electrum wallet problem

[simeon9311]

my btc inside electrum wallet gone ,can some one help me check???

[1715370557]

1715370557

[nc50lc]

No one can tell unless you provide more information.

You can follow this format: Tech Support Help Request Format
I'll also ask a Mod to move this to "Electrum" board.

[hosseinimr93]

What do you mean by "my btc gone"?
Do you mean you had bitcoin but the balance suddenly changed to zero?

Is your wallet synced? The circle located at bottom right corner of the window should be green.
Do you see any outgoing transaction in history tab?
Are you sure you have opened the correct wallet?

[simeon9311]

i using surface download electrum wallet to keep my bitcoin,
but now my btc gone,
no transaction found on my transaction history
only see have record already send out my btc from electrum wallet

[hosseinimr93]

no transaction found on my transaction history

If the wallet is synced (the circle at bottom right corner of the window is green) and there is no transaction in your history tab, that means that you haven't received any transaction.
Maybe, you have created multiple wallets and now you are opening the incorrect one.

only see have record already send out my btc from electrum wallet

I don't really understand this.
In the third line of your post, you said that there is no transaction.

Can you share the address you deposited to, so we can check its balance and transactions?
Note that by sharing your bitcoin address, you may damage your privacy, but it is has nothing to do with your security.
If you don't want to share your address for any reason, you can enter your address in a block explorer like blockchair.com and check the transactions (if there's any) yourself.

[hosseinimr93]

1JychhDmt13D3Gim6tHU53hRHwAZrSFdQs

Where did you get this address from?
The address has already received 6079 BTC and has been inactive in the past 10 months. I strongly doubt it's owned by you.

Isn't your wallet watch-only?

[simeon9311]

you try to download the stament from blockchair ,you can see the record, i dont have 6000+ btc

[simeon9311]

1JychhDmt13D3Gim6tHU53hRHwAZrSFdQs

Where did you get this address from?
The address has already received 6079 BTC and has been inactive in the past 10 months. I strongly doubt it's owned by you.

Isn't your wallet watch-only?

i already find the last transaction from hacker is to binance ,electrum wallet too bad

[Cricktor]

Have you verified that your Electrum wallet is genuine and not some malware?

Was your Electrum wallet protected with a strong password?

Was your device hacked?

How did you attribute the thief's transaction of your funds to a Binance account?

Did you report the theft to the police? (This likely won't bring back your funds, but opens possibilities to freeze the attacker's Binance account. In some cases thieves do silly things and may get de-anonymized on currency gateways. But it all depends on in which jurisdiction you live and how smart and persistent they investigate such crypto thefts.)

[nc50lc]

Based from the deleted reply address' history, the final destination is indeed Binance's hot wallet.
Send-all transaction was one block away from the last "usual" (two outputs: receiver and self) transaction.
Honestly, every other transactions look like non-batched withdraw-from-exchange transactions to me (you sure it's your address?).

Anyways, the "send-all" transaction was almost a year ago: June 4, 2021,
I highly doubt Binance can block the depositor's funds unless he haven't withdrawn it yet.
All you can do it to contact them (together with the authorities) and see if they can provide some info about the hacker's identity.

[simeon9311]

the binance reply say hacker already sell all btc and take money out of binance already，i dunno how the hacker can steal my btc on electrum wallet surface。the last i login check 2021 April，after check i never open the surface ，until 2022.4.24 i open check again my btc already 0 ，my electrum wallet have password and i never give any one my private key also can be hack。

[nc50lc]

-snip- i dunno how the hacker can steal my btc on electrum wallet surface。the last i login check 2021 April，after check i never open the surface ，until 2022.4.24 i open check again my btc already 0 ，my electrum wallet have password and i never give any one my private key also can be hack。

It will be easier to check how if you can provide a screenshot of electrum.
or at least the words written at the 'title bar' (top of Electrum),
example: Electrum 4.2.0 - wallet_1 [imported - watching only]

Also, did you created the wallet yourself or was it given to your by someone?

[simeon9311]

here can share photo？

[nc50lc]

here can share photo？

Upload it to imgbb.com or other image hosting site, then paste the link of the image to your reply.
You should also verify if your Electrum is not a fake, follow these instructions to verify its signature: https://bitcoinelectrum.com/how-to-verify-your-electrum-download/

BTW, if you're looking for a way to find the culprit, only Binance can help you with it.

