In need of help, got some of my btc stolen?

[rockk]

I rarely use btc to pay for anything, my pc is as private as possible, i am a long term holder, and something weird happend to me.
So this start of the year i bought using plisio some games, each 60 or so usd each, so i sent using bitcoin core wallet to the adress they gave me all was fine, i am also positive i checked my balance before closing btc core and all showed fine as it should be around 0.1 or so btc.
But today after half a month , it seems more then half is missing, so i checked the transactions and it makes no sense:

it seems everytime i sent the correct value to the correct adress, another transaction was also made with a much higher value? i don`t get it


here is my transactions and some pics from electrum


i dont understand how this happend, i m almost sure i dont have viruses and such since i use eset and malwarebytes, also router fw,i used btc since 2016...
i am baffled, please help.

also i checked one of the adresses the higher amounts were sent, they seem there unspent no transactions, nothing.

i reinstalled core wallet since i changed hdd , maybe its an older wallet and those are changes? i dont know anymore what to think, ty

last time i used btc was in april if i recall right

[Faisal2202]

I think you were not aware of the white label transaction fee, which is according to them is 1.5%, but I checked the reviews on different sites, and a person mentioned Plisio charged a 15% transaction fee aside from the cost you were paying, which means on 60 dollars you were paying 0.9 dollars (if the rate was 1.5%), and if the commission they were taking was 15%, then you were paying 9 dollars extra on your 60$ purchase + the transaction fee, and maybe there will be extra charges hidden from you. (source)

You must inquire with Plisio about it they might give you some details on the matter. Although I think for personal use they are cost-free, for business, they cost 0.5% commission. The rates are different everywhere, and only then can they sort the matter out for you, although I heard they have bad customer care too.

The transaction details show you sent another $600  while paying for your games. Here is the extra $600 you sent to the following address at the the following dates:

bc1qj4pjyc0m7d882kar9ry59hvc034d5fc9rw30wg 2024-03-24 21:21:33
bc1qn6q4kx2945ujx2dh4yztl7pcf62jwtl5gq79sp 2024-07-21 18:49:20
bc1qfm70pn6c2kljtzxcy4acrmkvuf7md4yjz0cqtg 2024-02-10 08:00:39

You were sure the balance was right I mean, it should not be right you were sending an extra $600 on every purchase. And in the photos you attached the sent balance is 0.011 while for 60 dollar purchase, it should be around 0.001 BTC.

[rockk]

I think you were not aware of the white label transaction fee, which is according to them is 1.5%, but I checked the reviews on different sites, and a person mentioned Plisio charged a 15% transaction fee aside from the cost you were paying, which means on 60 dollars you were paying 0.9 dollars (if the rate was 1.5%), and if the commission they were taking was 15%, then you were paying 9 dollars extra on your 60$ purchase + the transaction fee, and maybe there will be extra charges hidden from you. (source)

You must inquire with Plisio about it they might give you some details on the matter. Although I think for personal use they are cost-free, for business, they cost 0.5% commission. The rates are different everywhere, and only then can they sort the matter out for you, although I heard they have bad customer care too.

The transaction details show you sent another $600  while paying for your games. Here is the extra $600 you sent to the following address at the the following dates:

bc1qj4pjyc0m7d882kar9ry59hvc034d5fc9rw30wg 2024-03-24 21:21:33
bc1qn6q4kx2945ujx2dh4yztl7pcf62jwtl5gq79sp 2024-07-21 18:49:20
bc1qfm70pn6c2kljtzxcy4acrmkvuf7md4yjz0cqtg 2024-02-10 08:00:39

You were sure the balance was right I mean, it should not be right you were sending an extra $600 on every purchase. And in the photos you attached the sent balance is 0.011 while for 60 dollar purchase, it should be around 0.001 BTC.

The thing is I never sent 600, I check the amount u send 3 times in my browser on exchanges so I don't mess up the zeros, so im100% sure I never sent them or anyone hundreads of dollars.  Or the 1300.
The address of plissio is the same, the one with 60 or 70 USD.

Also my wallet is encrypted, so when the window pops up I am 100% sure I only send 1 transaction, not 2 at the same time to 2 different addresses, I don't even know how to do that

Thus us the plissio address bc1qw40vpr90585k0t4v46jj097p8e0mfayux26clt

I never sent anything else to anyone or anything this year.
I also uninstall the Bt core wallet and I don't use other wallets

Maybe the btcore wallet was compromised ?

