Did not use change address and now balance is $0. Transaction Unspent.

o_e_l_e_o

legendary

Activity: 2268

Merit: 18711

Quote from: Csmiami on November 17, 2020, 06:55:43 PM

[According to wallet explorer[/url], all 14 inputs belong to the same wallet (I'm not sure how the site determines that though). Seeing the ammounts of satoshis in the tx, it doesn't really look like a hacker may have been bothered; some of the inputs are as small as 500 satoshis; and to me, this just looks like a transaction to consolidate all your small inputs.

They simply use the fact that all the inputs are spent in the same transaction. And although the transaction looks like a consolidation transaction, it could equally be a sweep transaction where an attacker just clears everything in the wallet to their own address in one transaction.

Quote from: Rising87 on November 18, 2020, 12:12:06 AM

I would think they would he moved by now.

Not necessarily. Often hacked funds sit dormant for some time until people forget about them and stop watching the address. As above, if the output address is not highlighted, then it is not part of your wallet, and the likelihood is that either your device has malware or your seed phrase was compromised.

Rising87

newbie

Activity: 11

Merit: 3

Quote from: nc50lc on November 17, 2020, 11:39:30 PM

Quote from: Rising87 on November 17, 2020, 10:58:00 PM

I have no idea what happened as I did not initiate this transaction.

To be honest, I have no idea either.
Because the mobile and desktop versions both show the same behavior.

All I can suggest is to create a copy of your wallet by using "I already have a seed" and see if it will generate the same wallet and set of addresses.

-update-

Quote from: Rising87 on November 17, 2020, 10:58:00 PM

I apologize...The output is not green. 13 inputs are yellow, 1 output is green. This transaction was for my exact balance

Okay, you need to differentiate inputs from outputs, example (from testnet):
https://i.imgur.com/1ZgirbS.png

Your transaction shows that it has 14 inputs and 1 output.
So, what you mean is it has 13 yellow-highlighted inputs and 1 green-highlighted input.
The output is not highlighted.

We're now back to the possibility that your seed phrase was hacked.

Yes apologies. The output is not highlighted. Possibility it was hacked. Odd that the funds are still sitting there unused. I would think they would he moved by now.

nc50lc

legendary

Activity: 2534

Merit: 6080

Self-proclaimed Genius

Quote from: Rising87 on November 17, 2020, 10:58:00 PM

I have no idea what happened as I did not initiate this transaction.

To be honest, I have no idea either.
Because the mobile and desktop versions both show the same behavior.

All I can suggest is to create a copy of your wallet by using "I already have a seed" and see if it will generate the same wallet and set of addresses.

-update-

Quote from: Rising87 on November 17, 2020, 10:58:00 PM

I apologize...The output is not green. 13 inputs are yellow, 1 output is green. This transaction was for my exact balance

Okay, you need to differentiate inputs from outputs, example (from testnet):

Your transaction shows that it has 14 inputs and 1 output.
So, what you mean is it has 13 yellow-highlighted inputs and 1 green-highlighted input.
The output is not highlighted.

We're now back to the possibility that your seed phrase was hacked.

Rising87

newbie

Activity: 11

Merit: 3

Quote from: nc50lc on November 17, 2020, 10:42:55 PM

Quote from: Rising87 on November 17, 2020, 09:52:22 PM

Thank you very much for the suggestion and I went up to 1,000 and still not showing in my addresses.

It will be highlighted as "red" if it's out of your gap limit and "not highlighted" if it's not currently in the keypool.
There's definitely something weird going on here.

What's you're Electrum's version?

I was originally on 4.0.4 for mobile. Now on 4.0.4 desktop. The https://www.blockchain.com/btc/tx/4c00cfa1360b91fec3fe43b45f318d4810a4cd806069423ec8e103c694833493 transaction in Electrum shows yellow for all the inputs and green for the 1 output. However the output address is not in my addressees and using the ismine function is coming back as false. I have no idea what happened as I did not initiate this transaction.

I apologize...The output is not green. 13 inputs are yellow, 1 output is green. This transaction was for my exact balance

nc50lc

legendary

Activity: 2534

Merit: 6080

Self-proclaimed Genius

Quote from: Rising87 on November 17, 2020, 09:52:22 PM

Thank you very much for the suggestion and I went up to 1,000 and still not showing in my addresses.

It will be highlighted as "red" if it's out of your gap limit and "not highlighted" if it's not currently in the keypool.
There's definitely something weird going on here.

