In need of help, got some of my btc stolen?

[nakamura12]

But then why is blockchair showing my balance as 0.039 instead of aprox 0.1…?

I strongly believe this is just a big misunderstanding... When you copy and paste a certain address into any explorer, the amount it shows is not the collective worth of your whole wallet ^{[what you see is just for that specific individual address]}!
_{- BTW, it's actually 0.0329122BTC.}

This is also what I think about what happened to op. I also checked the address on mempool.space and the balance shows the same as you have explained. I think it is sent to a change address because if it's compromised then there won't be any btc left. Even a very small amount of bnb when I sent it to a compromised bnb address is that it was sent to another wallet address right after it was sent to the wallet where I sent it.

[joniboini]

I just installed yesterday electrum and there was a default wallet, and asked me the password so I did and showed me my transactions of my BTC wallet.
I think I installed it some years ago maybe and the default wallet remained in my roaming folder I guess.
Btw I downloaded it from official electrum website . Then it showed me my balance and couldn't believe my eyes .

So you don't import anything then? No seed/private key? Did you verify that it's the real Electrum app? Have you verified if it was the same wallet you created with Bitcoin Core? Why don't you download Bitcoin Core again and try to check your wallet with it? Have you verified it those address belongs to you by checking through the console as suggested above? I think it will be easier to understand if you explain these details further. I believe some suggestions above are quite helpful so try to check them out.

[Faisal2202]

The thing is I never sent 600, I check the amount u send 3 times in my browser on exchanges so I don't mess up the zeros, so im100% sure I never sent them or anyone hundreads of dollars.  Or the 1300.
The address of plissio is the same, the one with 60 or 70 USD.

Also my wallet is encrypted, so when the window pops up I am 100% sure I only send 1 transaction, not 2 at the same time to 2 different addresses, I don't even know how to do that

Thus us the plissio address bc1qw40vpr90585k0t4v46jj097p8e0mfayux26clt

I never sent anything else to anyone or anything this year.
I also uninstall the Bt core wallet and I don't use other wallets

Maybe the btcore wallet was compromised ?

I know i t night seem a small amount but it's 5 salaries I invested through time and put aside...so for me it's a tragedy
Ty for your help, also if anyone can help me to exactly find the issue and so I can understand , would gladly pay for their time if I can. I literally can't sleep and I think of this

I know how hard it can be and  in my sight the amount you lost is not small  we all have our priorities and I respect yours don't panic for now even if you are baffling you are doing great by not making any further transaction so the amount left can be saved. Don't share your seed phrase with anyone in the problem I know you are a techy guy and 45 I read the whole thread to see what's the update on your case.

So till now I understood that you made these transactions from core wallet but when you saw the remaining amount is lesser so you imported your wallet to electrum and you took screen shots and posted here. But the screen shots are saying there are two outputs for each transaction. The ones I mentioned are three transaction in which you lost 1800$ (600$ each) but there is another transaction made on (2024-07-15) and it did not deducted 600$ extra. Why?

I don't think your wallet was compromised, because if it were, then you wouldn't be seeing any money in your wallet. Here comes the change address concept. Which is one of the privacy feature of Bitcoin Core. It is a newly generated wallet address within your wallet.

What it does is, whenever you want privacy on your transaction, it sends the leftover funds to a new wallet address (change address). which makes the ownership finding difficult as now we can't know the wallet receives the 600 is yours or not. Which I mentioned in my last post, here they are again:

bc1qj4pjyc0m7d882kar9ry59hvc034d5fc9rw30wg
bc1qn6q4kx2945ujx2dh4yztl7pcf62jwtl5gq79sp
bc1qfm70pn6c2kljtzxcy4acrmkvuf7md4yjz0cqtg

I know there are more than 3 tx. These wallets must be in your bitcoincore wallet you just have to find them. Don't lose the recovery key as this case shows he can't access his change address back as he lost private key I am not a bitcoincore wallet user so to test the theory, I need to have it but it will take time. You are a techy person you can find them easily. If not then post again. I did not find any video tutorial to it. Well, the addresses received the funds are totally new so there are 100% chances that they are changes addresses. Don't delete the wallet or dat files, because when you used the private key to recover the wallet those keys don't bring back those change addresses back because they are random (AFAIK).

