Urgent Help. recover stuck transaction from phishing attack??

[andybruce]

I've just fallen victim to a phishing scam & sent 1.5 BTC to a fake website. I believe as the transaction is unconfirmed in the mem pool there may be a limited time I can claw it back by sending the same coin again with a higher transaction fee. My initial amount was sent with a low fee which is why it perhaps is unconfirmed after a long time.
 
I do need some technician help to try this as I have no idea how to do it. Transaction was sent via Wasabi Wallet.
 
Do you know of a person who can help & guide me what to do? I might have a shot.
 
Obviously a big reward to anyone who could help me claw back this transaction.
 
Andy Wonder.

[1713963422]

1713963422

[1713963422]

1713963422

[1713963422]

1713963422

[o_e_l_e_o]

Is your transaction opted in to replace by fee (RBF)? If you are unsure, either share the transaction ID here and I can check for you or paste it in to a good block explorer such as https://mempool.space/ and see if beside features it shows "RBF" in green or scored out and in red. If it is opted in, it is easy to cancel. If not, it is significantly harder and likely not possible.

Having said that, the last time I used Wasabi it didn't support RBF. Not sure if things have changed.

[NotATether]

Having said that, the last time I used Wasabi it didn't support RBF. Not sure if things have changed.

Unfortunately RBF is still not supported in Wasabi because the developers did not want to implement it.

[o_e_l_e_o]

In that case OP, your options are limited. You could import your seed phrase to a new wallet, and then create and broadcast a competing transaction which pays a higher fee and sends your coins to one of your own addresses instead. However, the vast majority of nodes would reject this as a double spend and so this new transaction would be very unlikely to be mined unless the original is not confirmed for 14 days and drops from the mempool. However, the scammer could continually rebroadcast the first transaction to ensure it doesn't drop.

The only other option, then, is to see if you can find a mining pool which will accept a payment to directly include your new transaction in one of their blocks.

[BitMaxz]

I don't know if double spend will work on the non-RBF transaction as others said here it wouldn't work but you can try your luck building a new transaction with the same inputs.

Try to use the tool from coinb.in I suggest you to download the latest version of their tool because their page isn't updated yet to the latest one. The latest one works fine to me without any issue on rebuilding the transaction.

Here's the link for the latest one https://github.com/OutCast3k/coinbin/releases/tag/1.6

And open it on any browser and look for "New" then transaction. After that load your TxID and edit the outputs if where you want to send them and make sure to calculate and increase the transaction fee.
Once you have the raw transaction copy them and sign it in your wallet and broadcast it here https://coinb.in/#broadcast

[HCP]

Unfortunately RBF is still not supported in Wasabi because the developers did not want to implement it.

Options are incredibly limited in this case

Pretty much the only way to get this sorted would be to manually craft a "competing" transaction and then get a miner to include it manually in their transaction pool.

Attempting a double spend is going to be very very difficult. The vast majority of nodes will outright reject it, so network propagation will be very limited, assuming you can even find another node that will accept it in the first place!

Personally, I would be trying to contact some of the major mining pools to see if they would even consider this request. 1.5 BTC is quite a substantial loss... condolences.

[Btcspot]

 Hi hope i can help, here is a video you can follow watch the whole video and follow steps. You may need your wallet phrase or key. You can thank me later then if it worked.
 Video here:
 https://www.youtube.com/watch?v=ycq7O48aPvQ

[nc50lc]

Hi hope i can help, here is a video you can follow watch the whole video and follow steps. You may need your wallet phrase or key. You can thank me later then if it worked.
-snip-

That's a quite old video.
With the current rules, it wont work because most nodes wont accept the replacement transaction if the it has no RBF flag.
Secondly, localbitcoins (if there was something special with their push service) now uses Blockstream's esplora to push transaction that wont also accept the replacement txn.

