My electrum wallet was compromised

[khbinversion]

Yesterday I discovered that my Electrum wallet had been emptied.
I never shared my keys or seed phrases, my antivirus didn't detect any viruses or malware, and I always updated my wallet through the official Electrum website. Despite all this, my wallet was emptied. Can anyone explain how they did it? Can I recover my coins? I'm very worried that Electrum's security has been compromised.

[OmegaStarScream]

When was it emptied, when was it installed/last updated? Can you share the txids or adresses?

You must've done something at some point that resulted into this. Electrum doesn't have a server where they store user data, everything about your wallet is stored in your computer and your computer alone.

[khbinversion]

I updated my wallet from the official website over three months ago, and on Sunday, January 18th, someone accessed it and made a transaction. Yesterday, Sunday the 25th, I logged into my wallet and found my balance was zero. Is there any way to recover the funds or report the theft?

[Charles-Tim]

I updated my wallet from the official website over three months ago, and on Sunday, January 18th, someone accessed it and made a transaction. Yesterday, Sunday the 25th, I logged into my wallet and found my balance was zero. Is there any way to recover the funds or report the theft?

Can you share the transaction ID (txid)? This can let us know if it is sent to an an exchange address or not. If it is sent to a noncustodial wallet you can not recover it. Maybe there is still little chance that you can recover it, especially if the money is of high amount and sent to an exchange that request for KYC.

Sorry about the loss.

Know that people around you can also be the one, everything is not only about online. I am not implying that it may not be online but both offline and online attack must be considered.

[OmegaStarScream]

I updated my wallet from the official website over three months ago, and on Sunday, January 18th, someone accessed it and made a transaction. Yesterday, Sunday the 25th, I logged into my wallet and found my balance was zero. Is there any way to recover the funds or report the theft?

Probably not much you can do about it since the transaction is confirmed already. As for reporting it to the authorities, it really depends. I would try and see if the hacker ever sent the funds to a  CEX using Arkham Intelligence: https://intel.arkm.com/ If he did, best to report him as it might help you identity him if the CEX has KYC (most of them do).

[khbinversion]

Can you share the transaction ID (txid)? This can let us know if it is sent to an an exchange address or not. If it is sent to a noncustodial wallet you can not recover it. Maybe there is still little chance that you can recover it, especially if the money is of high amount and sent to an exchange that request for KYC.

Sorry about the loss.


Yes, I'm sending the transaction ID.


TransactionID:

09049a6d636459450583a07aef71ce427f69a6e72fc83b1e9bd81da428292ba1

[OmegaStarScream]

TransactionID:

09049a6d636459450583a07aef71ce427f69a6e72fc83b1e9bd81da428292ba1

It's not a valid txid. Couldn't find it in different block explorers. Could you double check it (in case you're not sure how to do it: right click the transaction and then click copy)? Or simply post the hacker's address or one of your addresses that had funds

[Ruttoshi]

I updated my wallet from the official website over three months ago, and on Sunday, January 18th, someone accessed it and made a transaction. Yesterday, Sunday the 25th, I logged into my wallet and found my balance was zero. Is there any way to recover the funds or report the theft?

I updated my wallet from the official website over three months ago, and on Sunday, January 18th, someone accessed it and made a transaction. Yesterday, Sunday the 25th, I logged into my wallet and found my balance was zero. Is there any way to recover the funds or report the theft?

Who was that someone, do you have any idea of who made the transaction. That was when you should have created a new electrum wallet and transfer your funds into the new wallet because you got the signal that your wallet has been compromised on the 18th.

My guess is that someone close to you got access to your wallet which was why he transfered part of the money first before clearing your wallet after one week because if it's a stranger, he will clear the wallet once.

Sorry for your loss. If the funds is sent to an exchange, you might be lucky to get it back.

[Yamane_Keto]

I updated my wallet from the official website over three months ago, and on Sunday, January 18th, someone accessed it and made a transaction. Yesterday, Sunday the 25th, I logged into my wallet and found my balance was zero. Is there any way to recover the funds or report the theft?

Have you downloaded any programs recently? Antivirus scans alone are not sufficient.
Has anyone else accessed your computer—a friend, relative, or colleague?

Whatever the reason, it's either a problem with your computer, in which case it's best to format your device and change your password, or you've shared your seeds

[hosemary]

Any online device is always prune to hacking.
Note that you can't make sure your wallet is 100% safe, just because you have download the application from the official website and yoh hve antivirus installed on your computer.

If you want your wallet to be completely secure, you should go for a cold storage.

[khbinversion]

The transaction was made on Sunday, January 18th, and my balance was 0.24314381 BTC.

I send

transaction data and tracking of the wallet that was stolen from me.

https://www.blockchain.com/explorer/addresses/btc/bc1q8pjaumzy65mvra7nqsn35dmswl8ayk3st9nwyc

Here's the link to the wallet that withdrew the funds... can you please confirm if it's an exchange wallet?


Bitcoin Transaction
Broadcasted on 18 Jan 2026 07:22:16 GMT-3
Hash ID
6a4048b6e3d9bbc92d639a51048c7d1e4ef99ddcc9968f8cdac859f826415693

[OmegaStarScream]

The transaction was made on Sunday, January 18th, and my balance was 0.24314381 BTC.

