Topic: Bitcoin stolen instantly? (Read 652 times)

Looks likes you are using hacked version of wallet or your pc was infected. Your funds are gone, you can try to scan your pc with live antivirus cd or rescue disk like Kaspersky Rescue Disk. Its really hurts when you loose funds.

This happens a lot with people who use weak phrases to make their wallets with vanity gen, maybe this is not the scenario but if you make an addy from the phrase 'cocacola' and send money there, you will see how fast the bitcoin disappear from that addy. I think some hackers load al the weak addys and made a script to instantly send the money to their addys after someone put BTC on those weak addys.

If you didn't paste your seed somewhere online or some website your seed is safe.
So I'm sure you could be infected there's something blocking the file from scanning that is why the Malwarebytes couldn't find any malicious files inside in your PC.
If the virus was executed and running behind and pretending as system file I'm sure the Malwarebytes can't detect it or any antivirus this most likely a trojan virus.

Did you tried to scan the HDD as external to other PC just to make sure the infected file is not running from HDD? If not do this but make sure that the PC is clean before you scan the whole external HDD.

look like you ddnt't update your file, i thing this because it, deflecting server or something wrong when sinc of server.

Looks like this is Windows only? How good is this? By the looks of it, seems like this is made for Windows XP?
Looks very old too (got an award in 2013).

Is there an alternative software for other OS?
Not that I'm gonna need it but maybe some users find it useful.

You're not supposed to store the seed on the PC. Any program could have read that text file. Maybe it was backed up to the cloud by some backup program.

Maybe its worth to try  https://www.spyshelter.com/ and reboot the system. If there is a keylogger or some other kind of evil software Spyshelter will find it.

That can be an issue and a potential security threat. A PC where you keep your Bitcoins and your wealth shouldn't be used for shady activities like watching porn or downloading torrents. It takes time for new threats to be discovered by AV vendors and for the code to be recognised as malicious.

Like HeRetiK said, reinstalling your OS is the safest thing you can do now. 

Maybe you caught something on one of the torrent sites. While porn sites are supposedly surprisingly safe, torrent and streaming sites can't be quite as choosy as far as advertisers are concerned, so sometimes you'll get nasty little malware just from entering the site. Happened to me a couple years back, I wasn't sure whether to be pissed off or impressed. Either use ad blockers / disable JavaScript or use a VM when visiting any piracy related sites.

Also note that well written malware doesn't necessarily turn up on virus scans. Actually malware doesn't necessarily need to be well written to remain overlooked, it often suffices if it's just rare enough to slip under the radar. Accordingly I'd probably consider reinstalling my OS from scratch if I were you.

Do you have any spell checkers installed? Turns out they potentially leak your seed and other sensitive information:
https://www.zdnet.com/article/cryptocurrency-wallet-caught-sending-user-passwords-to-googles-spellchecker/

No, no suspicious files, I'm very careful about what I download. The only extension is Ant video downloader for Firefox. I don't remember what I did with the seed, I'm sure I had a text file with the seed at some point but it was stored only on my PC and I deleted it a long time ago or got lost when my old HDD failed. The old HDD never left the house, it's under my desk right now. I only had the old empty wallet which I now wish I had lost too. The wallet was exported on a stick and the stick always stayed in my house. Only I have access to this PC, I'm the only user. I rarely use Google drive, it wasn't ever uploaded there; I went trough all the old emails in my most used accounts and searched for terms and there's no trace of any wallet or seed and I don't remember ever sending anything like that over email in the first place. I don't even use or used Whatsapp, viber or similar apps. I use facebook but never used it for anything crypto related, I didn't have any reason to. I do use this PC for almost everything I do online (mainly youtube watching, wikipedia) including xxx and, rarely, torrents but I did deep scans and couldn't find any virus or malware anywhere. I disinfected dozens of PCs myself in my lifetime, I would've found something if there was something.
I mean it's just 100€ but I'm still bitter about it, I could've used that money.

OP have you downloaded any suspicious files since installing your Electrum wallet?
Any browser plugins?
How did you save your seed? You say you don't have a file with your seed but did you create one initially that you saved somewhere on your PC?
Is it a shared PC, could someone have gotten access to it?
Did you save it in an email client, viber, whatsapp, sent it over facebook, google drive etc?
Do you use the same PC where your Electrum is installed for other online activities, torrenting, gaming, xxx?

I have gone ahead and verified the installer as provided on the link via PM from btcSCNB... results are as follows:

So, that would indicate that the installer is "good"...

Therefore, assuming that the rest of the information we have is correct, the wallet was most likely to have been compromised in some other manner... keylogger or RAT that somehow managed to get seed mnemonic or wallet file+password... or the OP has unknowingly leaked their seed through some other manner (claiming forks from dodgy wallets? unlikely given it was an unused wallet) or stored it "digitally" in one form or another (ie. email/IM/screen shot/text file) and that storage has been compromised.

@btcSCNB, at this time, and unless you can positively identify how your seed/wallet was compromised, I would seriously contemplate wiping your computer and doing a fresh OS install... then changing ALL your passwords to EVERYTHING... as it would appear something on your PC or with your "OpSec" is compromised.

Then can you do what HCP suggested? Maybe we can help you verify the files if that's really legit or not. If that's legit then you're hacked, if not, then you lost your funds because the software is fake (or can be both).

Verifying the Electrum installer seems a bit complicated and I didn't manage to do it.
No updates were made to this version ever since I installed it in december last year. The installer has been in my PC ever since.
I'm usually super careful but apparently not when I should've been the most careful.

If you still have the installer... I would still try and verify the digital signature. Use the guides as posted by nc50lc.

Or, if you can't verify it yourself, feel free to upload it to a filehost somewhere... PM me the link to it, and I can try and verify the signature for you. At least that way maybe we can either confirm or eliminate the "fake wallet" possibility as the reason for your wallet being compromised.

I don't know. I'm gonna keep the compromised wallet for awhile, maybe the thief grows a consciousness and sends the coin back  . I checked that address on blockchain.com and the money hasn't been sent forward so far. After a month or so I'm gonna delete the bad wallet, electrum and every single file associated with it, registry entries, etc., maybe even reinstall Windows. I'm really paranoid right now. You say Electrum is safe which might be true but since there are so many bad clones out there and servers and attacks I wouldn't consider it safe. Of course, my mistake was using that old wallet which I had no reason to.

This is the fake mandatory upgrade attack other users are talking about: https://bitcointalksearch.org/topic/electrum-vulnerability-allows-arbitrary-messages-phishing-5090097

I think Electrum is one of the best wallet out there. So like others said, you must be hacked or your Electrum is fake. It is not really Electrum fault per se that your funds got lost instantly, if that was the case, there will be a lot of people protesting here and Electrum should be dead since long time ago.

My suggestion is make sure to always verify any file that you've downloaded from the internet to prevent something like this from happening again.

You must verify it as HCP said, you'll never know if it was the old redirecting eIectrum.org <-Fake Site from google search.

Follow these guides (select depending on your OS):

• How to Verify Your Electrum Wallet on Windows
• How do i verify Electrum installer on Linux?

I created the wallet myself many months ago through a new seed (standard method). I never used the wallet until today (its history was completely blank) and no one around me even knows what bitcoin or a bitcoin seed are or how to use. I should've used Jaxx and generate a fresh new wallet which i wanted to do but I was too lazy, damn it .

I still have the 3.3.0 installer. What kinda information do you need?