Help, Bitaddress.org created wallets with none matching Keys&addresses!

[Nick1982]

Hi,

 Really need anybodies help here. I created 4 paper wallets from bitaddress.org.

I saved the webpage so it was offline.

I then loaded the webpage up in a offline machine, proceeded to generate 4 wallets and transferred  funds to the wallets.

However I can't get into the wallets now, it seems the keys don't match the addresses.

Is there anything I can do?

I generated another wallet this time online from the webpage, and checked it by sending £2 approximately in BTC to it, it worked and I was able to get the £2 back out of the wallet as expected.   

I then tried the same thing use £2 on the saved webpage version of Bitaddress.org and the private key does not match the address it was sent to, which leaves me to believe there is a bug in it's generation.

Is there anything can be done? I had 2 bitcoins in total sent to these generated wallets I know can't access.

Thanks,

Nick

[1713627856]

1713627856

[1713627856]

1713627856

[BlackHatCoiner]

What kind of addresses were they? Legacy?

On what wallet did you import the private keys and realized they don't match? Did you try to check if the private keys match before you send 2BTC on the address(es)?

[pooya87]

1. are you sure that you used the real bitaddress.org and not some similar looking website?
2. when you say saved it offline, you should have downloaded the source code from github not ctrl+s the website you had open in browser.
3. a private key can create multiple different types of addresses. make sure that you are deriving the same address type (checking the first character would be enough for starters. it would be "1", "3" or "bc"). you have to explicitly tell the wallet your address type when you import the key into it.

[Charles-Tim]

I think this reply from LoyceV can be of help too.

Now I have the BIP38 public and private keys. So I print these.

Let's call them Bitcoin address and BIP38 encrypted private key. The address isn't encrypted.

In order to validate this wallet is functioning correctly, I use bitaddress.org's "wallet info" tab and enter the encrypted (6P...) private key on my paper wallet and passphrase.

All good so far!

Success. It opens a bunch of different addresses; the important ones I'm guessing are "Bitcoin Address" and "Bitcoin Address Compressed"

I suggest to only use the Compressed address, which is what bitaddress.org uses by default.

Also, "Private Key WIF 51 characters base58, starts with a '5'" and "Private Key WIF Compressed 52 characters base58, starts with a 'K' or 'L'".

You'll only need the Private Key WIF Compressed to use your funds from the compressed address.

I was under the impression that the "Bitcoin Address" was supposed to match the public key on my physical paper wallet, which goes along with the "Private Key WIF 51 characters base58, starts with a '5'".

However, I notice my physical paper wallets public address does not match the displayed "Bitcoin Address" from the "wallet info" tab. Instead the "Bitcoin Address Compressed" matches.

By default, it uses the compressed address. This reduces fees when you make a transaction.

So if I were importing and sweeping this wallet onto a hot wallet, would I use the "Encrypted Private Key (6p...)" as seen on my physical paper wallet

If your wallet supports it (my phone wallet Mycelium does), you can import/sweep the BIP38 encrypted key directly and enter the password in your wallet.

or the "Private Key WIF 51 characters base58, starts with a '5'" or "Private Key WIF Compressed 52 characters base58, starts with a 'K' or 'L displayed in the "wallet info" tab?

This works too. Decrypting the BIP38 private key before importing/sweeping works in almost any wallet.

Furthermore, is opening the wallet under "wallet details" on bitaddress.org (offline) using the encrypted private key on my paper wallet and passphrase, and seeing the matching "Bitcoin Address Compressed" to the physical paperwallet's public key in my hand, enough to verify the wallet is functioning correct and to begin sending funds to?

This is what I do too.
You could be even safer by using other software to decrypt the private key, so you don't rely on bitaddress only. I've used bitcoinpaperwallet.com for this, although I think it uses the same engine.

Before funding your paper wallet with high amounts, I suggest to make a small transaction first, and sweep it into a wallet to experience how it works. Fees aren't that high at the moment.
After this transaction your paper wallet can no longer be called "cold storage": create a new one.

...

But, I will like to know if there can be any way someone can check the validity of his paper wallet private key correponding to his address. I am thinking of Iamcoleman, but it is possible to use such to test the validity?

[hosseinimr93]

But, I will like to know if there can be any way someone can check the validity of his paper wallet private key correponding to his address.

You can simply install Electrum on an air-gapped computer, import your private keys and check generated addresses.

I am thinking of Iamcoleman, but it is possible to use such to test the validity?

