Topic: Bitcoin Wallet Empty, no transactions, no nothing - page 3. (Read 4255 times)

Every time i hear something like this my stomach cramps.. I get paranoid about the coins that I have. I have stopped downloading anything to my computer that Im not 100 percent sure it safe. I hope it wasn't too much of a loss.

Im not 100% sure, here is a tx id from transferring a little from a exchange

e998ecedfe1dcbaaa33c585ceb75eca3a2ef325743654436e80cc48ae14f5f6b

Nope, didnt get any error messages, just opened the client and downloaded the last few hundred blocks and nothing was in there

did you get an error saying your wallet.dat was corrupt?

if so did you say 'yes' re-download entire blockchain?

same thing happened to me - I used process explorer (or task manager if you must) to kill the bitcoind process. Fire it back up and after a while - hey presto...

By the way, are you sure that it doesn't look like a normal change transaction (not normal/a stealing tx would be a whole bunch of inputs and just one output). If you're not sure, please post the transaction id up...

Probably, Bitcoin will create 100 new addresses if wallet.dat is missing, and given that they got two different wallets, it sure doesn't sound like a technical glitch.

I'm sure you don't want to hear this, but to be safest you should probably reinstall everything from scratch at this point.

If your wallets were encrypted, it's very likely you have a keylogger on your system. This means: (1) don't log into anything, and (2) after your system is reinstalled (or better yet, from a different system), change all your important passwords, especially financial ones, cause it's a good bet someone else could have them now...

Yer just as we suspected, the keys were created only a couple of hours ago when i opened the wallet. This sucks. So the hacker just removed the wallet.dat file completely and when i opened the client it created new keys? Is this what happened?
Thanks for the help btw

I'm not sure it'll help you much, but here it is anyways (with the quotes, assuming you're on Windows):


Then you can double-click it (the file), and it will display the creation time of all of the reserve addresses (I think in the UTC time zone).

I couldnt find a bunch of reserve requests in the log file. Im not much of a techie but how do i use the the dumpwallet in the debug console? I typed dumpwallet into the console but it is asking for a string?

That really stinks, I was optimistic it may have just been a technical glitch, so sorry if I got your hopes up.

Is there any chance the transaction you're looking at was something you initiated, and you're just confusing a full-out transfer with a change address, or was there only one output?

Regarding the log file: maybe. Most hacker victims just have their wallets or keys stolen, and then the hacker transfers the Bitcoin out later. If the hacker actually used your PC to transfer the coin out, then it would be in the logs. Also in the logs will be a bunch of "reserve" address creation messages around the time your wallet.dat was recreated.

Did you have your wallet encrypted? Did you have RPC enabled?

Have you installed or upgrading any software on your PC recently (especially from this or another Bit/Altcoin forum)?

Not that I know of, seems the Minerals wallet was emptied on he 2nd of this month and the Bitcoin wallet yesterday. So the malware could have been sitting there for a while.

Did you download anything fishy lately?

https://www.buytrezor.com/ Then at least nothing like this will ever happen again.

Thanks for the reply.

It seems I may have been hacked. I checked the address I have sent bitcoins to from an exchange and the blockchain says my balance is zero and a transaction was made yesterday emptying the wallet. MY Minerals Coin address has also been emptied too
Will there be a trace of this transaction in the debug file? I have run a virus scan and all seems clean. Does anyone have any ideas how they got in?

If all the saved addresses are gone, I'd guess that either the wallet.dat file moved or was deleted (by accident? technical glitch? a hacker? hard to say...), or the place where Bitcoin Core is looking for the wallet.dat file changed/got reconfigured.

Usually hackers don't matter deleting the wallet.dat as far as I'm aware (they usually just transfer the Bitcoin out leaving you with a 0 balance but the same keys), so maybe that's a good sign....

Have you installed or upgrading any software on your PC recently? Do you have a backup of the wallet.dat? Did you ever intentionally choose an alternate datadir?

How much was in there (don't have to tell me, I just mean ask yourself)? If it was a lot and you have no backups, and if you're a techie yourself or if you're willing to enlist the aid of one (a friend or paid), you should probably assume a technical glitch (it's the best case) and do something drastic, like shut down your PC right now, and boot off of a rescue CD with some data recovery tools.

Otherwise, I guess I'd start by searching the whole HD for any wallet.dat file, including the Trash/Recycle Bin, in the hopes it was just an accident/technical glitch. If you do a dumpwallet via the debug console / RPC, it would be interesting to see the creation dates of all of the keys. I'm guessing they were all created just now when you opened your wallet, which means the original wallet.dat file wasn't where it was expected and it got recreated.

That's all I can think of for now...

Hey all,
I need some help, I opened my wallet to discover it had a 0 balance and no transaction history, no nothing. The wallet is synced but there is no information in the wallet. Even saved addresses are gone.
The wallet.dat file is still there.
Have I been hacked?

Im using the Windows Bitcoin core wallet. Has this happened to anyone before and what can i do about it?
Thanks