Lost seed recovered BTC stolen

[retroverseworld]

I found my lost seed and recovered my electrum wallet; only to find that wallet had been emptied.     10.78134 BTC gone, now 0. Can anyone explain to me how that is possible. How did someone successfully hack my account.

[hZti]

It is only possible if someone else had also access to the seed. It can be that there was a keylogger installed on your machine or that somebody found your records of the seed. On mempool.space you can see when the theft accrued and contact your local law enforcement about it.

[NeuroticFish]

I found my lost seed and recovered my electrum wallet; only to find that wallet had been emptied.     10.78134 BTC gone, now 0. Can anyone explain to me how that is possible. How did someone successfully hack my account.

Option 1. It may be that you've stored the seed somewhere somebody else had access to it. One of the most common mistakes is to store the seed in electronic systems - cloud, e-mail and so on.
Option 2. Your computer is infected. A malware can look for specific files, a malware can record your keystrokes.. and send everything to its master.
Option 3. You didn't pay attention, you have downloaded a malicious Electrum and also didn't check the signature.

Since the wallet is only a tool handling the keys to your coins, it's not necessary for somebody really access your computer, instead, just by having the seed he can recover to another wallet and spend your funds from there.
I'm really sorry for your loss, it's a huge amount you should have known to keep it on cold storage or at least hardware wallet.

PS. Bitcoin system doesn't have "accounts".

[Charles-Tim]

A lost wallet? How did you know that you successfully brute force the seed phrase?  Likely the seed phrase may not be correct.   probably you found and used another seed phrase.

Sorry about this, do not be careless with your seed phrase backup, having your seed phrase means you have your coins because with the seed phrase you can generate the keys and addresses and be able to recover back your wallet successfully.

Did you use passphrase? If not used along with seed phrase while regenerating the wallet, different keys and addresses will be generated, which means you generate a wrong wallet if your passphrase is not used.

Did your wallet synchronized with the blockchain or fully connected? You have to make sure your wallet fully synchronized

Have you checked your wallet balance? Is the coin sent to an unknown address? If your coin is sent to an unknown address, it means your wallet has been compromised.

[LoyceV]

How did someone successfully hack my account.

You're going to have to provide more details of how you created your wallet, how you stored it, how you lost your seed and how you found it back. Right now, your short post raises many questions that all have many possibilities depending on what you did.

[ABCbits]

I found my lost seed and recovered my electrum wallet; only to find that wallet had been emptied.     10.78134 BTC gone, now 0.

What exactly do you mean by "now 0"? Does electrum show transaction where 10.78134BTC is stolen/moved away? Does electrum show empty wallet? If it shows empty wallet, it's possible you entered wrong seed.

How did someone successfully hack my account.

FYI, Bitcoin protocol and Electrum doesn't have "account" system. There's no authority which can reverse the transaction or have log who accessed your wallet.

A lost wallet? How did you know that you successfully brute force the seed phrase?  Likely the seed phrase may not be correct.

What makes you think OP brute force his seed phrase? All he said is "I found my lost seed and ...".

[Charles-Tim]

What makes you think OP brute force his seed phrase? All he said is "I found my lost seed and ...".

Striked out and corrected.

[NotATether]

When was the BTC stolen? (what date?)

If it was around the 2018-2019 era and you were using an old Electrum version, maybe you downloaded a malicious copy by mistake when the phishing dialog came up after you opened the program.

[m2017]

How did someone successfully hack my account.

You're going to have to provide more details of how you created your wallet, how you stored it, how you lost your seed and how you found it back. Right now, your short post raises many questions that all have many possibilities depending on what you did.

From similar topics created by newbies and leaving 1-2 posts with a superficial content of their problem, a lot of questions remain, as LoyceV said, and he is definitely right. More detailed information is needed to find a solution. Beginners should take note that it would be nice to report more detailed description of the problems encountered. This will save time for everyone.

