HELP: Sent BTC: 78 confirmations, Unpaid and BTC sent to different addresses

[jose1346]

Need urgent help:

I sent BTC to from Electrum to my Coinbase wallet. The transaction is showing with 78 Confirmation and the Invoice has correct BTC address to send it to. After 8 hours of waiting, it is showing up up as status "UNPAID", BTC of course not in wallet. When looking at transaction, It appears that Electrum has split the transaction in to 2 transactions (fees) and actual transaction I assume). Both of these transactions are showing either on input or output a "Change Address" in yellow. Below please see transaction.

The wallet was newly created and installed on a new and secure VM With Defender, E/M/XDR, all updates, firewall etc) and has been online for only a few hours in total. No suspicious services running. I downloaded Electrum on original site and checked that it is legit and has cert etc. That front it good.

Any suggestions on what happened, where the money is and If if will arrive at some point? Or what to do?

I see that even though it was only one transaction on my side it was then split into two and senders and recipients were 2 different ones. That should not be the case.
I checked with Coinbase and they do not have the funds, as the funds were sent somewhere else and not to my wallet... which is not true... How can one transaction initiated suddenly became 2 different senders and 2 different recipients?

Thanks
Jose


Here the details:

fda193fd4511548abcc9f399b12ab1dbc9872fd2b89c2f4e10c7887691561673
Input:
828038x55x0       bc1qj2ay5m3l45klwappmqu9zw7ddlqlydr5mqeppw        0.231932  (change of address)
Output:
828038x220x0      bc1qfk6ky2r2ww7tkn4ymt59t4lq85rerthfemz3xr        0.23186963



220ceb6aaa0f9b00f4206177787362a4397ed9a9c243e74ab4c83e15f1decada
Input:
828029x32x6       bc1q9mlalrwj906rgzrup2yjrpphr7cgqjwlw6jrp8        0.1154    
827837x4x0        bc1q03avkk9308pum2mk84jsay09pfkcp7szug7h2j        0.11671  
Output:
828038x55x0       bc1qj2ay5m3l45klwappmqu9zw7ddlqlydr5mqeppw        0.231932 (change of address)


https://blockstream.info/tx/fda193fd4511548abcc9f399b12ab1dbc9872fd2b89c2f4e10c7887691561673?expand

[jrrsparkles]

I assume you're moving funds from your Electrum to coinbase exchange account not the wallet.

If you are sure that "bc1qj2ay5m3l45klwappmqu9zw7ddlqlydr5mqeppw" is your coinbase address then the issue is from the coinbase side, for some reason they didn't credit your balance even after the transaction has been confirmed.

220ceb6aaa0f9b00f4206177787362a4397ed9a9c243e74ab4c83e15f1decada
Input:
828029x32x6       bc1q9mlalrwj906rgzrup2yjrpphr7cgqjwlw6jrp8        0.1154    
827837x4x0        bc1q03avkk9308pum2mk84jsay09pfkcp7szug7h2j        0.11671  
Output:
828038x55x0       bc1qj2ay5m3l45klwappmqu9zw7ddlqlydr5mqeppw        0.231932 (change of address)

This should be your transaction originated from Electrum wallet which contains two inputs and one output, any transaction you see if done by the coinbase and it's very common to see funds moved from the address you sent to different address where you can see hundreds of other TXs which is called their hot wallet.

Contact the coinbase support team and show the TX details then they will most likely will add balance to the wallet.

[hosseinimr93]

If I understood you correctly, bc1qj2ay5m3l45klwappmqu9zw7ddlqlydr5mqeppw is highlighted in yellow. If that's the case, it means that that's your own address.
Did you cancel any transaction? When you cancel a tranaction, electrum replaces it with a new transaction sending the fund to one of your own addresses.

The fund was sent to bc1qj2ay5m3l45klwappmqu9zw7ddlqlydr5mqeppw and then to bc1qfk6ky2r2ww7tkn4ymt59t4lq85rerthfemz3xr.

Do you know bc1qfk6ky2r2ww7tkn4ymt59t4lq85rerthfemz3xr?

[HCP]

So, both of these transactions are showing in your Electrum client?

If so, can you please confirm which Coinbase address you were trying to send the funds to?

Also, did you attempt to "cancel" a transaction or do a "bump fee" on your transaction?

[jose1346]

Yes I did one (1) BTC transaction from my electrum Wallet to my own Coinbase exchange/Vault address. My receiving address on Coinbase is: 3BVy8iSzyFGYSzqngk1tdhYiLCMuucRFZB

In electrum I made sure I had the correct address as recipient and under Send Tab - it s hows that transaction (1) with date, Transfer,. amount and status In there I can see that the BTC address of the recipient is the correct address I put in (mine), status is showing "unpaid".

