Got robbed and I can't understand how

[LexLer]

Hello everyone. Yesterday I wanted to make a transaction to a trusted vendor as I do pretty often buy from him and on platform and something went VERY wrong as my transaction went on a random address?
Everything started with my choise to update Electrum to 4.0.4
Then after arriving at the checkout I went to my Electrum, Copy pasted vendor's address which is 
3C8tvXx94XBZ531cCxBSTqtf6semxMMJ6c and send the bitcoins worth of 62£ to it.
After waiting for 10,20,30 mins I understood something is wrong as my sent bitcoins weren't updated on the forum...they usually are updated in couple of minutes
I checked what happened with the transaction on blockchain.com and I was shocked!!!!!
It did sent to this address instead https://www.blockchain.com/btc/address/16KWT8NKWKoVKWhXBwg86DLNYt1yycVvCx
HOW it can happen after I always double check the details,address when I'm making transaction?
It never happened before, and I can't understand how and why it did happen.
Currently it has 0 confirmation and I have read allot on the internet how to recover or cancel those bitcoins which are still unconfirmed. 
1. Replace by Fee (RBF)
2. Double spend using a higher fee
Now I am afraid to make any new transaction obviously so second option is off for me.
However first option by RBF, I don't understand it as it says:  Some wallets support the RBF protocol allowing you to replace your original transaction with a new one that includes a higher transaction fee. This would effectively unstick your transaction.
But it doesn't say how to do it correctly because as I know if you increase the fee it starts the process going and it will be confirmed by miners soon and then it will be send to that random address.
Please Help me as I have no iddea what to next step. I would like to understand the RBF process so I can return the coins back if I still can.

I can share everything what is needed so that I can undertand how it did happen to avoid it next time.
Thank you all!

[1714574249]

1714574249

[1714574249]

1714574249

[1714574249]

1714574249

[1714574249]

1714574249

[jackg]

Does your browser save it's history - and can you work out where the app was downloaded from - and what version of electrum did you update from (was there a pop up message)?

If the coins were sent to some random address, it's likely you were a victim of a phishing attempt. While you still have the coins I'd recommend sweeping them into another wallet. If you have an android phone, I'd recommend downloading electrum from the playstore and sweeping the coins into a new wallet. If it was that the coins were sent to an unrecognised address.

[Charles-Tim]

For more answers, there are many users that will give you more quality answers, just move this thread to 'bitcoin technical support'.
You are just rubbed with a DDOS malware attack which changed the bitcoin address you input to hacker's bitcoin address. You may think you checked it but you did not because that is what actually happened.

About RBF, on most wallets you can only use the RBF to pump the fee of transactions so the chance it will be put in the next block will increase, but you can not use it to cancel the transaction, nor use it to send the bitcoin to another desired address. But, this could likely be possible on bitcoin core.

I am not really sure about bitcoin core, but check what I found out about it.
https://news.bitcoin.com/greenaddress-wallet-adds-replace-fee-rbf-front-end-transaction-support/
While opt-in replace-by-fee as included in Bitcoin Core allows replacing any unconfirmed transaction (even if this means unconfirmed transactions are “canceled”), GreenAddress users can only resend bitcoins from the same inputs to the same outputs, but with a higher fee. It only allows users to “boost” a transaction to increase the likelihood a miner will include it in a block.

If so, bitcoin core should be able to cancel the transaction by using RBF, but I am not certain. Let people using bitcoin core comment about this to know the validity of the statement.
The best you can do to avoid this from happening again is to back up your files, and perform a hard reset, you will need to create another wallet and import your seed phrase into the new wallet. Be careful of malware, unsafe browsing are the cause, install powerful anti malware. Also, always check the recipient address two to three times before pressing the send button.

[hosseinimr93]

However first option by RBF, I don't understand it as it says:  Some wallets support the RBF protocol allowing you to replace your original transaction with a new one that includes a higher transaction fee. This would effectively unstick your transaction.

Your transaction has been marked as RBF.
In Electrum 4.0.4, it's possible to double-spend RBF transactions to yourself.

Go to history tab, right-click on your transaction and click on "Cancel transaction". In the new window, you must select a new fee rate.
You will likely be able to replace that transaction with a new one to yourself, unless the Electrum app you are using is fake.
(Electrum official website is electrum.org. If you have downloaded Electrum from any other place, it's fake.)

Warning:
There's a high probability that your system has been compromised.
Even if you could send back the fund to yourself using RBF feature, you need to create a new wallet in a safe system and send all your fund to the new wallet.

[Wallflower28]

I think it has something to do with technical issues. And going to the thread that charles tim mentioned is the best choice since most of the bitcoin geek are in bitcoin and technical support. If there is a wrong with your transaction, I think when copy pasted the address. But I am not sure that it would happen as you said, you always double check the address you input. It is somehow scary if there is an issue like this, it is not safe to send when there are bugs in wallet. I don't know how to deal with this because this is my first time to encounter such problem like this.