Judging by the words of retroverseworld, there is a lot of uncertainty. I even have a suspicion that ~10.78 BTC was not stolen at all, it's just that OP did something wrong and his balance is not displayed. You can easily verify this by checking bitcoin address in the explorer. Of course, if retroverseworld links the address for check where ~10.78 should be.

[retroverseworld]

Wow, I'm impressed by all the responses and kindness of everyone that responded. Thank you all so much, you are amazing people.
To address the questions raised. I bought anything between 500 and 1500 BTC back in 2009 or 2010, can't remember  the amount exactly. I downloaded electrum on my PC, and spent a couple of days teaching myself to transfer between wallets. I wrote down the seed words for each wallet in a note book and once I was successful in making a few transfers I totally forgot about Bitcoin; until 2016 when the price of Bitcoin started rallying like crazy.

Then I spent 5 years searching for the notebook and eventually found it. I restored the wallet but it was empty and showed no transactions ever taking place in the history. That is still the case with that wallet. Then yesterday I was paging through a notebook, for a novel I wrote (Two River Farm and the Cry of the Jackal if anyone is interested); and here I found another set of 12 words. I promptly plugged them into electrum and was pleasantly surprised  to see historical transactions on it; but depressed to see the balance as zero BTC.

Since the chances of someone else having the same seed as me as virtually zero, I can only imagine a scammer; somehow got hold of my seed, quite possible as I was using a windows XP laptop at the time and withdrew all my Bitcoin.
I think I'm in way over my head here; despite more than five years of searching.

Here is one of the transactions, see what you make of it and let me know.49b17aaeb9308d2d314438baf6321033af09f62c0e9914e5b01ac4d7ba481a4d  bc1qmuuc762cw02gg9j7fmqrw0wcmr0ffm5xkxjnln          10.78134

Either my money has been stolen or we've found the first ever key collision in the history of Bitcoin and that's worth the Bitcoin Foundation paying off my kids' student loans and some.

Any comments are fully appreciated.

[LoyceV]

@retroverseworld: your story doesn't add up. Electrum didn't exist yet in 2010, so there were no seed words to write down at that time.
The transaction you posted happened last year, and the inputs were not years old. Address bc1qmuuc762cw02gg9j7fmqrw0wcmr0ffm5xkxjnln had a 0.01078134 Bitcoin balance, so I think you meant 10.78134 mBTC (Electrum's default unit).

[DaveF]

And native segwit bc1q addresses did not exist until 2017.
Either the OP is very off with their dates or
electrum did not exist until late 2011 and it took a bit of time before people started using it so early 2012 is a more realistic date.

-Dave

[BitMaxz]

I don’t know if you are trying to fool us or you just don’t really know how a Bitcoin works.

Check carefully your wallet I can't even seem to find the transaction of 500 to 1500 BTC from the address you posted.
If your Bitcoin came from this address 17HF2zJE5SWezC5VJF3uXfve3CuxPdDAUA then the total amount of this address is 0.32290541BTC and the first transaction of this wallet was Apr 25, 2021, which is far from what you said.

Are you sure that you own this wallet?

[nc50lc]

Here is one of the transactions, see what you make of it and let me know.49b17aaeb9308d2d314438baf6321033af09f62c0e9914e5b01ac4d7ba481a4d  bc1qmuuc762cw02gg9j7fmqrw0wcmr0ffm5xkxjnln          10.78134

For clarification, you had 10.78134 mBTC which is actually only 0.01078134 BTC, Electrum displays mBTC by default.

To address the questions raised. I bought anything between 500 and 1500 BTC back in 2009 or 2010, can't remember  the amount exactly. I downloaded electrum on my PC, and spent a couple of days teaching myself to transfer between wallets. I wrote down the seed words for each wallet in a note book and once I was successful in making a few transfers I totally forgot about Bitcoin; until 2016 when the price of Bitcoin started rallying like crazy.

Then I spent 5 years searching for the notebook and eventually found it. I restored the wallet but it was empty and showed no transactions ever taking place in the history.