I know i t night seem a small amount but it's 5 salaries I invested through time and put aside...so for me it's a tragedy
Ty for your help, also if anyone can help me to exactly find the issue and so I can understand , would gladly pay for their time if I can. I literally can't sleep and I think of this

[Russlenat]

I use mempool for my convenience checking your account.
https://mempool.space/address/1CChv6qepeypQYwkFshUKQ3RMcG5bPAydo

I use Mempool to easily check your account.

Let’s get to the most important part and summarize the figures based on your wallet history.

You’ve received a total of 0.56780229 BTC, and your remaining balance is now 0.03291220 BTC. That means you’ve spent or withdrawn 0.53489009 BTC from your wallet. You’ve had a total of 70 transactions (deposits/withdrawals), so it should be pretty easy to track if something is missing. With just 70 transactions, you can trace them all to see if everything adds up.

If the numbers don’t match, it’s possible that your PC has been compromised. You should take immediate steps to secure the remaining balance.

[rockk]

I use mempool for my convenience checking your account.
https://mempool.space/address/1CChv6qepeypQYwkFshUKQ3RMcG5bPAydo

I use Mempool to easily check your account.

Let’s get to the most important part and summarize the figures based on your wallet history.

You’ve received a total of 0.56780229 BTC, and your remaining balance is now 0.03291220 BTC. That means you’ve spent or withdrawn 0.53489009 BTC from your wallet. You’ve had a total of 70 transactions (deposits/withdrawals), so it should be pretty easy to track if something is missing. With just 70 transactions, you can trace them all to see if everything adds up.

If the numbers don’t match, it’s possible that your PC has been compromised. You should take immediate steps to secure the remaining balance.

But if you look it's always sent an additional big transaction only and at the same time as I be sent the real transaction amount .
Can my wallet file itself be compromised itself?
It doesn't make sense ..

[Solosanz]

Not a Bitcoin Core user and never has this experience.

To my knowledge if someone have compromised your wallet, didn't they can just spent all the coins you have now? so I think your computer is the problem. Why you not try to use other device and input the seed phrase, I think as long as it never connected with your computer, the device should be safe.

maybe its an older wallet and those are changes?

Other people would experience the same thing like you if Bitcoin Core was the problem, AFAIK there were no complaints.

[joniboini]

But if you look it's always sent an additional big transaction only and at the same time as I be sent the real transaction amount .

Another possibility I can think of is that you used a fake wallet to send your transaction, so they modify the transaction output but show the wrong details to trick you. Did you verify the files before you installed the app? Have you tried to open your wallet on a new device that is free from malware etc as mentioned above? I'm sure your PC was compromised, no update made Bitcoin Core or Electrum spend that much to a change address, especially one that your wallet doesn't control. I'd try to reinstall/format before I use it again. CMIIW.

[tvplus006]

it seems everytime i sent the correct value to the correct adress, another transaction was also made with a much higher value? i don`t get it

You have nothing to worry about, since the second address to which a large amount is being sent is the change address that you own. Since you are using Electrum, you need to go to the "address" section and there you will see all the addresses where your coins are returned.

[FatFork]

I also uninstall the Bt core wallet and I don't use other wallets

But you're showing us screenshots from the Electrum wallet?

Maybe the btcore wallet was compromised ?

This is very unlikely since you said your wallet file is encrypted and since the wallet wasn't emptied in one go.

[SFR10]

i reinstalled core wallet since i changed hdd , maybe its an older wallet and those are changes?

I also uninstall the Bt core wallet and I don't use other wallets

In addition to what the previous two users mentioned earlier about you using the Electrum wallet, you can go to the console tab on Electrum to check if those change addresses belong to you or not:
^{- I haven't used Bitcoin Core for a very long time but IIRC, there was a workaround in its coin control feature to force your main address to be the change address instead (it's not recommended)!}

• ismine("COPY YOUR ADDRESS HERE") > Click enter > If it shows True, it belongs to you.

[Maslate]

Try to look at the transactions here.

https://www.walletexplorer.com/wallet/580dd5a8a86b3ce4?from_address=1CChv6qepeypQYwkFshUKQ3RMcG5bPAydo

If you're convinced that some of your bitcoins were stolen or there are transactions you didn’t make, just save what’s left. Reformat your computer or create a new wallet to transfer your remaining balance. It’s tough to speculate, but whatever shows up in the transaction ledger is what’s really happening.

