Lost Bitcoin

[byt411]

Tested all the backup, the result is the same. The address does not appear anywhere
It seems to me that the problem arose after upgrading the bitcoin-core from version 0.9.0 to version 0.9.1. What do you think, does it make sense to try to download the older version?

No, it makes no difference. What is the last transaction you did? And I mean you.

[Heathcliff]

My last transaction:

Cтaтyc: 197 пoдтвepждeний
Дaтa: 10.05.2014 14:05
Для: 178cXz5JiZenB8HRfMsdUvB3kRbjziopfA
Дeбeт: -0.0008 BTC
Кoмиccия: -0.0001 BTC
Чиcтaя cyммa: -0.0009 BTC
ID тpaнзaкции: e3cff66b3f64cdb44b1b934ba7e06d68b2bf191441581e4e4f48258451edfe21-000

I brought up the balances on my other purse

[byt411]

My last transaction:

Cтaтyc: 197 пoдтвepждeний
Дaтa: 10.05.2014 14:05
Для: 178cXz5JiZenB8HRfMsdUvB3kRbjziopfA
Дeбeт: -0.0008 BTC
Кoмиccия: -0.0001 BTC
Чиcтaя cyммa: -0.0009 BTC
ID тpaнзaкции: e3cff66b3f64cdb44b1b934ba7e06d68b2bf191441581e4e4f48258451edfe21-000

I brought up the balances on my other purse

Were these addresses also yours?
1ByxEhE82qZxABhtsaj3yDJoJ26LV1YNF5
1ErU6w2UkWrnWLt91YRzGTgFmBAC3LZ3EY
1LN9Zi1nWpNDnRHyJ2UacZdCtiVp3n2UrG

[CaMeRoNy]

This problem happened too much recently and im afraid to say your BTC gto stolen. im not sure but good luck

[Heathcliff]

These addresses are not mine, I received BTC from 1ByxEhE82qZxABhtsaj3yDJoJ26LV1YNF5 and 1LN9Zi1nWpNDnRHyJ2UacZdCtiVp3n2UrG

[byt411]

These addresses are not mine, I received BTC from 1ByxEhE82qZxABhtsaj3yDJoJ26LV1YNF5 and 1LN9Zi1nWpNDnRHyJ2UacZdCtiVp3n2UrG

I have no idea how that happened then. I was guessing that it was just a change address, but it isn't. PM DannyHamilton, he can help.

[Heathcliff]

byt411,
Thank you very much for Your help and time!

[byt411]

byt411,
Thank you very much for Your help and time!

By the way, is your wallet encrypted?

[DannyHamilton]

I suspect that you have been hacked and the bitcoins are stolen and gone.  If I'm correct, then the thief seems to also control the following addresses:

1BcVNE8cYrHz6B6ECnJTgArTTTzzPw6tHw (where he received 0.1 BTC from 1KjGrZXG25UTHUFVdPJMEQFEqMsvyAsaie on 2014-05-07 15:34 UTC)

1LXFmDPtQmBHSVoQLSP17xU8Fztd75yusR (where he received 0.02026933 BTC on 2014-05-07 15:33 UTC)

1HJD4K4C2GwBLkARjQwqsdyaFbRVFu1jgc (this the the final address that your bitcoins were sent to.  They were held in 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t for 3 days from 2014-05-08 10:35 UTC until 2014-05-11 13:58 UTC when they were transferred to this address along with the 0.12026933 BTC from the other two addresses)

Please load up the original wallet (the one that has the two transactions that made your bitcoins disappear).

Then in the "Help" menu, choose "Debug Window".

In the "Debug Window", choose "Console".

Then enter the following four commands:

Code:

validateaddress 1Cy21mnkUMvZdJW4rDe7Z5ey9sbcZhzzfL
validateaddress 1FYS8yVDbGxaz8xkBsb53TQQ1jPrcYC17y
validateaddress 1GJ5Yy7SjDo1Bjgtqr4tPhGTu3Kz9mfkZ5
validateaddress 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t

I believe that you'll find that the first three commands will return:

"isvalid" : true

and

"ismine" : true

The last one will almost certainly return

"ismine" : false

If so, and if you did not intentionally send to 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t then a thief gained access to the private keys in your wallet.  Did you protect your wallet with a strong password?