Hmm... The dates are off, but at least earlier than Electrum v0.3 so this could really happen.
When restoring a funded old seed (made before v0.31 and v0.34) to the latest version, it will really result with an empty wallet due to an old "seed derivation bug".

More info here: /index.php?topic=5379817.msg58904925#msg58904925 (read page 2 to 3 for the potential solution).

Either my money has been stolen or we've found the first ever key collision in the history of Bitcoin and that's worth the Bitcoin Foundation paying off my kids' student loans and some.

That's not how to identify private key collisions, you'll have to present two different prvKeys that derive the same address.
If that how it works, then every "hacked" coins can be claimed as a collision.

And "Bitcoin Foundation" isn't some sort of a centralized body that governs Bitcoin, BTW.

[retroverseworld]

Thank you all once again. I liked nc50lc's response which explains what I suspected was happening with my original recovery seed phrase; returning zero BTC. Just to clarify a bit more. I have at least four or 5 very old electrum wallets pre-2011; all of which are displaying zero BTC on recovery and now thanks to one of you I know why. One of those wallets is the one with the 10.7mBTC as I've been corrected to say and for which I shared one of the transactions and one of addresses in my last post.
Am I 100% sure that the wallet belongs to me? Yes definitely; who else would it belong to unless, it's the first private key collision on the BTC blockchain ever. I read somewhere that it would take brute force until the end of the Universe to come up with the same seed or to  hack the private key from the public key. If I managed to do that; then I would be hailed a genius or best hacker on the planet. I'm neither; I can assure you that.
Now that's settled; I will try and follow the suggestions in the link posted by nc50lc (thank you) over the next few weeks.

Just to prove my point, if one of you has the time and inclination you could try and recover the coins in this old electrum wallet given by this old seed. (weave circle round thrice close your eyes holy dread honey hath jan) I reckon it could have anything between 8-12 BTC or have been recently recovered and emptied as I shared it already with a recovery agent in the states. I used the addresses to practice sending and receiving BTC to myself just to understand how the process worked. Remember I'm talking about something that was very novel and didn't make much sense back in 2009,2010 or even 2011. Do I have a tonne of BTC out there that I can't get hold off, because I was too negligent and stupid. Damn right I do.
I don't actually mind that the whole world will now know these particular seed phrases; as I want proof that they once held my BTC and that they must trace back to the original address with at least 800-1500 BTC. Does that make sense?

[DaveF]

...I have at least four or 5 very old electrum wallets pre-2011...

https://en.bitcoin.it/wiki/Electrum

Electrum is a lightweight Bitcoin client, based on a client-server protocol. It was released on 5 November 2011.

There is a VERY small chance you have one from LATE 2011 0% chance you have one from pre-2011

You can get older versions from here: https://download.electrum.org/
And even older versions can be found scattered around the internet if you search.

If you are not sure of the dates / wallet that is fine. But there is no way it's an electrum from that early.

-Dave

[SquirrelJulietGarden]

Option 2. Your computer is infected. A malware can look for specific files, a malware can record your keystrokes.. and send everything to its master.

How to lose your Bitcoins with CTRL-C CTRL-V

Option 3. You didn't pay attention, you have downloaded a malicious Electrum and also didn't check the signature.

Download, verify the wallet and if the signature is correct, install the wallet.
[Guide] How to Safely Download and Verify Electrum

[nc50lc]

Thank you all once again. I liked nc50lc's response which explains what I suspected was happening with my original recovery seed phrase; returning zero BTC. Just to clarify a bit more. I have at least four or 5 very old electrum wallets pre-2011; all of which are displaying zero BTC on recovery and now thanks to one of you I know why. One of those wallets is the one with the 10.7mBTC as I've been corrected to say and for which I shared one of the transactions and one of addresses in my last post.
-snip-

What I explained is a possibility for all Electrum wallets created pre-v0.31 or 0.34 versions in general.
However, your situation is a bit unclear because one of your "old wallets" can't be from 2011 since it has a native SegWit address which is only became available in v3.0 (Nov 2017).