[simeon9311]

binance reply me cannot do anything ，because the hacker I'd 0 coin

[Cricktor]

Binance won't give you the identity of the hacker's account as long as there is no police case and/or authorities or jurisdiction ask for it. As you don't know how "smart" the hacker was (faked or stolen identity for his Binance account was likely used) that's probably the only way left for you to try, despite maybe some forensic evidence on how the hacker got all necessary details to move your Bitcoins from your wallet (which very likely won't give you their identity; it's more for you to see what went wrong on your side of the story). If the hacker was careless with his Binance account, there is some small chance to disclose his identity.
You may have some (weak password) cloud backups or pourly saved seed and password; your Electrum wallet might not be genuine; your Surface laptop was maybe infected with some trojan malware and/or keylogger which exfiltrated your wallet file and encryption password or even your seed, if you were careless enough to store it in some unencrypted or weakly encrypted file on the device or somewhere else; ... many more possibilities to loose details for your funds to become obtainable for hackers/thieves.

I'm sorry for your loss, but a Surface laptop with likely Windows as OS on it isn't the best safe storage option for a Bitcoin owner or hodler (but I'm only speculating here).

[simeon9311]

TQ for all reply my msg ,coin is already gone ,binance also cannot do anything, i never give any one my wallet key ,and my wallet have long password, my surface after download wallet keep coin and do some transfer, i already close it with no network connect ,i think is electrum wallet have bug,dunno hacker how to use the bug to hack my wallet

[hosseinimr93]

As the address in question has received its first transaction about 6 years ago, you definitely created your wallet using a very old version of electrum.

In electrum versions older than 3.3.4, servers were able to show any message. Some servers abused this feature and showed a message asking users to download a fake version of electrum.
Didn't you update electrum using a link shared by servers?

[sheenshane]

As pointed out above yes, that's possible.
I experienced this before when I was using that old version but fortunately, I always verify and check before I download and I always used the official website to download the Electrum app on my PC.

Just read this article come from Cointelegraph, it seems the same in your case.  I highly recommend using a hardware wallet if you want to store it for a long period of time, hardware wallet has a feature that can protect itself from any malicious link.

[BitMaxz]

TQ for all reply my msg ,coin is already gone ,binance also cannot do anything, i never give any one my wallet key ,and my wallet have long password, my surface after download wallet keep coin and do some transfer, i already close it with no network connect ,i think is electrum wallet have bug,dunno hacker how to use the bug to hack my wallet

It's clear if what Electrum version you are using and where did you download the Electrum wallet?
Lower than 3.4.4 is no longer connected to any server except for phishing servers.

Maybe your Electrum wallet is not syncing properly? Without telling us the exact version of Electrum and where you downloaded it there is a big possibility that you are using a fake wallet or Malware.

[nc50lc]

TQ for all reply my msg -snip- i think is electrum wallet have bug,dunno hacker how to use the bug to hack my wallet

If it's a bug in Electrum, every user should have been hacked the same way as you.
The problem here is you never tried what's suggested like verifying electrum or providing screenshot, just jumping to conclusions.

But since it's really unrecoverable and finding the cause doesn't seem to concern you, we can wrap this thread up.
Most of your info doesn't add up anyways.

[simeon9311]

2015 i create wallet from multibit ，
2021 march i transfer to electrum，have make some transfer。
2021 april is my last check，after check i never open again and no connect any network
2021 june hacker hack，
2022 april i open check again all gone。
electrum wallet i download from electrum webside version 4.0.9

[simeon9311]

TQ for all reply my msg -snip- i think is electrum wallet have bug,dunno hacker how to use the bug to hack my wallet

If it's a bug in Electrum, every user should have been hacked the same way as you.
The problem here is you never tried what's suggested like verifying electrum or providing screenshot, just jumping to conclusions.

But since it's really unrecoverable and finding the cause doesn't seem to concern you, we can wrap this thread up.
Most of your info doesn't add up anyways.

screenshot to this webside？
https://ibb.co/3FTpw0x
is this correct？

[Cricktor]

screenshot to this webside？
https://ibb.co/3FTpw0x
is this correct？

This screenshot doesn't prove anything. A fraudulent Electrum binary looks very likely completely identical to the original Electrum.
You would need to check your downloaded binary if it has been properly signed with the developer's PGP keys.

To check if your downloaded Electrum binary is genuine, ie. signed by the developers ThomasV and maybe also SomberNight and Emzy (not sure if all three signed the v4.0.9 of Electrum) is the very basic but mandatory step every Electrum user should do.

But even if your Electrum binary is genuine, there are many more ways to loose funds from a hot wallet.

[BitMaxz]

It seems you don't understand anything from the previous posts are you living in China? use translate.google.com to understand what other people posts above.

I think you didn't understand about verifying Electrum to make sure you are using a legit Electrum wallet. You can read this guide below on how to do it

- https://bitcointalk.org/index.php?topic=5240594.0

You must read that thread first to understand how it works use the translator if you didn't understand then go back here for the result.

