My noob questions

[Folio]

Hello everyone. I believe this is the official forum where it all began, so I feel both excited and a bit embarrassed to write my ignorant questions here.

So I have fallen into the bitcoin hole for the last few months, but I have still a lot of doubts, if it's not a problem with moderators, I'd like to use this discussion to ask various questions regarding bitcoin that will pop to my mind. If it's a problem you can delete the topic.



Question 1: I have a wallet, I have the seed phrase. If I open it with the exodus wallet or the electrum wallet, I see my money. If I open it with atomic wallet, I see my balance at 0. I believe it must be because these wallets contain different kinds of addressed, because if I look at them, I indeed see different addresses. Is this normal? Shouldn't my wallet (whatever it is), see my coins in whichever address they are?

[coupable]

Hello everyone. I believe this is the official forum where it all began, so I feel both excited and a bit embarrassed to write my ignorant questions here.

Hello Folio, welcome to bitcoin forum.
You don't have to feel embarrassed. No one will judge you by your ignorance as a newbie. We all started somewhere like you.

So I have fallen into the bitcoin hole for the last few months, but I have still a lot of doubts, if it's not a problem with moderators, I'd like to use this discussion to ask various questions regarding bitcoin that will pop to my mind. If it's a problem you can delete the topic.

There is no problem with moderators to use this thread to ask various questions regarding bitcoin. You just have to move it to the Beginners & Help board [the "move" button is in the bottom of this page]. Instead, i suggest you to do your own researches using the search option or any searche engine in the internet, as almost all the frequent asked questions have been responsed before. But if you insist to use this forum whenever you want to ask something, i invite you to take a look at the forum rules before to start; Unofficial list of (official) Bitcointalk.org rules, guidelines, FAQ

Question 1: I have a wallet, I have the seed phrase. If I open it with the exodus wallet or the electrum wallet, I see my money. If I open it with atomic wallet, I see my balance at 0. I believe it must be because these wallets contain different kinds of addressed, because if I look at them, I indeed see different addresses. Is this normal? Shouldn't my wallet (whatever it is), see my coins in whichever address they are?

Atomic wallet is a multi-currency wallet. This means it can be used to store other cryptocurrencies. However, you should see your btc balance if you use your own seed. I am not familiar with it, just try to select only bitcoin pair and see if it shows your money.
As you are in a basic stage, i suggest you to continue with Electrum, it's a friendly use bitcoin client dedicated for both newbies and experienced users .

[bitmover]

Question 1: I have a wallet, I have the seed phrase. If I open it with the exodus wallet or the electrum wallet, I see my money. If I open it with atomic wallet, I see my balance at 0. I believe it must be because these wallets contain different kinds of addressed, because if I look at them, I indeed see different addresses. Is this normal? Shouldn't my wallet (whatever it is), see my coins in whichever address they are?

It is a good security practice not to write your seed anywhere. Don't go pasting your seed around wallets ,as you can be easily hacked this way.

Atomic wallet is not a very good wallet imo. Stick with electrum  or exodus.

You probably used the wrong derivation path in atomic wallet  , this is why you see other addresses.  Do they start with which number? And in electrum?

[BitMaxz]

Actually it's not safe to import seed to different wallets like Exodus and Atomic wallet. I don't want you to lose all of your Bitcoins next time make a wallet only for one wallet and don't export it to different wallets.

About your question, it seems that the Atomic wallet is generated a different wallet not the same as the Exodus wallet and Electrum.
The possible reason the Atomic wallet generates different derivation paths that's why it generates different wallet addresses and shows zero funds.

I suggest you better stay using Electrum this is what I currently using without any issue yet and friendly user.

And this topic must be moved to Wallet software

[Folio]

Hello everyone. I believe this is the official forum where it all began, so I feel both excited and a bit embarrassed to write my ignorant questions here.

Hello Folio, welcome to bitcoin forum.
You don't have to feel embarrassed. No one will judge you by your ignorance as a newbie. We all started somewhere like you.

So I have fallen into the bitcoin hole for the last few months, but I have still a lot of doubts, if it's not a problem with moderators, I'd like to use this discussion to ask various questions regarding bitcoin that will pop to my mind. If it's a problem you can delete the topic.

There is no problem with moderators to use this thread to ask various questions regarding bitcoin. You just have to move it to the Beginners & Help board [the "move" button is in the bottom of this page]. Instead, i suggest you to do your own researches using the search option or any searche engine in the internet, as almost all the frequent asked questions have been responsed before. But if you insist to use this forum whenever you want to ask something, i invite you to take a look at the forum rules before to start; Unofficial list of (official) Bitcointalk.org rules, guidelines, FAQ

Question 1: I have a wallet, I have the seed phrase. If I open it with the exodus wallet or the electrum wallet, I see my money. If I open it with atomic wallet, I see my balance at 0. I believe it must be because these wallets contain different kinds of addressed, because if I look at them, I indeed see different addresses. Is this normal? Shouldn't my wallet (whatever it is), see my coins in whichever address they are?

Atomic wallet is a multi-currency wallet. This means it can be used to store other cryptocurrencies. However, you should see your btc balance if you use your own seed. I am not familiar with it, just try to select only bitcoin pair and see if it shows your money.
As you are in a basic stage, i suggest you to continue with Electrum, it's a friendly use bitcoin client dedicated for both newbies and experienced users .

Thanks for the welcome. I moved the topic as you said.
I don't see the money in the atomic wallet even if I only leave bitcoin as a currency.
If I write my atomic wallet address on blockchair or blockstream I see no money either.

Question 1: I have a wallet, I have the seed phrase. If I open it with the exodus wallet or the electrum wallet, I see my money. If I open it with atomic wallet, I see my balance at 0. I believe it must be because these wallets contain different kinds of addressed, because if I look at them, I indeed see different addresses. Is this normal? Shouldn't my wallet (whatever it is), see my coins in whichever address they are?

It is a good security practice not to write your seed anywhere. Don't go pasting your seed around wallets ,as you can be easily hacked this way.

