Replaced transaction. Double spending attack?

[alterra57]

I'm not sure what's going on here so I am posting this topic. I lost some money but as long as we can save someone else from falling for the same scam it's all good.

Yesterday I had someone hit me up on Discord asking to have their Bitcoin exchanged for any other token. I agree even tho the amount was below my minimum. After waiting for a while for the other party to send the Bitcoin I get a phone call and need to go out. About 30 minutes later I get sent this screenshot:



At this point I'm out and can't send what we agreed on back for 1 reason:

1. I have no access to my wallets so I can't see if the other party has really sent the coins.


After getting spammed for hours with infinite messages and missed calls which were mostly made of threats about bad reviews I go back home and open my wallet to see that there is nothing in there.

I let the other party know about it and I get sent the following link: https://mempool.space/tx/c306113746b9cf78d6823ee75260ad311d612f0ae3c145207bccf71b2fdb5e44

At the time the transactions was visible at the page, it later changed to: "This transaction has been replaced by:
e5e783122e3c2dcd3b4ec3b1ed5533fe3b0438512c5597625351d0f108737c7f"

Meanwhile this shows up in my wallet:


Luckily the scammer wasn't smart enough to gain my trust and make 100x that amount.

At this point I'm confused and the most I can make out of this is that this is a double spending attack of some sort.

Now what I'm left with is the following: https://www.blockchain.com/btc/tx/c306113746b9cf78d6823ee75260ad311d612f0ae3c145207bccf71b2fdb5e44

Any suggestion as to what happened is welcome, the amount wasn't huge and I've already made that back twice so fuck the scammers but let's save someone else from falling for the same thing.

EDIT AND MASSIVE UPDATE

Last night I got contacted by a second Discord account under the name of Deon. Offering to exchange their Bitcoin for Litecoin. Below I have attached 2 images, 1 which contains messages from the account that scammed 170 USD out of me and another one which contains messages from the second account aka Deon.





I called out dsadsa on his scam and 2 minutes later Deon hits me up asking for an exchange. Judging by the way these 2 accounts type their messages in I managed to make a connection between the 2 and arrived at one conclusion, these 2 accounts are one and the same person.

Deon has sent me 500 USD worth of Bitcoin and I believe he is trying to gain my trust with his second account so he can play in the higher leagues.

This is absolutely surprising to me.

And here we are:

And again:


Mutual characteristics between the 2 accounts.

- Time of contact.
- Sense of urgency, things like I need it fast, I need it for a friend and so on so they can get me to send before transaction is confirmed at least 1 time.
- Threats about reporting me.
- One dead giveaway was the "min" they would reply with when asked for a txID.
- Another dead giveaway is that dsadsa "tested" me with a 170 USD transfer and Deon just sent 500 USD to a random guy with no escrow (which I offer).
- Another dead giveaway is that both accounts were like "I hope you won't scam me" after allegedly sending what was agreed on.
- Both accounts start with the letter d and when I provoked dsadsa about Deon there was a dead giveaway that he did not want me to make a connection between the two.
- After I told dsadsa he is a fucking idiot for not luring me in and gaining my trust the idiot tried to do just that with a second account.

[1713937987]

1713937987

[1713937987]

1713937987

[LoyceV]

How did you lose money? Did you pay him while your incoming transaction had 0 confirmations?
The part where his first transaction didn't confirm should have been a dead giveaway: it was double spent.

as long as we can save someone else from falling for the same scam it's all good.

Never trust an unconfirmed transaction from an untrusted source.

[hosseinimr93]

The scammer probably abused the RBF feature.
If a transaction has been flagged as RBF, (as long as it is unconfirmed) it can be replaced by a new transaction spending a same input and having a higher fee rate and higher absolute fee.

In your case, the fee rate used for the original transaction was 1 sat/vbyte and it was replaced with a new transaction using the fee rate of 3 sat/vbyte.
In the replacement transaction, the scammer sent the fund to his/her own address.

[alterra57]

How did you lose money? Did you pay him while your incoming transaction had 0 confirmations?
The part where his first transaction didn't confirm should have been a dead giveaway: it was double spent.

That is exactly what happened, because I delayed the transactions for multiple hours I decided to do it fee free and as fast as I could when I had access to my wallets, that is why I did not wait for it to be confirmed. I got good news tho, please read the section at the bottom of the original post.

