Electrum wallet just disappeared after a transaction

Abdussamad

legendary

Activity: 3710

Merit: 1586

Quote from: BitMaxz on May 22, 2020, 06:24:33 PM

The other thing is if your PC is infected with a hidden virus or Ransomware this virus can hide all of your files and folder. So if you have this virus this might be the reason why your wallet disappeared after using it.

spotily is not the same person as the OP who lost money. spotily bumped up this old thread because malware bytes stopped electrum from accessing an electrum server. i think that is his/her only concern.

BitMaxz

legendary

Activity: 3472

Merit: 3217

Playbet.io - Crypto Casino and Sportsbook

Quote from: Spotily on May 22, 2020, 06:05:53 AM

I think this is not the fake website.

Much better check the history of your browser as Abdussamad suggested above. You shouldn't compare the properties on IDM because they can make a fake Electrum address(Punny code URL). So I suggest you go to browser history as suggested above then copy the URL and paste it here. It will show the real URL if it is Punycode URL.

If you didn't check/verify the signature of the Electrum you downloaded there is a possibility that you downloaded a fake Electrum wallet.

Try to follow this guide below to verify the Electrum.
- How to verify Electrum (for Windows, Linux and Mac)

If the result is "Bad Signature" then you are using a fake Electrum wallet.

The other thing is if your PC is infected with a hidden virus or Ransomware this virus can hide all of your files and folder. So if you have this virus this might be the reason why your wallet disappeared after using it.

Try to install Kaspersky Total security in your device and scan the whole PC.

Abdussamad

legendary

Activity: 3710

Merit: 1586

Quote from: Spotily on May 22, 2020, 06:05:53 AM

Quote from: Abdussamad on May 22, 2020, 05:49:52 AM

all those claiming to have gotten electrum from the official website should go to their browser history and confirm the exact url they downloaded from. there are many fake sites that look official and legit.

I think this is not the fake website.

in that case you can whitelist it in malware bytes. it's probably just an electrum server. if it creates trouble for you can always switch to another.

pooya87

legendary

Activity: 3472

Merit: 10611

Quote from: Spotily on May 22, 2020, 06:05:53 AM

Quote from: Abdussamad on May 22, 2020, 05:49:52 AM

all those claiming to have gotten electrum from the official website should go to their browser history and confirm the exact url they downloaded from. there are many fake sites that look official and legit.

I think this is not the fake website.
https://i.imgur.com/xdrayE5.png

yes, that is the correct website but it is not the thing that you should spend time worrying about!
there are 2 and only 2 important steps which you must take to make sure you have the authentic compiled .exe file:

Step 1: Acquiring dev's PGP public key
figuring out what the real PGP public key of the real developer of this project (or any other project you want to verify) is. that can be done by asking a friend that you know or have the pub key of to sign the developer's pubkey and send it to you signed (that is what Web of Trust is all about) or if not possible at least search for multiple sources on the internet and check if all report the same public key. it can also be found on Electrum's github repository

Step 2: Verifying signature
use a PGP tool to verify the signature of the file you downloaded using the file + its signature + the public key you acquired in step 1. if the result of this step was successful then nothing else matters as long as you trust the Electrum developer.

andulolika

legendary

Activity: 2366

Merit: 1048

Electrum is fine, blockchain.com is fine, it happend to me with blockchain.com I didn't know what to blame, just a month or two ago, i turned my pc on and entered my wallet, i was expecting a transaction and waited, i went outside to smoke so i missed everything, by when i was back everything was gone, took me 9h to see the tx.

Most probably something i installed unless i had a corrupt version of OS which I doubt, I was using ubuntu and I checked the hashes but a wrong apt-get install and you fucked.

but you should see the transaction on the chain anyhow.
edit: merit to the dude below.

Spotily

newbie

Activity: 19

Merit: 0

Quote from: Abdussamad on May 22, 2020, 05:49:52 AM

all those claiming to have gotten electrum from the official website should go to their browser history and confirm the exact url they downloaded from. there are many fake sites that look official and legit.

I think this is not the fake website.
https://i.imgur.com/xdrayE5.png

Abdussamad

legendary

Activity: 3710

Merit: 1586

all those claiming to have gotten electrum from the official website should go to their browser history and confirm the exact url they downloaded from. there are many fake sites that look official and legit.

Spotily

newbie

Activity: 19

Merit: 0

Quote from: Luks82 on March 25, 2020, 10:51:39 AM

Just now, Malwarebytes blocked an attemp to connect to exs.ignorelist.com by the electrum 3.3.8 installer, saying its an exploit.... think we got the problem, and someone stole my money...

Same dude i got the installer in the official website of electrum.