Atomic wallet is not a very good wallet imo. Stick with electrum  or exodus.

You probably used the wrong derivation path in atomic wallet  , this is why you see other addresses.  Do they start with which number? And in electrum?

Hi, thanks. Yes I can imagine. But in the beginning I am making a lot of tests sending money to myself in order to get a grip of how it all works, but I can see how it can become dangerous.
The exodus wallet looks very good but you cannot set the fees therefore I abandoned it.

Now regarding the "derivation path", I think you are spot on.
The address of the atomic wallet starts with a 1, the one on the electrum wallet starts with the letter b.
Do I choose this "derivation path" or is it an automatic thing that the wallet does?
From what I understood, my money are still attached to my seed phrase, so even though my atomic wallet does not show them, they are in fact in there, the problem is that the wallet by default only shows a certain amount of addresses. Can I decide which addresses it shows?

Actually it's not safe to import seed to different wallets like Exodus and Atomic wallet. I don't want you to lose all of your Bitcoins next time make a wallet only for one wallet and don't export it to different wallets.

About your question, it seems that the Atomic wallet is generated a different wallet not the same as the Exodus wallet and Electrum.
The possible reason the Atomic wallet generates different derivation paths that's why it generates different wallet addresses and shows zero funds.

I suggest you better stay using Electrum this is what I currently using without any issue yet and friendly user.

And this topic must be moved to Wallet software

The problem with Electrum is that the mobile app looks a bit horrendous, but if you guys suggest it as the best one I will stick with it.
I had read that the Electrum wallet was hacked though a few years ago and a warning message appeared asking users to download a fake wallet which stole their money. That said, you think Electrum is the best wallet (besides the cold ones)?

I'd prefer to leave the topic to the beginner section as I have other questions.

[OmegaStarScream]

From what I understood, my money are still attached to my seed phrase, so even though my atomic wallet does not show them, they are in fact in there, the problem is that the wallet by default only shows a certain amount of addresses. Can I decide which addresses it shows?

The problem with Electrum is that the mobile app looks a bit horrendous, but if you guys suggest it as the best one I will stick with it.

Which wallet have you used to generate the seed?

Atomicwallet supports legacy addresses only (start with 1)  while Exodus and Electrum support bech32 addresses (start with bc1) and that's why you can't see your balance in atomic. Electrum lets you choose the type of addresses (while restoring the wallet), but other wallets don't.

The problem with Electrum is that the mobile app looks a bit horrendous, but if you guys suggest it as the best one I will stick with it.

If you don't like how Electrum wallet looks on the phone, go with Mycelium.

I had read that the Electrum wallet was hacked though a few years ago and a warning message appeared asking users to download a fake wallet which stole their money. That said, you think Electrum is the best wallet (besides the cold ones)?

If you don't want to invest in a hardware wallet, then yes, Electrum is definitely the way to go.

Note: You can restore any wallet's seed into electrum, but electrum's cannot be imported anywhere but to itself and Bluewallet.

[Charles-Tim]

That said, you think Electrum is the best wallet (besides the cold ones)?

For saving bitcoin, electrum wallet is one of the best, but you too have to use it carefully, there are malware that can hack electrical wallet, avoid unknowingly installing malware and you are good to go. As for me, I like only one bitcoin mobile wallet, it is electrum. Be careful of your seed phrase, so far too use electrum, it will be advisable to only use another electrum wallet for recovery in case as it will not deny you of you seed phrase, it will always use the same derivation part.

As for hardware wallet, they are one of the safest but that does not mean electrum wallet is not good, but if you have money to get a good hardware wallet like trezor one or ledger nano s or x, them tou are good, but no wallet is 100% safe until you yourself is so careful, also, hardware wallets support many cryptocurrencies.

[Folio]

Which wallet have you used to generate the seed?

Atomicwallet supports legacy addresses only (start with 1)  while Exodus and Electrum support bech32 addresses (start with bc1) and that's why you can't see your balance in atomic. Electrum lets you choose the type of addresses (while restoring (https://bitcoinelectrum.com/restoring-your-standard-wallet-from-seed/) the wallet), but other wallets don't.

I don't remember which wallet I used to generate the seed, but I think it was the Atomic wallet.

If you don't like how Electrum wallet looks on the phone, go with Mycelium.

So I can use Electrum on the PC and Mycelium on the phone without any danger?

For saving bitcoin, electrum wallet is one of the best, but you too have to use it carefully, there are malware that can hack electrical wallet, avoid unknowingly installing malware and you are good to go. As for me, I like only one bitcoin mobile wallet, it is electrum. Be careful of your seed phrase, so far too use electrum, it will be advisable to only use another electrum wallet for recovery in case as it will not deny you of you seed phrase, it will always use the same derivation part.

As for hardware wallet, they are one of the safest but that does not mean electrum wallet is not good, but if you have money to get a good hardware wallet like trezor one or ledger nano s or x, them tou are good, but no wallet is 100% safe until you yourself is so careful, also, hardware wallets support many cryptocurrencies.

Given that I plan on reaching 1 btc at least (if it doesn't skyrocket before I'm able to), I think I will make 2 wallets, the main one which I will keep on a Linux live usb stick and a small one to use daily. But that's for the future, I'll have to learn how to sign a transaction offline.


Question 2: on the Electrum wallet I have some money on the address X and some other money on the address Y. The sum of x and y make the total amount of my money. Can I move the money to a specific address or do I have to "send" them to myself?

Question 3: when I choose which address I want to use to receive money, if I select the ones with money in them, they are highlighted in red. Does this only mean that they already contain money or there's something else to know?

Question 4: how come I can choose which address to use to receive money but I cannot choose which address to use to send money? If it automatically uses the main one, the receiver will be able to see my balance, no?

[OmegaStarScream]

So I can use Electrum on the PC and Mycelium on the phone without any danger?

Yes, you can but it's not recommended to use the same seed on multiple devices.

