Missing bitcoins from wallet

[stelmor]

I haven't opened my bitcoin wallet for about 2 month. I had a small amount of bitcoins on multipool decided to transfer to my wallet.
After syncing my wallet noticed a DEBIT of:
.30btc on 6/10/2014  address was n/a
Status: 873 confirmations
Date: 6/10/2014 16:39
Debit: -0.01 BTC
Debit: -0.27 BTC
Debit: -0.01 BTC
Debit: -0.01 BTC
Net amount: -0.30 BTC
Transaction ID: a80a666ee19be52c8b005ad89274d2f762655ee4ca9da7899f6d94b1bfe86734

I was wondering if theirs away to find out what happened to my bitcoins or how they were debit out of my wallet?

[1715183159]

1715183159

[1715183159]

1715183159

[1715183159]

1715183159

[byt411]

What client are you using? You probably got keylogged, or hacked.

[micky123]

What client are you using? You probably got keylogged, or hacked.

Certainly looks like your account was hacked. You may check the transaction on blockchain.info: https://blockchain.info/tx/a80a666ee19be52c8b005ad89274d2f762655ee4ca9da7899f6d94b1bfe86734

[ranochigo]

I think you have virus there. Some viruses are programmed to send Bitcoins from your wallet to a specific address. Make a cold storage next time.

[DannyHamilton]

On June 10, at approximately 21:36:23 UTC, someone sent 1.07595932 BTC to the address: 1ME9sErsy44Hfk2Jh6GGucbMpKM2NYgnUq

If this transaction was not created by you, then someone else gained access to your private keys.  Most likely this would be due to malware on your computer (virus, keylogger, trojan program, etc).  Do you recall what you were doing at that time on that day?  It might explain where you got the malware.

[gondel]

I haven't opened my bitcoin wallet for about 2 month. I had a small amount of bitcoins on multipool decided to transfer to my wallet.
After syncing my wallet noticed a DEBIT of:
.30btc on 6/10/2014  address was n/a
Status: 873 confirmations
Date: 6/10/2014 16:39
Debit: -0.01 BTC
Debit: -0.27 BTC
Debit: -0.01 BTC
Debit: -0.01 BTC
Net amount: -0.30 BTC
Transaction ID: a80a666ee19be52c8b005ad89274d2f762655ee4ca9da7899f6d94b1bfe86734

I was wondering if theirs away to find out what happened to my bitcoins or how they were debit out of my wallet?

Hi man,
Sorry to hear that, but probably you got hacked somehow. Do not trust anyone!
BTW what is that IP means?

This one is from the transaction micky123  mentioned.
Thanks!

[ranochigo]

I haven't opened my bitcoin wallet for about 2 month. I had a small amount of bitcoins on multipool decided to transfer to my wallet.
After syncing my wallet noticed a DEBIT of:
.30btc on 6/10/2014  address was n/a
Status: 873 confirmations
Date: 6/10/2014 16:39
Debit: -0.01 BTC
Debit: -0.27 BTC
Debit: -0.01 BTC
Debit: -0.01 BTC
Net amount: -0.30 BTC
Transaction ID: a80a666ee19be52c8b005ad89274d2f762655ee4ca9da7899f6d94b1bfe86734

I was wondering if theirs away to find out what happened to my bitcoins or how they were debit out of my wallet?

Hi man,
Sorry to hear that, but probably you got hacked somehow. Do not trust anyone!
BTW what is that IP means?

This one is from the transaction micky123  mentioned.
Thanks!

The transaction was first relayed by this node. That means that the transaction was broadcasted to this node first, before to the rest of the network. It doesn't mean that it is the IP of the person who stole it, can be inaccurate.

[TheEvilSocks]

That sucks dude! I looks like someone hacked into your system.
You should scan your system for any viruses and/or malware

[byt411]

What client are you using? You probably got keylogged, or hacked.

Certainly looks like your account was hacked. You may check the transaction on blockchain.info: https://blockchain.info/tx/a80a666ee19be52c8b005ad89274d2f762655ee4ca9da7899f6d94b1bfe86734

I am asking what client he is using, and also, was your wallet encrypted?
Client = bitcoin-qt, Multibit, Electrum, blockchain.info, etc.

[ranochigo]

That sucks dude! I looks like someone hacked into your system.
You should scan your system for any viruses and/or malware

be aware that not every anti virus can be very effective in looking for viruses. Some of them can even be FUD.  Try to reinstall system and change all your passwords.

