you or your friend has been infected with a clipboard hijacking virus.
If the log from my question above isn't the same as that address, I'm afraid that you're the one who's infected.
If it's the same, then your friend is the one who might be infected, try to confirm it by telling him to copy-paste random addresses.

[ElectrumHELP]

Hello everyone, thanks for helping me.

nc50lc

To answer your question: I have no log, but i made an screenshot of the adress.
I can confirm that the characters are exactly the same.
I can confirm that nobody is infecected. I take a lot of transactions every day with
my electrum and everything is fine. My friend is also not infected, i tried it
with copy-paste random adresses and before everything was fine to.

Friends. Today i tried to export my friend private keys with the BIP39 tool.
When i do that, i get this adresses (all private keys starts with L + K)

Adresses:

14iHnGKkqsdM3NykGVpVjKh6vzAUtrgvfg
1PR2qjouLzFG4kN7MxSDieoPKv27f5s3KF
1MbrPiPEc6ejTyMuDyetVjG8ukTD944MhV
1F8rZ2HUfDm5cL7XkZ8tbKhb4xvgQGzfTf
17sEzjjMAi9H2nt5DwPL13GYDvC7ZekC3V
1PW2wFKxEjZ3wW9EJeRktmxNx72LU4gnua
1J4TkMr855PT78sSmNXQBSaiH5Gyz9EYfR
1PLxESd4FiDZvGrki9AFidudtMwabdMesx
1HT3jeTGdB82Vtma3ogeRKnEBppyrahNGJ
1FbCqvgzJyJjH2FuQ45xerFGj3UxtpDQDj
1PSK6ZaiVKKctHXk41tWDF5qfNRmjr8hca
13QrhvjJuCqjkomTYGqzYUeyyJASEMMsuB
18Fed1Xup8Sf54zgLh9K5LcTzq3qHdhRPz
18iwJw4QTYVo7XcayiXAhvCLutCkY8q9Yb
17Gsw3fZFsyTqC6ChJPZDbkDxyU9qYpDbr
163Agjius6UQCTDWKZVMX7WLcakRWnoLcM
1GjQZnhivUCaYMKzU6w9XuPsr9ajsvLs3t
1CbPz91QftfXKAoxNCRkoHSvBieXVES6xg
1DPrv1uU18ZswG3neqWonzv6FDYi1jm4ok
13xfUfuzyLxPhAPbfC8Bf3ffcijG7XAsoB

The adress where i sended the bitcoins (bc1qj50q40uugqq23pz2nxgey3u2f0lphy3ls4x567), is not there. ), is
not there. Is this also the proof that he isnt the owner of the adress? Since HCP told me, there is no need to confirm the Adress in ledger, i am not sure  again what happened here.

But also i cant find the private key of this adresse there (bc1qefs2d4ck8mw68l24r9w7y2nwy7t3nkt43fw5pg),
but thats the Third Transaction which My friend recieved.
https://blockstream.info/tx/14210edd41e629264106f90470a1cff9fd870c391fa4094a93a4fba7e11f2d53

I mean, the BIP39 tool should display the private keys to this adress too, right?
So both adress starts with bc1 are missing on BIP39.

Maybe there is something wrong?

If anyone can fix this, i can donate 500 Euro to the board wallet.
You can also contact me with PN / telegram / wickR.

Have you guys more ideas?
Kind regards and big THANKS

[Rath_]

Friends. Today i tried to export my friend private keys with the BIP39 tool.

Are you referring to this tool? If so then first of all, you should use the offline version without the Internet connetion. Never enter your recovery phrase on any online website. Once you recover your friend's funds, create a new wallet using Ledger and send the coins there. You should be also be careful when entering the seed on a computer since it could be infected with some malware. Having said that, never enter your seed anywhere unless there is no other choice.

If you tried to use this particular tool to generate your addresses then you should have also modified the derivation path after entering your seed. Under 'Derivation Path', there are a few buttons (BIP32, BIP44, BIP49, BIP84, BIP141). Select BIP84 and you should see addresses starting from bc1. You can also easily modify the account number under that tab.

[ElectrumHELP]

Friends. Today i tried to export my friend private keys with the BIP39 tool.

Are you referring to this tool? If so then first of all, you should use the offline version without the Internet connetion. Never enter your recovery phrase on any online website. Once you recover your friend's funds, create a new wallet using Ledger and send the coins there. You should be also be careful when entering the seed on a computer since it could be infected with some malware. Having said that, never enter your seed anywhere unless there is no other choice.

If you tried to use this particular tool to generate your addresses then you should have also modified the derivation path after entering your seed. Under 'Derivation Path', there are a few buttons (BIP32, BIP44, BIP49, BIP84, BIP141). Select BIP84 and you should see addresses starting from bc1. You can also easily modify the account number under that tab.

Hello, yes i mean this tool from coleman, i use it offline. Thanks, so i tried it with BIP84 like you said and now i can see all the adresses with bc1, but the Adress where i sended the funds to (which we are missing) bc1qj50q40uugqq23pz2nxgey3u2f0lphy3ls4x567, is not there. I am right that this is also a explanation / proof that he is not the owner of the this adress? I tried account from 0-9. My way is, trying to find the private keys for this Adress bc1qj50q40uugqq23pz2nxgey3u2f0lphy3ls4x567, so maybe i get a clue if he is the owner, but i cant find the private keys, so for me it looks also like he is not the owner. I dont know where are the coins, i have no explanation, except he is not the owner and make failure during copy & paste, but this never happened to him....