[FinneysTrueVision]

I used electrum because I wanted to make a quick purchase using BTC and as I ce said I don't keep any BTC client installed, I'm paranoic regarding security.
I have eset firewall, router firewall no ports open and Malwarebytes. So when I saw in electrum wallet 0.039 I panicked and started looking up.

For the transactions I used an older version of by core wallet because I had issues syncing it.

I lost every time a  transaction I made , and it's always the plissio address plus another one. But in my wallet I'm 100% positive it did not show, since I never had lower then 0.,09 or smt similar and you can see I always sent correct amount to plissio BTC adresa ending in lt


The addresses with the high amount have no transactions and are not emptied, that's why I was thinking maybe is the change address somehow? But then why is blockchair showing my balance as 0.039 instead of aprox 0.1…?

My BT core waller I closed since and did not get se it at all thinking I don't want to risk again losing something while doing a transaction.

My wallet has around 310 kb is that normal size? My 2017 wallet had like 90 kb. I keep many versions of my wallet, I loaded the 2022 wallet now, thinking all wallets are the same and it doesn't matter

The change should still be in the Bitcoin Core wallet that you originally used. You can’t see it in Electrum because Core sent the change to a different address type than your inputs. Electrum only supports one address type per wallet so to see your funds that are in native segwit addresses you have to import your seed phrase again and select the native segwit address type for the wallet.

[rockk]

The thing is I never sent 600, I check the amount u send 3 times in my browser on exchanges so I don't mess up the zeros, so im100% sure I never sent them or anyone hundreads of dollars.  Or the 1300.
The address of plissio is the same, the one with 60 or 70 USD.

Also my wallet is encrypted, so when the window pops up I am 100% sure I only send 1 transaction, not 2 at the same time to 2 different addresses, I don't even know how to do that

Thus us the plissio address bc1qw40vpr90585k0t4v46jj097p8e0mfayux26clt

I never sent anything else to anyone or anything this year.
I also uninstall the Bt core wallet and I don't use other wallets

Maybe the btcore wallet was compromised ?

I know i t night seem a small amount but it's 5 salaries I invested through time and put aside...so for me it's a tragedy
Ty for your help, also if anyone can help me to exactly find the issue and so I can understand , would gladly pay for their time if I can. I literally can't sleep and I think of this

I know how hard it can be and  in my sight the amount you lost is not small  we all have our priorities and I respect yours don't panic for now even if you are baffling you are doing great by not making any further transaction so the amount left can be saved. Don't share your seed phrase with anyone in the problem I know you are a techy guy and 45 I read the whole thread to see what's the update on your case.

So till now I understood that you made these transactions from core wallet but when you saw the remaining amount is lesser so you imported your wallet to electrum and you took screen shots and posted here. But the screen shots are saying there are two outputs for each transaction. The ones I mentioned are three transaction in which you lost 1800$ (600$ each) but there is another transaction made on (2024-07-15) and it did not deducted 600$ extra. Why?

I don't think your wallet was compromised, because if it were, then you wouldn't be seeing any money in your wallet. Here comes the change address concept. Which is one of the privacy feature of Bitcoin Core. It is a newly generated wallet address within your wallet.

What it does is, whenever you want privacy on your transaction, it sends the leftover funds to a new wallet address (change address). which makes the ownership finding difficult as now we can't know the wallet receives the 600 is yours or not. Which I mentioned in my last post, here they are again:

bc1qj4pjyc0m7d882kar9ry59hvc034d5fc9rw30wg
bc1qn6q4kx2945ujx2dh4yztl7pcf62jwtl5gq79sp
bc1qfm70pn6c2kljtzxcy4acrmkvuf7md4yjz0cqtg

I know there are more than 3 tx. These wallets must be in your bitcoincore wallet you just have to find them. Don't lose the recovery key as this case shows he can't access his change address back as he lost private key I am not a bitcoincore wallet user so to test the theory, I need to have it but it will take time. You are a techy person you can find them easily. If not then post again. I did not find any video tutorial to it. Well, the addresses received the funds are totally new so there are 100% chances that they are changes addresses. Don't delete the wallet or dat files, because when you used the private key to recover the wallet those keys don't bring back those change addresses back because they are random (AFAIK).