[tvplus006]

it seems everytime i sent the correct value to the correct adress, another transaction was also made with a much higher value? i don`t get it

You have nothing to worry about, since the second address to which a large amount is being sent is the change address that you own. Since you are using Electrum, you need to go to the "address" section and there you will see all the addresses where your coins are returned.

If we assume that the second address to receive is not a change address, then in this case the loss of the OP would not amount to $600, but many times more, since it was debited every time a transaction was made. But the OP does not write that he lost several thousand dollars.

[rockk]

it seems everytime i sent the correct value to the correct adress, another transaction was also made with a much higher value? i don`t get it

You have nothing to worry about, since the second address to which a large amount is being sent is the change address that you own. Since you are using Electrum, you need to go to the "address" section and there you will see all the addresses where your coins are returned.

If we assume that the second address to receive is not a change address, then in this case the loss of the OP would not amount to $600, but many times more, since it was debited every time a transaction was made. But the OP does not write that he lost several thousand dollars.

I used electrum because I wanted to make a quick purchase using BTC and as I ce said I don't keep any BTC client installed, I'm paranoic regarding security.
I have eset firewall, router firewall no ports open and Malwarebytes. So when I saw in electrum wallet 0.039 I panicked and started looking up.

For the transactions I used an older version of by core wallet because I had issues syncing it.

I lost every time a  transaction I made , and it's always the plissio address plus another one. But in my wallet I'm 100% positive it did not show, since I never had lower then 0.,09 or smt similar and you can see I always sent correct amount to plissio BTC adresa ending in lt


The addresses with the high amount have no transactions and are not emptied, that's why I was thinking maybe is the change address somehow? But then why is blockchair showing my balance as 0.039 instead of aprox 0.1…?

My BT core waller I closed since and did not get se it at all thinking I don't want to risk again losing something while doing a transaction.

My wallet has around 310 kb is that normal size? My 2017 wallet had like 90 kb. I keep many versions of my wallet, I loaded the 2022 wallet now, thinking all wallets are the same and it doesn't matter

[Saint-loup]

There are 70 transactions related to this address since 2017, so it would be more easy to understand the issue if you'd post the ids or the links of the suspicious transactions instead. Anyway I guess you are referring to the last ones, well if the other addresses than the recipient address (bc1qw40vpr90585k0t4v46jj097p8e0mfayux26clt as I understand) are not change addresses, don't belong to your wallet and you've not entered them yourslef when making your sending transactions as Pay to Many adresses, then your wallet is necessarily corrupted or is a malicious version of Electrum.  

But then why is blockchair showing my balance as 0.039 instead of aprox 0.1…?

What do you mean bro? You've checked the extended public key (xpub key) of your wallet within blockchair, that's what you mean? Please bro try to be a bit clearer and more precise in your explanations. If yes, it is what it is. But fortunately it wouldn't be a so big loss up to now.

Edit: I see you've used Bitcoin Core   What do you mean bro? You can't import the HD seed of a Bitcoin Core wallet into Electrum neither into most wallet AFAIK so what have you done precisely? You've just imported the private key of this address(1CChv6qepeypQYwkFshUKQ3RMcG5bPAydo)? If yes Electrum won't be able to know what are the change addresses related to your initial Bitcoin Core wallet belonging to this address. You need to check that into Bitcoin Core.

[BitMaxz]

If you are using a pirated OS that you just downloaded from a random source even if you have eset and Malwarebytes in your PC we are not sure that your PC is not compromised if I am right and you are using pirated OS then that's not safe you are actually giving access someone to your PC remotely if you are using those OS came from random sources.

If you have a backup wallet the only solution that I could recommend is to install a fresh OS Linux is the best option if you want to stay using Windows then make sure that you download Windows directly from Microsoft and don't use any pirated OS that comes from a random source.

[SFR10]

But then why is blockchair showing my balance as 0.039 instead of aprox 0.1…?