TryNinja

legendary

Activity: 2758

Merit: 6830

Quote from: Lucius on March 25, 2020, 11:15:52 AM

I don't think server is a problem, other user is report same server blocked by MB - but he was definitely confirmed that Electrum is downloaded from official site. I leave little chance that both cases have something to do with the server in question.

I said that because I found the URL in this list: https://hodlister.co/server-verification.tx

But apparently its market as "are working as expected" (which I missed and only read "there are still some false-positives of scam servers detected as legitimate:", thinking the url is one of them), so you are probably right.

Lucius

legendary

Activity: 3234

Merit: 5637

Blackjack.fun-Free Raffle-Join&Win $50🎲

Quote from: Luks82 on March 25, 2020, 10:51:39 AM

Just now, Malwarebytes blocked an attemp to connect to exs.ignorelist.com by the electrum 3.3.8 installer, saying its an exploit.... think we got the problem, and someone stole my money...

MB sometimes block Electrum servers, but this does not have to mean that it is a real danger, only a false warning. As DireWolfM14 is say, you probably download fake version of Electrum - and you do that by using Google search and pick first result from the top which in most case is paid add used by hackers to scam you and others.

Coinbase is send coins to your Legacy address -> 1LCtHWuQvRG7SFvxsXZ8aXhiLYSoQXXDBd (https://www.blockchain.com/btc/address/1LCtHWuQvRG7SFvxsXZ8aXhiLYSoQXXDBd) then hacker is send this coins to bc1q03u7xehrht5ha7vgss8ulu3umlk5lzqt3z0yt2 (https://www.blockchain.com/btc/address/bc1q03u7xehrht5ha7vgss8ulu3umlk5lzqt3z0yt2) and it seems he was very busy in last few days - total balance moved through that address was 0.67187460 BTC.

Check your browsing history, try to find link to that Electrum site from where you download wallet - post it here by using option Insert Code so we can report it and take that site down.

Edit :

Quote from: TryNinja on March 25, 2020, 11:06:36 AM

I believe this server could be one of the ones which used to send fake messages to the users connected to them, telling the user to download a fake (and infected) update of the wallet.

I don't think server is a problem, other user is report same server blocked by MB - but he was definitely confirmed that Electrum is downloaded from official site. I leave little chance that both cases have something to do with the server in question.

Quote from: Electrum_LedgerNS_Issue on February 10, 2020, 10:24:29 AM

Downloaded Malwarebytes after it happened and ran a scan - only some PUPs but the realtime protection detected 2 things afterwards: Malicious site "exs[dot]ignorelist[dot]com pointing to electrum-3.3.8.exe and qualified as an exploit and endthefed[dot]onthewifi[dot]com pointing to electrum-3.3.8.exe qualified as "Phishing", so this might be a lead even if I don't see what a server can do to cause this.

TryNinja

legendary

Activity: 2758

Merit: 6830

Quote from: Luks82 on March 25, 2020, 10:51:39 AM

Just now, Malwarebytes blocked an attemp to connect to exs.ignorelist.com by the electrum 3.3.8 installer, saying its an exploit.... think we got the problem, and someone stole my money...

I believe this server could be one of the ones which used to send fake messages to the users connected to them, telling the user to download a fake (and infected) update of the wallet[1].

You probably downloaded an infected Electrum from a fake website (or your PC is already infected). From where did you download it? Go to your download history or browser history and see the exact website where you downloaded it from.

[1] https://hodlister.co/server-verification.txt

DireWolfM14

copper member

Activity: 2338

Merit: 4543

Join the world-leading crypto sportsbook NOW!

Quote from: Luks82 on March 25, 2020, 10:39:38 AM

Sorry, maybe im not explaining myself very well, english is not my mother language...
So, there is one transaction, from Coinbase to Electrum Wallet, then it happened something, including my electrum wallet crash, while this transaction was being made. When i managed to open electrum again, my wallet was gone, so i recovered it with the 12 words phrase. At that moment it showed me another transaction, from my electrum wallet to an outer wallet... this is the hash if you want to have a look a23c5255ea0b2a92fcefacc552fd4e5f530710ac7cb54eb7a2391e4124e16a0e
And this is my wallet with this two movements https://www.blockchain.com/btc/address/1LCtHWuQvRG7SFvxsXZ8aXhiLYSoQXXDBd
As i remember, while i was checking the transaction status i saw this other movement, but i thought it was part of the show...
Seems like i've been pissed and Phished in this show.

I think you have had your money stolen, and it sounds like you downloaded a malicious version of Electrum.

Quote from: Luks82 on March 25, 2020, 10:51:39 AM

Just now, Malwarebytes blocked an attemp to connect to exs.ignorelist.com by the electrum 3.3.8 installer, saying its an exploit.... think we got the problem, and someone stole my money...

