Did not use change address and now balance is $0. Transaction Unspent.

[Rising87]

Hi all,

I've used Electrum a handful of times and stupidly thought change address were causing me to not be able to send close to full amounts in my wallet balance.  My last transaction I turned change address off and it went through successfully.  However there was a transaction the following day that I don't recall making and my balance is now at zero.  I checked blockchain and the address the funds were sent to are unspent.

Is there anything I can do?  Likely not but I figured it was worth a question to this group.

https://www.blockchain.com/btc/tx/4c00cfa1360b91fec3fe43b45f318d4810a4cd806069423ec8e103c694833493

Thanks in advance!

[1715409413]

1715409413

[1715409413]

1715409413

[1715409413]

1715409413

[1715409413]

1715409413

[1715409413]

1715409413

[BitMaxz]

Did you make that transaction you link above? Or just forgot that you sent Bitcoin to someone?

Check the Electrum status a circle at the bottom right corner of Electrum if it's green, red, or arrow?

It looks like this



The green means the connection is fine but if it was red means you have a connection issue same as if you stuck on syncing or double arrow.

[Rising87]

Thank you so much for the quick response.  I did not send the transaction.  Unfortunately I use the Android app.  Is there any way to check this step in the app from what you linked above?

[o_e_l_e_o]

I did not send the transaction.

This is not an issue with change addresses then. Your wallet will not make transaction on its own, regardless of what selection you made regarding using or not using change addresses. If you absolutely did not make that transaction, then your wallet has been compromised and someone else has made that transaction to steal your coins.

Did anyone else have access to your phone? Where did you download the Android app from? How did you back up your seed phrase?

[Rising87]

I did not send the transaction.

This is not an issue with change addresses then. Your wallet will not make transaction on its own, regardless of what selection you made regarding using or not using change addresses. If you absolutely did not make that transaction, then your wallet has been compromised and someone else has made that transaction to steal your coins.

Did anyone else have access to your phone? Where did you download the Android app from? How did you back up your seed phrase?

Thats what I'm thinking.  My balance is never at exactly zero.  Usually there is some fraction of a bitcoin left there, however small it may be.  My phone is fingerprint locked so I wonder how they got my seed.  Its hidden as a screenshot in an unrelated folder within the Android Data System files.  I downloaded the Windows Electrum version and the dot was green.  If I make a new wallet and keep the seed phrase elsewhere then will I be safe going forward?

[BitMaxz]

Thats what I'm thinking.  My balance is never at exactly zero.  Usually there is some fraction of a bitcoin left there, however small it may be.  My phone is fingerprint locked so I wonder how they got my seed.  Its hidden as a screenshot in an unrelated folder within the Android Data System files.  I downloaded the Windows Electrum version and the dot was green.  If I make a new wallet and keep the seed phrase elsewhere then will I be safe going forward?

What phone model you currently use?
Most Chinese phone or clones are not secured and it's vulnerable to any threats the same as the rooted phone. If you are using these phones then you have a big problem.

The phone has always had an auto-sync feature that can sync most of your data including images so maybe the seed screenshot might be sync to your email and your email might be connected to another device and restored the backup seed image? It's just like if you take a picture from your phone it will appear also to other devices if your email is connected.

If you still have the seed from your phone try to import it to Electrum in Windows to check the balance and let's hope that your Bitcoin still there.


About your last question, we can't guarantee the safety of your wallet if you know that your laptop/PC is secured then your wallet is safe but before you install the Electrum you should verify the signature first to make sure the installer that you download is legit.

You can check these two guides on how to verify Electrum.
- How to verify Electrum (for Windows, Linux and Mac)
- [GUIDE] How to Safely Download and Verify Electrum [Guide]

[o_e_l_e_o]

Its hidden as a screenshot in an unrelated folder within the Android Data System files.

That is the most likely culprit for how your coins were stolen. Your seed phrase should only ever be written down, as Electrum tells you when you create a new wallet, and never saved electronically in any format.

If I make a new wallet and keep the seed phrase elsewhere then will I be safe going forward?

Possibly. Your wallet could also have been compromised from malware, or a key logger, or a fake Electrum app, and so on, although saving your seed phrase as a screenshot is the most likely. We don't know therefore if simply creating a new wallet on the same device will be safe enough.

Personally I wouldn't risk it. I would be looking to make sure whatever device I use next is clean by wiping it and installing a fresh OS.

[Rising87]

Thank you all for the help.  Does it make it odd that the funds are still in the address it was sent to and are currently unspent?  Also the transaction that mine was included with addresses where the originating deposit was back to March 2020.  I used the same address as when I received the funds from the Bitcoin ATM.  Could that have something to do with it?