[andybruce]

Thanks for all the suggestions guys. The transaction has now been confirmed on the blockchain & I am past the point of no return. I never though I would fall victim to a phishing scam as I'm usually pretty good at spotting these things. Unfortunately it was late & I was tired otherwise I may have spotted it. Therein lies a lesson.   

[BlackHatCoiner]

Thanks for all the suggestions guys. The transaction has now been confirmed on the blockchain & I am past the point of no return. I never though I would fall victim to a phishing scam as I'm usually pretty good at spotting these things. Unfortunately it was late & I was tired otherwise I may have spotted it. Therein lies a lesson.

Wow, 1.5 BTC seems a huge amount. Sorry for your loss. I wonder how well-made scam was that, that made you broadcast a €45000 equivalent in Bitcoin. Be aware next time of phishing attacks. They're like everywhere trying to rip us off.

Recommendation: Use a wallet like electrum that allows you to replace your transaction by fee, instead with wasabi that may have some limitations. (I didn't know that it had that one, though!)

[pooya87]

instead with wasabi that may have some limitations. (I didn't know that it had that one, though!)

Wasabi wallet doesn't allow creation of transactions marked by RBF so it doesn't have the option. They claim it leads to privacy leak. You can read more about it here although some of the arguments are old such as the pools not mining RBF transactions https://github.com/zkSNACKs/WalletWasabi/issues/1543#issuecomment-508194801

[bob123]

Recommendation: Use a wallet like electrum that allows you to replace your transaction by fee, instead with wasabi that may have some limitations. (I didn't know that it had that one, though!)

Actually, that's a "feature".

Wasabi is made for people who want to preserve some privacy while using a lightweight client.
RBF is turned off to create an unobtrusive transaction fingerprint.

While i'd like an option to enable RBF for people who actually know what they are doing, i do understand their decision.

[BlackHatCoiner]

RBF is turned off to create an unobtrusive transaction fingerprint.

Sorry if it's a dumb question, but why would RBF create an unobtrusive transaction fingerprint?

[hosseinimr93]

Sorry if it's a dumb question, but why would RBF create an unobtrusive transaction fingerprint?

When you increase the fee and create a new transaction for implementing RBF, the added fee is deducted from the change.
With comparing the original transaction and the replacement transaction, it's easy for everyone to find out which output is the receiver address and which one is your change address.

[bitbollo]

Thanks for all the suggestions guys. The transaction has now been confirmed on the blockchain & I am past the point of no return. I never though I would fall victim to a phishing scam as I'm usually pretty good at spotting these things. Unfortunately it was late & I was tired otherwise I may have spotted it. Therein lies a lesson.   

sorry to read that. It's an huge amount and seems a "well done" scam if you get hooked by them...
I think it's could be also useful if you can share some details about this scam and your issue https://bitcointalk.org/index.php?board=83.0 so other people would able to avoid or able to recognize a similar scam.

[o_e_l_e_o]

When you increase the fee and create a new transaction for implementing RBF, the added fee is deducted from the change.

While this is true for the casual user who just uses RBF to bump the fee, it is not necessarily true if you know what you are doing. You can change the value of both the change and the recipient outputs, so it is not clear which one is which. You can instead include another input and use that to bump the fee, leaving all the outputs the same. You could instead replace the recipient's address with one of your own (unused) addresses, and make a second totally separate transaction to pay the recipient. The transaction may only have 1 output and no change.

I think a better idea would be for Wasabi to allow RBF to be enabled with an option hidden in the settings somewhere and with a pop up warning it could decrease privacy, so users who know what they are doing can still use it, while those who don't appreciate the risks wouldn't.

[pooya87]

I think a better idea would be for Wasabi to allow RBF to be enabled with an option hidden in the settings somewhere and with a pop up warning it could decrease privacy, so users who know what they are doing can still use it, while those who don't appreciate the risks wouldn't.

