help please, i can't find my funds

[ribo]

I apologize to the moderators and to all the frequenters of the forum, I don't know which could be the right section.
I have been using the electrum wallet for several years (very occasionally, i can say for two or three transactions a year).
Today I couldn't remember my password (I tried the 6/7 that I usually use and none allowed me to access) and so I created a new wallet and entered the seeds I had saved.
I found all the old transactions in this new wallet and I sent myself from binance, as I usually do, bitcoins for an equivalent of around €600.
Inside the wallet, in the transaction history, I found two operations at the same time, one with the credit of what I had sent and the another one with the same amount but in negative. The result after 6/7 confirmations is that I have 0 in the wallet.
What happened? I've lost everything? Please help me

[1714661686]

1714661686

[1714661686]

1714661686

[1714661686]

1714661686

[1714661686]

1714661686

[OmegaStarScream]

It sounds to me like something was monitoring your wallet, that explains why the funds were sent at exactly the same time. If your overall balance says 0, and you can't recognize the transaction (or the address the funds are being sent) then your computer might have been compromised.

Could you share the TXID, and tell us which wallet version were you using?

[Charles-Tim]

What happened? I've lost everything? Please help me

Sorry, your wallet was compromised. Either someone know your seed phrase or you device is infected with malware.

I use passphrase with my wallet. Any loss would definitely be online. Passphrase can help, but it can also lead to loss of coins if you lost its backup, just like seed phrase. It is good to backup the seed phrase and passphrase differently in different locations.

Also always make sure you avoid malware.

For €600, you need a cold wallet for it. If you can not make yourself a cold wallet, buy a hardware wallet like Passport.

[Yamane_Keto]

Sorry, your wallet was compromised. Either someone know your seed phrase or you device is infected with malware.

The negative balance is not an indication that the wallet has been hacked, but rather a problem with electrum server or with establishing the connection.

@OP Can you try to verify that your balance has arrived in your Binance account or check it in any block explorer or share the TXID?

The address that will appear in the block explorer is the one your money was sent to, so if it's not your address I would strongly recommend re-installing the OS, updating it to last version, and staying away from random clicking/downloading although I don't expect you to have lost your money.

[ribo]

Could you share the TXID, and tell us which wallet version were you using?

this is the first transaction id

fc6751b38bdca19669f9060f18ebd49db5b1c6ffd6e8034c8afd773d5c3b5f27

and at the same time the second txid is

153e4f30dfdd000066ab1c6f600d2b259fb029db2034937d5bf216a506616651

i was using an old one version (can be 3.3.2?)
i updated after this issue and now i have the last one version

[Yamane_Keto]

fc6751b38bdca19669f9060f18ebd49db5b1c6ffd6e8034c8afd773d5c3b5f27

https://www.blockchain.com/explorer/transactions/btc/fc6751b38bdca19669f9060f18ebd49db5b1c6ffd6e8034c8afd773d5c3b5f27

TX inputs in this transaction belong to Binance and cannot be held in your wallet.

and at the same time the second txid is
153e4f30dfdd000066ab1c6f600d2b259fb029db2034937d5bf216a506616651

https://www.blockchain.com/explorer/transactions/btc/153e4f30dfdd000066ab1c6f600d2b259fb029db2034937d5bf216a506616651
input: 1HspDRoAS3YQyYgJsvHk57zZ898ZhZyJy3
output: bc1q8tfe0jr7gxghgxhhry4wkfpwl64mdpqnhnamg7 (If this address is not yours, then you have been scammed.)

i was using an old one version (can be 3.3.2?)
i updated after this issue and now i have the last one version

It is better to reinstall OS, as you have downloaded viruses or an unofficial version.