[Nhor1011]

Hi all,

I've used Electrum a handful of times and stupidly thought change address were causing me to not be able to send close to full amounts in my wallet balance.  My last transaction I turned change address off and it went through successfully.  However there was a transaction the following day that I don't recall making and my balance is now at zero.  I checked blockchain and the address the funds were sent to are unspent.

Is there anything I can do?  Likely not but I figured it was worth a question to this group.

https://www.blockchain.com/btc/tx/4c00cfa1360b91fec3fe43b45f318d4810a4cd806069423ec8e103c694833493

Thanks in advance!

I think what you said is impossible having a transaction that you didn't know and make your balance zero. Maybe you just neglect that you made that transaction or there is someone that also know your private key and did that without your knowing. Always be careful with your private key to make your funds secured.

[Rising87]

Hi all,

I've used Electrum a handful of times and stupidly thought change address were causing me to not be able to send close to full amounts in my wallet balance.  My last transaction I turned change address off and it went through successfully.  However there was a transaction the following day that I don't recall making and my balance is now at zero.  I checked blockchain and the address the funds were sent to are unspent.

Is there anything I can do?  Likely not but I figured it was worth a question to this group.

https://www.blockchain.com/btc/tx/4c00cfa1360b91fec3fe43b45f318d4810a4cd806069423ec8e103c694833493

Thanks in advance!

I think what you said is impossible having a transaction that you didn't know and make your balance zero. Maybe you just neglect that you made that transaction or there is someone that also know your private key and did that without your knowing. Always be careful with your private key to make your funds secured.

So this is the transaction that wiped out my balance https://www.blockchain.com/btc/address/18Aq4fB8TAYcvg7hLBtzYCSvkvEpBgrykJ  Theres 14 addresses feeding into the where the funds were sent.  I found that another address dated 9/21/20 actually matched a change address I had highlighted in yellow from Electrum.  I have had several transactions between 9/21/20 and 11/12/20 using change addresses so wouldn't the balance have already been transferred out of the 9/21 address when I sent my next transaction with change address?  How could this 9/21 address have feed bitcoin to this 11/13/20 transaction (url posted above)?


Actually a lot of these addresses on  https://www.blockchain.com/btc/address/18Aq4fB8TAYcvg7hLBtzYCSvkvEpBgrykJ are matching my old change addresses from past transactions.  How is this possible?

[Csmiami]

Actually a lot of these addresses on  https://www.blockchain.com/btc/address/18Aq4fB8TAYcvg7hLBtzYCSvkvEpBgrykJ are matching my old change addresses from past transactions.  How is this possible?

According to wallet explorer, all 14 inputs belong to the same wallet (I'm not sure how the site determines that though). Seeing the ammounts of satoshis in the tx, it doesn't really look like a hacker may have been bothered; some of the inputs are as small as 500 satoshis; and to me, this just looks like a transaction to consolidate all your small inputs. And all of the inputs are change addresses, used only once...

You saying that most of the addresses used there kind of reinforces that theory, so... Did you try installing the wallet in Electrum as it was suggested earlier? The app shouldn't create transactions by itself, but for what you've told, I'm pretty confident it was a consolidation tx. If you install Electrum on your computer, and check it's connected; check if the funds do show, and if they don't, try increasing the gap limit.

If none of that works, I'm pretty clueless. Bitcoin core does have a command to check whether an address belongs to the wallet in use; but I'm unaware of Electrum having a similar feature

[hosseinimr93]

According to wallet explorer, all 14 inputs belong to the same wallet (I'm not sure how the site determines that though).

Walletexplorer collect all addresses that have been spent together into a same wallet.
Assuming address A and address B are inputs of a transaction, walletexplorer put both of them in a same wallet. Also, if address C is spent with each of addresses A and B in any other transaction, address C will go to a same wallet too.
This is exactly why all those 14 addresses are in a same wallet.

Bitcoin core does have a command to check whether an address belongs to the wallet in use; but I'm unaware of Electrum having a similar feature

In Electrum you need to use the command below.

Code:

ismine("address")

[Rising87]

Actually a lot of these addresses on  https://www.blockchain.com/btc/address/18Aq4fB8TAYcvg7hLBtzYCSvkvEpBgrykJ are matching my old change addresses from past transactions.  How is this possible?

According to wallet explorer, all 14 inputs belong to the same wallet (I'm not sure how the site determines that though). Seeing the ammounts of satoshis in the tx, it doesn't really look like a hacker may have been bothered; some of the inputs are as small as 500 satoshis; and to me, this just looks like a transaction to consolidate all your small inputs. And all of the inputs are change addresses, used only once...