[Heathcliff]

18:53:12

validateaddress 1Cy21mnkUMvZdJW4rDe7Z5ey9sbcZhzzfL


18:53:12

{
"isvalid" : true,
"address" : "1Cy21mnkUMvZdJW4rDe7Z5ey9sbcZhzzfL",
"ismine" : true,
"isscript" : false,
"pubkey" : "028ac26a7c31b1cbcecd5b9db3912181501f72e43baea4eb831e4e0cb24824b438",
"iscompressed" : true
}


18:54:40

validateaddress 1FYS8yVDbGxaz8xkBsb53TQQ1jPrcYC17y


18:54:40

{
"isvalid" : true,
"address" : "1FYS8yVDbGxaz8xkBsb53TQQ1jPrcYC17y",
"ismine" : true,
"isscript" : false,
"pubkey" : "0251cb9e2c6d7036df4f172df0793cc9c618b7d036833eea115db4ceb3861a7ae9",
"iscompressed" : true
}


18:54:54

validateaddress 1GJ5Yy7SjDo1Bjgtqr4tPhGTu3Kz9mfkZ5


18:54:54

{
"isvalid" : true,
"address" : "1GJ5Yy7SjDo1Bjgtqr4tPhGTu3Kz9mfkZ5",
"ismine" : true,
"isscript" : false,
"pubkey" : "02008283a25965c101eae73044bc6b919f1623055464d225a6890f1cabdaefb701",
"iscompressed" : true
}


18:55:11

validateaddress 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t


18:55:11

{
"isvalid" : true,
"address" : "1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t",
"ismine" : false
}

The password is very complex (13 characters, including letters of different case, numbers and symbols). The password is not repeated anywhere, is used only in the wallet

[cr1776]

https://blockchain.info/address/1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t this is valid. If 1MbDk... is the unknown address you don't own, then you cannot do anything other than finding out how the hack might happenen.

That is valid, the original one shows as:

1MbDKqngwKQ49TowToHGc9nZBRt99CqK8т

Which is not valid.


I suspect that you've been hacked too.

[byt411]

So I assume it was a keylogger? I searched google and heathcliff posted on a russian forum that his wallet was encrypted with a password of 12 characters or something.

[Heathcliff]

So I assume it was a keylogger? I searched google and heathcliff posted on a russian forum that his wallet was encrypted with a password of 12 characters or something.

Yes!
On the Russian forum is the message " пapoли бoлee 12 знaкoв" (translate - passwords for more than 12 characters). Their 13 

One moment. When upgrading to version 0.9.1 appeared similar message
http://s52.radikal.ru/i138/1405/3f/aec7e6cf4357.png
Translate:
Database blocks corrupted. To rebuild the database blocks right now?

After the rebuild appeared transaction.

Rem.: The program downloaded from the official site...
P.S.This screenshot was received when trying to install the old version of the program. But he is the same... Very strange circumstances...

[Heathcliff]

So I assume it was a keylogger?

I thought so too... The system is installed Avast Internet Security, I also scanned the computer itself Avast and two anti-virus scanners (DrWeb & avz from Kaspersky Lab). Keyloggers not found!

[DannyHamilton]

To the best ability that we can, I think we've confirmed that the 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t is not a change address.

There is a transaction in the blockchain that sends to both 1Cy21mnkUMvZdJW4rDe7Z5ey9sbcZhzzfL and 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t.

Therefore, it looks like 1Cy21mnkUMvZdJW4rDe7Z5ey9sbcZhzzfL is the change address (since it returns "ismine" : true) and 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t is the address that was actually sent to.

Since both addresses received in the same transaction, and 1Cy21mnkUMvZdJW4rDe7Z5ey9sbcZhzzfL is in the wallet.dat, it looks like you have the correct wallet.dat.  I don't think you are going to find 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t in any backups.

At this point, unless any other evidence turns up, I don't think you'll be able to recover these bitcoins.

As for how it happened, I really don't know.  It seems pretty certain that a thief managed to get access to your unencrypted wallet.dat from somewhere.  A keylogger installed on your computer would be the first guess.  A trojan that waits for you to type your password and then steals the unencrypted content would be another possibility.  Have you imported the wallet.dat file (or private keys) into any other wallets?

[Heathcliff]

 Have you imported the wallet.dat file (or private keys) into any other wallets?

No, I did not import keys

[PlusLegit]

that must suck, the rat must be FUD, maybe i can help you out if u got skype

[byt411]

Do you have a backup of the wallet or private keys? Then you can see if the address was there.

Read the thread before posting, his coins were definitely stolen.

[btcxyzzz]

It is essential that you at least run Linux if you're dealing with crypto. Windows is complete malware-filled trash and you just can't protect youself from it - antivirus programs are frequently not detecting them. Sorry to say, but it seems that your BTCs has been stolen.

[Heathcliff]

It is essential that you at least run Linux if you're dealing with crypto. Windows is complete malware-filled trash and you just can't protect youself from it - antivirus programs are frequently not detecting them. Sorry to say, but it seems that your BTCs has been stolen.

You are right. Now I also think that was a steal. And I understand - Bitcoins not return ...
Linux ... One word - late.

In conclusion - thank you all for your participation and your time.

P.S.  If anyone have an idea on how to return the stolen - will be grateful (in PM)