The scammer probably abused the RBF feature.
If a transaction has been flagged as RBF, (as long as it is unconfirmed) it can be replaced by a new transaction spending a same input and having a higher fee rate and higher absolute fee.

In your case, the fee rate used for the original transaction was 1 sat/vbyte and it was replaced with a new transaction using the fee rate of 3 sat/vbyte.
In the replacement transaction, the scammer sent the fund to his/her own address.

Thank you. After doing some more investigating this seems to be the case, I wasn't sure at first but your reply confirmed it for me.

[NotATether]

There is nothing you can do on a protocol level to prevent someone else from performing this kind of attack on you, so you have to tell the other parties to send first next time (and then you yourself don't send until it confirms), or use escrow.

[o_e_l_e_o]

After getting spammed for hours with infinite messages and missed calls which were mostly made of threats about bad reviews I go back home and open my wallet to see that there is nothing in there.

This should have been a red flag. In peer to peer trades, you should never feel rushed or harassed by the other person. Whenever you do, it is usually because they are trying to pull something shady. In this case, he was rushing to get you to send your half of the trade before his transaction confirmed, so he could replace it with RBF and steal your money. However...

Mutual characteristics between the 2 accounts.

I am not convinced that any of the characteristics you have listed are enough to make a definitive link between these two accounts. It seems to me that there is a not insignificant chance that you have just stolen $500 worth of bitcoin from an innocent third party.

[alterra57]

There is nothing you can do on a protocol level to prevent someone else from performing this kind of attack on you, so you have to tell the other parties to send first next time (and then you yourself don't send until it confirms), or use escrow.

Oh yeah, will definitely keep my eyes open for this type of scam.

[alterra57]

After getting spammed for hours with infinite messages and missed calls which were mostly made of threats about bad reviews I go back home and open my wallet to see that there is nothing in there.

This should have been a red flag. In peer to peer trades, you should never feel rushed or harassed by the other person. Whenever you do, it is usually because they are trying to pull something shady. In this case, he was rushing to get you to send your half of the trade before his transaction confirmed, so he could replace it with RBF and steal your money. However...

Mutual characteristics between the 2 accounts.

I am not convinced that any of the characteristics you have listed are enough to make a definitive link between these two accounts. It seems to me that there is a not insignificant chance that you have just stolen $500 worth of bitcoin from an innocent third party.

There's much more than that going on in this case. Say for example, how high are the chances that someone will pay a 5% fee for a crypto <-> crypto exchange when they can use KuCoin to do that for a much lower fee? There's just too many things going on with this one. I am still verifying the transactions tho and I am going somewhere with it, like the scammers address being connected with the second persons address. Still needs much work but will post results when I'm done.

[LoyceV]

I got good news tho, please read the section at the bottom of the original post.

How sure are you?

I am not convinced that any of the characteristics you have listed are enough to make a definitive link between these two accounts. It seems to me that there is a not insignificant chance that you have just stolen $500 worth of bitcoin from an innocent third party.

My thoughts exactly. Even though it sounds likely, is (for instance) 80% really enough for this?

There's much more than that going on in this case. Say for example, how high are the chances that someone will pay a 5% fee for a crypto <-> crypto exchange when they can use KuCoin to do that for a much lower fee?

I guess it depends on how often you do these trades. If you do it several times per day, it could be a coincidence. If you rarely do it, they're likely the same.
Even instant exchangers can do such a trade at 0.5 to 1% fee.

I am still verifying the transactions tho and I am going somewhere with it, like the scammers address being connected with the second persons address.

Try https://blockpath.com/

[hosseinimr93]

It seems to me that there is a not insignificant chance that you have just stolen $500 worth of bitcoin from an innocent third party.

Someone who claims to be that innocent third party has created a topic in "Scam Accusations" board against OP.
$500 exchange scam

[16xypjnxlrew]

Now I understand why you require a collateral from everyone! Stop pretending to be a creditor - you are a common scammer who deceives honest newbie and accuses the victims of scam with his friends!

[Deonnn]

No, my payment was confirmed, and i never said that u have to send me it before confirmations, Im new on forum and i dont know how all works, so refund my money scammer!

[16xypjnxlrew]

Thanks for posting this on the forum! You need to create a flag that this scammer stole $500 from you! Where are the honest authoritative users of the forum? Will they help us create a scam flag?

[BitcoinGirl.Club]

I am coming from the scam accusation topic from Deonnn

Mutual characteristics between the 2 accounts.

