Topic: funds immediately leaving electron wallet after receiving from TestNet faucet - page 2. (Read 301 times)

This is getting stranger by the minute.
I've created another public KEY, this time I didn't even look at the prive key.
i've created on the wallet that I'm developing using NBitcoin library.
I'm compiling everything from source code
Then I requested to a couple of faucets some test coins and when I'm looking into the block chain this is what I see:

The public address is "mwT5PqSoLCeojDhghhBdXFCMMwGYxb34Ge"
I've received 3 "payments" from 3 different faucets (all on the same block).
But at the same time all of them where spend and when to the same address as on the prevues testes, and all of this happened on the same "block"
and based on the timestamps at the same time.
How can this be possible?

On the bright side we can rule out "a compromised" Electrum (which by the way I did downloaded from the official site + verified the signature)

   "Transaction": [
      {
         "TransactionId": "02e8df6726862abb55f509882b0c8e461847bb4f06c30aa3bc7728fddf7af7c3",
         "n": 1,
         "value": "0.02844292",
         "scriptPubKey_address": "mwT5PqSoLCeojDhghhBdXFCMMwGYxb34Ge",
         "datetime": "2022-10-21T17:06:49",
         "Used": {
            "UsedId": "066c68d50edebc57dbb35e4a16c45cdc740c83e920b6d05c22a382904839d075",
            "UsedN": 1,
            "UsedDateTime": "2022-10-21T17:06:49",
            "UsedTo": [
               {
                  "scriptPubKey_address": "mjuKUaEPi2FXEtRNZRNUxdHAf7499npQ3j",
                  "n": 0,
                  "value": "0.02821192"
               }
            ]
         }
      },
      {
         "TransactionId": "5598cb033f74571b7008548c0d2934ee5a1473d49b916cfacf432848aea8dfee",
         "n": 1,
         "value": "0.00066664",
         "scriptPubKey_address": "mwT5PqSoLCeojDhghhBdXFCMMwGYxb34Ge",
         "datetime": "2022-10-21T17:06:49",
         "Used": {
            "UsedId": "e46c907ae25eeed9cb73c3fa095c21c2e36fdb7d597d13e693f52435330fff66",
            "UsedN": 1,
            "UsedDateTime": "2022-10-21T17:06:49",
            "UsedTo": [
               {
                  "scriptPubKey_address": "mjuKUaEPi2FXEtRNZRNUxdHAf7499npQ3j",
                  "n": 0,
                  "value": "0.00043564"
               }
            ]
         }
      },
      {
         "TransactionId": "65ceb923844fd8761751ab8584f4170ee6760b250e2ad19dcd66f5d8a618ce8d",
         "n": 0,
         "value": "0.00010000",
         "scriptPubKey_address": "mwT5PqSoLCeojDhghhBdXFCMMwGYxb34Ge",
         "datetime": "2022-10-21T17:06:49",
         "Used": {
            "UsedId": "6efbcda30b63948fba9bcae84976dfad16769feb593275a9cc34eff035a64726",
            "UsedN": 0,
            "UsedDateTime": "2022-10-21T17:06:49",
            "UsedTo": [
               {
                  "scriptPubKey_address": "mjuKUaEPi2FXEtRNZRNUxdHAf7499npQ3j",
                  "n": 0,
                  "value": "0.00009488"
               }
            ]
         }
      }
   ]
}

My vote goes towards a malicious clone of Electrum and/or somebody else having your wallet's seed (btw, if you translate your writing to English to post here, you may want to fix Electrum's name; make also sure you get the original names from here, not translated ones).
Get another Electrum, make sure you get it from https://Electrum.org, also make sure you verify the downloaded Electrum. Install and play with this one.
At runtime check that you have version 4.3.2, i.e. you're using the new one.

Of course, make with this new Electrum a completely new wallet, don't restore the old.

Both of the addresses you imported into Electrum send your coins to the same address: mjuKUaEPi2FXEtRNZRNUxdHAf7499npQ3j which received more than 110 tBTC!

It seems like the problem is coming from the code/plug-in you're using to generate the WIF keys. Where did you get it from?
But why would someone write a malicious code to steal testnet coins! Or des it generate mainnet addresses too?

To be sure this is indeed the cause of the problem: create a wallet with Electrum and see if the problem persist. If it does, then either your device is compromised or you're using a fake version of Electrum.

In security critical scenarios you can't really figure out what application you are running by looking at the about page. What you needed to do was to first get the digital signature of the installation file you used to install this application and then find a way to acquire the correct public key of the real author of the application you think you are running (in this case Electrum in which case pubkeys are found on github). And finally to verify the signature.

Try to create a new key from your wallet, derive the testnet bitcoin address and fund that address without importing the WIF prvKey to Electrum.
See if the funds will still be wiped out.

If it does, then there's something wrong with your wallet.
If it didn't, then it's your "Electron" or something between the WIF export->import.

This is the "about"

--------------------------
Version 4.2.2

Electrum's focus is speed, with low resource usage and simplifying Bitcoin. You do not need to perform regular backups, because your wallet can be recovered from a secret phrase that you can memorize or write on paper. Startup times are instant because it operates in conjunction with high-performance servers that handle the most complicated parts of the Bitcoin system.

Uses icons from the Icons8 icon pack (icons8.com).
--------------------------

Are you sure that you are using Electrum or electron wallet?
If its electron then you are using a fake Electrum wallet better uninstall that wallet and download the original Electrum from electrum.org.

Then make a new wallet again for testnet let see if your issue solved.

You probably made a typo, but it may worth mentioning that it's neither electron nor electors. The wallet is called Electrum.

