Weird Transactions in Wallet that I didn't make

[ncsupanda]

My Bitcoin Core wallet randomly sent 0.0020546 BTC to 1brain7kAZxPagLt2HRLxqyc3VgGSa1GR
Then quickly received it all back at 1HZwkjkeaoZfTSaJxDw6aKkxp45agDiEzN

Later received random BTC (0.000055) from 1HZwkjkeaoZfTSaJxDw6aKkxp45agDiEzN
And my wallet sent them to 1ENnzep2ivWYqXjAodTueiZscT6kunAyYs

I have a solid password of over 20 numbers, letters, random cases, and special characters. And not all of my BTC are missing.

Any ideas?

[1715103918]

1715103918

[1715103918]

1715103918

[1715103918]

1715103918

[Wulfcastle]

My Bitcoin Core wallet randomly sent 0.0020546 BTC to 1brain7kAZxPagLt2HRLxqyc3VgGSa1GR
Then quickly received it all back at 1HZwkjkeaoZfTSaJxDw6aKkxp45agDiEzN

Later received random BTC (0.000055) from 1HZwkjkeaoZfTSaJxDw6aKkxp45agDiEzN
And my wallet sent them to 1ENnzep2ivWYqXjAodTueiZscT6kunAyYs

I have a solid password of over 20 numbers, letters, random cases, and special characters. And not all of my BTC are missing.

Any ideas?

Possibly both are internal wallet address, not really sure?

EDIT : There was a topic exactly like this a while back, can't seem to find it now.

[ncsupanda]

19:40:32

validateaddress 1brain7kAZxPagLt2HRLxqyc3VgGSa1GR


19:40:32

{
"isvalid" : true,
"address" : "1brain7kAZxPagLt2HRLxqyc3VgGSa1GR",
"ismine" : false
}



19:40:57

validateaddress 1ENnzep2ivWYqXjAodTueiZscT6kunAyYs


19:40:57

{
"isvalid" : true,
"address" : "1ENnzep2ivWYqXjAodTueiZscT6kunAyYs",
"ismine" : false
}

[DannyHamilton]

You appear to have run "importprivkey 5KYZdUEo39z3FPrtuX2QbbwGnNP5zTd7yyr2SC1j299sBCnWjss" on your wallet.

This is the private key to the address 1HZwkjkeaoZfTSaJxDw6aKkxp45agDiEzN (which must now be in your wallet).

This is not a very smart thing to have done, since that is a private key that is known to the public.  This means anyone aware of that private key can spend any bitcoins that you receive at that address.

It is a bad idea to import private keys into wallets unless you know what you're doing.

[Bitobsessed]

This might help.  Looks like he might have been warning you?  1brain = GoodGuy bitcoin stealer lol.

From: https://news.ycombinator.com/item?id=7365663

Perhaps this comment will start a good discussion, or maybe people won't like it because I'm one of the thieves mentioned. I'm the owner of the 1brain7kAZxPagLt2HRLxqyc3VgGSa1GR address.

First, for those curious, the passphrases of the wallets taken from so far:

19JsLFDRxuTsAjapE79FgoVNdNdB2hNU5M - "alfanumerico" (0.36875 BTC)

1PQiixL1SyytXoUGFBGA5ptW9uTjsBrdhX - "emergency" (0.00085 BTC)

1CqRJYoztkWifUYadFg13MHdmECx6uEdy7 - "butterfly" (0.00025 BTC)

16ga2uqnF1NqpAuQeeg7sTCAdtDUwDyJav - "password" (0.00085 BTC)

1HZwkjkeaoZfTSaJxDw6aKkxp45agDiEzN - "" (0.474972 BTC)

1HoSFymoqteYrmmr7s3jDDqmggoxacbk37 - "hello" (0.000555 BTC)

1C7zdTfnkzmr13HfA2vNm5SJYRK6nEKyq8 - "correct horse battery staple" (0.243762 BTC)

1JwSSubhmg6iPtRjtyqhUYYH7bZg3Lfy1T - "correct horse battery staple" (0.000079 BTC)

The implementation isn't particularly exciting. I have a PostgreSQL database containing a single `address' table storing (address, privKey, passphrase). Of course, the passphrase doesn't actually need to be stored, but I kept it around to satisfy my own curiosity. I run a modified bitcoind client that checks each transaction it hears about (in CTxMemPool::accept) to see if any of the outputs are in my database. If they are, a transaction is created, signed and broadcast to send the same number of BTC (minus fees) to 1brain7kAZxPagLt2HRLxqyc3VgGSa1GR.

I just wanted to point out that, when I started this, it was not for financial gain. I simply saw it as a fun and interesting exercise about the Bitcoin protocol. I wanted to see if I was capable to "winning the race" -- trust me when I say there are loads of people out there "mining" brainwallets, and whosever transaction is included in a block first tends to win and get the Bitcoin. I never expected to gain over 1 BTC, I think I got rather lucky. My database contains 19,412,020 passphrases (mostly single passwords, actually) which all came from various wordlists I found online. I consider this to be a fairly small dictionary, based on what I've read about other people doing the same thing. I originally had plans to make the database much bigger, however I've since moved onto other projects.

I'm happy to answer questions if people have any. There's a signed version of this comment at http://pastebin.com/s29kk2bb, which you can verify (rather ironically) at http://brainwallet.org/#verify.

[pirsquared]

You appear to have run "importprivkey 5KYZdUEo39z3FPrtuX2QbbwGnNP5zTd7yyr2SC1j299sBCnWjss" on your wallet.

This is the private key to the address 1HZwkjkeaoZfTSaJxDw6aKkxp45agDiEzN (which must now be in your wallet).