[ribo]

Maybe this can help...
I see in my old addresses, always 2 transactions, one positive and one negative.
The first one (positiva) at a certain time, while the second one (negative) about 2 hours later
and one time few minutes later.
Today, the transactions positive and negative are at the same time. Is it possible they didn't sync yet?
I've never seen in the history the positive and negative transcactions, just today, while in the addresses history
i see always 2 transactions.
I don't know if i can send screenshots or if i must hide something.
sorry for my poor english and for my inexperience with the wallet

[hosseinimr93]

i was using an old one version (can be 3.3.2?)
i updated after this issue and now i have the last one version

How did you update your wallet?
Electrum versions older than 3.3.4 were vulnerable to a phishing attack in which the servers could display a message asking users to update electrum from a fake website.
Did you update your electrum through a link displayed on a pop up message? If so, you downloaded a fake version of electrum.

[ribo]

i was using an old one version (can be 3.3.2?)
i updated after this issue and now i have the last one version

How did you update your wallet?
Electrum versions older than 3.3.4 were vulnerable to a phishing attack in which the servers could display a message asking users to update electrum from a fake website.
Did you update your electrum through a link displayed on a pop up message? If so, you downloaded a fake version of electrum.

i made the transactions with the old version.
then, i went to the website and i downloaded the new version after the issue

by the way, i see now the address bc1q8tfe0jr7gxghgxhhry4wkfpwl64mdpqnhnamg7 in the blockchain and it's surely not mine
I see it has a balance of 2.234 $ and i guess 650 $ were mine

[OmegaStarScream]

Maybe this can help...
I see in my old addresses, always 2 transactions, one positive and one negative.
The first one (positiva) at a certain time, while the second one (negative) about 2 hours later
and one time few minutes later.
Today, the transactions positive and negative are at the same time. Is it possible they didn't sync yet?
I've never seen in the history the positive and negative transcactions, just today, while in the addresses history
i see always 2 transactions.
I don't know if i can send screenshots or if i must hide something.
sorry for my poor english and for my inexperience with the wallet

You've already shared the TXID, so feel free to post the screenshot (you have to upload them to an image hosting service, and post the link here). Just make sure you're not showing seed phrase/the private keys.

And no, this doesn't look like a syncing issue. Even if the wallet is showing the wrong data, the blockexplorers shouldn't.
You said you updated your wallet by going to the website, did you do that manually by going to google?

[ribo]

You've already shared the TXID, so feel free to post the screenshot (you have to upload them to an image hosting service, and post the link here). Just make sure you're not showing seed phrase/the private keys.

And no, this doesn't look like a syncing issue. Even if the wallet is showing the wrong data, the blockexplorers shouldn't.
You said you updated your wallet by going to the website, did you do that manually by going to google?

yes, i did via google, but anyway after having the problem

https://postimg.cc/gallery/htL4ZvD

[BitMaxz]

yes, i did via google, but anyway after having the problem

Based on the image it seems someone already knows your seed backup. And possibly you maybe accidentally upgraded it from 3.3.2(as you mentioned above) to a fake Electrum wallet before?
Older version 3.3.4 are vulnerable to phishing attacks and they will push you to upgrade to the latest version if you click the popup with a phishing link it will bring you to a fake site with fake Electrum.

Have you verified the installer before you upgraded the Electrum to the latest version?
Have you also uninstalled and deleted the old version before you install the latest version?

If not, then you've been hacked.

[Zoomic]

You said you updated your wallet by going to the website, did you do that manually by going to google?

yes, i did via google, but anyway after having the problem

https://postimg.cc/gallery/htL4ZvD

Seems you downloaded a fake Electrum at the process of updating it from the Google play store. I nearly would have been a victim of a similar hack but I had to visit the Electrum website. It was from the website that I was redirected to the google play directly to the Electrum wallet.

You would have also noticed, just that you don't visit your wallet often.

[hosseinimr93]

yes, i did via google, but anyway after having the problem

Even if you have downloaded electrum from the correct website, you shouldn't consider your wallet safe and you should no longer use it.
I recommend you to format your hard drive and reinstall your operating system. Download electrum from its official website and don't forget to verify your download.

Seems you downloaded a fake Electrum at the process of updating it from the Google play store.

This is not possible.
Play store is used for downloading Android's applications and according to the image shared by OP, he/she is using the desktop version of electrum.

[BitMaxz]

Seems you downloaded a fake Electrum at the process of updating it from the Google play store. I nearly would have been a victim of a similar hack but I had to visit the Electrum website. It was from the website that I was redirected to the google play directly to the Electrum wallet.