If I'm not wrong, iancoleman can be used only for getting private keys and addresses derived from a seed phrase. As the website's title says, it's a mnemonic code Converter
I don't think you can enter a private key and get the address.

[Nick1982]

Hi thanks everyone.

I double checked the compressed address, basically the address that it generated as the public address(share) on the left is not anywhere in the corresponding key.

I think it has gone.

There must be a glitch in bitaddress.org when doing it offline.

I didn't know about the checking, I was told never to enter the private key online. But i guess you could do that offline.

I think it's lost.

I was investing my parents retirement money too. 

Thanks for your help.

[o_e_l_e_o]

But, I will like to know if there can be any way someone can check the validity of his paper wallet private key correponding to his address. I am thinking of Iamcoleman, but it is possible to use such to test the validity?

You cannot check individual private keys with iancoleman. OP can either use bitaddress.org, click on "Wallet Details", and paste the private key in there, or could use https://brainwalletx.github.io/, click on "Private Key", then "Toggle Key", and paste the private key in there. Since bitaddress only generates legacy addresses, then either should work. Note that of course you should never paste a private key in to a live website, as you are highly likely to have your coins stolen. If using either of these sites, make sure you download them from the GitHub and run in an airgapped environment.

-snip-

I tried simply saving the bitaddress.org page, and it still generated keys correctly for me. The most likely culprit here is OP's wallet is generating a P2SH or P2WPKH address instead of a P2PKH, or he has used the wrong one of the compressed/uncompressed key.

[Danydee]

 Did you printed the generated addresses/keys on the first  ?  

 
 I would tell you to just test generating the addresses from the private Keys on a saved https://bitaddress.org/ .html offline version and look if you get the sames

-snip-

I tried simply saving the bitaddress.org page, and it still generated keys correctly for me. The most likely culprit here is OP's wallet is generating a P2SH or P2WPKH address instead of a P2PKH, or he has used the wrong one of the compressed/uncompressed key.

 It's surely that !  


 
 It would be a real shame if his parents £2k get lost like that  !

[Buttermellow]

<snip>

There are really difficulties in using bitcoin and this is why it could have difficulties in being adapted. Aside from the scammers that are technically good in making fake sites or phishing sites, doing fraud and etc. might be difficult for bitcoin to be adapted by the community. However, in every problem that needs to be addressed and if there is a willingness for a change it could happen. I think there will come a time that bitcoin dev can get the idea on how to minimize, eradicate and keep bitcoin funds safely without being compromised by technical issues and bad elements.

[Nick1982]

Did you printed the generated addresses/keys on the first  ?  

 
 I would tell you to just test generating the addresses from the private Keys on a saved https://bitaddress.org/ .html offline version and look if you get the sames ]

Hi yes, i created some other wallets and sent £2 to them from the offline one, same problem. I've done this method before and it has never been a problem. I can only think it must be a glitch.

A created new wallets to test straight from the website and didn't have the same problem, so must be the offline webpage I used.

Lot of emotions right now.

Share this with the community if you can, hopefully some good can come of my loss.

[Danydee]

  So why software wallets are not offering more options, I think of the essentially ones (that are part of the protocol), why they are not so configurable ! ??

A created new wallets to test straight from the website and didn't have the same problem, so must be the offline webpage I used.

 Some wallets may interpret the private keys you importing differently from the one you get/you used
 The same private key can give the: compressed / uncompressed / SegWit ..  addresses !

 That is why I asked you if you safely saved them and to try on bitaddress to see what you get from them ..

[Charles-Tim]

I think there will come a time that bitcoin dev can get the idea on how to minimize, eradicate and keep bitcoin funds safely without being compromised by technical issues and bad elements.

Bitcoin developers have tried their best.

They created offline wallets, and also making it simple to handle for novice, example are hardware wallets.
They created online wallets that can be used offline, lime electrum wallet
They created multisignature wallet, so that if one of the private key is compromised, the users can move the bitcoin to another wallet, so that the fund is completely safe. Although, high transactions fee is the issue of multisig, but BIP340 to BIP342 have been established, only remaining it to be introduced into bitcoin core and other bitcoin wallets, to make multisig transactions indistinguishable from single payment wallets. And this will be introduced later.

Users needs to be conscious about their online activities too, someone that sends money to scammers during fake giveaway, is it the fault of bitcoin develpers, or someone that is making use of noncustodial exchange and the exchanges was hacked, or someone that is browising anyhow on his wallet computer and/or phone and bitcoin stolen as a result of malware. These are not the fault of developers.

