Greenaddress: Bitcoins lost when transferring wallets from old phone to new one

[amadirok]

Hi, I'm new and not at all experienced; I hope someone can help me:
I had a greenaddress wallet on my old phone, a Samsung S10.
I bought a refurbished Samsung S21, and I used the function to transfer settings with Samsung's "Smart Switch" app.
Once I've finished transferring the data from the old phone to the new one, I open greenaddress, type in the 24-word password, and i sow the account was zero!
A transfer appears to have been made at the time the smart switch was running, and this is the transaction screen, which emptied my account.
here the screenshot:
https://drive.google.com/file/d/1LQa-CvDl9V0xfeHVtH5i7IbyTNbzJPNg/view?usp=sharing
https://drive.google.com/file/d/1LL2OwRWDo9VvAU6dTZ_OYz6Ib6l0xhgv/view?usp=sharing
https://drive.google.com/file/d/1LmlGrLVWkSpOmqeMRbPJjstaayA26n7f/view?usp=sharing
https://drive.google.com/file/d/1LQa-CvDl9V0xfeHVtH5i7IbyTNbzJPNg/view?usp=sharing


What may have happened?

Thanks to anyone who wants to help me. If anyone helps me recover the lost satoshis I will reward them generously.

[1714618221]

1714618221

[1714618221]

1714618221

[1714618221]

1714618221

[1714618221]

1714618221

[Churchillvv]

This might be a result of phishing links that must have been connected to your device and perhaps they didn't take action since connection but decided to use the opportunity that you're moving from one phone to another an conducted a transaction.

Since the new address is not yours the it's purely a hack. That means you have been scammed and perhaps I haven't used the greenaddress wallets but I learnt it's an open source wallet but that doesn't mean it can't be hacked.

For your information, there is no way to get your funds back since it has been transferred to a new address already, even though go to the police to report or try to tack the funds it will only cost you more than the actual amount which you seek.

This just another sad news of stolen funds but a means to remind you to always keep your bitcoin safe using a good wallet like Electrum in an offline device (cold storage). Almost every wallet that has to be online is prone to hack because everyday we see new updates on hacks that means the internet is obviously a bait that could catch at any time.

[FinneysTrueVision]

Where was the wallet you imported your seed into downloaded from? Blockstream ended support for GreenAddress wallet in 2021. If you tried to import your seed into a wallet named GreenAddress instead of Blockstream Green, it is very likely that it was a fake wallet that isn’t related to Blockstream at all. Your Bitcoin is gone for good if you inadvertently gave the seed to an attacker.

[LoyceV]

A transfer appears to have been made at the time the smart switch was running

I never use "transfer software" like this when I get a new phone, but it sounds like the transfer software had access to your wallet files. A PIN is easy to brute-force, so if the transfer software contains malware, it could steal anything it wants. That also means you should consider your new phone compromised now.

[amadirok]

Where was the wallet you imported your seed into downloaded from? Blockstream ended support for GreenAddress wallet in 2021. If you tried to import your seed into a wallet named GreenAddress instead of Blockstream Green, it is very likely that it was a fake wallet that isn’t related to Blockstream at all. Your Bitcoin is gone for good if you inadvertently gave the seed to an attacker.

I had downloaded greenaddress long before 2021, in fact, then I had uninstalled it when I sold the old phone, and when I installed it again on the Samsung S10 I searched for it on the Play Store and searching for "greenaddress" I found this app:

https://drive.google.com/file/d/1MBG7DA46p4Qi6-ja23xJaQBS8ef-Plwb/view?usp=drive_link

is it a scam?

or is it the phone I bought used here: https://tomatosmartphone.it/ that could contain malware?

[khaled0111]

I don't know what happened but I don't think your wallet was hacked or someone stole your coins, certainly not because you imported your wallet into a new device!

I saw the screenshots you shared and I noticed the notification on your wallet stating that the transaction which moved your coins is "possibly self transfer"!
So I looked up the transaction on a block explorer: https://mempool.space/address/3C6J7r24XYim8CwKPvCdU6Dg1NmnwEwFLy
It appears your coins were sent back to the address which has sent them to you almost a year ago.

As I said, I don't know what happened but if you can remember where you got the coins from then you may figure out what happened.