And the website they are talking about is starting with https not the screenshot of your Electrum wallet. The official website of Electrum is Electrum.org and if you downloaded the Electrum wallet on different source or website then it's a malware or fake Electrum wallet.

[nc50lc]

-snip-

screenshot to this webside？
https://ibb.co/3FTpw0x
is this correct？

Yes, that's the one.
So it seems like it's an "[imported wallet]" and not "[imported watching-only]", which you have the key.
Together with the other screenshot that you've PM'ed me, the transactions matched with the address from your deleted reply.
Now, we can rule out one of the possible cause that's mentioned by others.

2015 i create wallet from multibit ，
2021 march i transfer to electrum，have make some transfer。
2021 april is my last check，after check i never open again and no connect any network
2021 june hacker hack，
2022 april i open check again all gone。
electrum wallet i download from electrum webside version 4.0.9

Judging from the dates and the screenshot's Electrum version, v4.0.9 (2020-Dec-18 ~ 2021-Mar-30) matched the latest version at that time.
If it's a fake version, the funds would've been stolen a few moments after you unlocked the wallet, but it happened months later.
It's highly unlikely that it's a fake Electrum (but it's much better if you can verify electrum's signature).

The other possibilities that I can think of are:

• [1] Since it's never opened while it's hacked, the hacker must had access to your private key. Example, from your backup or from [2].
• [2] Your MultiBit wallet may be accessed by the hacker. Since you just imported the private key to Electrum, the fund is still accessible using the key in your MultiBit.
  Note that deleted files can still be restored unless the disk was zero filled or physically destroyed.

[simeon9311]

2015-2021 i using multibit
2021 multibit stop working，i cannot transfer my btc
2021 i only change to electrum.

if hacker hack from multibit，why wait i change to electrum hacker only hack？hacker can see my private key when i key in electrum？？

[nc50lc]

-snip-
if hacker hack from multibit，why wait i change to electrum hacker only hack？hacker can see my private key when i key in electrum？？

The hacker might got access to your MultiBit only in June 2021.
The thing is, the funds were sent while Electrum is offline for a long time, the most probable way for the hacker to steal your bitcoins that way is to get access to the address' private key then import it to his own wallet to spend it himself, so it's either one of the two options.

The delay may be caused by some hindrance which no one knows, it depends on how you dispose of MultiBit and its backups after you imported the prvKey to Electrum.
MultiBit doesn't have to work, he just have to get the wallet file to export the private key from it.

Note: The bitcoins wasn't actually moved to Electrum, importing the private key doesn't mean that it's sent to that imported Electrum wallet;
Importing the prvKey just granted your Electrum access to the funds, but it's still accessible using the original wallet.

[Cricktor]

In my opinion the OP doesn't have a fraudulent Electrum binary but rather his former MultiBit private key(s) have been somehow stolen by the hacker.

I didn't pay enough attention to the "[imported]" in the screenshot of the OP's Electrum wallet window title which indicates an Electrum wallet where the private key(s) have been imported. So it's very likely not a security issue of Electrum (that many more users would've likely experienced) but rather a security issue of the underlying private key(s) of the user's former MultiBit wallet.

The OP could have likely saved his stolen Bitcoins by sweeping the old private key(s) into a newly created standard Electrum wallet (a new HD wallet with completely new private keys) and not only importing private key(s) into a non-HD Electrum wallet.

[simeon9311]

sad case，nothing can do …… binance reply say only can give imformation to police，but police here ask me……what is btc……，i dunno what can do now，

i ask binance want imformation，
binance say wait police，
police say what is btc

i dunno how to take hacker imformation from binance. sad case

[Cricktor]

You owned something that was worth a certain amount of your local currency and was stolen from your possession. In the majority of jurisdictions this should be enough for the police to file a case, it shouldn't matter if they're not the brightest candles on the cake to know or recognize what Bitcoin is. Of course, you may live in a country that has ignorant police. Involving a lawyer to push a theft case will cost you money and chances are very likely pretty slim to pinpoint the thief and get your Bitcoins back.

Unfortunately that's bad for those who lost their coins by theft and even worse the thieves get away with their crimes.

[Pmalek]

What happened with the computer that you originally installed the Multibit client on in 2015?
Is it the same computer that you use now?
Did you give it to someone, did you sell it?
What do you use your computers for where you keep you wallets and private keys? Any torrents, pirated games, porn?
How tech savvy are you? Do you believe you could have caught some type of malware due to your internet activities?

The keys were imported from Multibit and maybe a second computer. That means the same keys exist and were hot in two different software wallets and possibly two different computers.