Once I saw this issue. I always think of the tragedy involving one of our local members who lost
1.2 BTC in this thread:
[TANYA] Lacak BTC yang dicuri in September.
Short story, based on his explanation:
sampe sekarang masih belum ketawan dari mana malwarenya berasal (tapi kemungkinan besar dari app electrumnya yg dicompromise). jadi sebelumnya di electrum addressnya bener address saya, tapi txnya pending locally gitu. pas fee ditambahin addressnya kereplace sama address scammer, sama persis seperti kasus dibawah ini
https://www.reddit.com/r/Electrum/comments/1ccrfop/transaction_replaced_to_scammer_wallet/dan wallet ini udah bertahun2 juga di mac ini dan gapernah ada issue, bisa om om semua liat kalau sudah ada 10k tx dan biasanya aman aja. dan kalau masalah kenapa gak dicek addressnya pas replace, saya lagi mabuk dan dah gak sabar mau split ace di stake bj duitnya kurang.
To this day, it’s still unclear where the malware originated (though it’s highly likely that the Electrum app itself was compromised). Previously, the address shown in Electrum was indeed my own, but the transaction remained in a "pending" state locally. When I increased the fee, the address was replaced with a scammer’s address—exactly like the case described here:
https://www.reddit.com/r/Electrum/comments/1ccrfop/transaction_replaced_to_scammer_wallet/I’ve been using this wallet on my Mac for years without any issues; as you can see, there are 10,000 past transactions, and everything had always been fine. As for why I didn’t check the address when it was replaced—well, I was intoxicated and impatient to split a pair of aces in a game of blackjack, but I didn't have enough funds.
I thought, at the time these case being opened by him. I and our other local member think this because a Clipboard Hijacked. So, we and others decided to advise him to maybe test some transactions or check his device..
Feels bad for him.
