Topic: How to recover my btc (Read 115 times)

But wait…
For you to have made the RBF that means you have access to the wallet as well, just that both of you  have access to the wallet(so it’s more like race to securing the fund), and you double spending means the transaction of the  funds should be in one of your address if the output still remains the same as it was when you initiated the “cancel order “.
Hence, I’m also interested in this ,was it more like a friendship wallet( how did  you manage to share something secret)just curious how/what really lead to that… seem you aren’t replying any comment since.

You're not wrong. As far as I know and understand RBF there's no first and second (or old and new) transaction in the mempool when an older transaction is replaced by RBF with a newer transaction. The replaced transaction gets evicted from the mempool as soon as when the node accepts the replacement transaction in its mempool. So there's only the new transaction as replacement left in the node's mempool and waiting to be confirmed in one of the next blocks.

If some node's mempool doesn't have the newer replacement transaction, but only the original older one for whatever reasons (no conditionless Full-RBF e.g. or the newer replacement transaction didn't reach the node yet), once the double-spending replacement transaction gets confirmed the original older transaction becomes invalid and is dropped

I felt the need to be accurate here to avoid someone might get a false sense of the mechanics.


Only the sender or those who control private keys of old transaction's inputs (commonly only the sender) can do RBF. Receiver or sender can do CPFP.


The OP didn't provide unambiguous details, so it's a bit foggy what happened, but I believe what you describe is the very likely scenario. Fenerch's wallet recovery words were mistakenly disclosed to whomever and thus giving away control of his own wallet.

Some details remain unclear and I hope for some more clarification (OP was active today e.g.), so that everybody can learn from what bad things happened here.

If you successfully canceled the transaction, you should still be able to see the balance in your current wallet because it was simply sent to a change address in the same wallet that you own.

You should be able to see it rightaway in your total balance if you don't make any new transaction again from the same wallet the scammer might send it again to a new address that you don't own.

If I were you do it right now create a new wallet on different device and get a new BTC address and send them to this new wallet.

Or maybe it shows no balance? If that is the case, it is possible that the scammer made a new transaction after you cancelled the previous one. Because the scammer has complete control over your wallet, he can react immediately if you cancel the transaction and make a new one.
If that happens, and the transaction has already received one confirmation, there is no way to recover it.

They are similar but quite and differead as you have learnt yes the RBF is used to speed up transaction by increasing the transaction fee, the CPFP too can be use to speed up transactions but unlike the RBF which requires the key of the sending address, the receiver can use this too to speed up the transaction by CFPF which combines the required transaction fee of the parent transaction and the child transaction and then pumps or increase them so that the parent transaction can be added to the blockchain faster.

For RBF it is when the the second transaction gets confirmed that  the old one gets invalidate totally because of double spending rules.

A sender does RBF and a Receiver uses CPFP

To whom did you give your 12 mnemonic recovery words? You should've known that this is an absolute no-no-never. Even when you think it's embarrassing, it would be interesting to know how you were tricked to disclose your recovery words to someone else.

How do you know it's not the scammer's address?


Totally...

If you don't control the private key for "that another wallet address" then there  is no way to send them back ^{except the good will of those who control it at this moment}.

I also can not get How did you manage to share your SEED phrase in the course of transaction. ^{Did someone ask/force you to do this?}

Well it seems I actually mixed up two things here. Because RBF is used for transactions most times to speed them up  I ignored the fact that the creation of a new transaction hash would mean double spending the transaction but I think the clearest difference between both of them I can clearly spot now is that for RBF the parent transaction gets invalidated but in CPFP the parent transaction gets confirmed because of the child transaction.

I went through the post and some other threads on CPFP and RBF here on the forum and I've been able to understand them better. Thanks khaled0111 and Cricktor.

Electrum's "cancel" feature doesn't send to an address that's not belong to your wallet, it'll send to your change address.
However, the replacement transaction is still has opt-in RBF true flag so it's still up for replacement.
Besides, most nodes and miners accept replacements even without opt-in RBF flag.

"Cancel" isn't a solution to counter hacked seed phrase or private keys, it's for correcting mistakenly typed/pasted output.

Without knowing the transaction ID, it's still fairly easy to tell what happened:
Since another person has your seed phrase, your cancel transaction was immediately got replaced by that person the second you've broadcasted it.
Most of the time, it's automated that all it needs is a second to broadcast a replacement once they've receive your "cancel transaction" to their mempool.
If you didn't monitored the cancel unconfirmed transaction in your transaction history, you wouldn't notice that it changed output because the perpetrator broadcasted another replacement.

It would've been a race of who'll broadcast a replacement last or until the send amount is mostly allocated as fee, until the lucky txn get relayed to a miner who successfully mined the next block.

This is not what Electrum does when you cancel a yet unconfirmed but published transaction. A CPFP (Child Pay For Parent) transaction would spend one or more yet unconfirmed transaction outputs of the parent transaction to new transaction outputs, i.e. when confirmed there would be two transactions, the parent and the child transaction on the blockchain.

When you ask Electrum to cancel a pending unconfirmed transaction the original transaction is RBF replaced with a transaction that effectively double-spends your original transaction's inputs to a new address of your own wallet. This funds returning double-spend transaction needs to pay higher fees than the original replaced transaction. When it gets confirmed there's only the replacing transaction on the blockchain, the original one got evicted earlier from the mempool, because it got replaced by a more favourable transaction due to higher fees.

For a cancel transaction to work the original transaction needs to have RBF enabled (default for Electrum since some versions) and you need to have all private keys of the original transaction's inputs. This is usually the case when you cancel a transaction that has been submitted from your own wallet.

Since it’s your wallet seed that got compromized then you shouldn’t have used the cancel feature. You should’ve sent the coins to a completely different and secure wallet.
Do you mind sharing the transaction ID? The culprit most likely replaced your second transacion with a new one and send the coins to a different address.
How do you know it doesn’t belong to him?

While CPFP and RBF are mainly used to accelerate transactions, they are completely different and don’t work the same way:
https://bitcointalksearch.org/topic/how-replace-by-fee-rbf-an-child-pays-for-parent-cpfp-can-speed-up-confirmati-5309234

If the BTC is already sitting in another wallet address, can it still come back to mine?
thanks.

Your approach to try stopping them was wrong if you ask me because the RBF transaction you created was a new transaction with a new hash to an address in the same wallet that has been compromised but with a higher fee. When you hit the cancel transaction button on Electrum it uses RBF to return the funds back to an address in your wallet by double spending with a higher fee.

What the cancel transaction button does is re-spend the unconfirmed transaction with a higher fee and it works because miners prioritise transactions with higher fees so the new RBF transaction gets confirmed first leaving the initial one invalid since the coins have been spent already.
You should be making an RBF to a new wallet instead (one that hasn't been compromised)

I use Electrum. I mistakenly gave my 12 words. the address holding the asset now is not my own and it is not the scammer address too

I don’t see the link between "max" and "replace by fee" to be honest!
You can cancel (replace by fee) any transaction even if it doesn’t spend all your balance as long as the transaction hasn’t been confirmed.

If you have canceled the pending transaction sucessfully then your coins should be sent to one of your wallet addresses. It doesn’t have to be the same address you sent the coins from.
Which wallet are you using?

hello,
i was almost scammed today, but luckily, the scammer send out 'MAX' which made it possible for me to cancel with a replace by fee. however when i used this, my btc got sent to a different address and i don't know what to do to recover now.