[TheEvilSocks]

That sucks dude! I looks like someone hacked into your system.
You should scan your system for any viruses and/or malware

be aware that not every anti virus can be very effective in looking for viruses. Some of them can even be FUD.  Try to reinstall system and change all your passwords.

ofcourse!

Upload any downloaded files from June 5 - June 10 to http://virustotal.com/
They'll analyze the files, if it was a virus and it was FUD, then it won't be FUD anymore

[shorena]

-snip-
BTW what is that IP means?
-snip-

-snip-
The transaction was first relayed to blockchain.info by this node. That means that the transaction was broadcasted to this node first, before to the rest of the network. It doesn't mean that it is the IP of the person who stole it, can be inaccurate. It basically means nothing

fixed that for you.

Also, welcome to the internet, sometimes things have these little questionmarks that explain stuff.

[stelmor]

Sorry guys for the delay work and family stuff. I really appreciate the responses, nice to know we have a caring community.
I was planing on trading my bitcoin for gold or silver bullion since the bitcoin price was moving up. I didn't have much in terms of bitcoin since I was just starting to mine in January 2014. My wallet had .3348103 btc now with the loss of .30btc now down to .0348103 so trading for gold or silver is out of the question. Also sitting on pretty much worthless mining equipment with a total hash rate of 24gh. I guess I have to buy on the dips as they say.

The Bitcoin wallet I'm using is Bitcoin 0.8.5 BETA(QT). I didn't encrypt the wallet my fault of course. I'm in the process now of moving all wallets to usb thumb drive and deleting from my PC.
Wish their was a way to stop this illegal theft but as in everything in life you learn from your mistakes. Just suck having to tell the wife and explaining the mining equipment is not worth what I paid for it either.

Alright I'm done whining now on to more positive thoughts!

Thanks to everyone who responded.

Stelmor

[stelmor]

I was minning on BTC Guild the address they used was from my wallet was: 1KUa5crBP8mJRu9Bhq8iWvS4iQbfyWUEEo  Looks like they spent my bitcoins I believe they were from Switzerland maybe.

Transaction View information about a bitcoin transaction
a80a666ee19be52c8b005ad89274d2f762655ee4ca9da7899f6d94b1bfe86734
1KUa5crBP8mJRu9Bhq8iWvS4iQbfyWUEEo (0.01 BTC - Output)
1KUa5crBP8mJRu9Bhq8iWvS4iQbfyWUEEo (0.27 BTC - Output)
1KUa5crBP8mJRu9Bhq8iWvS4iQbfyWUEEo (0.01 BTC - Output)
1KUa5crBP8mJRu9Bhq8iWvS4iQbfyWUEEo (0.01 BTC - Output)
1CpS5ik4WxtwdWHYxJaWWj2axswoabwgHs (0.49660874 BTC - Output)                      -------  1ME9sErsy44Hfk2Jh6GGucbMpKM2NYgnUq - (Spent) 1.07595932 BTC
1CpS5ik4WxtwdWHYxJaWWj2axswoabwgHs (0.04513143 BTC - Output)
1CpS5ik4WxtwdWHYxJaWWj2axswoabwgHs (0.23461915 BTC - Output)
                                                                                            
1.07595932 BTC
Summary
Size   1079 (bytes)
Received Time   2014-06-10 21:36:23
Included In Blocks   305169 (2014-06-10 21:39:39 +3 minutes)
Confirmations   1060 Confirmations
Relayed by IP    74.71.81.112 (whois)
Visualize   View Tree Chart
Inputs and Outputs
Total Input   1.07635932 BTC
Total Output   1.07595932 BTC
Fees   0.0004 BTC
Estimated BTC Transacted   1.07595932 BTC
Scripts   Hide scripts & coinbase

Transaction Visualization a80a666ee19be52c8b005ad89274d2f762655ee4ca9da7899f6d94b1bfe86734
https://blockchain.info/tree/58214055

1ME9sErsy44Hfk2Jh6GGucbMpKM2NYgnUq
1.07595932 BTC

origin
1.07595932 BTC
74.71.81.112 USA
to address 1ME9sErsy44Hfk2Jh6GGucbMpKM2NYgnUq
46.28.204.51 Switzerland
 

[ranochigo]

I was minning on BTC Guild the address they used was from my wallet was: 1KUa5crBP8mJRu9Bhq8iWvS4iQbfyWUEEo  Looks like they spent my bitcoins I believe they were from Switzerland maybe.