I strongly believe this is just a big misunderstanding... When you copy and paste a certain address into any explorer, the amount it shows is not the collective worth of your whole wallet ^{[what you see is just for that specific individual address]}!
_{- BTW, it's actually 0.0329122BTC.}

[rockk]

There are 70 transactions related to this address since 2017, so it would be more easy to understand the issue if you'd post the ids or the links of the suspicious transactions instead. Anyway I guess you are referring to the last ones, well if the other addresses than the recipient address (bc1qw40vpr90585k0t4v46jj097p8e0mfayux26clt as I understand) are not change addresses, don't belong to your wallet and you've not entered them yourslef when making your sending transactions as Pay to Many adresses, then your wallet is necessarily corrupted or is a malicious version of Electrum.  

But then why is blockchair showing my balance as 0.039 instead of aprox 0.1…?

What do you mean bro? You've checked the extended public key (xpub key) of your wallet within blockchair, that's what you mean? Please bro try to be a bit clearer and more precise in your explanations. If yes, it is what it is. But fortunately it wouldn't be a so big loss up to now.

Edit: I see you've used Bitcoin Core   What do you mean bro? You can't import the HD seed of a Bitcoin Core wallet into Electrum neither into most wallet AFAIK so what have you done precisely? You've just imported the private key of this address(1CChv6qepeypQYwkFshUKQ3RMcG5bPAydo)? If yes Electrum won't be able to know what are the change addresses related to your initial Bitcoin Core wallet belonging to this address. You need to check that into Bitcoin Core.

Only 2024 , 4 transactions.
bc1qw40vpr90585k0t4v46jj097p8e0mfayux26clt
This is the legit address .
The rest I don't know what they are.

I use original is not pirsted. I am a tech savvy person I'm 45, I love everything related to PC, I program also, that is why I am baffled how can this happen .

The only thing I can think of is maybe I downloaded a corrupted BTC core wallet but Im not a full to enter weird websites also eset would block the install or opening the exe or mb.

I never used electrum to make transactions, I always use but core since I'm familiar with that one being so old.

So can a fake Bitcoin core wallet behave in such way, to send the normal amount to the address you want and sent another random looking like amount to a different address once I wrote my pass to confirm sending it? Then show ín the wallet the original BTC amount minus the real transaction amount and not the fake amount treansacted ?

Seems pretty complex to behave in such a way.

I did t get how changes work tho but I will verify the addresses. I'm am very sad.

[khaled0111]

So can a fake Bitcoin core wallet behave in such way, to send the normal amount to the address you want and sent another random looking like amount to a different address once I wrote my pass to confirm sending it? Then show ín the wallet the original BTC amount minus the real transaction amount and not the fake amount treansacted ?

If you have downloaded a fake wallet or you wallet has been exposed then the attacker would have stolen all your coins not just part of it. Why didn’t he do that if he has full access to your wallet? This doesn’t make sense to me!

I did t get how changes work tho but I will verify the addresses. I'm am very sad.

What’s weird is that your wallet is a legacy wallet as the sending addresses start with "1" but what are supposed to be your change addresses are segwit addresses! So they can’t be your wallet change addresses.

How did you import your bitcoin core wallet into Electrum?

[rockk]

So can a fake Bitcoin core wallet behave in such way, to send the normal amount to the address you want and sent another random looking like amount to a different address once I wrote my pass to confirm sending it? Then show ín the wallet the original BTC amount minus the real transaction amount and not the fake amount treansacted ?

If you have downloaded a fake wallet or you wallet has been exposed then the attacker would have stolen all your coins not just part of it. Why didn’t he do that if he has full access to your wallet? This doesn’t make sense to me!

I did t get how changes work tho but I will verify the addresses. I'm am very sad.

What’s weird is that your wallet is a legacy wallet as the sending addresses start with "1" but what are supposed to be your change addresses are segwit addresses! So they can’t be your wallet change addresses.

How did you import your bitcoin core wallet into Electrum?

Exactly my point.

I just installed yesterday electrum and there was a default wallet, and asked me the password so I did and showed me my transactions of my BTC wallet.
I think I installed it some years ago maybe and the default wallet remained in my roaming folder I guess.
Btw I downloaded it from official electrum website . Then it showed me my balance and couldn't believe my eyes .

I never used electrum wallet for transactions tho. That I'm sure off.

[PX-Z]

it seems everytime i sent the correct value to the correct adress, another transaction was also made with a much higher value? i don`t get it

Is it really a transaction? It looks like change address to me based on your screenshots if you are talking the amount and another address in the output in electrum.

Tell us if your wallet balance keep depleting in large amount when you send small transactions? If yes, you are infected with malware regardless if you have two or more AV, so most recommended way is reset your device.