You would have also noticed, just that you don't visit your wallet often.

He didn't mention that he did update it to Google Play Store if you read and understand what OmegaStarScream said he meant if he did search it through Google because sometimes there are some Google ads on search results that will bring you to the fake Electrum site with fake Electrum wallet.

[Zoomic]

Seems you downloaded a fake Electrum at the process of updating it from the Google play store. I nearly would have been a victim of a similar hack but I had to visit the Electrum website. It was from the website that I was redirected to the google play directly to the Electrum wallet.

You would have also noticed, just that you don't visit your wallet often.

He didn't mention that he did update it to Google Play Store if you read and understand what OmegaStarScream said he meant if he did search it through Google because sometimes there are some Google ads on search results that will bring you to the fake Electrum site with fake Electrum wallet.

Ok I understand now. I misunderstood it as I compared it to one incident that happened to me. I got a notification from google that my wallet needs to be updated. Instead of updating it, I uninstalled it completely and tried downloading a new one and eventually got the wrong app.

[sheenshane]

Seems you downloaded a fake Electrum at the process of updating it from the Google play store.

This is not possible.
Play store is used for downloading Android's applications and according to the image shared by OP, he/she is using the desktop version of electrum.

i was using an old one version (can be 3.3.2?)
i updated after this issue and now i have the last one version

I freshly remember that I was also nearly a victim and almost compromise my Electrum wallet but luckily I know that it is safe to download on the official website.  This is on the desktop and not in the Android app, the version mentioned by OP was vulnerable to hack and there's a pop-up message that says you can't proceed with your transactions not unless you need to install a new version by the given link in the pop-up message.

So the comment above was right, you downloaded the fake Electrum app on your desktop and you're not alone because I saw here before someone posting the same problem as yours.  If there's any amount left, just transfer it quickly because that's already a compromised account.

[Faisal2202]

So sad, but you have scammed already as many members already mentioned it to you. I found it shocking because i never used electrum before and i was told to use it because it is open source and if it would contains any backdoors then they will be exposed but now i am wondered to think that how a person like you using after 2 or 3 years later, and didn't have the time to research about the wallet.

Like, what has been happened till now, is there any phishing attacks going on. How a person like the OP would know when something will happen. I am so confused and don't know that should i use it. Because i can not remain that much active to keep tracking the activities of this wallet or maybe i have to follow some investigator from Twitter.

Overall, the point is, such thing could also be done if your OS is not downloaded from the official platform, because a few weeks back i heard a news in which the OP said, hackers now had implemented Backdoors in the Cracked OS that you download from Pirated websites so that you don't have to pay fee for activation or if you might have used some software that was pirated and was compromised. Well in any cases, it might happen that, you fall prey to clipboard scam too in which your copied address is changed with scammers address in the clipboard of the System. 

[o_e_l_e_o]

I freshly remember that I was also nearly a victim and almost compromise my Electrum wallet but luckily I know that it is safe to download on the official website.

No, it isn't - not in isolation. Obviously you should only ever download from electrum.org, but an attacker could still compromise the Electrum website and upload malicious software there for users to download. The only way to be safe is to verify the software you download using the developers' PGP keys.

I am so confused and don't know that should i use it.

There are no backdoors or issues with Electrum itself. It remains perfectly safe to use provided you have downloaded the real version and verified prior to using it. OP has either downloaded a fake version or has leaked his seed phrase, and there is no issue with Electrum itself.

[joniboini]

Because i can not remain that much active to keep tracking the activities of this wallet or maybe i have to follow some investigator from Twitter.

You can set up a cold wallet with Electrum on one of your devices that is never connected to the internet, store the seed somewhere safe and you'll be free from any hijack. At the very least, you already know that using a pirated OS is risky so as long as you don't use any pirated software then there should be no problem. Follows the suggestion to verify the file and so on above. I believe you can avoid what happened to OP as long as you have good security practices.

I don't think following some security news is that difficult either, just visit this forum once in a while and see if there is any news related to any exploit. Most of the time people will post new threads if something major has happened.