I send

transaction data and tracking of the wallet that was stolen from me.

https://www.blockchain.com/explorer/addresses/btc/bc1q8pjaumzy65mvra7nqsn35dmswl8ayk3st9nwyc

Here's the link to the wallet that withdrew the funds... can you please confirm if it's an exchange wallet?

https://intel.arkm.com/explorer/address/bc1q8pjaumzy65mvra7nqsn35dmswl8ayk3st9nwyc



So if I'm reading this correctly, it looks like previous to stealing your funds, the address has withdrawn some funds from HitBTC (an exchange). The exchange used to have a page to check the current KYC limits, etc. but right now, I cannot find any, I mean there are multiple ones, but most of them seem outdated. So I'm not sure if they do require KYC (mandatory) or they're still operating as before (allow users to be unverified, but can only withdraw up to a certain limit per day).

And after stealing your funds, the user has used Fixedfloat (ff.io) to swap the funds (to something else). ff is an instant exchange, and do not request KYC documents unless they detect something suspicious.

EDIT:
Please refer to LoyceV's post: https://bitcointalk.org/index.php?topic=5572637.msg66343721#msg66343721
As well as nc50lc's: https://bitcointalk.org/index.php?topic=5572637.msg66339576#msg66339576

I'm not sure where you're from, but if you think law enforcement would pursue this, I would take the chance to report it to them. They can contact HitBTC and FixedFloat on your behalf and they should get proper answers since they are required to.

The adress still has most of the funds, so it might be worth to bookmark the link and keep checking it occasionally. Hopefully he does a mistake and send it to something like Binance or Bybit where you know for sure he's KYCed.

I would keep my expectations low though, because even if you find his identity... it's not guaranteed that you would get your money back especially if you're not from the same country/region.

[khbinversion]

Thanks... I'm from Argentina.

I already sent an email to Fixed Float; they have a specific one for help with crimes.
Let's see if they reply. I'll also contact HitBTC.
Thank you very much for your help.

[BlackHatCoiner]

Did you use a password to encrypt the wallet in Electrum? A password, not a passphrase (which is the 13th or 25th word of a seed phrase). If you didn't encrypt the wallet file using a password, then any third party software could have got access to the wallet via the file system. Many programs get that access from Windows, and it certainly goes undetected by antivirus software. 

It's not impossible to compromise an encrypted wallet on an Internet connected computer, but it's orders of magnitude more difficult in terms of the permissions it'd require.

[Stalker22]

Thanks... I'm from Argentina.

I already sent an email to Fixed Float; they have a specific one for help with crimes.
Let's see if they reply. I'll also contact HitBTC.
Thank you very much for your help.

Doubt you will achieve much on your own.  There are certain procedures to follow in situations like this, and simply "sending an email" to the exchange will not be enough.

Exchanges are businesses, not police departments.  They are not going to freeze funds or hand over private user data just because you emailed them claiming a crime happened.  Without an official police request or a court order, they will likely give you a templated "we are looking into it" response and do absolutely nothing.  you need to report this to the local authorities first.  Exchanges typically only react when a law enforcement agency contacts their legal department directly.

[khbinversion]

Thank you so much for your help. I've already filed a police report with IC3, which is part of the FBI in the US.
I hope you can help me. Thank you.

[khaled0111]

Thank you so much for your help. I've already filed a police report with IC3, which is part of the FBI in the US.
I hope you can help me. Thank you.

If I’m understanding OSS analysis correctly, then in your case, it would be better to contact HitBtc and see if they can help you (it would be better if they receive an official request from the authorities). As OSS said, FixedFloat doesn’t require kyc, so there is little chance they can help you identify the hacker.
Good to know that you filed a polie report as this is the best thing to do. For the moment, you need to figure out how this hacker got access to your wallet to prevent any further losses.

[DireWolfM14]

Retrieving the funds is one thing, but if you want to prevent it from happening again you need to figure out how this happened in the first place.

[nc50lc]

And after stealing your funds, the user has used Fixedfloat (ff.io) to swap the funds (to something else).

It looks more like another victim's funds going to the hacker's address through FF (prob an exchanged Altcoin) instead of OP's funds because its UTXO (6a4048b6:0) is currently still unspent.

TransactionID:

09049a6d636459450583a07aef71ce427f69a6e72fc83b1e9bd81da428292ba1

It's a mystery where you get this invalid TXID, is there a chance that you've copied this somewhere in your transaction history?
Providing a link to a screenshot of your history tab should help.

Also, you've only mentioned that you downloaded Electrum from the "official website" without telling the URL of that official website.

[mindrust]

Retrieving the funds is one thing, but if you want to prevent it from happening again you need to figure out how this happened in the first place.

This smells like a fake electrum update and OP says he always did updated from electrum’s own website. I have been using electrum for more than a decade and I never did any updates after the initial download till I move to a new pc or os and redownload the wallet. Never got hacked once.

For some reason, whenever I hear an electrum user got hacked, it is always about the updates. The OP mentioned doing updates specifically and that makes me think he did a lot of updates. This is just an assumption but it is very likely that he landed on a malware… and possibly he didn’t do every update from the official sources even though he thinks he did. (It could be phishing, could be one of those early electrum versions that had an exploit in it, and even those versions were fine… till you make the update they suggested)

Don’t do updates unless you have to or you gain something from it imo. I follow this with every software and so far I am good. If it is not broken security-wise, it means it is working. If it is working, no need to disturb it.