And just like all of us said, Electrum wasn't even released yet on the alleged creation date of your seed phrases.

• Here's the announcement thread: http://bitcointalk.org/index.php?topic=50936.msg607510#msg607510 (dated November 5, 2011)
• Here's the initial release (source code): github.com/spesmilo/electrum/commits/master?after=bdbd5...+14035 (dated November 5, 2011)

[LoyceV]

I have at least four or 5 very old electrum wallets pre-2011

As explained: that's not possible.

One of those wallets is the one with the 10.7mBTC as I've been corrected to say and for which I shared one of the transactions and one of addresses in my last post.

That's not wallet from 2010: the transaction happened in 2021.

Am I 100% sure that the wallet belongs to me? Yes definitely

If you're sure about that: forget about Electrum, and try to remember what you actually used. Electrum didn't exist, so it must have been something else. Have you ever used brainwallets?

you could try and recover the coins in this old electrum wallet given by this old seed. (weave circle round thrice close your eyes holy dread honey hath jan)

That's not a seed phrase, it's not even random. It comes from a poem by Kubla Khan:

Weave a circle round him thrice,
And close your eyes with holy dread
For he on honey-dew hath fed,

Only "jan" is missing from the poem.

[retroverseworld]

Great comments from ETFbitcoin, and yes it's a line from Kubla Khan, and as I said; I was using it for practice purposes only; sending and receiving small amounts of bitcoin. I don't remember the exact steps for purchasing the coins; but roughly, back then; when you purchased the coins from bitcoin.org I think, you then had to transfer them from your purchase account to a wallet. I'm 99% sure that the wallet was electrum. When setting up the wallet it generated the seed automatically; but it offered you the option to enter your own 12 word seed and that I remember very clearly.
I used my favourite poem at the time and words from a favourite song (not shared that yet). For my main account I used default seed generated by Electrum.
It also said that you must never write the words anywhere in case someone discovered them and used them to still your coins. I wrote them down anyway and forgot about them for years until my interest was aroused by the sudden increase of Bitcoin value; then began the long search for the seed. I turned the house and garage over and under looking for them and eventually after  years  of searching I spotted them, scribbled so nonchalantly it's a wonder I ever found them. The excitement was electric. I could barely breathe when I typed them into electrum; but my heart sank as the BTC balance came up as zero.
Then began the search for proof of purchase. You see; if I could get the date of purchase and amount I paid I could at the very list go to blockchain explorer and locate my address and my coins because they would still be on the blockchain; with very few transactions clustered around the date of purchase. Needless to say, I was not able to find any proof; banks only keep records for 6 years so they could not help either. So I was back to square one. The only thing I have is a bunch of stupid meaningless words; but potentially worth a fortune. So I'm not ready to give up yet.
The latest breakthrough was finding those 12 words with the 10.7mBTC. That proved to me that the seed works under the correct circumstances.

1. Yes it's possible I downloaded a dodgy Electrum copy and someone stole all my coins. Then let's find the trail on the blockchain. I don't think this happened because nobody cared about Bitcoin to want to steal it back then.

2. Electrum wasn't available before 2011, nobody but  spesmilo knows that for sure; his first commit on github is bumping up the version number.
from distutils.core import setup
version = "0.29"
version = "0.30"
So question, might be when did github to allow developers to push their code first come out. He might have been using SVN before that.
3. If not electrum then what other wallets were there, in shall we say 2011. Just bitcoin core and electrum right, I don't think there was anything else. I suspect I might have used a beta version; but honestly I don't really remember.
I know 100% that I bought the coins before or at the latest 2011; because I was working for this one company and I left that company in 2011 and I had already bought the coins by then.

I have now managed to check all my seeds against version 0.3 and most of the words are rejected. So  now back to square one.
Maybe it was a different version of Electrum, maybe it was some other random wallet type whose name I can't remember. What a nightmare.