This is not a very smart thing to have done, since that is a private key that is known to the public.  This means anyone aware of that private key can spend any bitcoins that you receive at that address.

It is a bad idea to use import private keys into wallets unless you know what you're doing.

<---This is good information to know.

[pirsquared]

This might help.  Looks like he might have been warning you?  1brain = GoodGuy bitcoin stealer lol.

From: https://news.ycombinator.com/item?id=7365663

Perhaps this comment will start a good discussion, or maybe people won't like it because I'm one of the thieves mentioned. I'm the owner of the 1brain7kAZxPagLt2HRLxqyc3VgGSa1GR address.

First, for those curious, the passphrases of the wallets taken from so far:

19JsLFDRxuTsAjapE79FgoVNdNdB2hNU5M - "alfanumerico" (0.36875 BTC)

1PQiixL1SyytXoUGFBGA5ptW9uTjsBrdhX - "emergency" (0.00085 BTC)

1CqRJYoztkWifUYadFg13MHdmECx6uEdy7 - "butterfly" (0.00025 BTC)

16ga2uqnF1NqpAuQeeg7sTCAdtDUwDyJav - "password" (0.00085 BTC)

1HZwkjkeaoZfTSaJxDw6aKkxp45agDiEzN - "" (0.474972 BTC)

1HoSFymoqteYrmmr7s3jDDqmggoxacbk37 - "hello" (0.000555 BTC)

1C7zdTfnkzmr13HfA2vNm5SJYRK6nEKyq8 - "correct horse battery staple" (0.243762 BTC)

1JwSSubhmg6iPtRjtyqhUYYH7bZg3Lfy1T - "correct horse battery staple" (0.000079 BTC)

The implementation isn't particularly exciting. I have a PostgreSQL database containing a single `address' table storing (address, privKey, passphrase). Of course, the passphrase doesn't actually need to be stored, but I kept it around to satisfy my own curiosity. I run a modified bitcoind client that checks each transaction it hears about (in CTxMemPool::accept) to see if any of the outputs are in my database. If they are, a transaction is created, signed and broadcast to send the same number of BTC (minus fees) to 1brain7kAZxPagLt2HRLxqyc3VgGSa1GR.

I just wanted to point out that, when I started this, it was not for financial gain. I simply saw it as a fun and interesting exercise about the Bitcoin protocol. I wanted to see if I was capable to "winning the race" -- trust me when I say there are loads of people out there "mining" brainwallets, and whosever transaction is included in a block first tends to win and get the Bitcoin. I never expected to gain over 1 BTC, I think I got rather lucky. My database contains 19,412,020 passphrases (mostly single passwords, actually) which all came from various wordlists I found online. I consider this to be a fairly small dictionary, based on what I've read about other people doing the same thing. I originally had plans to make the database much bigger, however I've since moved onto other projects.

I'm happy to answer questions if people have any. There's a signed version of this comment at http://pastebin.com/s29kk2bb, which you can verify (rather ironically) at http://brainwallet.org/#verify.

You, sir, are  BALLER. Many may find your tactics fraudulent, but I think it is brilliant. You are using math to eductate and make some money doing it. Please continue educating.

[ncsupanda]

You appear to have run "importprivkey 5KYZdUEo39z3FPrtuX2QbbwGnNP5zTd7yyr2SC1j299sBCnWjss" on your wallet.

This is the private key to the address 1HZwkjkeaoZfTSaJxDw6aKkxp45agDiEzN (which must now be in your wallet).

This is not a very smart thing to have done, since that is a private key that is known to the public.  This means anyone aware of that private key can spend any bitcoins that you receive at that address.

It is a bad idea to import private keys into wallets unless you know what you're doing.

I personally have never done this.

Time to break out the virus scanner. Thank you for the knowledgeable response.

[DannyHamilton]

You appear to have run "importprivkey 5KYZdUEo39z3FPrtuX2QbbwGnNP5zTd7yyr2SC1j299sBCnWjss" on your wallet.

This is the private key to the address 1HZwkjkeaoZfTSaJxDw6aKkxp45agDiEzN (which must now be in your wallet).

This is not a very smart thing to have done, since that is a private key that is known to the public.  This means anyone aware of that private key can spend any bitcoins that you receive at that address.

It is a bad idea to import private keys into wallets unless you know what you're doing.

I personally have never done this.

Time to break out the virus scanner. Thank you for the knowledgeable response.

Well that's certainly odd.

If you look in the "Receiving addresses" under the "File" menu, is 1HZwkjkeaoZfTSaJxDw6aKkxp45agDiEzN listed as one of the receiving addresses in your wallet?

More specifically, if you run

Code:

validateaddress 1HZwkjkeaoZfTSaJxDw6aKkxp45agDiEzN

Does it return:

Code:

"ismine" : true

If the address isn't in your wallet, then I can't see any reason for your wallet to indicate that it sent 0.0020546 BTC to 1brain7kAZxPagLt2HRLxqyc3VgGSa1GR since the only transaction that sent that much to that address spent an output that had been received the bitcoins at address 1HZwkjkeaoZfTSaJxDw6aKkxp45agDiEzN.

If that address is in your wallet, and you didn't put it there, then I don't understand how it could have gotten there.  I suppose it could have been some sort of virus or malware, but that seems like a very odd thing for malware to do when it could just take your entire balance instead.

[Lamigo]

EDIT : There was a topic exactly like this a while back, can't seem to find it now.

I searched the address "1brain7kAZxPagLt2HRLxqyc3VgGSa1GR" on google, and I guess I have found it for you.
https://bitcointalk.org/index.php?topic=347828.0