I am not convinced that any of the characteristics you have listed are enough to make a definitive link between these two accounts. It seems to me that there is a not insignificant chance that you have just stolen $500 worth of bitcoin from an innocent third party.

I agree here that the evidences are not enough to keep his $500 and pretending that the other user was Deonnn.

@alterra57 I left you a tag from the other topic. I think you should send the BTC back to Deonnn if you are not interested to trade with him.

Update: How is this topic belongs to the Bitcoin Technical Support board?

[alterra57]

I got good news tho, please read the section at the bottom of the original post.

How sure are you?

I am not convinced that any of the characteristics you have listed are enough to make a definitive link between these two accounts. It seems to me that there is a not insignificant chance that you have just stolen $500 worth of bitcoin from an innocent third party.

My thoughts exactly. Even though it sounds likely, is (for instance) 80% really enough for this?

There's much more than that going on in this case. Say for example, how high are the chances that someone will pay a 5% fee for a crypto <-> crypto exchange when they can use KuCoin to do that for a much lower fee?

I guess it depends on how often you do these trades. If you do it several times per day, it could be a coincidence. If you rarely do it, they're likely the same.
Even instant exchangers can do such a trade at 0.5 to 1% fee.

I am still verifying the transactions tho and I am going somewhere with it, like the scammers address being connected with the second persons address.

Try https://blockpath.com/

I've never done any trades like these before where someone hits me up for a crypto to crypto transaction, so having 2 in the same day within 2 minutes, both having the same sense of urgency is a first. One needs it within 5 mins and the other within 15 minutes "for a friend".

At this point, after going through both chats once again I am 100% sure these 2 accounts are owned by the same person.





Deon didn't even bother to ask for any vouches on my side, that has never happened. He tried doing what he did with the other account but it didn't work.

Also thank you for suggesting blockpath, hope it's going to help me.

[alterra57]

It seems to me that there is a not insignificant chance that you have just stolen $500 worth of bitcoin from an innocent third party.

Someone who claims to be that innocent third party has created a topic in "Scam Accusations" board against OP.
$500 exchange scam

Thank you for bringing this to my attention.

[Deonnn]

I dont understand what you not understand, you said me to wait for 6/6 confirmations i said OK Double-Spend Is only possible when transaction is UNCONFIRMED, so refund my money hop hop 3NMR3mq1Q4NhJjmuUxHkU3BKojDEeEyiUo or take ban!

[alterra57]

I dont understand what you not understand, you said me to wait for 6/6 confirmations i said OK Double-Spend Is only possible when transaction is UNCONFIRMED, so refund my money hop hop 3NMR3mq1Q4NhJjmuUxHkU3BKojDEeEyiUo or take ban!

Explain this "Deon".

Reading your conversation, I am going to tag the accused party. I hope they come and defend in their support.

Please don't! If you read the other thread started by alterra57, you will realize who is the real scamper here.

I'll just comment on this:
OP, from the screenshot you posted, in one of your replies you said this: "Give me proof  it's me and take money I m not dsadsa and I don't know who is this".
I'll give you a proof. This is the transaction ID sent by dsadsa: https://mempool.space/tx/c306113746b9cf78d6823ee75260ad311d612f0ae3c145207bccf71b2fdb5e44
Which was replaced by this one: https://mempool.space/tx/e5e783122e3c2dcd3b4ec3b1ed5533fe3b0438512c5597625351d0f108737c7f
The coins were sent to this address: bc1qtey6w27temcjdsv5uaglfa97d3a56flfv6w7eh which was used as input in the transaction you linked in OP (your address)

Proof of Payment:
https://www.blockchain.com/btc/tx/5bf44f3b65573b3c8e975eb0f68e991a77621e037ff4492856e4c126d5c27222

So, can you explain why someone you don't even know who he is (sdasda) sent you $500 worth of bitcoin?

[Deonnn]

Theres nothing to respond, you said me to wait for confirmations I DID IT, you scammed me and blocked yes? yes! so until i dont get money you are SCAMMER and you should be banned! staff gave u clear respond REFUND MONEY

[alterra57]

Theres nothing to respond, you said me to wait for confirmations I DID IT, you scammed me and blocked yes? yes! so until i dont get money you are SCAMMER and you should be banned! staff gave u clear respond REFUND MONEY

Mate, you literally got called out, no money for you. I'll donate it to an animal shelter. Don't scam people, fuckface.