Did I find a bug in the Bitcoin Core wallet?

[walletrecovery]

In which case, I can only conclude that the "scammer" has purposely included a transaction from one of the addresses in the OPs personal wallet in an attempt to troll them
[/quote]

See "+ new info:" I added research information in the topic.

[1715644728]

1715644728

[1715644728]

1715644728

[1715644728]

1715644728

[achow101]

Can you explain exactly what you do when you replace the wallet file? And by exactly, I mean every step, including shutting down Bitcoin Core, copying the file in, any other files you copy, and any files you delete.

For example:
1. Shutdown with File > Exit
2. Open data directory
3. Delete wallet.dat file
4. Copy new wallet.dat file
5. Start Bitcoin Core by double clicking shortcut.

Can you also upload the entire debug.log file (the entire thing, not just a snippet, and not just a screenshot). You can copy and paste it in, or if it is too big, upload the file somewhere or copy it's contents to a paste site like pastebin, then provide the link.


If you are shutting down and replacing the file incorrectly, it is possible that some database stuff from one wallet ends up in another wallet because the database system that the wallet uses creates more files than just the wallet.dat file. However a clean shutdown will cleanup and remove them, so there shouldn't be any problems there. Note that if this is the problem, there isn't really anything that Bitcoin Core can do other than stop using this DB system, which we are in the process of doing. In that case, there isn't a bug, just a really strange edge case and you should doing things properly to not run into it.

[walletrecovery]

This is 100% thrue algo:

For example:
1. Shutdown with File > Exit
2. Open data directory
3. Delete wallet.dat file
4. Copy new wallet.dat file
5. Start Bitcoin Core by double clicking shortcut.

and I have debug.log (i cute it since 10.18.2020) = 1,12mb
but file contains some lines like this, I replace data to "*":
Discover: User-PC - ****:*:****:****:****:****:****:****
AddLocal([****:*:****:****:***:****:****:****]:****,*)
You can take this file from: https://dropmefiles.com/B0Hsm
6 days left...

[achow101]

The log file indicates that each of the wallets that has the transaction in question contains it because it matches against the wallet. The lines that say

Code:

AddToWallet 7b12e1df59224bfbc9b0b8f29085f9b1364ca0bd06379a2a9bb7e751aab86bb7  new

indicate that.

Would you be willing to send me the wallet.dat files so I can investigate this further?


It looks like all of these wallets contain the address 3ABxGuyibTGH4n1Y3NMKNWP8477VBGTjCs which also paid you, which is why you see the same 2 transactions show up in both. I think what is happening is that all of the fake wallets were made from the same base wallet that had send you money.

[walletrecovery]

The log file indicates that each of the wallets that has the transaction in question contains it because it matches against the wallet. The lines that say

Code:

AddToWallet 7b12e1df59224bfbc9b0b8f29085f9b1364ca0bd06379a2a9bb7e751aab86bb7  new

indicate that.

Would you be willing to send me the wallet.dat files so I can investigate this further?


It looks like all of these wallets contain the address 3ABxGuyibTGH4n1Y3NMKNWP8477VBGTjCs which also paid you, which is why you see the same 2 transactions show up in both. I think what is happening is that all of the fake wallets were made from the same base wallet that had send you money.

I have one address only: https://ibb.co/LgFR58B
I don’t know anything about this address: https://blockchain.com/btc/address/3ABxGuyibTGH4n1Y3NMKNWP8477VBGTjCs
Maybe this is my client who once paid for a collection of wallets through the satoshidisk.com service, I no longer use this service and deleted all links.
Here are the two files that started my research: https://dropmefiles.com/eK4Hy
6 days left...

[achow101]

The log file indicates that each of the wallets that has the transaction in question contains it because it matches against the wallet. The lines that say

Code:

AddToWallet 7b12e1df59224bfbc9b0b8f29085f9b1364ca0bd06379a2a9bb7e751aab86bb7  new

indicate that.

Would you be willing to send me the wallet.dat files so I can investigate this further?


It looks like all of these wallets contain the address 3ABxGuyibTGH4n1Y3NMKNWP8477VBGTjCs which also paid you, which is why you see the same 2 transactions show up in both. I think what is happening is that all of the fake wallets were made from the same base wallet that had send you money.

I have one address only: https://ibb.co/LgFR58B
I don’t know anything about this address: https://blockchain.com/btc/address/3ABxGuyibTGH4n1Y3NMKNWP8477VBGTjCs
Maybe this is my client who once paid for a collection of wallets through the satoshidisk.com service, I no longer use this service and deleted all links.
Here are the two files that started my research: https://dropmefiles.com/eK4Hy
6 days left...

Yes, it is as I thought.

Both wallets are almost identical. Each wallet has 203 keys, of which 202 of them are identical. One of those keys that are the same is for the address 3ABxGuyibTGH4n1Y3NMKNWP8477VBGTjCs. This address has also sent money to you at 3QjnBKZAdUK3MVfekycu2FhCpT3hvmYa5X. Because both of these wallets contain the key for 3ABxGuyibTGH4n1Y3NMKNWP8477VBGTjCs, both wallets also contain the transaction made to you, thus you see them.

What likely happened is that whoever gave these wallets to you started from the same base wallet. From this wallet file, they then inserted extra records for the addresses that have the balance that you care about. At some point they sent money to you from the base wallet, perhaps to prove that the wallets have money. Regardless, the wallets are nearly identical and the reason that the transaction appears in these wallets and in your wallet is because they all contain keys involved in that particular transaction.

Therefore there is no bug and you are working with maliciously crafted wallets.

[walletrecovery]

Yes, it is as I thought.

Both wallets are almost identical. Each wallet has 203 keys, of which 202 of them are identical. One of those keys that are the same is for the address 3ABxGuyibTGH4n1Y3NMKNWP8477VBGTjCs. This address has also sent money to you at 3QjnBKZAdUK3MVfekycu2FhCpT3hvmYa5X. Because both of these wallets contain the key for 3ABxGuyibTGH4n1Y3NMKNWP8477VBGTjCs, both wallets also contain the transaction made to you, thus you see them.

What likely happened is that whoever gave these wallets to you started from the same base wallet. From this wallet file, they then inserted extra records for the addresses that have the balance that you care about. At some point they sent money to you from the base wallet, perhaps to prove that the wallets have money. Regardless, the wallets are nearly identical and the reason that the transaction appears in these wallets and in your wallet is because they all contain keys involved in that particular transaction.

Therefore there is no bug and you are working with maliciously crafted wallets.

You are just a genius person, I haven’t studied bitcoin that deeply, because I am not a programmer.
Thank you very much for your answer, now we can put an end to this story and I close the topic.
Thanks to everyone who took part in the discussion.