Electrum transfer bitcoin to unknow adress bc1

[novamims]

Hi,
Can you help me please.
I bought bitcoin on coinbase, I transfer this bitcoin to my electrum wallet. I receive the bitcoin but after few hours, electrum transfer all received bitcoin without my autorisation to an unknow adress beginnig with bc1...
For further information, i used electrum version since 2019.
Now i tried to restore my wallet with the last version with my seed, but the balance is always 0.
How I can get my bitcoin back please ?

[1715476766]

1715476766

[1715476766]

1715476766

[1715476766]

1715476766

[1715476766]

1715476766

[ranochigo]

Sounds like either a compromised software installation or computer.

Have you downloaded anything suspicious recently? How did you download your Electrum? Did you verify and check its authenticity?

[novamims]

No, sure nothing. If I create a read wallet with this address bc1q..... I see the bitcoins since the transfer always on this address.
I am a begginer, but I think perhaps it is a probleme with adress sigwit, bech 32 or something like that, or incopatibility between coinbase and electrum.

[Charles-Tim]

Check the transaction history on Electrum to be certain that you received the coin and that if the received coin has been transferred from your address to another address.

If the coin is transferred to another address, your wallet has been compromised or you installed a compromised wallet.

I will advice you to download Electrum wallet from https://electrum.org and verify its signature. Format your device of malware and reinstall your computer OS to make it new again and be careful of malware and people.

[novamims]

Thank you for your reply.
I always used a soft from electrum.org
But I don't know how to verify a signature.
I think the bitcoin are not stollen, because they are always store on this adress  bc1...
I can give you the transaction number of received btc from coinbase and the not wanted transfer :

reveive from coinbase : eebcbf5a8917bdd01b62e91efcf5dce1d90533f5c54a20d2931f7e3c164a8d24
transfer not wanted : 5602e4b208771b8acb484b3c9c54a851666e85f2267621a9e5ee7a710210772a

[hosseinimr93]

I am a begginer, but I think perhaps it is a probleme with adress sigwit, bech 32 or something like that, or incopatibility between coinbase and electrum.

No.

I always used a soft from electrum.org

If you are sure that you downloaded electrum from the official website, either your computer is compromised or someone had access to your seed phrase.

But I don't know how to verify a signature.

The link to the guide was already posted by Charles-Tim.
[GUIDE] How to Safely Download and Verify Electrum [Guide]

I think the bitcoin are not stollen, because they are always store on this adress  bc1...

If you are not the one who made the outgoing transaction, your bitcoin has been stolen.

[NdaMk]

I go with @charles-Tim that either there has been a phishing on your account where by Your coin is sent to a different wallet. Which if true your coin is lost already. Another might be Malware issue, and to be certain it is a real electrum wallet you need to verify GPG signature.

This link might help https://bitcoinelectrum.com/how-to-verify-your-electrum-download/

[ranochigo]

No, sure nothing. If I create a read wallet with this address bc1q..... I see the bitcoins since the transfer always on this address.
I am a begginer, but I think perhaps it is a probleme with adress sigwit, bech 32 or something like that, or incopatibility between coinbase and electrum.

There is no incompatibility within any of the addresses. Any incompatibility would've resulted in a failed transaction and in no circumstances would Electrum initiate a transfer to any other addresses for you. It is natural that you can see the funds with a watch-only wallet because the funds aren't moved from that address but you won't be able to spend it without the key.

The only two plausible reasons would be either you forgot about a transaction that you've made or if your wallet is compromised, with the latter being far more likely.

[novamims]

ah ok, I will try to verify gpg signature tonight.
But I tried to restore the wallet on 2 different computer and 3 mobil phone, but it is always the same.
I think there is another reason, because I have 3 purchase like that, and all the bitcoin transfer on bc1 adress are not spend since begining of may, i can see it when I create a read wallet with this adress bc1 :

bc1q4tjunthvhp6c6hqun6yylvy0hewqp4fkgpplde
bc1qcgcv84x7q7dj6nqptee9yekhf2nw7dgq74newl

how i can check this address if are not mine ?

[NeuroticFish]

Thank you for your reply.
I always used a soft from electrum.org
But I don't know how to verify a signature.
I think the bitcoin are not stollen, because they are always store on this adress  bc1...