What's your Electrum's version?

-typo-

Rising87

newbie

Activity: 11

Merit: 3

Quote from: hosseinimr93 on November 17, 2020, 10:00:02 PM

Quote from: Rising87 on November 17, 2020, 09:52:22 PM

Sorry I meant 14 inputs are mine and the 1 output is green. However I went to console and did the ismine function and returned false. The address is not being shown in my addresses tab. No idea how Electrum is identifying this as green but not showing in my addresses.

Go to console tab and use the code below to generate more addresses.

Code:

[wallet.create_new_address(False) for i in range(50)]

The number 50 in the code above is number of addresses generated by Electrum. You can change it to any other number.

Thank you very much for the suggestion and I went up to 1,000 and still not showing in my addresses.

hosseinimr93

legendary

Activity: 2380

Merit: 5213

Quote from: Rising87 on November 17, 2020, 09:52:22 PM

Sorry I meant 14 inputs are mine and the 1 output is green. However I went to console and did the ismine function and returned false. The address is not being shown in my addresses tab. No idea how Electrum is identifying this as green but not showing in my addresses.

Go to console tab and use the code below to generate more addresses.

Code:

[wallet.create_new_address(False) for i in range(50)]

The number 50 in the code above is number of addresses generated by Electrum. You can change it to any other number.

Rising87

newbie

Activity: 11

Merit: 3

Quote from: hosseinimr93 on November 17, 2020, 09:46:22 PM

Quote from: Rising87 on November 17, 2020, 09:09:06 PM

So I got back onto the PC version. Its definitely a change address transaction because all the outputs are yellow with the receiving address green. I went to console to check if the address is mine and it return false. Is there any hope to get funds?

What do you mean by all the outputs? The transaction you posted has only 1 output. I think you meant inputs. right?

If that's the case, it means that all 14 inputs of the transaction had been used as change addresses before.
Also, the address highlighted in green is yours. If that's the receiving address, you should have access to the fund.

Sorry I meant 14 inputs are mine and the 1 output is green. However I went to console and did the ismine function and returned false. The address is not being shown in my addresses tab. No idea how Electrum is identifying this as green but not showing in my addresses.

hosseinimr93

legendary

Activity: 2380

Merit: 5213

Quote from: Rising87 on November 17, 2020, 09:09:06 PM

So I got back onto the PC version. Its definitely a change address transaction because all the outputs are yellow with the receiving address green. I went to console to check if the address is mine and it return false. Is there any hope to get funds?

What do you mean by all the outputs? The transaction you posted has only 1 output. I think you meant inputs. right?

If that's the case, it means that all 14 inputs of the transaction had been used as change addresses before.
Also, the address highlighted in green is yours. If that's the receiving address , you should have access to the fund.

Rising87

newbie

Activity: 11

Merit: 3

Quote from: Csmiami on November 17, 2020, 06:55:43 PM

Quote from: Rising87 on November 17, 2020, 06:35:41 PM

Actually a lot of these addresses on https://www.blockchain.com/btc/address/18Aq4fB8TAYcvg7hLBtzYCSvkvEpBgrykJ are matching my old change addresses from past transactions. How is this possible?

According to wallet explorer, all 14 inputs belong to the same wallet (I'm not sure how the site determines that though). Seeing the ammounts of satoshis in the tx, it doesn't really look like a hacker may have been bothered; some of the inputs are as small as 500 satoshis; and to me, this just looks like a transaction to consolidate all your small inputs. And all of the inputs are change addresses, used only once...

You saying that most of the addresses used there kind of reinforces that theory, so... Did you try installing the wallet in Electrum as it was suggested earlier? The app shouldn't create transactions by itself, but for what you've told, I'm pretty confident it was a consolidation tx. If you install Electrum on your computer, and check it's connected; check if the funds do show, and if they don't, try increasing the gap limit.

If none of that works, I'm pretty clueless. Bitcoin core does have a command to check whether an address belongs to the wallet in use; but I'm unaware of Electrum having a similar feature

So I got back onto the PC version. Its definitely a change address transaction because all the outputs are yellow with the receiving address green. I went to console to check if the address is mine and it return false. Is there any hope to get funds?

hosseinimr93

legendary

Activity: 2380

Merit: 5213

Quote from: Csmiami on November 17, 2020, 06:55:43 PM

According to wallet explorer, all 14 inputs belong to the same wallet (I'm not sure how the site determines that though).