In the History transaction tab I have suddenly 2 entries (1 for 0.000178 and one for 0.231932) - equaling the total amount I was sending 0.23211.

I did not cancel anything, no bump fees. I hit transfer, it created the invoice piece that is showing unpaid,. but the money is gone. And do I know who or what the 2 addressees where that the tokens were sent to: absolutely not.  I only out in my address.

Unknown addresses that I have no clue where they came from but are showing in the transaction details and highlighted in yellow as "Wallet change":

bc1qj2ay5m3l45klwappmqu9zw7ddlqlydr5mqeppw
bc1qfk6ky2r2ww7tkn4ymt59t4lq85rerthfemz3xr.

[HCP]

Yes I did one (1) BTC transaction from my electrum Wallet to my own Coinbase exchange/Vault address. My receiving address on Coinbase is: 3BVy8iSzyFGYSzqngk1tdhYiLCMuucRFZB

This address does not appear in either of those transactions and there is no transaction history for it:


so you have NOT sent any funds to it.

In electrum I made sure I had the correct address as recipient and under Send Tab - it s hows that transaction (1) with date, Transfer,. amount and status In there I can see that the BTC address of the recipient is the correct address I put in (mine), status is showing "unpaid".

"Unpaid" tells me that what you've done is setup a transaction but then clicked "Save" instead of "Pay...".

Effectively, you entered the address, the amount and then didn't actually sign or broadcast the transaction. I am assuming your "Send" tab looks something like this:



If you right click that "Invoice" item and then select "Details" it will probably show something like this:


except with your 3BVy8iSzyFGYSzqngk1tdhYiLCMuucRFZB address showing.

In the History transaction tab I have suddenly 2 entries (1 for 0.000178 and one for 0.231932) - equaling the total amount I was sending 0.23211.

I did not cancel anything, no bump fees. I hit transfer, it created the invoice piece that is showing unpaid,. but the money is gone. And do I know who or what the 2 addressees where that the tokens were sent to: absolutely not.  I only out in my address.

Unknown addresses that I have no clue where they came from but are showing in the transaction details and highlighted in yellow as "Wallet change":

bc1qj2ay5m3l45klwappmqu9zw7ddlqlydr5mqeppw
bc1qfk6ky2r2ww7tkn4ymt59t4lq85rerthfemz3xr.

I have no explanation for where these other addresses/transactions came from... there is certainly something weird happening. Either your seed/wallet has been compromised and a 3rd party has restored your wallet and moved the funds, or the copy of Electrum you are using is "bad"™.

Given you stated you checked digital signatures etc, then it would appear your seed/wallet has been compromised in some other way.  

[pooya87]

Unknown addresses that I have no clue where they came from but are showing in the transaction details and highlighted in yellow as "Wallet change":

Almost every time that you send coins, there will be some left over or "change" which Electrum sends to another address that belongs to your own wallet under the "change" section. It highlights those addresses with yellow color to indicate that it is your change and belongs to your wallet.

[nc50lc]

The wallet was newly created and installed on a new and secure VM With Defender, E/M/XDR, all updates, firewall etc) and has been online for only a few hours in total. No suspicious services running. I downloaded Electrum on original site and checked that it is legit and has cert etc. That front it good.

Given you stated you checked digital signatures etc, then it would appear your seed/wallet has been compromised in some other way.  

Since he mentioned "Defender", he may be using Windows and OP may be talking about the "DigiCert" SSL Certificate that came with the Windows binaries that can be seen in its file properties under "Digital Signatures" tab.

@OP if you haven't done this initially: bitcoinelectrum.com/how-to-verify-your-electrum-download, try it to your downloaded Electrum binary to see if it's actually Electrum.

[jose1346]

Unknown addresses that I have no clue where they came from but are showing in the transaction details and highlighted in yellow as "Wallet change":

Almost every time that you send coins, there will be some left over or "change" which Electrum sends to another address that belongs to your own wallet under the "change" section. It highlights those addresses with yellow color to indicate that it is your change and belongs to your wallet.

Is there a way to recover the fund that are in the change address? Looks like that is where they are stuck and never really left the wallet.

[hosseinimr93]

Is there a way to recover the fund that are in the change address? Looks like that is where they are stuck and never really left the wallet.

The change addresses (those that are highlighted in yellow) are your own addresses.
Any fund that has been sent to your change addresses should be displayed in your wallet and you should be able to spend them easily.

Now the problem is that the fund has been moved from bc1qj2ay5m3l45klwappmqu9zw7ddlqlydr5mqeppw (your change address) to bc1qfk6ky2r2ww7tkn4ymt59t4lq85rerthfemz3xr.
If you didn't make that transaction, your wallet has been compromised.