[RESOLVED] Atomic wallet. Bitcoin sent to a Dogecoin address...

[TryNinja]

Slightly topic but how did you find out the owner of the address? Am I missing something here?

That's not a random DOGE address. OP had this address in his clipboard, from a different wallet.

I have found out that i have had a dogecoin address copied in my clipboard and not a btc address. So to find out if that really happened i copied the same dogecoin address and tried sending a small btc amout to test if it would happen again, and it did. So, if you send btc to dogecoin address in Atomic wallet it actualy accepts it

[...] I use that dogecoin wallet, it is a wallet on a site which i deposit all sorts of different coins, i slected it from a drop down menu which was next to the btc wallet/ address and copied it. I contacted the site of which i use dogecoin and ofcourse they told me no dogecoins were recieved.

[1714517343]

1714517343

[1714517343]

1714517343

[1714517343]

1714517343

[HCP]

Here is a test wallet, I sent some BTC , then sent it to a Doge address, it went through just like how OP explained, there is 0 relationship between the address Atomic wallet sends btc to and the seed, I tried all different combination like using Doge's PK to magically generate a BTC address, nothing worked, the address they send to is pretty strange

I think I have worked out what they have done... and, if you can get the private key for the DOGE address, I think the BTC could be recoverable!

...
Doge Address which BTC was sent to:

Code:

D95aC8TEQrbCRWqFVhYHzSj17uB7s8yd74

...
BTC addresss Atomic (magically) sent to:

Code:

14wUesWb7SgutWeem7YjSgZQEmSpUWKPm1

If we take the DOGE address and Base58Check Decode it:

1e2b35ec3cee8bf29b2e52c29add024953c31294eeb5dc265f

and if we take the "mystery" BTC address and do the same:

002b35ec3cee8bf29b2e52c29add024953c31294ee28c75ad0

Essentially, Atomic seems to have simply converted the DOGE address from Base58Check to HEX, then stripped off the DOGE "address prefix" (0x1e == "D") and the "checksum bytes", added the BTC address prefix (0x00 == "1") and then recalculated and appended the checksum and then converted from HEX back to Base58Check to end up with a BTC address...

Basically, if you can get the HEX Doge PK, you can get to the BTC address:

(Using Mikeywith's example)

DOGE PK:
QRw8xX9VAw67f9db8hqbN4EAWrj3Cwu1jZHDgoR6hg2nKBaKc7gD

--> HEX PK (using "wallet details" tab on DOGE paperwallet generator (TIP: click "skip" ):
6308E894B22395F94EF2E935762ADB9A4D5DCAAB672FAEDD51908FD24C6E2902



--> BTC (compressed) addy (using bitaddress.org):
14wUesWb7SgutWeem7YjSgZQEmSpUWKPm1



So, if OP can get the DOGE website to extract the DOGE private key, they'll be able to recover the full amount of BTC

[LoyceV]

6308E894B22395F94EF2E935762ADB9A4D5DCAAB672FAEDD51908FD24C6E2902

I'm impressed! Let me be the first to do the obvious: 1bfed039329a6b0bf00dc36f737400519f7e8d62066388ef93c614f97343b5eb (destination: mikeywith's profile addy).

[DaveF]

...

Holy crap, why?

What were they thinking?

There are many wallets out there, with many faults, but this just looks like someone was playing around with some code and then someone else committed it to the build.

Eliminating the fact that the address should have failed 1st basic validation check, [heck my lame ass programmer just starts with does it start with a "1" or "3" or "bc1" ? before even going past that] why would you ever change or touch the address prefix?

-Dave

[Favelj]

Here is a test wallet, I sent some BTC , then sent it to a Doge address, it went through just like how OP explained, there is 0 relationship between the address Atomic wallet sends btc to and the seed, I tried all different combination like using Doge's PK to magically generate a BTC address, nothing worked, the address they send to is pretty strange

I think I have worked out what they have done... and, if you can get the private key for the DOGE address, I think the BTC could be recoverable!

...
Doge Address which BTC was sent to:

Code:

D95aC8TEQrbCRWqFVhYHzSj17uB7s8yd74

...
BTC addresss Atomic (magically) sent to:

Code:

14wUesWb7SgutWeem7YjSgZQEmSpUWKPm1

If we take the DOGE address and Base58Check Decode it:

1e2b35ec3cee8bf29b2e52c29add024953c31294eeb5dc265f

and if we take the "mystery" BTC address and do the same:

002b35ec3cee8bf29b2e52c29add024953c31294ee28c75ad0

Essentially, Atomic seems to have simply converted the DOGE address from Base58Check to HEX, then stripped off the DOGE "address prefix" (0x1e == "D") and the "checksum bytes", added the BTC address prefix (0x00 == "1") and then recalculated and appended the checksum and then converted from HEX back to Base58Check to end up with a BTC address...