I think the only reason why they haven't implemented RBF is because it is going to be a bit complicated since each transaction has multiple signers and when you want to bump the fee each signer has to sign the transaction again and they may not be available anymore.
Otherwise it is trivial to implement the "bump fee" code in a way that it divides the additional fee among all outputs and deducts a fixed amount from all of them (eg. 100 satoshi from each 10 outputs to increase the total fee by 1000). I also think the library they are using (NBitcoin) doesn't have such a feature so Wasabi devs would have to implement it themselves with a workaround!

[bob123]

While this is true for the casual user who just uses RBF to bump the fee, it is not necessarily true if you know what you are doing.

Unfortunately that's not as easy as it sounds.
Especially since quite a lot of people believe they know what they are doing. Probably way more than actually know what they are doing.

You can change the value of both the change and the recipient outputs, so it is not clear which one is which.

I guess this won't be happening quite often since a transaction usually has a reason. You can't just pay someone less than agreed on.
Therefore in most cases it would need to be subtracted from the change, i assume.

You can instead include another input and use that to bump the fee, leaving all the outputs the same.

This would mix more outputs together which is generally worse. Especially for people who are not that good with coin control.
Further this will create one output which is guaranteed to be deemed as a change output by an observer.

You could instead replace the recipient's address with one of your own (unused) addresses, and make a second totally separate transaction to pay the recipient. The transaction may only have 1 output and no change.

This might work for generic amounts. But for specific amounts (e.g. 164.21$ in BTC at time X) that might be quite easy to reveal.
At least it is by far not as privacy-preserving as just sending a single transaction with that amount.

I think a better idea would be for Wasabi to allow RBF to be enabled with an option hidden in the settings somewhere and with a pop up warning it could decrease privacy, so users who know what they are doing can still use it, while those who don't appreciate the risks wouldn't.

I'd like the option, definitely yes.
But bumping the fee will most likely always result in decreased privacy.
And i believe a lot of people will think they know how to bump it without revealing which output is the recipient and which is the change, while in fact they don't.

Privacy isn't a straight forward topic. It's quite complicated.

[o_e_l_e_o]

I guess this won't be happening quite often since a transaction usually has a reason. You can't just pay someone less than agreed on.

No, but you can add in an additional input and then overpay someone buy a few thousand sats for the sake of obfuscating which is the recipient address and which is/are the change address(es).

This would mix more outputs together which is generally worse. Especially for people who are not that good with coin control.

Sure, but this is for people who know what they are doing, and will know only to link another input from the same address or from a standalone address which does not compromise their privacy by linking to the previous inputs.

Further this will create one output which is guaranteed to be deemed as a change output by an observer.

Why? Let's say I have a transaction spending 0.1 BTC, paying 0.066 to one address and 0.033 to another address, and 0.001 BTC in fees. I bump it by including a second input of 0.001 BTC, all of which goes to the fee. The two outputs remain unchanged.

I'd like the option, definitely yes.
But bumping the fee will most likely always result in decreased privacy.

But the option should be available for those who understand the risks. I've never been a fan of software making decisions based on the lowest common denominator. If other users don't want to use advanced features, fine, but I shouldn't be prevented from using them because of their ambivalence and/or ignorance.

[PrimeNumber7]

When you increase the fee and create a new transaction for implementing RBF, the added fee is deducted from the change.

While this is true for the casual user who just uses RBF to bump the fee, it is not necessarily true if you know what you are doing. You can change the value of both the change and the recipient outputs, so it is not clear which one is which. You can instead include another input and use that to bump the fee, leaving all the outputs the same. You could instead replace the recipient's address with one of your own (unused) addresses, and make a second totally separate transaction to pay the recipient. The transaction may only have 1 output and no change.

While this is technically feasible according to consensus rules, however, I don't think many (any) wallet devs want to implement what you describe because it would allow users to double-spend transactions in a way that would involve the recipient not receiving the original amount of coin as was in the original transaction. I think most devs do not want to be involved in helping users conduct that kind of activity.