Transaction View information about a bitcoin transaction
a80a666ee19be52c8b005ad89274d2f762655ee4ca9da7899f6d94b1bfe86734
1KUa5crBP8mJRu9Bhq8iWvS4iQbfyWUEEo (0.01 BTC - Output)
1KUa5crBP8mJRu9Bhq8iWvS4iQbfyWUEEo (0.27 BTC - Output)
1KUa5crBP8mJRu9Bhq8iWvS4iQbfyWUEEo (0.01 BTC - Output)
1KUa5crBP8mJRu9Bhq8iWvS4iQbfyWUEEo (0.01 BTC - Output)
1CpS5ik4WxtwdWHYxJaWWj2axswoabwgHs (0.49660874 BTC - Output)                      -------  1ME9sErsy44Hfk2Jh6GGucbMpKM2NYgnUq - (Spent) 1.07595932 BTC
1CpS5ik4WxtwdWHYxJaWWj2axswoabwgHs (0.04513143 BTC - Output)
1CpS5ik4WxtwdWHYxJaWWj2axswoabwgHs (0.23461915 BTC - Output)
                                                                                            
1.07595932 BTC
Summary
Size   1079 (bytes)
Received Time   2014-06-10 21:36:23
Included In Blocks   305169 (2014-06-10 21:39:39 +3 minutes)
Confirmations   1060 Confirmations
Relayed by IP    74.71.81.112 (whois)
Visualize   View Tree Chart
Inputs and Outputs
Total Input   1.07635932 BTC
Total Output   1.07595932 BTC
Fees   0.0004 BTC
Estimated BTC Transacted   1.07595932 BTC
Scripts   Hide scripts & coinbase

Transaction Visualization a80a666ee19be52c8b005ad89274d2f762655ee4ca9da7899f6d94b1bfe86734
https://blockchain.info/tree/58214055

1ME9sErsy44Hfk2Jh6GGucbMpKM2NYgnUq
1.07595932 BTC

origin
1.07595932 BTC
74.71.81.112 USA
to address 1ME9sErsy44Hfk2Jh6GGucbMpKM2NYgnUq
46.28.204.51 Switzerland
 

Not accurate, a person in US can connect to a Switzerland node and a person from Taiwan can connect to a Switzerland node. There isn't much accuracy.

[stelmor]

I was going off the Transaction Visualization a80a666ee19be52c8b005ad89274d2f762655ee4ca9da7899f6d94b1bfe86734
https://blockchain.info/tree/58214055
https://blockchain.info/tx/a80a666ee19be52c8b005ad89274d2f762655ee4ca9da7899f6d94b1bfe86734

I'm not an expert so your probably correct just thought I'd post this information anyway.

stelmor

[ranochigo]

I was going off the Transaction Visualization a80a666ee19be52c8b005ad89274d2f762655ee4ca9da7899f6d94b1bfe86734
https://blockchain.info/tree/58214055
https://blockchain.info/tx/a80a666ee19be52c8b005ad89274d2f762655ee4ca9da7899f6d94b1bfe86734

I'm not an expert so your probably correct just thought I'd post this information anyway.

stelmor

A clever person would use coin mixing services to hide the stolen coins. That is what I am suspecting anyway.

[shorena]

-snip-
Looks like they spent my bitcoins I believe they were from Switzerland maybe.

Sorry the tree view is just that: another view of the transactions.

https://blockchain.info/de/tx/2a9483eac13427deffc7f7f4dd259cdbe272f66b3a122aa0769637db2309770d

So the same as here:

-snip-
BTW what is that IP means?
-snip-

-snip-
The transaction was first relayed to blockchain.info by this node. That means that the transaction was broadcasted to this node first, before to the rest of the network. It doesn't mean that it is the IP of the person who stole it, can be inaccurate. It basically means nothing

fixed that for you.

-snip-

applies. The IPs mean nothing. 

Sorry for your loss. Take is a very expensive lesson to encrypt your data. The attacker must somehow gotten access to your machine though. So you should check further (scan from external boot device) or reinstall your OS just to be safe. A change of passwords (from a different machine) might also be wise.

[cp1]

Did you generate that address in bitcoin-qt or did you import it from something someone else gave you, maybe a brainwallet?  Did someone else have access to your computer who could have stolen the coins?

[stelmor]

Someone from multipool I believe hacked into both my litecoin and bitcoin wallet both happened when moving coins over from multipool to both wallets when I went to encrypt both wallets both had sent coins. Time to reload my pc. Month of mining GONE!  

I generated my address from both litecoin & bitcoin wallet for multipool to send to probably keylogged me.  $350 dollars worth of coin vanished!

My excitement for cyptocoins has just hit the floor! Starting to think is this really worth it?