Anyways, it's possible that your computer is infected with a malware or you are using a fake version of electrum, however I don't know why a hacker should steal worthless testnet coins.
Where did you download electrum from? Did you download electrum from its official website (electrum.org) or somewhere else?

I just did another test.
I've created a new Key from my wallet and instad of copying and pasting it into election I type the WIF (one character at a time :-) )
When I request coins from a faucet , I experience the same problem
her's the new public address:

mvj3tFakMuFx15FewGtzpdhvxtrw5trvhw

https://blockstream.info/testnet/address/mvj3tFakMuFx15FewGtzpdhvxtrw5trvhw

Any idea what is happening???
Thanks

I've crated a wallet on electors importing a WIF (just one address).
After that I've requested several coins from faucets on Testnet.
When I see the history of transactions very time I receive some coins is immediately sent to a new address.
This is the public address:

muYbXen3W19pCrKapW9cEUdwvqoP7LV9ZH

Here's a link to a test explorer with the addresss:

https://blockstream.info/testnet/address/muYbXen3W19pCrKapW9cEUdwvqoP7LV9ZH

This is a brand new address that I've created on a wallet that I'm developing and imported the WIF in electrum.

Could this bee some type of "malware plugin" that recored the WIF when I've moved from one wallet to the other?
Has somebody else seen something like this?

Here's a JSON of each Vout and Vin

{
   "Transaction": [
      {
         "TransactionId": "8457733c113568bb53eba8a6d3160f6932bf167b916a1d3c31f76e43a6b1d3ec",
         "n": 1,
         "value": "0.01922572",
         "scriptPubKey_address": "muYbXen3W19pCrKapW9cEUdwvqoP7LV9ZH",
         "datetime": "2022-10-20T19:52:28",
         "Used": {
            "UsedId": "b335d8e6f2ab6ea69677c46841aa47804433b198b313504b2c0b0e4259afc7eb",
            "UsedN": 1,
            "UsedDateTime": "2022-10-20T19:52:28",
            "UsedTo": [
               {
                  "scriptPubKey_address": "mjuKUaEPi2FXEtRNZRNUxdHAf7499npQ3j",
                  "n": 0,
                  "value": "0.01899472"
               }
            ]
         }
      },
      {
         "TransactionId": "89721265fb77dac877ca687e151a20f495d6fa60737146d9a9f2ddab522d4411",
         "n": 0,
         "value": "0.00031480",
         "scriptPubKey_address": "muYbXen3W19pCrKapW9cEUdwvqoP7LV9ZH",
         "datetime": "2022-10-20T19:52:28",
         "Used": {
            "UsedId": "ebd7af5aad4c08641723c88496c7fa2f444b329473ea01ffbdc7ee61327b2fbe",
            "UsedN": 0,
            "UsedDateTime": "2022-10-20T19:52:28",
            "UsedTo": [
               {
                  "scriptPubKey_address": "mjuKUaEPi2FXEtRNZRNUxdHAf7499npQ3j",
                  "n": 0,
                  "value": "0.00008380"
               }
            ]
         }
      },
      {
         "TransactionId": "a4d28ef0c9c714db2b247262bf5ff8088d859ff8cad833a9456198ee9fd9d853",
         "n": 1,
         "value": "0.00050000",
         "scriptPubKey_address": "muYbXen3W19pCrKapW9cEUdwvqoP7LV9ZH",
         "datetime": "2022-10-20T19:52:28",
         "Used": {
            "UsedId": "0244a84c9f2d4a04d979e8fabe5b1e2baa4f75f3914c51619b00f00782a1e0c4",
            "UsedN": 1,
            "UsedDateTime": "2022-10-20T19:52:28",
            "UsedTo": [
               {
                  "scriptPubKey_address": "mjuKUaEPi2FXEtRNZRNUxdHAf7499npQ3j",
                  "n": 0,
                  "value": "0.00026900"
               }
            ]
         }
      },
      {
         "TransactionId": "c875f88f9f2ba613ec902f46588126ec6d1bb1bcedfc1ce62d006620fddb4b3a",
         "n": 1,
         "value": "0.00010000",
         "scriptPubKey_address": "muYbXen3W19pCrKapW9cEUdwvqoP7LV9ZH",
         "datetime": "2022-10-20T21:39:10",
         "Used": {
            "UsedId": "ee6243dfbe9964512a807286c32c3b1603958b559825c61fa316e0d4f5d24d9a",
            "UsedN": 1,
            "UsedDateTime": "2022-10-20T21:39:10",
            "UsedTo": [
               {
                  "scriptPubKey_address": "mjuKUaEPi2FXEtRNZRNUxdHAf7499npQ3j",
                  "n": 0,
                  "value": "0.00009488"
               }
            ]
         }
      },
      {
         "TransactionId": "ec3f4ab0bca77aca9a9b9ac2c035d2d2c8e3079bac121a335f2ecff0cf4e7ee2",
         "n": 1,
         "value": "0.00010000",
         "scriptPubKey_address": "muYbXen3W19pCrKapW9cEUdwvqoP7LV9ZH",
         "datetime": "2022-10-20T19:37:50",
         "Used": {
            "UsedId": "afc03d24ee2311a40ed98e97c8e3a5b5d783267a6a691c23727f0176a546fa72",
            "UsedN": 1,
            "UsedDateTime": "2022-10-20T19:37:50",
            "UsedTo": [
               {
                  "scriptPubKey_address": "mjuKUaEPi2FXEtRNZRNUxdHAf7499npQ3j",
                  "n": 0,
                  "value": "0.00009488"
               }
            ]
         }
      }
   ]
}