Question 2: on the Electrum wallet I have some money on the address X and some other money on the address Y. The sum of x and y make the total amount of my money. Can I move the money to a specific address or do I have to "send" them to myself?

Question 3: when I choose which address I want to use to receive money, if I select the ones with money in them, they are highlighted in red. Does this only mean that they already contain money or there's something else to know?

Question 4: how come I can choose which address to use to receive money but I cannot choose which address to use to send money? If it automatically uses the main one, the receiver will be able to see my balance, no?

- Do you mean you want to move everything to one address? If so, then yes, you'll have to send them to yourself (create a transaction and pay a fee).
- That's basically it, you can keep using the same address to receive funds, but that's not recommended (for privacy reasons).
- You can right-click the address and then simply select "Send from".

[Charles-Tim]

OmegaStarScream has answered you all, seed phrase is not for recovering bitcoin from one wallet to another wallets frequently,  using it on another different wallet is not also advisable, use the seed phrase only for recovery of the same wallet on another device is better and also should be during theft or damage or when changing device, not for fun sake. Not that you can not use seed phrase to recover on another wallet of different type, but you have to make sure the new wallet you want to input the seed phrase support the derivation part of the old wallet.

Question 4: how come I can choose which address to use to receive money but I cannot choose which address to use to send money? If it automatically uses the main one, the receiver will be able to see my balance, no?

It is not advisable to use one (main) address, using wallets that can generate new address automatically for each transaction is better, new address will also be generated automatically while sending, this is to maintain high level of privacy. So, you do not need to bother choosing which address you want to use to send as the address will change for each transactions automatically.

If it automatically uses the main one, the receiver will be able to see my balance, no?

Any amount of bitcoin sent to a single address can be traced/tracked, if you are using only one address to send or receive, that means all bitcoin sent through the address can be traced, but your balance can not be seen only some kind of malware can do this.

[bitmover]

It is a good security practice not to write your seed anywhere. Don't go pasting your seed around wallets ,as you can be easily hacked this way.

Atomic wallet is not a very good wallet imo. Stick with electrum  or exodus.

You probably used the wrong derivation path in atomic wallet  , this is why you see other addresses.  Do they start with which number? And in electrum?

Hi, thanks. Yes I can imagine. But in the beginning I am making a lot of tests sending money to myself in order to get a grip of how it all works, but I can see how it can become dangerous.
The exodus wallet looks very good but you cannot set the fees therefore I abandoned it.

Now regarding the "derivation path", I think you are spot on.
The address of the atomic wallet starts with a 1, the one on the electrum wallet starts with the letter b.
Do I choose this "derivation path" or is it an automatic thing that the wallet does?
From what I understood, my money are still attached to my seed phrase, so even though my atomic wallet does not show them, they are in fact in there, the problem is that the wallet by default only shows a certain amount of addresses. Can I decide which addresses it shows?

You money is attached to the Seed, however you have to tell your wallet where inside this seed your funds are. This is what the derivation path is. It will tell your wallet where to look

As your address with balance starts with 'b', it is a native segwit address, its derivation path is m / 84' / 0' / 0'
In your atomic wallet, as its starts with '1', it is a legacy address, and the derivation path is m / 44' / 0 / 0

[Benefactor]

Hello everyone. I believe this is the official forum where it all began, so I feel both excited and a bit embarrassed to write my ignorant questions here.

So I have fallen into the bitcoin hole for the last few months, but I have still a lot of doubts, if it's not a problem with moderators, I'd like to use this discussion to ask various questions regarding bitcoin that will pop to my mind. If it's a problem you can delete the topic.



Question 1: I have a wallet, I have the seed phrase. If I open it with the exodus wallet or the electrum wallet, I see my money. If I open it with atomic wallet, I see my balance at 0. I believe it must be because these wallets contain different kinds of addressed, because if I look at them, I indeed see different addresses. Is this normal? Shouldn't my wallet (whatever it is), see my coins in whichever address they are?

Congratulations to everyone on the Bitcoin Forum. Yes you can feel free to ask any question related to Bitcoin here but it is better if you follow the forum rules in a good. The moderators here are all very sincere. You can ask questions here to find out any useful bitcoin related information. Everyone will answer your question with a lot of sincerity. I'm telling you to get rid of the Atomic wallet. Lean towards the Electrum Wallet as soon as possible. It will be good for you.

[Folio]

Question 5: is a wallet with 24 words safer than one with 12 words? I have one with 12, should I switch to one with 24? I am getting serious with bitcoin now.

[OmegaStarScream]

Question 5: is a wallet with 24 words safer than one with 12 words? I have one with 12, should I switch to one with 24? I am getting serious with bitcoin now.

Well, in short, both are impossible to crack. If you want to know the math behind it, read this: https://bitcointalk.org/index.php?topic=5078657.0

It's worth mentioning that some wallets (like Electrum and Trezor) allow their users to extend their seed with custom words which can be very helpful to add an extra layer of security.

[Pmalek]

The problem with Electrum is that the mobile app looks a bit horrendous, but if you guys suggest it as the best one I will stick with it.
I had read that the Electrum wallet was hacked though a few years ago and a warning message appeared asking users to download a fake wallet which stole their money. That said, you think Electrum is the best wallet (besides the cold ones)?

Don't focus on the looks and the design of the wallet. The security and safety of funds should be your top priority. The correct use of Electrum fulfills those goals.

Electrum was never hacked. Certain users abused a loophole that allowed Electrum servers to send custom messages. These messages informed the users that their Electrum software was out of date and needed to be updated. They posted links to phishing websites. Those who clicked and installed the fake software lost their Bitcoin. This loophole has been patched since the 3.3.4 version of Electrum.

That is why we always say verify your Electrum signatures before you install the software. If those who were phished had done that, they would have noticed that the software they installed was fake and is not the original Electrum.

[Lucius]

That is why we always say verify your Electrum signatures before you install the software. If those who were phished had done that, they would have noticed that the software they installed was fake and is not the original Electrum.