Basically, if you can get the HEX Doge PK, you can get to the BTC address:

(Using Mikeywith's example)

DOGE PK:
QRw8xX9VAw67f9db8hqbN4EAWrj3Cwu1jZHDgoR6hg2nKBaKc7gD

--> HEX PK (using "wallet details" tab on DOGE paperwallet generator (TIP: click "skip" ):
6308E894B22395F94EF2E935762ADB9A4D5DCAAB672FAEDD51908FD24C6E2902
https://i.imgur.com/fmPDR5U.png


--> BTC (compressed) addy (using bitaddress.org):
14wUesWb7SgutWeem7YjSgZQEmSpUWKPm1
https://i.imgur.com/YmXyYUc.png


So, if OP can get the DOGE website to extract the DOGE private key, they'll be able to recover the full amount of BTC

Thx for this, don't understand a thing about it, lol, but I have forwarded this to the doges add site. If they would be able to help.

[bitmover]

Essentially, Atomic seems to have simply converted the DOGE address from Base58Check to HEX, then stripped off the DOGE "address prefix" (0x1e == "D") and the "checksum bytes", added the BTC address prefix (0x00 == "1") and then recalculated and appended the checksum and then converted from HEX back to Base58Check to end up with a BTC address...

Lol

This is very crazy.

This is very arbitrary. This should never be done in a wallet, or any kind of software that deals with other people' money.

Atomic wallet is not capable of handling other people' funds.

Thx for this, don't understand a thing about it, lol, but I have forwarded this to the doges add site. If they would be able to help.

Without the DOGE add private key, there is nothing they can do.

[mikeywith]

Sir!! You are a genius  .

I initially figured out the mystery BTC address might come from doge's PK.

different combination like using Doge's PK to magically generate a BTC address

But obviously I am not smart enough to use the hexadecimal format of the PK, so I used the PK as is and it wasn't a valid PK for BTC so bitaddress.org used the Doge's PK as a passphrase to hash a whole new PK which obviously resulted in new different BTC address, but you nailed it.

I'm impressed! Let me be the first to do the obvious: 1bfed039329a6b0bf00dc36f737400519f7e8d62066388ef93c614f97343b5eb (destination: mikeywith's profile addy).

Hey thanks for sending me my BTC back.  

Thx for this, don't understand a thing about it, lol, but I have forwarded this to the doges add site. If they would be able to help.

They can't recover the BTC sent to that addy, only you can do it, if you don't know how ask for help, and ingore any PMs from people who tell you they will help you recover your coins, any advice given must come from a trusted person on forum, the process is rather simple you can do it yourself, just follow what HCP did, if things are still unclear, ask here and members including myself will teach you how to do it.

After getting your money back, you should return the money they sent you, at least this is what I would do if I was in your place because no matter how you look it at, it's stealing!, you should inform them and if they decide that you should keep the money they sent for the inconvenience they caused you, then keep it, if they ask you to return it, please do.

[Favelj]

Sir!! You are a genius  .

I initially figured out the mystery BTC address might come from doge's PK.

different combination like using Doge's PK to magically generate a BTC address

But obviously I am not smart enough to use the hexadecimal format of the PK, so I used the PK as is and it wasn't a valid PK for BTC so bitaddress.org used the Doge's PK as a passphrase to hash a whole new PK which obviously resulted in new different BTC address, but you nailed it.

I'm impressed! Let me be the first to do the obvious: 1bfed039329a6b0bf00dc36f737400519f7e8d62066388ef93c614f97343b5eb (destination: mikeywith's profile addy).

Hey thanks for sending me my BTC back.  

Thx for this, don't understand a thing about it, lol, but I have forwarded this to the doges add site. If they would be able to help.

They can't recover the BTC sent to that addy, only you can do it, if you don't know how ask for help, and ingore any PMs from people who tell you they will help you recover your coins, any advice given must come from a trusted person on forum, the process is rather simple you can do it yourself, just follow what HCP did, if things are still unclear, ask here and members including myself will teach you how to do it.

After getting your money back, you should return the money they sent you, at least this is what I would do if I was in your place because no matter how you look it at, it's stealing!, you should inform them and if they decide that you should keep the money they sent for the inconvenience they caused you, then keep it, if they ask you to return it, please do.

Ofcourse i would send back what they gave me, but i do not have the doge pk to even try and recover the btc.

[LoyceV]

Thx for this, don't understand a thing about it, lol, but I have forwarded this to the doges add site. If they would be able to help.

They can't recover the BTC sent to that addy, only you can do it

The Dogecoin address belongs to a website, which means they have the private key, so with HCP's explanation they can recover the funds. I don't know what site it was, if it's a large exchange it won't be easy (nor cheap) for them to access the private key.

[HCP]

Holy crap, why?
What were they thinking?

I wouldn't mind finding out the answers to those questions myself... I suspect we'll never know... but I suspect that it is probably related in some part to Atomic being a multicurrency wallet and it's need to be able to generate different coin addresses from the same private keys etc.