Thank you,
What you say makes me think hard,
So I switched hard disks to nvme2 since they are much faster, I copied everything from old HDD to new, thinking all wallet.dat are basically my seed, I deleted everything that contained wallet.dar with chain state from older Bitcoin core clients that weren't even installed, to speed up the process.

Now, this is the part I don't understand and never taught off, the change addresses , so basically you have to use your latest wallet.dat , or the one you used last time or part of your funds will be gone basically since Bt core generated random addresses from your original seed that contain these unique change addresses and your original address is sum of all your change addresses ?

So I made 4 transactions this year, last time I wasn't even paying attention to what btcore I use since I didn't delete it I guess, and everything showed fine since all the change addresses were contained in that recent wallet.dat?

And now that I installed newest btcore client and imported the deer I found from 2022 they don't contain my change addresses so I'm shown the Ballance without them ?

So I need to use the latest seed to have those change addresses included as mine ..

My key question is, is this process broadcaster to the chain so my main address is the owner and the value of my wallet is the one including the change ?

Because the first thing I did was to run to a Blockchain explorer and enter my BTC adresa to see if the low value of my wallet is real, and it showed the low value not the good one which is around 0.1. I know this value because I strived always to have 10% of 1 magical Btc and again I never cashed out of crypto, through all the freaking crashes and ppl laughing at me, and now this. I'm heartbrokren and frustrated not knowing what happend , I was always prepared to lose crypto even I I fully believed in it  but not like this. I'm usually the guy that tells others to be paranoid about security.

What I think now of doing

Get my old laptop

Format it

Install unregistered win 10 from Microsoft

Install latest Bitcoin core wallet

Searching and finding all my wallets sorted by dates

Start importing each chronologically from new to old

Find the latest BTC core software I used and recover that wallet also.

[SmartGold01]

i am baffled, please help.

also i checked one of the adresses the higher amounts were sent, they seem there unspent no transactions, nothing.

i reinstalled core wallet since i changed hdd , maybe its an older wallet and those are changes? i dont know anymore what to think, ty

last time i used btc was in april if i recall right

If I could recall correctly, any transaction that has been approved from the blockchain can never be reversed back and this shows that automatically your bitcoin is gone forever.
The only exception is when you have happened to know the address owner you can person message them for a refund to you address but, sorry to say you can restore them as they are already missing. Sorry for your experience and in cryptospace security should be your utmost priority to survive.

[Samlucky O]

Not a Bitcoin Core user and never has this experience.

To my knowledge if someone have compromised your wallet, didn't they can just spent all the coins you have now? so I think your computer is the problem. Why you not try to use other device and input the seed phrase, I think as long as it never connected with your computer, the device should be safe.

Exactly that was what I was also thinking. If it was hacked or compromised, the total amount would have been swept up by now. because no body will see such amount without withdrawing it. I guess there where extra charges from the transaction he made just as Faisal2202 has explained.

[Saint-loup]

Thank you,
What you say makes me think hard,
So I switched hard disks to nvme2 since they are much faster, I copied everything from old HDD to new, thinking all wallet.dat are basically my seed, I deleted everything that contained wallet.dar with chain state from older Bitcoin core clients that weren't even installed, to speed up the process.

Now, this is the part I don't understand and never taught off, the change addresses , so basically you have to use your latest wallet.dat , or the one you used last time or part of your funds will be gone basically since Bt core generated random addresses from your original seed that contain these unique change addresses and your original address is sum of all your change addresses ?

So I made 4 transactions this year, last time I wasn't even paying attention to what btcore I use since I didn't delete it I guess, and everything showed fine since all the change addresses were contained in that recent wallet.dat?