[cryptomaniac_xxx]

Your machine may have been infected by the Copy-Paste Virus For Bitcoin Users -- Beware!!!. You can also read this guide, TUTORIAL: How to use Electrum (for advanced users).

Much better to move your wallet to another machine that is not compromise, and re-format the other once that is infected, just to be sure that your pc is clean.

As far as how you get infected, maybe you download it or click some suspicious link.

[Steamtyme]

Wow are you lucky... that you were being cheap. No worries I do the same, but thanks to your low fee this transaction is still sitting unconfirmed. Follow the advice you've been given and you should be fine in re-rerouting this transaction.

I'm curious when you confirm the address, is it after you paste?? I always paste then check the last 6 or 7 characters and the first 6 or 7. I don't envy you but you have to put some work in and assume all your devices could be compromised. Dig out your seed phrases and start fresh on a new device, luckily this wasn't a massive amount and you have a chance to recover, learn, and move on.

[sunsilk]

From the official page website of electrum, it says that 4.0.4 version is the latest version. The warning tells that the lower version of 3.3.4 are the vulnerable versions which you could simply think that it's the reason for that problem. I doubt it that the fault came from that update you've made.

Can't you remember any other software or app that you have downloaded and launched other than electrum?

[SquallLeonhart]

Any of the two methods you have mentioned is under probability, it may work for you or maybe not. I hope you have not installed malware to your device, because sometimes there are malware that will be sent by hackers which will prompt you to update your wallet which is not true and when you update they gain access to your wallet and steal your money with whatever they are using.

Then back to reversing your transactions, you said it still has 0 confirmations, before you can use the Replace By Fee (RBF) method, I think you will have to be using a special wallet that does that and you must have ticked the option when sending your Bitcoin, if not, that leaves you with the second method which is to double spend using a higher fees. But, why I wouldn't say this would work is because of most of the miners are using safeguards to stop double spending, same thing with some wallets. If there is any other way, then I hope someone who is more experienced replies your post.

[LexLer]

However first option by RBF, I don't understand it as it says:  Some wallets support the RBF protocol allowing you to replace your original transaction with a new one that includes a higher transaction fee. This would effectively unstick your transaction.

Your transaction has been marked as RBF.
In Electrum 4.0.4, it's possible to double-spend RBF transactions to yourself.

Go to history tab, right-click on your transaction and click on "Cancel transaction". In the new window, you must select a new fee rate.
You will likely be able to replace that transaction with a new one to yourself, unless the Electrum app you are using is fake.
(Electrum official website is electrum.org. If you have downloaded Electrum from any other place, it's fake.)

Warning:
There's a high probability that your system has been compromised.
Even if you could send back the fund to yourself using RBF feature, you need to create a new wallet in a safe system and send all your fund to the new wallet.

I have downloaded the version from https://electrum.org/#home from 4.0.3 to 4.0.4 I always update to the newest version.
And I can't see anywhere that you can " Cancel the unconfirmed transaction". The only thing I can do is to increase the fee but it doesn't say anything about cancelling it...
So should I increase the fees as RBF is ticked on and will I get the coins by doing so??

[bob123]

So should I increase the fees as RBF is ticked on and will I get the coins by doing so??

No, this would just increase the fee and would result in the transaction getting confirmed faster.
You need to create a new transaction spending the same input.

To do so, do the following:

• Disconnect Electrum from the Network
• Open the console (View -> Show Console -> Then the "Console" tab)
• Enter: wallet.remove_transaction("a219bb1983c1dea6a00360fa830e5961deaf5a1dccbafd0578c81087db3b50e5")
• Close and restart Electrum
• Create a new transaction sending your funds with a pretty high fee (definitely more than the 16 sat/vB from the first transaction) -> sign it and save/export it
• Connect electrum to the network again
• Import the just created transaction (Tools -> Load transaction -> from text/file (depending on what you have chosen in the last step))
• Broadcast it

You are just rubbed with a DDOS malware attack which changed the bitcoin address you input to hacker's bitcoin address.

Please do not comment on topics you don't know anything about.
Such useless and wrong information is just clogging up the thread making it more difficult to find valuable information.

[kamadazje]

As what I notice there is a big possibility that you are in the wrong wallet or you have updated your wallet to an infectious software where it will automatically send your money to the hacker address. Even if you have check the address plenty of times, the hackers already made a move that any transfer will transferred to his address.

Upon checking the address, it says that it only receive one transaction with a total balance of 0.00561911 BTC. There is a big possibility that you are the only victim of his scheme. It will be good if you can double check everything before proceeding to another transaction so you can avoid making the same mistake like uninstall your wallet and download again an updated wallet that are coming from the main website of electrum. You should make sure also that you have the latest update of your antivirus for additional protection.