The reason why many people are hacked via Electrum is not only in the fact that users did not verify the signature (but most had no idea it was possible), but also in the fact that this security flaw existed at all and was not previously detected and fixed. Most (at least on this forum) blame users exclusively for not doing something (verify signatures), but it is also a big responsibility of those who have publicly distributed software with such a security flaw.

I don't see that such things can be avoided in the future unless downloading such sensitive programs would only be possible by forcing users to verify downloaded files before installation.

[Folio]

What does it mean "verify your Electrum signature"?

[o_e_l_e_o]

What does it mean "verify your Electrum signature"?

Much like the private and public keys we use in bitcoin to sign and verify transactions, we can use private and public keys in general cryptography to sign and verify other data.

When Electrum is released, the main developor Thomas Voegtlin signs the release with one of his private cryptography keys. He also publishes the corresponding public key. Anyone who downloads Electrum can then use that public key to verify that the version of Electrum they downloaded is identical to the version of Electrum which was signed by Voegtlin. If you had accidentally downloaded a malicious version, someone had tampered or edited the code in the version you downloaded, malware had buried itself inside, etc., then the verification process would fail, alerting you that you had downloaded a malicious copy and not to use it. In short, verifying your download ensures that you are using a legitimate copy straight from the developer.

There's an explanation of this on the Electrum download page here:

GPG signatures are a proof that distributed files have been signed by the owner of the signing key. For example, if this website was compromised and the original Electrum files had been replaced, signature verification would fail, because the attacker would not be able to create valid signatures. (Note that an attacker would be able to create valid hashes, this is why we do not publish hashes of our binaries here, it does not bring any security).

For a newbie's guide on how to verify your download, have a look at the following links:
https://bitcoinelectrum.com/how-to-verify-your-electrum-download/
https://bitzuma.com/posts/how-to-verify-an-electrum-download-on-windows/
https://bitzuma.com/posts/how-to-verify-an-electrum-download-on-mac/

[Folio]

My god why does it have to be so complicated.

[o_e_l_e_o]

It's like anything new - it can seem overwhelming at first, but stick with it and you will soon figure out all these quirks and nuances.

With bitcoin, you are "being your own bank". You are taking complete control of your money and not trusting any third party to look after it or manage it for you. Think about your average commercial bank. Think about how complicated their internal database must be, how robust their security systems are, how many employees they have working for them, and so on. With bitcoin, you are emulating all that for yourself. By necessity that comes with a degree of complexity.

It is possible to skip all this and use bitcoin in the most simple way possible - create an account on an exchange, buy bitcoin there, and leave it their storage. You don't have to worry about seed phrases, derivation paths, verifying signatures, or any of the things discussed here. But to do so is to miss out on the very essence of what bitcoin is - peer to peer, trustless, decentralized. If you are going to trust a third party like an exchange to do all the heavy lifting for you, then why use bitcoin at all? Why not just stick to fiat?

To be fair, the question regarding verifying signatures does not just apply to Electrum or bitcoin wallets. I verify everything from Tor to my password manager. When you are downloading or updating any piece of software, it is good practice to verify that it has not been tampered with.

[pooya87]

That is why we always say verify your Electrum signatures before you install the software. If those who were phished had done that, they would have noticed that the software they installed was fake and is not the original Electrum.

The reason why many people are hacked via Electrum is not only in the fact that users did not verify the signature (but most had no idea it was possible), but also in the fact that this security flaw existed at all and was not previously detected and fixed. Most (at least on this forum) blame users exclusively for not doing something (verify signatures), but it is also a big responsibility of those who have publicly distributed software with such a security flaw.

I don't see that such things can be avoided in the future unless downloading such sensitive programs would only be possible by forcing users to verify downloaded files before installation.

developers have no responsibility, and it is not just because of the MIT license that eliminates that responsibility entirely but because of the simple fact that any software that has ever been released and will ever be released has flaws. there is no escaping that. it doesn't matter how many developers spend how much time on that software, it will have flaws that will be exploited at some point and fixed afterwards.

the blame is on users exclusively in this particular case because they could have protected themselves with very simple and mandatory steps that includes signature verification and using cold storage.

[Pmalek]

...but also in the fact that this security flaw existed at all and was not previously detected and fixed. Most (at least on this forum) blame users exclusively for not doing something (verify signatures), but it is also a big responsibility of those who have publicly distributed software with such a security flaw.

I agree with the part that such a vulnerability shouldn't have existed, but to be fair, it wasn't a vulnerability until bad actors made it one. The developers probably didn't consider it could become a problem since they don't share the same thought of hackers and various scammer and exploiters. Nobody and nothing is perfect.

We as users should do our part in following suggested standards. The blame is still very much on the individuals, not the software, although I agree that some small part is on the developers as well. Because even if those custom messages were present today, if the users verify the signatures, and pay attention that the software updates for the software stem from the genuine site, they would not be phished.

[bob123]

[...] but also in the fact that this security flaw existed at all and was not previously detected and fixed. Most (at least on this forum) blame users exclusively for not doing something (verify signatures), but it is also a big responsibility of those who have publicly distributed software with such a security flaw.

"Such a security flaw" ?

The CVSS score of that vulnerability is somewhere between 2.5 and 3.5 out of 10 and therefore low severity.
It doesn't do anything else than just displaying a message.

If an user visits a fake github page with no source code and installs malware without verifying the signature, they are completely at fault.

It is almost like saying "I received an email in my mail client and clicked the link to install this program. The email client is at fault." That's not exactly the same since, but both is nonsense and comparable.

[Lucius]

"Such a security flaw" ?

The CVSS score of that vulnerability is somewhere between 2.5 and 3.5 out of 10 and therefore low severity.
It doesn't do anything else than just displaying a message.

If an user visits a fake github page with no source code and installs malware without verifying the signature, they are completely at fault.

It is almost like saying "I received an email in my mail client and clicked the link to install this program. The email client is at fault." That's not exactly the same since, but both is nonsense and comparable.