[Rath_]

I tried account from 0-9. My way is, trying to find the private keys for this Adress bc1qj50q40uugqq23pz2nxgey3u2f0lphy3ls4x567, so maybe i get a clue if he is the owner, but i cant find the private keys, so for me it looks also like he is not the owner. I dont know where are the coins, i have no explanation, except he is not the owner and make failure during copy & paste, but this never happened to him....

I don't think he is in control of that address either. You mentioned that you sent a total of 4 transactions. Three to that address and one to another one. However, I can see a fourth transaction in the missing address. Another ~0.1 BTC was sent to bc1qj50q40uugqq23pz2nxgey3u2f0lphy3ls4x567. Was that transaction sent by you?

What about bc1qefs2d4ck8mw68l24r9w7y2nwy7t3nkt43fw5pg address? You claim that your friend could see the transaction received to that wallet. Did you manage to find that address in one of these 10 accounts?

[nc50lc]

nc50lc

Today i tried to export my friend private keys with the BIP39 tool.
When i do that, i get this adresses (all private keys starts with L + K)

-snip-

But also i cant find the private key of this adresse there (bc1qefs2d4ck8mw68l24r9w7y2nwy7t3nkt43fw5pg),
but thats the Third Transaction which My friend recieved.
https://blockstream.info/tx/14210edd41e629264106f90470a1cff9fd870c391fa4094a93a4fba7e11f2d53

I mean, the BIP39 tool should display the private keys to this adress too, right?
So both adress starts with bc1 are missing on BIP39.

Maybe there is something wrong?

Did you mean, the seed phrase, not private keys alone?

Those are legacy addresses, you have to select the proper derivation path to derive the Native SegWit addresses.
For iancoleman's BIP39 tool, select BIP84 tab.

So you have access to your friend's keys, he must be a very close "friend" to entrust you his keys.
But the post above about "ismine: false" is the answer to your question, and I second it.

[ElectrumHELP]

I tried account from 0-9. My way is, trying to find the private keys for this Adress bc1qj50q40uugqq23pz2nxgey3u2f0lphy3ls4x567, so maybe i get a clue if he is the owner, but i cant find the private keys, so for me it looks also like he is not the owner. I dont know where are the coins, i have no explanation, except he is not the owner and make failure during copy & paste, but this never happened to him....

I don't think he is in control of that address either. You mentioned that you sent a total of 4 transactions. Three to that address and one to another one. However, I can see a fourth transaction in the missing address. Another ~0.1 BTC was sent to bc1qj50q40uugqq23pz2nxgey3u2f0lphy3ls4x567. Was that transaction sent by you?

What about bc1qefs2d4ck8mw68l24r9w7y2nwy7t3nkt43fw5pg address? You claim that your friend could see the transaction received to that wallet. Did you manage to find that address in one of these 10 accounts?

Hello. Yes, you are right. I can see 4 transactions on this adress (bc1qj50q40uugqq23pz2nxgey3u2f0lphy3ls4x567) too. The fourth with ~0.1 BTC was not sent by me.

This adress i can find in his electrum wallet: bc1qefs2d4ck8mw68l24r9w7y2nwy7t3nkt43fw5pg.
So this amount send by me he recieved.

nc50lc

Today i tried to export my friend private keys with the BIP39 tool.
When i do that, i get this adresses (all private keys starts with L + K)

-snip-

But also i cant find the private key of this adresse there (bc1qefs2d4ck8mw68l24r9w7y2nwy7t3nkt43fw5pg),
but thats the Third Transaction which My friend recieved.
https://blockstream.info/tx/14210edd41e629264106f90470a1cff9fd870c391fa4094a93a4fba7e11f2d53

I mean, the BIP39 tool should display the private keys to this adress too, right?
So both adress starts with bc1 are missing on BIP39.

Maybe there is something wrong?

Did you mean, the seed phrase, not private keys alone?

Those are legacy addresses, you have to select the proper derivation path to derive the Native SegWit addresses.
For iancoleman's BIP39 tool, select BIP84 tab.

So you have access to your friend's keys, he must be a very close "friend" to entrust you his keys.
But the post above about "ismine: false" is the answer to your question, and I second it.

Yes, i have tried it with BIP84 and i get all the private keys with the bc1 adresses, but i cant see the missing adress and not the belonging private key.
Yes, he is my best friend, we trust each other.

[Rath_]

Hello. Yes, you are right. I can see 4 transactions on this adress (bc1qj50q40uugqq23pz2nxgey3u2f0lphy3ls4x567) too. The fourth with ~0.1 BTC was not sent by me.

If your friend didn't send it or didn't ask anyone to pay him to that address then that is really concerning. Imagine how lucky you would have to be to receive free 0.1 BTC. I am sorry but it will seem to be someone else's address if your friend says that he doesn't know anything about the fourth transaction.

On friday i could see all the transaction, i think i have a problem with the derivation path, but i am not sure.

Still, this quote concerns me. The story doesn't add up. If you could see all the transactions then you should also had all the addresses. They shouldn't disappear on their own.