Only download Electrum from here: https://electrum.org/#download
And learn to verify the download, here's a tutorial: https://bitcoinelectrum.com/how-to-verify-your-electrum-download/

I don't know how secure your computer is, but there may be some other malware installed. I'm of the philosophy of better safe than sorry, so you may want to nuke your OS and reinstall it from scratch.

Luks82

newbie

Activity: 7

Merit: 1

Just now, Malwarebytes blocked an attemp to connect to exs.ignorelist.com by the electrum 3.3.8 installer, saying its an exploit.... think we got the problem, and someone stole my money...

Luks82

newbie

Activity: 7

Merit: 1

Sorry, maybe im not explaining myself very well, english is not my mother language...
So, there is one transaction, from Coinbase to Electrum Wallet, then it happened something, including my electrum wallet crash, while this transaction was being made. When i managed to open electrum again, my wallet was gone, so i recovered it with the 12 words phrase. At that moment it showed me another transaction, from my electrum wallet to an outer wallet... this is the hash if you want to have a look a23c5255ea0b2a92fcefacc552fd4e5f530710ac7cb54eb7a2391e4124e16a0e
And this is my wallet with this two movements https://www.blockchain.com/btc/address/1LCtHWuQvRG7SFvxsXZ8aXhiLYSoQXXDBd
As i remember, while i was checking the transaction status i saw this other movement, but i thought it was part of the show...
Seems like i've been pissed and Phished in this show.

DireWolfM14

copper member

Activity: 2338

Merit: 4543

Join the world-leading crypto sportsbook NOW!

Quote from: Luks82 on March 25, 2020, 09:32:49 AM

Is it possible that due a first failed attempt to verificate the transaction, a secondary transaction was made?

That's not quite how bitcoin works. Each block that includes your transaction counts for one confirmation. I'm not exactly sure what you mean the first transaction failing. If your wallet software crashed, that has no affect on the blockchain transaction that you initiated with Coinbase.

Quote from: Luks82 on March 25, 2020, 09:32:49 AM

i see in my wallet now that i received the BTCs, but now its another order wich i didnt made, but this one in sending the money out...
this looks bad isnt it?

If you login to your Coinbase account, and click on the "portfolio" tab, on the right you'll find a column with your recent transactions. Click on the most recent one, then click on "view transaction. That will send you to a blockchain explorer. In your Electrum software, on the history tab, right click on the incoming transaction, and select view on blockchain explorer. The transaction IDs should be the same.

OmegaStarScream

staff

Activity: 3500

Merit: 6152

Quote from: Luks82 on March 25, 2020, 09:32:49 AM

Is it possible that due a first failed attempt to verificate the transaction, a secondary transaction was made?
i see in my wallet now that i received the BTCs, but now its another order wich i didnt made, but this one in sending the money out...
this looks bad isnt it?

It's starting to become difficult to understand what's the issue here but It definitely looks like someone has access to your wallet/computer.

Is the transaction from Coinbase to Electrum the only one you made yourself? If so, please provide us with the receiving address (you can find that by going to your Coinbase transactions history).

Luks82

newbie

Activity: 7

Merit: 1

Is it possible that due a first failed attempt to verificate the transaction, a secondary transaction was made?
i see in my wallet now that i received the BTCs, but now its another order wich i didnt made, but this one in sending the money out...
this looks bad isnt it?

Luks82

newbie

Activity: 7

Merit: 1

Yes, it maybe just went off, but strange thing is my wallet disappeared... thank you for your advice!

AdolfinWolf

legendary

Activity: 1946

Merit: 1427

Quote from: Luks82 on March 25, 2020, 07:56:32 AM

Hi and thank you,
i just did what you said not to do Embarrassed

i recovered the seed with the 12 words.... and made a copy of the wallet, but i dont know why it happened, some phishing attemp?
should i do something else to secure it?

Well, is your money still there? If so, it might just be your hard drive / other hardware that is failing you, or a corrupt operating system.

If your money is gone, you are likely infected, either a trojan, keylogger, or perhaps you downloaded a malicious version of electrum.

In both cases it would be smart to either update your HDD/do some virus scans and perhaps a factory reset. Again, you've given us very little information, so i neither know what the issue is, i do know you should be very careful with storing more money on that device.

Can you maybe follow this guide and check if your download of Electrum is legit? https://bitzuma.com/posts/how-to-verify-an-electrum-download-on-windows/

jackg

copper member

Activity: 2856

Merit: 3071

https://bit.ly/387FXHi lightning theory

Quote from: Luks82 on March 25, 2020, 08:03:22 AM

yes, sorry, i forgot to say that, i downloaded it from official page

Definitely? As in you typed electrum.org?

Topic: Electrum wallet just disappeared after a transaction (Read 311 times)