I had no doubt you wouldn't comment this way, and I know very well your position when it comes to things like this. But you only look at these things from the position of someone who is some kind of expert in the IT industry. All those poor people who lost their BTC because the official wallet showed them a fake message don't care what the score is, that low score means nothing when they money is gone.

It is complete nonsense to compare an email client with an Electrum, but if it makes sense to you... This is about someone taking advantage of something that allowed him to cheat a lot of people, and part of the responsibility for that lies with the developer.

But that’s just my opinion, there’s no need to further discuss what someone should or shouldn’t have done.

[bob123]

I had no doubt you wouldn't comment this way, and I know very well your position when it comes to things like this. But you only look at these things from the position of someone who is some kind of expert in the IT industry. All those poor people who lost their BTC because the official wallet showed them a fake message don't care what the score is, that low score means nothing when they money is gone.

I do realize that the victims don't really care about how a specific score is rating that vulnerability.
But with BTC and the whole be your own bank around it, people also need to secure their funds themselves.


And we are not talking about being extremely techy.
It is enough to internalize "simple" things like 1) only downloading from the official website and 2) do not click on random links / do not download random stuff.

I believe that you don't have to be techy or be working in the IT field to actually do that.

But a lot of people still fall for simple scam mails (e.g. nigerian prince or whatever the current equivalent of that is).
And those people are not ready yet for keeping their money safe - all on their own.

BTC does not have a system yet which is that fool-proof. And i doubt we will ever get that far.
So people actually have to learn new things. They have to learn basic IT stuff like not clicking on every random link.

We can just hope that the victims learnt it this way. And that their loss wasn't too huge.

[Folio]

Ok but the fake link came from the wallet itself as far as I understood, so that's not exactly like a scammy email.

[Lucius]

~snip~

I completely agree that a very large number of crypto users have a completely wrong attitude when it comes to crypto, it is a combination of ignorance and misunderstanding of the very idea on which BTC was created. There is no doubt that most are not ready to be their own bank, this is shown by all examples of hacking - but also the fact that millions of BTC are kept on crypto exchanges and online wallets.

There is also no doubt that all Electrum users are responsible for what happened to them, primarily because they were unaware that Electrum does not have an official update option from the program itself, and secondly that there is something that allows them to check the legitimacy of a file before installing.

But it’s also a fact that Electrum existed as much as 3 years before someone took advantage of this vulnerability, and that’s the only reason I say that part of the responsibility is also on those who didn’t discover it in time. Of course, what pooya87 wrote should also be taken into account, and that is that the license was issued by the MIT and that there is no material or criminal liability.

According to research from 2019, the value of BTC stolen in this way is measured at about $ 4 million, but it should be noted that at the end of 2018 the price of BTC was at least three times lower than today, and that all those who still have vulnerable versions remain potential victims. So far, the biggest known loss was $140,000, which is big money anywhere in the world.

Ok but the fake link came from the wallet itself as far as I understood, so that's not exactly like a scammy email.

This is true, and because of that you should never trust anything blindly, but check and verify every thing related to crypto.

[Pmalek]

primarily because they were unaware that Electrum does not have an official update option from the program itself...

I think this was also changed, not sure if with version 3.3.8 or an older one. I remember reading that it became possible for Electrum to check if you were using the latest version and if updates are available. I assume if they are, it would let you download and install them. I never used that option or care for it that much as that is not the way I plan to update my Electrum anyways.

[bob123]

primarily because they were unaware that Electrum does not have an official update option from the program itself...

The vulnerability allowed the server to show a message to the client.
It wasn't really an update function. It was a warning message saying that the current version is vulnerable and that an update should be performed (with an link to the fake version of electrum).

I remember reading that it became possible for Electrum to check if you were using the latest version and if updates are available. I assume if they are, it would let you download and install them.

It would only show that there is an update available. You still would have to visit electrum.org to download and install it.

[Folio]

Question 6: can you help me understand how the transactions work?

So for example I sent 73,5 € to myself in May, this is the transaction as displayed by the wallet.
By this image, I can see that I sent 0.00853949 bitcoin, of which 0.00066542 bitcoin have been spent on the fees.





Now when I check the transaction on the blockchain, I would expect to see something like

from X (x= address of the sender) to Y (y = address of the receiver).

And the amount without fees, so 0.00787407 bitcoin.


Instead, if I look at the transaction on the blockchain, this is what I see.




What I don't understand:

1. Why is the "input total" 0.02253233 btc? What I sent was 0.00853949. Is this "input total" the total amount I had in my wallet when I made the transaction? If so, why on Earth would I want to show that to the person receiving the payment?

2. What do the numbers 1, 2, 3 and 4 indicate? I expected to see the amount of money I sent from my address to his address, instead I see 4 addresses and 4 different amounts of bitcoin.


How come the images don't show? I used the tag properly.

[o_e_l_e_o]

Think of bitcoin transactions like physical cash you hold in your hand, rather than like electronic cash you send via a bank transfer. If I have a 20 euro note, and I want to pay you 15 euros, then I have to use the whole 20 and get 5 back as change. If I have two 10 euro notes, and I want to pay you 15, then I have to use both of them, again getting 5 back as change. You can't cut a 10 euro note in half and call it 5 euros.

The same is true for bitcoin. All the coins in your wallet are part of discrete "unspent outputs" or "UTXOs". When you want to spend part of an output, you have to spend the whole output and get some of it back as change. Spending the output like this create two new outputs - one being sent to the person or address you are paying, and another being sent back to you with the change.

1. Why is the "input total" 0.02253233 btc?

Your wallet has combined two outputs, one with 0.00034433 BTC and one with 0.02218800 BTC.

Is this "input total" the total amount I had in my wallet when I made the transaction? If so, why on Earth would I want to show that to the person receiving the payment?

You wouldn't, but all bitcoin transactions are public, and so viewable to anyone. If you want to pick and choose which UTXOs to include in your transaction, then you need to use a wallet such as Electrum which allows you to do that.