And now that I installed newest btcore client and imported the deer I found from 2022 they don't contain my change addresses so I'm shown the Ballance without them ?

So I need to use the latest seed to have those change addresses included as mine ..

My key question is, is this process broadcaster to the chain so my main address is the owner and the value of my wallet is the one including the change ?

Because the first thing I did was to run to a Blockchain explorer and enter my BTC adresa to see if the low value of my wallet is real, and it showed the low value not the good one which is around 0.1. I know this value because I strived always to have 10% of 1 magical Btc and again I never cashed out of crypto, through all the freaking crashes and ppl laughing at me, and now this. I'm heartbrokren and frustrated not knowing what happend , I was always prepared to lose crypto even I I fully believed in it  but not like this. I'm usually the guy that tells others to be paranoid about security.

What I think now of doing

Get my old laptop

Format it

Install unregistered win 10 from Microsoft

Install latest Bitcoin core wallet

Searching and finding all my wallets sorted by dates

Start importing each chronologically from new to old

Find the latest BTC core software I used and recover that wallet also.

Since you're using BTC since 2016 from what you've said in the OP, there are odds that for some reasons, you were still using an old version of Bitcoin Core or of its addresses management feature at least. That is to say a non Hierarchical Deterministic scheme. I'm not a Bitcoin Core specialist but maybe you've created your initial wallet.dat with a non HD version of Bitcoin Core and because of that, you've no HD seed into your wallet.dat and Bitcoin Core is unable to recalculate your change addresses not included(saved/written) in your wallet.dat.
Or maybe it is a single address/private key that you've imported and you didn't save the wallet.dat after your transactions or you've lost the right file.

[FatFork]

I'm heartbrokren and frustrated not knowing what happend , I was always prepared to lose crypto even I I fully believed in it  but not like this. I'm usually the guy that tells others to be paranoid about security.

I get the feeling you're a bit muddled on how Bitcoin wallets actually work.  You're mixing up terms and saying things that don't make much sense.  All wallets nowadays generate multiple public addresses spawned from one original seed and  this covers change addresses too.  So there's no master address or single address that represents your entire wallet.  Unless you imported the wallet using a private key - that wallet would have only one public address (well actually three, depending on the script type, but I won't get into that). 

I strongly recommend you ask someone with more expertise for assistance if you dont wanna risk losing your money forever with amateur moves.

[dzungmobile]

I get the feeling you're a bit muddled on how Bitcoin wallets actually work.  You're mixing up terms and saying things that don't make much sense.  All wallets nowadays generate multiple public addresses spawned from one original seed and  this covers change addresses too.  So there's no master address or single address that represents your entire wallet.

In the past, with earliest Bitcoin wallet softwares, there was no Deterministic wallets or Hierarchical Deterministic (HD) wallets.

Bitcoin wallets chapter in Mastering Bitcoin book is a good educational resource to learn about wallet development history.

Nowadays, we are mainly using Hierarchical Deterministic wallets that give us a Wallet seed, from which wallet software creates Master key, Child keys, Grandchild keys and so on, then different addresses for using.

We can recover each public address by a corresponding private key but we can recover a whole wallet with a wallet seed.

[rockk]

so i found the folders i used , the bitcoin core , i have like 3

https://gyazo.com/f6e0d93ab3b3c34222bbd9cde81ecbb1


i found wallet from 2024 in a folder, from january or february, can i mess up something by using older wallets? i dont know how to proceed. should i install latest bt core client and latest wallet.dat i had before friday when i noticed the issue with the missing value of my wallet?

im not sure i used this one, but one of these in one of the folders, since i tought using bt core clients is not important.  

i never reinstalled wallets, since i changed hdd i tought best is to install clean latest wallet.

 i did not start bitcoin core wallet , i mean i started it friday but never let it finish, i started electrum wallet, then got horrified and did not start any since.

[Smartvirus]

I have had to follow up this thread as it goes, replies and your posts in between and I can picture what as distressed situation you might be in, finding out that your transactions aren’t adding up and each time you have to initiate a transaction, a couple more is been sent out.