[nc50lc]

I have downloaded the version from https://electrum.org/#home from 4.0.3 to 4.0.4 I always update to the newest version.
And I can't see anywhere that you can " Cancel the unconfirmed transaction". The only thing I can do is to increase the fee but it doesn't say anything about cancelling it...
So should I increase the fees as RBF is ticked on and will I get the coins by doing so??

Check your 'addresses' tab if 16KWT8NKWKoVKWhXBwg86DLNYt1yycVvCx belongs to your own wallet.
To enable addresses tab, click "View->Show Addresses".

Because the "cancel transaction" option of an RBF txn will be removed from the 'right click-menu' if you've used it already or you've sent to your own address.

P.S. I've noticed that you already replaced the transaction using "increase fee" despite the previous posts' info.
Replaced tx: 11b13a56c45f849b8654a58dea5982c18f70b1d32e24b9be363776a8eb773e69
New tx: a219bb1983c1dea6a00360fa830e5961deaf5a1dccbafd0578c81087db3b50e5

[bob123]

P.S. I've noticed that you already replaced the transaction using "increase fee" despite the previous posts' info.

He indeed decided to increase the fee of the transaction stealing all of his coins..

OP, if you want to save your coins, do what i have posted.
But replace the transaction id in the 3rd step with the actual one you now want to double-spend (a219bb1983c1dea6a00360fa830e5961deaf5a1dccbafd0578c81087db3b50e5).

[Arman The Parman]

Hopefully you got your coins back.

If you want to increase your security, may I suggest you use a multisignature wallet, and either an air-gapped Electrum desktop wallet, or non-airgapped Electrum wallets with hardware wallets. Use partially signed bitcoin transactions, and inspect the addresses each time you sign, and when you broadcast.

Cheers
Arman The Parman
(@parman_the)

[NotATether]

• Disconnect Electrum from the Network
• Open the console (View -> Show Console -> Then the "Console" tab)
• Enter: wallet.remove_transaction("a219bb1983c1dea6a00360fa830e5961deaf5a1dccbafd0578c81087db3b50e5")
• Close and restart Electrum
• Create a new transaction sending your funds with a pretty high fee (definitely more than the 16 sat/vB from the first transaction) -> sign it and save/export it
• Connect electrum to the network again
• Import the just created transaction (Tools -> Load transaction -> from text/file (depending on what you have chosen in the last step))
• Broadcast it

Thank you very much for these steps. I needed to cancel an unconfirmed transaction that was stuck in the mempool for two days because I was trying to pay to a Protonmail bitcoin address that by then no longer existed.

[vapourminer]

I needed to cancel an unconfirmed transaction that was stuck in the mempool for two days because I was trying to pay to a Protonmail bitcoin address that by then no longer existed.

technically, the address still exists and would of and still will take coin sent to it. addresses never cease existing and will always show any activity associated with them.

you would of had to contact the address owner if that coin had confirmed.

[hosseinimr93]

I needed to cancel an unconfirmed transaction that was stuck in the mempool for two days because I was trying to pay to a Protonmail bitcoin address that by then no longer existed.

You could do that much easier. For cancelling (double-spending to yourself) an unconfirmed transaction, the only thing needed is to right-click on your transaction and select "Cancel transaction".
If you click on "Cancel transaction", the previous transaction will be replaced by a new one to your own wallet.
You need to follow the suggestion given by bob123 only if you want to replace the transaction with a new one including outputs that are not yours.

Let's say I have sent BTC to Bob and I want to replace that transaction with a new one to Alice. To do so, as explained by bob123, I must disconnect Electrum from network, remove the previous transaction, sign a new transaction and import it.
For replacing that transaction with a new one to myself, there is no need to that. I can click "cancel transaction" instead. Electrum will automatically replace that transaction with a new transaction to one of addresses of my wallet.  

(The "cancel transaction" feature is available only in the 4.0.4 version. )

[LexLer]

You were right, the address I have sent bitcoins is one of mine as I can see it on my "Addresses" list.
However its colored in yellow "change" it says.
Should I just increase the fee and I'll get coins back or is there any other proccess after increasing the fee?
Thanks!

[nc50lc]

You were right, the address I have sent bitcoins is one of mine as I can see it on my "Addresses" list.
However its colored in yellow "change" it says.

Hmm, since this is the same as the PM, I take that this is a reply to my post on the previous page.

Double-check the transaction again, because they usually have a "change" which certainly belongs to your wallet.
Double-click the txn in the history tab and look at the "outputs".

Should I just increase the fee and I'll get coins back or is there any other proccess after increasing the fee?

If there's only one output which is your own change addr, then you have likely copied your own address or used cancel transaction unintentionally.
Note: "Cancel transaction" will double-spend the transaction's input(s) and send it to one of your change address.
In this case, there's nothing sent so there's nothing to recover but there'll be a deduction from your balance which is that transaction's transaction fee.

But if there's another output, then check if it's the same as the receiver's address and look for "Replace by fee" at the upper right.
If it's "true", then you should be able to use "cancel transaction" in case you want to cancel it, which is only available for v4.0.4.