[amadirok]

I don't know what happened but I don't think your wallet was hacked or someone stole your coins, certainly not because you imported your wallet into a new device!

I saw the screenshots you shared and I noticed the notification on your wallet stating that the transaction which moved your coins is "possibly self transfer"!
So I looked up the transaction on a block explorer: https://mempool.space/address/3C6J7r24XYim8CwKPvCdU6Dg1NmnwEwFLy
It appears your coins were sent back to the address which has sent them to you almost a year ago.

As I said, I don't know what happened but if you can remember where you got the coins from then you may figure out what happened.

Is very strange:
as you can see here:
https://drive.google.com/file/d/1zWKBwz0L9BwvCsQA1R9-SsOoTIuNEZPj/view?usp=sharing
https://drive.google.com/file/d/1Gpq7FqyZzJOTKXQ5cmNgXbdIZi59t5Kn/view?usp=sharing

You see, they come from my Coinbase account, but that account has been empty since I sent the 679 satoshis to green address, I checked now there's nothing. Sorry, I'm not an expert, but how can you tell that the recipient is the same? I don't see the same address on coinbase...

here is my address on coinbase:
https://drive.google.com/file/d/1JPiTDe1x3xVWjwNNobzVB04f2TKzrWTI/view?usp=sharing

[FinneysTrueVision]

I had downloaded greenaddress long before 2021, in fact, then I had uninstalled it when I sold the old phone, and when I installed it again on the Samsung S10 I searched for it on the Play Store and searching for "greenaddress" I found this app:



is it a scam?

or is it the phone I bought used here: https://tomatosmartphone.it/ that could contain malware?

That is the real Blockstream Green wallet that replaced the old GreenAddress. We can now rule out having installed a scam app. Buying a refurbished phone doesn’t necessarily mean it will have malware, especially if it was factory reset and has the stock operating system from Samsung.

I don't know what happened but I don't think your wallet was hacked or someone stole your coins, certainly not because you imported your wallet into a new device!

I saw the screenshots you shared and I noticed the notification on your wallet stating that the transaction which moved your coins is "possibly self transfer"!
So I looked up the transaction on a block explorer: https://mempool.space/address/3C6J7r24XYim8CwKPvCdU6Dg1NmnwEwFLy
It appears your coins were sent back to the address which has sent them to you almost a year ago.

As I said, I don't know what happened but if you can remember where you got the coins from then you may figure out what happened.

You are reading the block explorer wrong. The transaction from a year ago shows him receiving BTC in his Green wallet address 3C6J7r24XYim8CwKPvCdU6Dg1NmnwEwFLy. After that, the funds were swept two weeks ago from this address to a different address which is 1J51SvXqXaCuUb6SeuDPw5d7g6WLkY24rX. Whenever you make a transaction that doesn’t have any change, Blockstream.info’s heuristics will say it is a possible self-transfer. It doesn’t mean you actually transferred to yourself, but it’s an assumption that is sometimes helpful in blockchain analysis.

Looking at the address where the funds were swept to it appears to be a Binance deposit address.
https://platform.arkhamintelligence.com/explorer/address/1J51SvXqXaCuUb6SeuDPw5d7g6WLkY24rX

@amadirok you should check your Binance account to see if you made a recent deposit that you do not remember.

[amadirok]

@amadirok you should check your Binance account to see if you made a recent deposit that you do not remember.

I have never had an account on binance

By observing the movements of that Binance account you can see that the incoming BTC are immediately transferred to this address:
https://platform.arkhamintelligence.com/explorer/address/bc1qgzrva028eym96uax90j28qj3aqhh3dy8gk6qvp
He should be the thief son of a bitch, right?

[FinneysTrueVision]

I have never had an account on binance

By observing the movements of that Binance account you can see that the incoming BTC are immediately transferred to this address:
https://platform.arkhamintelligence.com/explorer/address/bc1qgzrva028eym96uax90j28qj3aqhh3dy8gk6qvp
He should be the thief son of a bitch, right?

The address it was moved to is a wallet Binance is using to consolidate deposits.

In order to recover your funds you will have to follow the instructions on this page
https://www.binance.com/en/support/faq/how-to-report-stolen-funds-transferred-to-binance-360000006051