This is hardly any case of a hack as, it always begins with you. Should jacking have been the case, of course it would t wait on you to initiate a transaction and your wallet would be empty in minutes for sure.

It’s all a mixup and you really should calm yourself and go through it step by step. Getting this and that file could just complicate the whole thing for you as, am having to see a lot of files you’ve generated already.

What I don’t understand is, change addresses are supposed to balance up your wallet with your deducted balance from what have been sent out. How is yours not the same and instead, you’re having different values…?
Is there an automated command on your wallet like, having to pay several addresses at a time, I just don’t get it.

[FatFork]

yeah well that s why i m here, like i ve said i didnt keep up with wallet updates, i know the principle, i had no idea about generating multiple adresses, i knew my adress, where i received some btc from some people, and i used bt core always to buy somt, since 2022 untill 2024 i didnt buy or do anything.

Your wallet generated multiple addresses well before this year. For example, take a look at this transaction: https://blockchair.com/bitcoin/transaction/e97619487f0319c8b199ff18300a6baf264cb3ad619f2879419d80c353b2f3a2. It uses a total of four inputs. Three from the address 1CC...ydo and one from the address 1BZ...UVz. This was back in 2022.

then this year i bought 4 games or so, when i closed the bt core , amount was right, i always check amount of wallet, because i never trust anything

yesterday i wanted to buy something, because it allowed only crypto, and since i had to resync all bt core wallet, since 2008 would ve took 12 hours ,

So, there's a bit of a problem with your story. If you were using the wallet for payments earlier this year, why did you have to resync the Core wallet all the way back to 2008 yesterday? That doesn't add up.

so i installed electrum, once i installed electrum (downloaded from their official site electrum.org),  i entered my pass for default adress,

This part is really confusing. Importing a wallet from BT Core to Electrum isn't as simple as just entering a password. Plus, the password you use to unlock your BT Core wallet doesn't matter in Electrum, because they use completely different storage methods.

and shock and horror i had not even half of my btc (around 0.1 now only 0.039) so i checked blockchair of my adress , main adress i always used terminating in ydo and horror it was only 0.039.

Checking just one address on the blockchain explorer won't show you the full balance of your wallet. You need to look at all the addresses that belong to your wallet, not just one.

i did not start bitcoin core wallet , i mean i started it friday but never let it finish, i started electrum wallet, then got horrified and did not start any since.

It sounds like you couldn't even see your wallet balance in BT Core at all. All you did was try to import your wallet into Electrum and check a single address on the Blockchain explorer, right?  All things considered, your funds seem to be safe. You just don't know how to access them. Can you at least try to run BT Core and tell us what happens when you try to open your wallet?

[rockk]

I have had to follow up this thread as it goes, replies and your posts in between and I can picture what as distressed situation you might be in, finding out that your transactions aren’t adding up and each time you have to initiate a transaction, a couple more is been sent out.

This is hardly any case of a hack as, it always begins with you. Should jacking have been the case, of course it would t wait on you to initiate a transaction and your wallet would be empty in minutes for sure.

It’s all a mixup and you really should calm yourself and go through it step by step. Getting this and that file could just complicate the whole thing for you as, am having to see a lot of files you’ve generated already.

What I don’t understand is, change addresses are supposed to balance up your wallet with your deducted balance from what have been sent out. How is yours not the same and instead, you’re having different values…?
Is there an automated command on your wallet like, having to pay several addresses at a time, I just don’t get it.

I never used such command, I usually had issue syncing or calculating fees , that's why I tried to use different btcore wallets.

Since 2017 I stopped changing coins for ants, etc, I also mind, I was very familiar with things involving crypto, but after that craze I settled down and never wanted to touch it for a long long time.

I simply started the wallet, and my balance was there, tbh I don't even recall importing the wallet in btcore.

I think I had electrum installed long ago and the default wallet was in the roaming folder that's why it simply needed my password to load my wallet, first I even thought it's another address I forgot some BTC .