Walletexplorer collect all addresses that have been spent together into a same wallet.
Assuming address A and address B are inputs of a transaction, walletexplorer put both of them in a same wallet. Also, if address C is spent with each of addresses A and B in any other transaction, address C will go to a same wallet too.
This is exactly why all those 14 addresses are in a same wallet.

Quote from: Csmiami on November 17, 2020, 06:55:43 PM

Bitcoin core does have a command to check whether an address belongs to the wallet in use; but I'm unaware of Electrum having a similar feature

In Electrum you need to use the command below.

Code:

ismine("address")

Csmiami

copper member

Activity: 1652

Merit: 1325

I'm sometimes known as "miniadmin"

Quote from: Rising87 on November 17, 2020, 06:35:41 PM

Actually a lot of these addresses on https://www.blockchain.com/btc/address/18Aq4fB8TAYcvg7hLBtzYCSvkvEpBgrykJ are matching my old change addresses from past transactions. How is this possible?

According to wallet explorer, all 14 inputs belong to the same wallet (I'm not sure how the site determines that though). Seeing the ammounts of satoshis in the tx, it doesn't really look like a hacker may have been bothered; some of the inputs are as small as 500 satoshis; and to me, this just looks like a transaction to consolidate all your small inputs. And all of the inputs are change addresses, used only once...

You saying that most of the addresses used there kind of reinforces that theory, so... Did you try installing the wallet in Electrum as it was suggested earlier? The app shouldn't create transactions by itself, but for what you've told, I'm pretty confident it was a consolidation tx. If you install Electrum on your computer, and check it's connected; check if the funds do show, and if they don't, try increasing the gap limit.

If none of that works, I'm pretty clueless. Bitcoin core does have a command to check whether an address belongs to the wallet in use; but I'm unaware of Electrum having a similar feature

Rising87

newbie

Activity: 11

Merit: 3

Quote from: Nhor1011 on November 17, 2020, 06:26:52 PM

Quote from: Rising87 on November 17, 2020, 03:20:35 PM

Hi all,

I've used Electrum a handful of times and stupidly thought change address were causing me to not be able to send close to full amounts in my wallet balance. My last transaction I turned change address off and it went through successfully. However there was a transaction the following day that I don't recall making and my balance is now at zero. I checked blockchain and the address the funds were sent to are unspent.

Is there anything I can do? Likely not but I figured it was worth a question to this group.

https://www.blockchain.com/btc/tx/4c00cfa1360b91fec3fe43b45f318d4810a4cd806069423ec8e103c694833493

Thanks in advance!

I think what you said is impossible having a transaction that you didn't know and make your balance zero. Maybe you just neglect that you made that transaction or there is someone that also know your private key and did that without your knowing. Always be careful with your private key to make your funds secured.

So this is the transaction that wiped out my balance https://www.blockchain.com/btc/address/18Aq4fB8TAYcvg7hLBtzYCSvkvEpBgrykJ Theres 14 addresses feeding into the where the funds were sent. I found that another address dated 9/21/20 actually matched a change address I had highlighted in yellow from Electrum. I have had several transactions between 9/21/20 and 11/12/20 using change addresses so wouldn't the balance have already been transferred out of the 9/21 address when I sent my next transaction with change address? How could this 9/21 address have feed bitcoin to this 11/13/20 transaction (url posted above)?

Actually a lot of these addresses on https://www.blockchain.com/btc/address/18Aq4fB8TAYcvg7hLBtzYCSvkvEpBgrykJ are matching my old change addresses from past transactions. How is this possible?

Nhor1011

member

Activity: 994

Merit: 11

Daxetoken.net

Quote from: Rising87 on November 17, 2020, 03:20:35 PM

Hi all,

I've used Electrum a handful of times and stupidly thought change address were causing me to not be able to send close to full amounts in my wallet balance. My last transaction I turned change address off and it went through successfully. However there was a transaction the following day that I don't recall making and my balance is now at zero. I checked blockchain and the address the funds were sent to are unspent.

Is there anything I can do? Likely not but I figured it was worth a question to this group.

https://www.blockchain.com/btc/tx/4c00cfa1360b91fec3fe43b45f318d4810a4cd806069423ec8e103c694833493

Thanks in advance!

I think what you said is impossible having a transaction that you didn't know and make your balance zero. Maybe you just neglect that you made that transaction or there is someone that also know your private key and did that without your knowing. Always be careful with your private key to make your funds secured.