2. What do the numbers 1, 2, 3 and 4 indicate?

Numbers 1 and 2 are two different UTXOs which you used in that transaction. Number 3 is the output you sent, and number 4 is the change being returned to your wallet.

How come the images don't show?

Newbies can't post images. You need to rank up by spending more time on the forum.


As an aside, although you have blanked out the transaction ID and the addresses, simply showing the amounts involved is enough for someone to find that transaction on a block explorer in the space of a couple of minutes.

[Folio]

Thanks but I am still confused, what a weird way of processing the transfer. So basically every time I send money I have to send my entire wallet and then I receive back the change? Who is sending me back the change? The miner? Does he have to pay fees on that transfer too?

So I sent him the 2 amounts that are shown on the left, the 3 arrived to him and the 4 is what comes back to me (without the fees).

But why did I have to send him 1 and 2? Number 2 alone was way more than sufficient to make the payment. I don't get it.

[Coin_trader]

Thanks but I am still confused, what a weird way of processing the transfer. So basically every time I send money I have to send my entire wallet and then I receive back the change? Who is sending me back the change? The miner? Does he have to pay fees on that transfer too?

So I sent him the 2 amounts that are shown on the left, the 3 arrived to him and the 4 is what comes back to me (without the fees).

But why did I have to send him 1 and 2? Number 2 alone was way more than sufficient to make the payment. I don't get it.

Don't make it too much complicated. All the balance at address 1,2,3 and 4 belongs to your general wallet. So it will just sum up at the end that's why total balance is what you are viewing on your electrum wallet. You can disregard the technical side if you are too confused. The most important thing to consider is your total balance. And you can deposit to any of your previous address since it was all connect and it will just sum up.

Mining fee will be deducted to your total balance at all. Just protect your private key and everything will be fine.

[o_e_l_e_o]

So basically every time I send money I have to send my entire wallet and then I receive back the change?

No, not at all. You only have to send the entire output, whereas your wallet likely contains multiple different outputs (one from each transaction you received).

Who is sending me back the change? The miner? Does he have to pay fees on that transfer too?

The change is built in to the transaction automatically. Technically you are sending it to yourself. The miner does not have control of it at any point, and the fee for it is built in to the fee you pay for the transaction.

So I sent him the 2 amounts that are shown on the left, the 3 arrived to him and the 4 is what comes back to me (without the fees).

Correct.

But why did I have to send him 1 and 2? Number 2 alone was way more than sufficient to make the payment. I don't get it.

Yeah, this is a bit strange and not typical. Which wallet software did you use to make this transaction?

The reason this likely happened is to "consolidate" inputs. By using two inputs, the change from both is combined in to one output. Having fewer outputs saves fees in long run. To go back to my earlier analogy, it's like I have a 10 euro note and 1 euro in coins, and I owe you 6 euros. I could give you the 10 and get more coins in change, or I could give you 10 plus the coins to make 11, and then get a nice 5 euro note back as change.

[Folio]

Don't make it too much complicated. All the balance at address 1,2,3 and 4 belongs to your general wallet. So it will just sum up at the end that's why total balance is what you are viewing on your electrum wallet. You can disregard the technical side if you are too confused. The most important thing to consider is your total balance. And you can deposit to any of your previous address since it was all connect and it will just sum up.

Mining fee will be deducted to your total balance at all. Just protect your private key and everything will be fine.

I want to know as much as possible (without studying computer programming and cryptography).
I don't know my private key nor have I written it anywhere, I only stored the seed physically.

So basically every time I send money I have to send my entire wallet and then I receive back the change?

No, not at all. You only have to send the entire output, whereas your wallet likely contains multiple different outputs (one from each transaction you received).

Who is sending me back the change? The miner? Does he have to pay fees on that transfer too?

The change is built in to the transaction automatically. Technically you are sending it to yourself. The miner does not have control of it at any point, and the fee for it is built in to the fee you pay for the transaction.

So I sent him the 2 amounts that are shown on the left, the 3 arrived to him and the 4 is what comes back to me (without the fees).

Correct.

But why did I have to send him 1 and 2? Number 2 alone was way more than sufficient to make the payment. I don't get it.

Yeah, this is a bit strange and not typical. Which wallet software did you use to make this transaction?

The reason this likely happened is to "consolidate" inputs. By using two inputs, the change from both is combined in to one output. Having fewer outputs saves fees in long run. To go back to my earlier analogy, it's like I have a 10 euro note and 1 euro in coins, and I owe you 6 euros. I could give you the 10 and get more coins in change, or I could give you 10 plus the coins to make 11, and then get a nice 5 euro note back as change.

Thank you. Can you define "output"? It seems weird that I have outputs. It would seem normal that the money I receive are inputs and the money I send are outputs, but by the way you speak it seems like it's the opposite.
How do I know how many "outputs" there are in my wallet?

I don't understand why these "outputs" must be moved altogether as one... given that it's completely digital wasn't it easier to consider every satoshi as a singular movable unit?

[o_e_l_e_o]

Can you define "output"? It seems weird that I have outputs. It would seem normal that the money I receive are inputs and the money I send are outputs, but by the way you speak it seems like it's the opposite.

Transactions have both inputs and outputs. Bitcoin which are not being spent in a transaction are called unspent outputs.

Let's say I have 2 bitcoin in my wallet in a single unspent output. I then spend that unspent output by using it as the input to a transaction. With that transaction I create two new outputs - one output of 0.5 BTC to you, and one ouput of 1.5 BTC as change back to myself. These two new outputs are unspent outputs (also known as UTXOs short for "unspent transaction outputs") until such a time as they are used as inputs in a transaction.

How do I know how many "outputs" there are in my wallet?

It depends on the wallet you are using. Good ones will let you view individual outputs, whereas custodial or web wallets are unlikely to have this feature.

Here's a good resource that might help you understand if more thoroughly: https://learnmeabitcoin.com/beginners/outputs. I'd recommend all the beginner's guides on that site as good sources of info in general.