Then I checked the address I used to receive BTC and horror story began.
This was Friday.

And again every damned time I closed the Bt core client I was checking the total sum how much I have leftz there is no way I wouldn't notice a difference of .1 in fevruary or March

I even had used first time replace by fee in January cuz I had one of the 50 USD paymfnts stuck for a game I bought so I rebroadcasted it using a higher fee, so I was checking all the time the amount .

So , what I want to say if the Bitcoin core client would've sent  that big amounts I would be had noticed. It's in my nature. Habit.

I will bite the bullet and let the latest btcore I installed sync. I guess. My Pc is clean . Rescanned all drives many times .

[FatFork]

I will bite the bullet and let the latest btcore I installed sync. I guess. My Pc is clean . Rescanned all drives many times .

Or you can simply import your private keys from the BT Core wallet into Electrum, and continue from there. But this time make sure that you have imported all the addresses from the old wallet, because it seems that you missed doing it the first time and you probably imported only one single address.

[khaled0111]

My assumption is you have created your wallet with a bitcoin version that doesn’t support segwit (that makes sense since your first transaction dates back to 2017) then you updated core to a newer version that supports segwit. This can explain why some of your transactions have both segwit and legacy inputs.
However, this doesn’t answer how you managed to open your bc wallet with Electrum! Are you sure you didn’t dump your wallet’s PKs and then youimported them into electrum?

What I suggest doing right now is to let bitcoin core finish syncing and see if it will show your entire balance.

[rockk]

ok, so i finished syncronizing my bitcoin core freshly installed wallet , since then, i guess it took 2 days,

here is what happend:
1. my final balance is normal, around 0.1 thank God!

2. i tought for some reason my receiving adress is my wallet , so checking the receiving adress i saw only limited amount

3. the bitcoin wallet seem to be sending to your change adresses amounts of bitcoin even if you dont do anything, i have transactions of -0.01 and right after +0.01 and so on , so i guess bitcoin core wallet constantly sends amounts to your change adress, i dont understand this exactly, but i don`t care tbh

4. my mistake was using electrum wallet (installing it, and having some old electrum wallet by default in it thinking is the same as the bt core wallet , i had no idea that the wallet has many adresses not just one (somehow i never heard of it )

 I want to thank every one of you that replied to this post, your words offered my confort , because i had to be away for few days then and i had no access to my pc, i felt violated and stupid , and buffled to have been robbed, especially since i am very paranoic when it comes to security and i also worked in cybersecurity, and i felt like a total idiot tbh. I also have a daughter, so i felt like i lost her money , since all i work for is for her future , so hers, so i felt even worse (and i had to attend a wedding and pretend all is fine, to my wife and her family )

so i had a nightmarish weekend because of this, but i knew best thing to do is not touch anything in such cases.

again, thank you all you all helped more then you ll ever know. <3

i guess the topic can be deleted, ty

[tvplus006]

...i guess the topic can be deleted, ty

Such topics should not be deleted, it is possible that someone has also encountered a similar problem and will be able to find an answer to their question here. You should lock the topic yourself, to do this you need to click the "Lock topic" button, which you can find in the lower left corner of the page.

[dzungmobile]

However, this doesn’t answer how you managed to open your bc wallet with Electrum! Are you sure you didn’t dump your wallet’s PKs and then youimported them into electrum?

In Electrum wallet, you can import private keys to get different public addresses. This wallet software disabled Legacy address creation with user interface but you can do it with Import, using following codes

Code:

p2pkh:private_key
p2wpkh-p2sh:private_key
p2wpkh:private_key

p2pkh for Legacy address
p2wpkh-p2sh for Segwit address
p2wpkh for Native Segwit address

Types of Bitcoin address

[Woodie]

If really someone had access to your wallet, I think they would have wiped out your wallet dry...and just for the sake of getting to the bottom of this, counter check with the addresses shared/linked to your wallet incase you have invoices that came through to your email address and paid off.. Sometimes we might tend to forget these things as it's part of being human, but just incase do check, good luck.