Rising87

newbie

Activity: 11

Merit: 3

Thank you all for the help. Does it make it odd that the funds are still in the address it was sent to and are currently unspent? Also the transaction that mine was included with addresses where the originating deposit was back to March 2020. I used the same address as when I received the funds from the Bitcoin ATM. Could that have something to do with it?

o_e_l_e_o

legendary

Activity: 2268

Merit: 18711

Quote from: Rising87 on November 17, 2020, 04:24:58 PM

Its hidden as a screenshot in an unrelated folder within the Android Data System files.

That is the most likely culprit for how your coins were stolen. Your seed phrase should only ever be written down, as Electrum tells you when you create a new wallet, and never saved electronically in any format.

Quote from: Rising87 on November 17, 2020, 04:24:58 PM

If I make a new wallet and keep the seed phrase elsewhere then will I be safe going forward?

Possibly. Your wallet could also have been compromised from malware, or a key logger, or a fake Electrum app, and so on, although saving your seed phrase as a screenshot is the most likely. We don't know therefore if simply creating a new wallet on the same device will be safe enough.

Personally I wouldn't risk it. I would be looking to make sure whatever device I use next is clean by wiping it and installing a fresh OS.

BitMaxz

legendary

Activity: 3374

Merit: 3095

Playbet.io - Crypto Casino and Sportsbook

Quote from: Rising87 on November 17, 2020, 04:24:58 PM

Thats what I'm thinking. My balance is never at exactly zero. Usually there is some fraction of a bitcoin left there, however small it may be. My phone is fingerprint locked so I wonder how they got my seed. Its hidden as a screenshot in an unrelated folder within the Android Data System files. I downloaded the Windows Electrum version and the dot was green. If I make a new wallet and keep the seed phrase elsewhere then will I be safe going forward?

What phone model you currently use?
Most Chinese phone or clones are not secured and it's vulnerable to any threats the same as the rooted phone. If you are using these phones then you have a big problem.

The phone has always had an auto-sync feature that can sync most of your data including images so maybe the seed screenshot might be sync to your email and your email might be connected to another device and restored the backup seed image? It's just like if you take a picture from your phone it will appear also to other devices if your email is connected.

If you still have the seed from your phone try to import it to Electrum in Windows to check the balance and let's hope that your Bitcoin still there.

About your last question, we can't guarantee the safety of your wallet if you know that your laptop/PC is secured then your wallet is safe but before you install the Electrum you should verify the signature first to make sure the installer that you download is legit.

You can check these two guides on how to verify Electrum.
- How to verify Electrum (for Windows, Linux and Mac)
- [GUIDE] How to Safely Download and Verify Electrum [Guide]

Rising87

newbie

Activity: 11

Merit: 3

Quote from: o_e_l_e_o on November 17, 2020, 04:13:45 PM

Quote from: Rising87 on November 17, 2020, 03:47:41 PM

I did not send the transaction.

This is not an issue with change addresses then. Your wallet will not make transaction on its own, regardless of what selection you made regarding using or not using change addresses. If you absolutely did not make that transaction, then your wallet has been compromised and someone else has made that transaction to steal your coins.

Did anyone else have access to your phone? Where did you download the Android app from? How did you back up your seed phrase?

Thats what I'm thinking. My balance is never at exactly zero. Usually there is some fraction of a bitcoin left there, however small it may be. My phone is fingerprint locked so I wonder how they got my seed. Its hidden as a screenshot in an unrelated folder within the Android Data System files. I downloaded the Windows Electrum version and the dot was green. If I make a new wallet and keep the seed phrase elsewhere then will I be safe going forward?

o_e_l_e_o

legendary

Activity: 2268

Merit: 18711

Quote from: Rising87 on November 17, 2020, 03:47:41 PM

I did not send the transaction.

This is not an issue with change addresses then. Your wallet will not make transaction on its own, regardless of what selection you made regarding using or not using change addresses. If you absolutely did not make that transaction, then your wallet has been compromised and someone else has made that transaction to steal your coins.

Did anyone else have access to your phone? Where did you download the Android app from? How did you back up your seed phrase?

Rising87

newbie

Activity: 11

Merit: 3

Thank you so much for the quick response. I did not send the transaction. Unfortunately I use the Android app. Is there any way to check this step in the app from what you linked above?

Topic: Did not use change address and now balance is $0. Transaction Unspent. (Read 209 times)