Topic: Lost Bitcoin - page 3. (Read 4303 times)

I also lost my BTC

If they are stolen you wont get them back. Scan with malwarebytes and hijackthis ,try to figure out how you got hacked,infected.  Any remote administration tool installed ? RDP,VNC,TW etc...

You are right. Now I also think that was a steal. And I understand - Bitcoins not return ...
Linux ... One word - late.

In conclusion - thank you all for your participation and your time.

P.S.  If anyone have an idea on how to return the stolen - will be grateful (in PM)

It is essential that you at least run Linux if you're dealing with crypto. Windows is complete malware-filled trash and you just can't protect youself from it - antivirus programs are frequently not detecting them. Sorry to say, but it seems that your BTCs has been stolen.

Read the thread before posting, his coins were definitely stolen.

that must suck, the rat must be FUD, maybe i can help you out if u got skype

No, I did not import keys

To the best ability that we can, I think we've confirmed that the 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t is not a change address.

There is a transaction in the blockchain that sends to both 1Cy21mnkUMvZdJW4rDe7Z5ey9sbcZhzzfL and 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t.

Therefore, it looks like 1Cy21mnkUMvZdJW4rDe7Z5ey9sbcZhzzfL is the change address (since it returns "ismine" : true) and 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t is the address that was actually sent to.

Since both addresses received in the same transaction, and 1Cy21mnkUMvZdJW4rDe7Z5ey9sbcZhzzfL is in the wallet.dat, it looks like you have the correct wallet.dat.  I don't think you are going to find 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t in any backups.

At this point, unless any other evidence turns up, I don't think you'll be able to recover these bitcoins.

As for how it happened, I really don't know.  It seems pretty certain that a thief managed to get access to your unencrypted wallet.dat from somewhere.  A keylogger installed on your computer would be the first guess.  A trojan that waits for you to type your password and then steals the unencrypted content would be another possibility.  Have you imported the wallet.dat file (or private keys) into any other wallets?

I thought so too... The system is installed Avast Internet Security, I also scanned the computer itself Avast and two anti-virus scanners (DrWeb & avz from Kaspersky Lab). Keyloggers not found!

Yes!
On the Russian forum is the message " пароли более 12 знаков" (translate - passwords for more than 12 characters). Their 13 

One moment. When upgrading to version 0.9.1 appeared similar message
http://s52.radikal.ru/i138/1405/3f/aec7e6cf4357.png
Translate:
Database blocks corrupted. To rebuild the database blocks right now?

After the rebuild appeared transaction.

Rem.: The program downloaded from the official site...
P.S.This screenshot was received when trying to install the old version of the program. But he is the same... Very strange circumstances...

So I assume it was a keylogger? I searched google and heathcliff posted on a russian forum that his wallet was encrypted with a password of 12 characters or something.

That is valid, the original one shows as:


Which is not valid.


I suspect that you've been hacked too.

18:53:12

validateaddress 1Cy21mnkUMvZdJW4rDe7Z5ey9sbcZhzzfL


18:53:12

{
"isvalid" : true,
"address" : "1Cy21mnkUMvZdJW4rDe7Z5ey9sbcZhzzfL",
"ismine" : true,
"isscript" : false,
"pubkey" : "028ac26a7c31b1cbcecd5b9db3912181501f72e43baea4eb831e4e0cb24824b438",
"iscompressed" : true
}


18:54:40

validateaddress 1FYS8yVDbGxaz8xkBsb53TQQ1jPrcYC17y


18:54:40

{
"isvalid" : true,
"address" : "1FYS8yVDbGxaz8xkBsb53TQQ1jPrcYC17y",
"ismine" : true,
"isscript" : false,
"pubkey" : "0251cb9e2c6d7036df4f172df0793cc9c618b7d036833eea115db4ceb3861a7ae9",
"iscompressed" : true
}


18:54:54

validateaddress 1GJ5Yy7SjDo1Bjgtqr4tPhGTu3Kz9mfkZ5


18:54:54

{
"isvalid" : true,
"address" : "1GJ5Yy7SjDo1Bjgtqr4tPhGTu3Kz9mfkZ5",
"ismine" : true,
"isscript" : false,
"pubkey" : "02008283a25965c101eae73044bc6b919f1623055464d225a6890f1cabdaefb701",
"iscompressed" : true
}


18:55:11

validateaddress 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t


18:55:11

{
"isvalid" : true,
"address" : "1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t",
"ismine" : false
}

The password is very complex (13 characters, including letters of different case, numbers and symbols). The password is not repeated anywhere, is used only in the wallet

I suspect that you have been hacked and the bitcoins are stolen and gone.  If I'm correct, then the thief seems to also control the following addresses:

1BcVNE8cYrHz6B6ECnJTgArTTTzzPw6tHw (where he received 0.1 BTC from 1KjGrZXG25UTHUFVdPJMEQFEqMsvyAsaie on 2014-05-07 15:34 UTC)

1LXFmDPtQmBHSVoQLSP17xU8Fztd75yusR (where he received 0.02026933 BTC on 2014-05-07 15:33 UTC)

1HJD4K4C2GwBLkARjQwqsdyaFbRVFu1jgc (this the the final address that your bitcoins were sent to.  They were held in 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t for 3 days from 2014-05-08 10:35 UTC until 2014-05-11 13:58 UTC when they were transferred to this address along with the 0.12026933 BTC from the other two addresses)

Please load up the original wallet (the one that has the two transactions that made your bitcoins disappear).

Then in the "Help" menu, choose "Debug Window".

In the "Debug Window", choose "Console".

Then enter the following four commands:


I believe that you'll find that the first three commands will return:

"isvalid" : true

and

"ismine" : true

The last one will almost certainly return

"ismine" : false

If so, and if you did not intentionally send to 1MbDKqngwKQ49TowToHGc9nZBRt99CqK8t then a thief gained access to the private keys in your wallet.  Did you protect your wallet with a strong password?

By the way, is your wallet encrypted?

byt411,
Thank you very much for Your help and time!

I have no idea how that happened then. I was guessing that it was just a change address, but it isn't. PM DannyHamilton, he can help.

These addresses are not mine, I received BTC from 1ByxEhE82qZxABhtsaj3yDJoJ26LV1YNF5 and 1LN9Zi1nWpNDnRHyJ2UacZdCtiVp3n2UrG

This problem happened too much recently and im afraid to say your BTC gto stolen. im not sure but good luck

Were these addresses also yours?
1ByxEhE82qZxABhtsaj3yDJoJ26LV1YNF5
1ErU6w2UkWrnWLt91YRzGTgFmBAC3LZ3EY
1LN9Zi1nWpNDnRHyJ2UacZdCtiVp3n2UrG