You saying that most of the addresses used there kind of reinforces that theory, so... Did you try installing the wallet in Electrum as it was suggested earlier? The app shouldn't create transactions by itself, but for what you've told, I'm pretty confident it was a consolidation tx. If you install Electrum on your computer, and check it's connected; check if the funds do show, and if they don't, try increasing the gap limit.

If none of that works, I'm pretty clueless. Bitcoin core does have a command to check whether an address belongs to the wallet in use; but I'm unaware of Electrum having a similar feature

So I got back onto the PC version.  Its definitely a change address transaction because all the outputs are yellow with the receiving address green. I went to console to check if the address is mine and it return false.  Is there any hope to get funds?

[hosseinimr93]

So I got back onto the PC version.  Its definitely a change address transaction because all the outputs are yellow with the receiving address green. I went to console to check if the address is mine and it return false.  Is there any hope to get funds?

What do you mean by all the outputs? The transaction you posted has only 1 output. I think you meant inputs. right?

If that's the case, it means that all 14 inputs of the transaction had been used as change addresses before.
Also, the address highlighted in green is yours. If that's the receiving address , you should have access to the fund.

[Rising87]

So I got back onto the PC version.  Its definitely a change address transaction because all the outputs are yellow with the receiving address green. I went to console to check if the address is mine and it return false.  Is there any hope to get funds?

What do you mean by all the outputs? The transaction you posted has only 1 output. I think you meant inputs. right?

If that's the case, it means that all 14 inputs of the transaction had been used as change addresses before.
Also, the address highlighted in green is yours. If that's the receiving address, you should have access to the fund.

Sorry I meant 14 inputs are mine and the 1 output is green.  However I went to console and did the ismine function and returned false.  The address is not being shown in my addresses tab.  No idea how Electrum is identifying this as green but not showing in my addresses.

[hosseinimr93]

Sorry I meant 14 inputs are mine and the 1 output is green.  However I went to console and did the ismine function and returned false.  The address is not being shown in my addresses tab.  No idea how Electrum is identifying this as green but not showing in my addresses.

Go to console tab and use the code below to generate more addresses.

Code:

[wallet.create_new_address(False) for i in range(50)]

The number 50 in the code above is number of addresses generated by Electrum. You can change it to any other number.

[Rising87]

Sorry I meant 14 inputs are mine and the 1 output is green.  However I went to console and did the ismine function and returned false.  The address is not being shown in my addresses tab.  No idea how Electrum is identifying this as green but not showing in my addresses.

Go to console tab and use the code below to generate more addresses.

Code:

[wallet.create_new_address(False) for i in range(50)]

The number 50 in the code above is number of addresses generated by Electrum. You can change it to any other number.

Thank you very much for the suggestion and I went up to 1,000 and still not showing in my addresses.

[nc50lc]

Thank you very much for the suggestion and I went up to 1,000 and still not showing in my addresses.

It will be highlighted as "red" if it's out of your gap limit and "not highlighted" if it's not currently in the keypool.
There's definitely something weird going on here.

What's your Electrum's version?

-typo-

[Rising87]

Thank you very much for the suggestion and I went up to 1,000 and still not showing in my addresses.

It will be highlighted as "red" if it's out of your gap limit and "not highlighted" if it's not currently in the keypool.
There's definitely something weird going on here.

What's you're Electrum's version?

I was originally on 4.0.4 for mobile.  Now on 4.0.4 desktop.  The https://www.blockchain.com/btc/tx/4c00cfa1360b91fec3fe43b45f318d4810a4cd806069423ec8e103c694833493 transaction in Electrum shows yellow for all the inputs and green for the 1 output.  However the output address is not in my addressees and using the ismine function is coming back as false.  I have no idea what happened as I did not initiate this transaction.

I apologize...The output is not green.  13 inputs are yellow, 1 output is green.  This transaction was for my exact balance

[nc50lc]

I have no idea what happened as I did not initiate this transaction.

To be honest, I have no idea either.
Because the mobile and desktop versions both show the same behavior.

All I can suggest is to create a copy of your wallet by using "I already have a seed" and see if it will generate the same wallet and set of addresses.
-update-

I apologize...The output is not green.  13 inputs are yellow, 1 output is green.  This transaction was for my exact balance

Okay, you need to differentiate inputs from outputs, example (from testnet):


Your transaction shows that it has 14 inputs and 1 output.
So, what you mean is it has 13 yellow-highlighted inputs and 1 green-highlighted input.
The output is not highlighted.

We're now back to the possibility that your seed phrase was hacked.