It's either that your wallet or computer is compromised, either somebody else got access to the seed words of your wallet - either when they were generated, either from where you store the backup of the phrase (storing in email, cloud, desktop is not safe). If one recovered your wallet on any device in the world, he could easily spend your funds (i.e. transfer them under his control).

It doesn't matter the money stays on that specific wallet address. If it's not an address under your control, or, even easier, if it's a transaction you didn't do, then your money is stolen.

how i can check this address if are not mine ?

In Electrum, go to Console tab (you may need to View->Console) and type:

Code:

ismine("bc1q4tjunthvhp6c6hqun6yylvy0hewqp4fkgpplde")

[novamims]

When I copy paste your code @NeuroticFish on the console, the answer is "false"


What informations I can give you to check this 4 transactions (2 receive from coinbase and 2 not wanted)

[moderator's note: consecutive posts merged]

[nc50lc]

I think there is another reason, because I have 3 purchase like that, and all the bitcoin transfer on bc1 adress are not spend since begining of may, i can see it when I create a read wallet with this adress bc1 :

Don't overthink it.
It's normal for hackers to keep the funds untouched until they gained enough balance.
Since the transfers aren't that large, it will be wasteful to spend those right away.

[novamims]

I anderstant that, thank you for your answers guys.

[NeuroticFish]

When I copy paste your code @NeuroticFish on the console, the answer is "false"

Then the address is not yours. Sorry, but it's what I've been expecting.

What informations I can give you to check this 4 transactions (2 receive from coinbase and 2 not wanted)

I'm not sure what you want us to check. We don't know what addresses are in your wallet. We can check if the transactions are processed and if they have confirmations, they are final and cannot be reverted.


I'm not sure what you've done wrong, I don't know if it's your computer that's infected, if it's your wallet that it's a malicious clone, or you didn't store your wallet's seed safely.
What I am almost sure is that somebody has stolen your money.

..Maybe you consider acquiring a hardware wallet, keep its seed backup always offline; it should make this kind of events less likely to happen...

[novamims]

thank you @NeuroticFish, I will do that and buy a nano S.
I am really a beginner, and i thought I have done something wrong with the adress and the compatibility with coinbase regarding the adress segwit native and others because I don't understand that.

[Charles-Tim]

I am really a beginner, and i thought I have done something wrong with the adress and the compatibility with coinbase regarding the adress segwit native and others because I don't understand that.

There is nothing like address is not compatible, you can send bitcoin from any bitcoin address type which starts from 1, 3 or bc1, you can also receive bitcoin from any of the listed bitcoin address type. You just need to be careful of malware and attackers, including people around you which can compromise your wallet.

You will find the OP of this thread interesting: Good topics on security and privacy

[novamims]

Thanks you @Charles-Tim, for the information, that's where I had my doubts.

[jackg]

There was a phishing attack on electrum wallets where a popup got people to download software that was a scam wallet which sent funds to the scammer group.

Depending on when you downloaded your wallet in 2019, you might've fallen victim to this as normal electrum servers started blocking electrum clients connections to stop being ddosed (there mightve been some normal nodes still running too though and you just got unlucky).

Depending on your level of security you might want to try to use a different computer when dealing with bitcoin wallets from now on, reinstall your os to wipe apps you don't need or trust or just start uninstall ing things that might've compromised your system.

Antivirus may be good for retrospective cleansing too (they might not pick up malware as soon as it drops but they'll be able to get it later - eg wait a week or two before installing an update on software).

[BitMaxz]

If you downloaded Electrum last 2019 around January there is a big possibility that you are using Electrum version 3.3.3 which is vulnerable to any phishing attack and possible Electrum 3.3.3 notified you to update it with the latest version with a link and downloaded a fake Electrum.

If you click that link before and installed it then the Electrum wallet you are using is the fake one if you deposit any amount of the fake wallet all of them will be forwarded automatically to another BTC address that is not yours.

Do you remember what Electrum version did you use before?

[NotATether]

Since it's clear your PC has malware on it I strongly advisd you to re-install the operating system with another copy of Windows (or Linux).

Stop using the seed phrase which is compromised and is being stolen from, and create a new wallet for your transactions.

It is possible that the malware has came from not a fake Electrum copy, but from one of the generic "bitcoin stealing" malwares on cracked software/games and pirated movies sites.