[Folio]

Can you define "output"? It seems weird that I have outputs. It would seem normal that the money I receive are inputs and the money I send are outputs, but by the way you speak it seems like it's the opposite.

Transactions have both inputs and outputs. Bitcoin which are not being spent in a transaction are called unspent outputs.

Let's say I have 2 bitcoin in my wallet in a single unspent output. I then spend that unspent output by using it as the input to a transaction. With that transaction I create two new outputs - one output of 0.5 BTC to you, and one ouput of 1.5 BTC as change back to myself. These two new outputs are unspent outputs (also known as UTXOs short for "unspent transaction outputs") until such a time as they are used as inputs in a transaction.

How do I know how many "outputs" there are in my wallet?

It depends on the wallet you are using. Good ones will let you view individual outputs, whereas custodial or web wallets are unlikely to have this feature.

Here's a good resource that might help you understand if more thoroughly: https://learnmeabitcoin.com/beginners/outputs. I'd recommend all the beginner's guides on that site as good sources of info in general.

Oh ok, now I got it, thank you!
I guess they are called outputs because those coins originally came from the miners who mined them.

[Pmalek]

Those screenshots and the way the transaction was put together is why coin control is so important. What I mean with that is being able to select which outputs you want to spend.
You sent 0.00853949 BTC. You could have used only the 0.022188 output. There was no reason to include the 0.00034433 output in the transaction.

Since o_e_l_e_o used Euros as an example, I am going to do the same. Lets say you want to spend €6. In your wallet you have a €5 bill and a €10 bill. I assume you would pay using the €10 bill, am I correct? And you wouldn't touch the €5 bill. But what you did with your Bitcoin transaction is that you gave the cashier both bills to pay for your €6 item. That wasn't necessary.      

Additionally, the 180 sat/vbyte fee is very high and unless you are very much in hurry such a fee is not needed. Even if you are in a hurry, a lower fee would have probably server you equally as good.  

[Folio]

Those screenshots and the way the transaction was put together is why coin control is so important. What I mean with that is being able to select which outputs you want to spend.
You sent 0.00853949 BTC. You could have used only the 0.022188 output. There was no reason to include the 0.00034433 output in the transaction.

Since o_e_l_e_o used Euros as an example, I am going to do the same. Lets say you want to spend €6. In your wallet you have a €5 bill and a €10 bill. I assume you would pay using the €10 bill, am I correct? And you wouldn't touch the €5 bill. But what you did with your Bitcoin transaction is that you gave the cashier both bills to pay for your €6 item. That wasn't necessary.      

Additionally, the 180 sat/vbyte fee is very high and unless you are very much in hurry such a fee is not needed. Even if you are in a hurry, a lower fee would have probably server you equally as good.  

Yes indeed, the fact that it used both outputs to send the money doesn't make any sense. I didn't choose it, it was automatic and the fee is high due to the wallet I think. I must have sent that money using Exodus which doesn't allow you to select the fees. What's a reasonable fee?

I now see how I can select which output to spend from Electrum. Thanks!

By the way that website is awesome, he even has a youtube channel with very clear explanations. Thanks guys!

[o_e_l_e_o]

What's a reasonable fee?

So the fee rate is calculated based on the size of your transaction in virtual bytes. Transactions with more inputs and outputs take up more virtual bytes than transactions with fewer inputs and outputs. The actual monetary value of the transaction is irrelevant as far as the fee goes. If you had a transaction of 500 vbytes, and you paid 5000 sats in fee, then your fee rate is 10 sats/vbyte. You might have a larger transaction which uses multiple inputs and ends up as 3000 vbytes, and you could pay a higher fee of 9000 sats, but your rate then would only be 3 sats/vbyte. So although your second transaction costs you more, it actually has a lower fee rate than your first. Since miners are always looking to maximize their own profits, they will generally pick the transaction with the highest fee rate. This lets them squeeze the maximum profit out of the finite space in each bitcoin block.

With that in mind, a reasonable fee depends on how many other transactions are waiting to get confirmed at the time, and what fee rates those transaction have paid. If the mempool (the mempool is the pool of unconfirmed transactions waiting to be mined) is empty, than a fee rate of 1 or 2 sats/vbyte will be more than enough to be confirmed quickly. If the mempool is very full, then a fee rate of 1 or 2 sats/vbyte will put you right at the bottom and you may have to wait many hours or even days to be confirmed. In those cases, you would want to pay a higher fee to get closer to the tip of the mempool if you are in a hurry.

If you want a site to just tell you what would be a reasonable fee to use, I would suggest using this one: https://www.coinb.in/#fees. You can ignore all the sliders and just use the small number at the bottom of the blue box "XX Sat/Byte".

If you want to have more control over what fee you set (and likely save some money along the way), then I would suggest using the bottom graph on this site, titled "Mempool Size in MB": https://jochen-hoenicke.de/queue/#1,8h. This is a bit more difficult to get your head around. Essentially each colored band shows how many megabytes of transactions at each fee rate are currently waiting to be confirmed, and so you can choose where you want to place your transaction. 1miau has written a good guide to using this site here: Make sure to avoid wasting BTC for too high fees – step by step guide (Electrum)

[Folio]

So regarding the hack on twitter, what exactly happened in this transaction?




1 is the address of the sender, right?
2 is the address of the receiver, right?

So what are those other addresses? The sender sent money to those other addresses as well? If so why are those addresses showing in the transaction as well?

[pooya87]

1 is the address of the sender, right?
2 is the address of the receiver, right?
So what are those other addresses? The sender sent money to those other addresses as well? If so why are those addresses showing in the transaction as well?

any address on the left side is considered sender(s) and anything on the right is considered receiver(s). technically you can have as many sender and receiver in any transaction as you want with any amount you want between 0 and less than sum of the inputs. but practically there are standard limits that apply for instance very small amounts such as 1 satoshi is considered spam and will be rejected by nodes.

[HCP]

So regarding the hack on twitter, what exactly happened in this transaction?