Still, that's still some very very very VERY poor (as in non-existent) address validation

[mikeywith]

The Dogecoin address belongs to a website,

I must have missed this part, well, "not your keys , not your bitcoin", I assume even if they were willing to help they would still charge him a certain amount pf fees, some exchanges will do that for a fixed amount like hitbtc charges $100 IIRC, some might ask for a certain percentage, and some will just tell you they can't do it, let's see how it goes for OP.

[Favelj]

Will keep you guys posted and tell you about the end result of everything in the next couple of days.
Thank you for everything.

[bitmover]

I must have missed this part, well, "not your keys , not your bitcoin", I assume even if they were willing to help they would still charge him a certain amount pf fees, some exchanges will do that for a fixed amount like hitbtc charges $100 IIRC, some might ask for a certain percentage, and some will just tell you they can't do it, let's see how it goes for OP.

That's because it isn't cheap for them to get the private keys. That address might be in cold storage, for example. When they get the private key for that address they will expose the whole cold wallet and they will have to move all their coins (probably millions of dollars). There are many risks (like missing coins, messing seeds backups etc), costs (like mining fees and developers` time)

So, I doubt the website will give that private key for such a small amount...

[TryNinja]

That's because it isn't cheap for them to get the private keys. That address might be in cold storage, for example. When they get the private key for that address they will expose the whole cold wallet and they will have to move all their coins (probably millions of dollars). There are many risks (like missing coins, messing seeds backups etc), costs (like mining fees and developers` time)

They don't need to expose their cold wallet nor create a new one. They can craft a Doge BTC transaction sending the coins back to OP and sign it offline in the cold wallet. If signing a tx was that hard, they wouldn't even be able to move their BTC when they need to (like replinishing the hot wallet) and would need to move millions all the time. The problem is that this probably has to be done manually and by someone with access to the wallet, so it's really time consuming.

[bitmover]

They can craft a Doge transaction sending the coins back to OP and sign it offline in the cold wallet.

I don't think this will work.
They don't have any doge to send. They don't even have the BTC, because the BTC is not in an address they control.

They have the private key from the doge address OP tried to sent his BTC to.
But his BTC ended up in an unknown address, which its private key was generated from the doge private key (which that exchange/website has).

So, this website need to share its private key with OP. A signed transaction is not enough as far as I understand this.

[TryNinja]

Corrected: BTC not DOGE. This whole situation is confusing.

They don't have any doge to send. They don't even have the BTC, because the BTC is not in an address they control.

The BTC didn't end up in an unknown address. The website can use the DOGE hex private-key to spend the coins in the related BTC address, exactly like HCP described here. And this doesn't require any internet connection at all, so like I said, the wallet stays "cold". Craft the tx, sign offline, broadcast. OP doesn't need anyone's pkey.

edit:

I read a good explanation (but can't find it back) a while ago. In short, after many hacks, any exchange with a decent security setup doesn't have a single person with access to private keys. So the "someone" you mentioned doesn't exist, it has to be at least multiple people.

I agree. I didn't literally mean a single person, but whoever is necessary to access the private-key (even more time consuming if it requires more people and protocols).

[LoyceV]

The problem is that this probably has to be done manually and by someone with access to the wallet, so it's really time consuming.

I read a good explanation (but can't find it back) a while ago. In short, after many hacks, any exchange with a decent security setup doesn't have a single person with access to private keys. So the "someone" you mentioned doesn't exist, it has to be at least multiple people.

[Favelj]

I am very happy to say that this issue is now resolved in full. The site where Doge add was from were able to retrive the full amount of sent btc which they have already sent to me.
Also I have contacted Atomic supoort and told them that, and I told them if they wanted I am willing to send them 0.05 BTC which they gave me for compensation for the problem which started all of this. They, as I have seen from their latest update have fixed this big issue and now if you try to send doge via btc it says "Invalid Address" like it does for other coins.

Thank you all that were willing to give advice and help. This btc means alot to me, for some it might not be alot, for me it is a bit different. Thank you...

[Lucius]

I am very happy to say that this issue is now resolved in full.

Great news, I'm glad you managed to get your BTC back and that you decided to be persistent, because that's the only way things like this are handled. Since you have an open thread in Scam Accusation, it would be fair to write there that the matter is resolved - so even though Atomic Wallet did not intend to compensate you in the beginning, it all ended well. I just hope that they also learned something from this.

[Favelj]

I am very happy to say that this issue is now resolved in full.

Great news, I'm glad you managed to get your BTC back and that you decided to be persistent, because that's the only way things like this are handled. Since you have an open thread in Scam Accusation, it would be fair to write there that the matter is resolved - so even though Atomic Wallet did not intend to compensate you in the beginning, it all ended well. I just hope that they also learned something from this.

Have posted that the issue is resolved in the scam accusation thread, thank you for reminding me.