About paper wallet, it is the most difficult wallet to deal with, that is why I can not advise newbies to use it as a way of holding unless he has asked people that knows about it very well to explain for him and out him through. If I want to use a paper wallet, I will look for ways to verify if the private key and the address matches before I can use it for holding.
Edit:

You cannot check individual private keys with iancoleman. OP can either use bitaddress.org, click on "Wallet Details", and paste the private key in there, or could use https://brainwalletx.github.io/, click on "Private Key", then "Toggle Key", and paste the private key in there. Since bitaddress only generates legacy addresses, then either should work. Note that of course you should never paste a private key in to a live website, as you are highly likely to have your coins stolen. If using either of these sites, make sure you download them from the GitHub and run in an airgapped environment.

Thanks, highly educated and constructed in easy to understand way.

[o_e_l_e_o]

Hi yes, i created some other wallets and sent £2 to them from the offline one, same problem. I've done this method before and it has never been a problem. I can only think it must be a glitch.

I think you may have downloaded a fake copy of bitaddress. Can you check the addresses you funded on a block explorer? Are the coins still there, or have they been moved?

Try opening the offline version of bitaddress you have downloaded and paste in one of your private keys. Make note of the compressed and uncompressed addresses. Do they match the addresses you have funded?

Now go to the bitaddress github (https://github.com/pointbiz/bitaddress.org), download, and run offline. Paste in the private key. Do the addresses generated match the ones you just generated in the previous step?

[LoyceV]

But, I will like to know if there can be any way someone can check the validity of his paper wallet private key correponding to his address.

You can simply install Electrum on an air-gapped computer, import your private keys and check generated addresses.

This is good practice to do. I always check if I can recreate an address before funding a private key that wasn't created by a wallet.

There must be a glitch in bitaddress.org when doing it offline.

Are you sure you downloaded it from the original website? One character difference could lead to phishing.

I then tried the same thing use £2 on the saved webpage version of Bitaddress.org and the private key does not match the address it was sent to

Can you email (LoyceValenzuela@gmail.com) me the (compressed) version you downloaded? I'd like to compare it to the original.

[seoincorporation]

When you generate the address you get the addy and the private key, so, to get access to the coins you should import the private keys to any wallet. But the problem here is ¿Why you make an address on an online site? that's one of the biggest mistakes you can do because the site can save the keys, or a MITM attack could take the keys when they were created. The right way to make your own paper wallets it's with vanitygen. That's our best option.

[DeathAngel]

This sucks, sorry for the loss OP. This is in part, due to paranoia why I never use paper wallets. I know there are ways to check & that there are things that can go wrong with all types of storage devices/ methods. I recommend Trezor & Bitcoin Core Wallet as the best & safest ways to store your bitcoin.

[Chris!]

When you generate the address you get the addy and the private key, so, to get access to the coins you should import the private keys to any wallet. But the problem here is ¿Why you make an address on an online site? that's one of the biggest mistakes you can do because the site can save the keys, or a MITM attack could take the keys when they were created. The right way to make your own paper wallets it's with vanitygen. That's our best option.

... No.

Where do I start?

1. They downloaded the website and used it offline. This is stated in the OP
2. That's not what a man-in-the-middle attack is
3. Vanitygen doesn't let you generate paper wallets per se. They're vanity addresses. From there you can choose to create a paper wallet, hot wallet, import it into a hardware wallet or anything else. Using vanitygen is only more secure if it's on an air-gapped computer.

If you're going to buy a bitcointalk account to shitpost at least get the basics down.


OP I'd be happy to help in whatever way I can. I used bitaddress to create many paper wallets and always without issue. As others have stated please make sure to double check every address type. Legacy includes compressed or uncompressed. Both of these would show up on a bitaddress paper wallet.

[o_e_l_e_o]

This is good practice to do. I always check if I can recreate an address before funding a private key that wasn't created by a wallet.

This. It would be like putting a bunch of cash in a safe without first checking that the key works, only the safe is completely indestructible.

The right way to make your own paper wallets it's with vanitygen.

There is little inherent difference between using a website which you have downloaded and ran offline and using a piece of software which you have downloaded and ran offline. Both are equally capable of being filled with bugs which generate incorrect addresses, and both are equally capable of returning fake or pre-generated addresses to which an attacker has access to the private key.

[pooya87]

There must be a glitch in bitaddress.org when doing it offline.

this tool is one of the oldest ones around and it is not doing anything complicated. it is a very straight forward RNG usage, pubkey derivation, hashing and encoding. all easy and simple. chances of having a bug (glitch) are very small.