1 is the address of the sender, right?
2 is the address of the receiver, right?

So what are those other addresses?

Looks like whomever sent that transaction was attempting to make a point... Possibly to the hackers.

Did you read the "addresses"?

The message appears to be:
"Just read all transaction outputs as text, you take risk when use Bitcoin for your Twitter game. Bitcoin is traceable. Why not Monero?"

The sender sent money to those other addresses as well?

Technically yes... But it was ~0.00000666 for each one... And 0.00001337 (aka "leet") to the hackers address

If so why are those addresses showing in the transaction as well?

As already stated, you can have multiple inputs or outputs.

[Folio]

Thanks, I have read most of that website but I still have some doubts about how to read that web page.

So the one on the left is the original output or "container of bitcoin" that the sender is using to send money away.
The ones on the right are the receiving addresses that receive parts of the original output. Each receiving address is a new input.

What I don't get is: why are they listed together? This way if John sends me 5 and John sends another 3 to Elisabeth, I will be able to see that John sent 3 to Elisabeth?? Isn't this a bad thing?
I mean unless this is a feature that like in emails sends the same message to many addresses (cc in emails) it seems like very bad privacy.

I certainly don't want the pet store to know that I spent money at the car store before if I am using the same output for these 2 payments, that's my business not his.

[HCP]

What I don't get is: why are they listed together? This way if John sends me 5 and John sends another 3 to Elisabeth, I will be able to see that John sent 3 to Elisabeth?? Isn't this a bad thing?
I mean unless this is a feature that like in emails sends the same message to many addresses (cc in emails) it seems like very bad privacy.

I certainly don't want the pet store to know that I spent money at the car store before if I am using the same output for these 2 payments, that's my business not his.

And this is why "address re-use" is a "Bad Idea"™ if you value your and other peoples privacy.

If you only ever use an address once, and give anyone who asks for one a completely new and previously unused address, then this kind of tracking becomes more difficult, as it is harder to ascertain what address belongs to whom.

[o_e_l_e_o]

Everything has a weak spot and for any transaction that is a change addresses.

This can be obfuscated. You can design a transaction so it is impossible to tell which outputs are recipients and which outputs are change. You can spend an entire output and leave no change. You can split your change in to multiple outputs. You can mix or coinjoin your change to consolidate it back to a single output.

Address reuse should still be discouraged. With the existence of HD wallets, there really isn't any reason to reuse addesses when you can generate new ones with a couple of clicks.

[pooya87]

All that is a  severe challenge for user because over time, you forget where,why and whom you sent and from whom you got, and you rely entirely on a client which is not so selective in this regard. One has  to be a meticulous person to follow all those rules. If you do a few transactions a week, it’s possible. But with tens transaktions per day it is hardly achievable for common man.

most clients usually let you set a description for each transaction you receive which could be a reminder of who the recipient or sender of a transaction was and in majority of cases users don't really need such reminders and in special cases the user can use a custom client (like what exchanges or merchants do) to have additional functionality.

[o_e_l_e_o]

All that is a  severe challenge for user

Sure. Maintaining your privacy is no easy task, and this is by no means unique to bitcoin. It's time consuming and sometimes difficult or awkward to use Linux, use Tor, avoid Google, encrypt your communications, encrypt your data, avoid centralized exchanges, run your own full node, control your change outputs, etc. But it is also entirely possible to do all these things. Separate wallets, separate addresses, and labelling your transactions and your outputs, all let you keep track of change outputs to prevent linking them to other transactions or each other.

[o_e_l_e_o]

One wallet i.e. Lerdger nano + Electrum + bunch of deviation paths  like this m/.../.../x' where x is changeable and depends on the "source-of -income"/customer/exchange.

It's a good approach, and using different accounts on the same wallet has a number of benefits. It vastly reduces the possibility of accidentally linking different addresses or change outputs together, since they are kept separate in different wallets. Since the accounts are all derived from the same seed phrase, it also means you only have to back up and secure a single seed phrase rather than multiple seed phrases. As long as you never transfer funds directly between accounts without mixing, coinjoining, or otherwise obfuscating them first, then it would be very difficult to link the accounts together just from blockchain analysis.

I also use a similar set up but with different passphrases instead of different derivation paths on my Ledger wallet. A single seed phrase which is backed up securely, and multiple different passphrases which I load temporarily to the wallet (rather than associating with a secondary PIN) when I need to access them. The upside of this is that if my seed is compromised, only the top level wallet can be accessed. The downside is it takes an extra few minutes to load each wallet as you have to input the specific passphrase each time.

[Folio]

Why did I get this bad privacy rating? I used a new address, so how is it bad privacy and how could I improve it?

[o_e_l_e_o]

The Blockchair Privacy Indicator only tells you how easy it is link inputs and outputs as belonging to the same person. It doesn't tell you anything about who that person is or how easily or otherwise they could be identified. Without seeing the exact transaction I can't be overly specific, but we can look at the two indicators which have been displayed - "Round value" and "Output value x100".

One of the outputs of the transaction must have a "Round value" - something like 0.5 BTC, 1 BTC, 0.35 BTC. It is highly unlikely that a change value would be perfectly rounded, and so it can be assumed that the round value output is the recipient, and the other outputs are the change.

One of the outputs of the transaction is more than x100 bigger than the other. It is more likely that this output will be the change.

Essentially what Blockchair is telling you is that it is possible to tell which outputs from the transaction are the change and which outputs are to the recipient. Since your address is brand new, as you say, if it is otherwise unlinked to your identity or other addresses then that is far as the analysis can go.

If you wanted to improve the privacy on this transaction to make it less obvious which outputs were change and which weren't, then you could add some extra satoshi to the payment to avoid it being a round number (so instead of paying 0.1 BTC, pay 0.10048394 BTC, for example), and you could also split the change in to multiple outputs of similar sizes.

For more info about Blockchair's Privacy score, see this page: https://blockchair.com/api/docs#link_M6