Lost Bitcoines In A Transaction to Coinbase

Abdussamad

legendary

Activity: 3710

Merit: 1586

Quote from: o_e_l_e_o on July 29, 2021, 09:22:19 AM

The malicious Electrum wallets did not wait for the user to create a transaction, and simply swept all the funds as soon the wallet was opened.

Unless he had a password set. In that case the software waits until you try to spend bitcoin and enter the password to do so and then it steals from you.

o_e_l_e_o

legendary

Activity: 2268

Merit: 18771

Quote from: hosseinimr93 on July 29, 2021, 09:01:46 AM

Yes, Seems that OP is victim of the vulnerability in versions older than 3.3.4 and was deceived by the arbitrary message displayed when broadcasting a transaction.

Not necessarily. OP states he remembers copy and pasting the Coinbase address and creating the transaction. The malicious Electrum wallets did not wait for the user to create a transaction, and simply swept all the funds as soon the wallet was opened. It sounds more likely the OP either copied the wrong address from somewhere, or it was clipboard malware, rather than Electrum malware.

After poking around a bit more on the blockchain, some of the funds from the transaction which swept the address 1Q6Boa9VQxxcCCNDKK1dennXSud1m5ALAc end up on Bitstamp through the following chain of transactions:

https://mempool.space/tx/ce1cef757536327cee8ef5f8a5a452f46e90aa1eb4eaada1eaad49454faf5760
https://mempool.space/tx/c545b162ecad5e8b5d320964587bd3cd0e09e4e22097ca0a460d261d46f78c29
https://mempool.space/tx/e0d290721225f5eba1bf5d51ee81fe4131db890294604f968e058f34005a949b

Ending at address 36uwFSav1wadZMf7nWzg9SJg8RLFtUzmob, which is known to belong to Bistamp (or at least, it was, but hasn't been used in over a year).

I don't think you can do anything useful with this information, unless there is any chance at all you actually copied an address from a Bitstamp account by mistake, rather than a Coinbase account?

hosseinimr93

legendary

Activity: 2380

Merit: 5213

Quote from: Lucius on July 29, 2021, 05:22:44 AM

Given all the answers I read in this thread, we could very likely conclude that your transaction did not have its destination in the Coinbase wallet, but that you were a victim of clipboard malware or a fake Electrum wallet.

Yes, Seems that OP is victim of the vulnerability in versions older than 3.3.4 and was deceived by the arbitrary message displayed when broadcasting a transaction.
According to this post , he was using the version 3.0.6 before the update.
And as OP was probably scammed in the same way as that Reddit thread, I think he/she updated electrum through the link displayed by a dishonest server.

Pmalek

legendary

Activity: 2730

Merit: 7065

Quote from: OscarRu on July 29, 2021, 04:00:07 AM

Now all this is literally saying is, "there is nothing we can do... Good day sir"

That's exactly what they are saying, sorry!

Quote from: OscarRu on July 29, 2021, 04:00:07 AM

Though, is there really nothing I can do, given the blockchain information at hand?

In terms of getting your coins back, your chances are slim. There is no centralized authority or customer support in Bitcoin that can help you and Coinbase can't do anything either because the coins were never deposited in one of their wallets either. Use this bad experience as a learning opportunity download software from official sources and verify its authenticity.

Quote from: OscarRu on July 29, 2021, 04:00:07 AM

Does this perhaps look like I fell into a scam, as some people have quoted, and thus getting in touch with the authorities would be to no avail, given how the Blockchain works?

Looking at the info hosseinimr93 found, it looks like you were a victim of a scam, yes. Finding a person behind a bitcoin address is a difficult task otherwise people wouldn't use Bitcoin. If the scammer sent those coins to an exchange where he performed KYC, it would be doable. But the exchange will never give you that information. You would have to get law enforcement involved and the sum that went missing is simply not worth it. It's around $800 worth of bitcoin. The cost of trying to recover it and finding the culprit could be bigger. Like Lucius said, too much time has passed.

Lucius

legendary

Activity: 3234

Merit: 5637

Blackjack.fun-Free Raffle-Join&Win $50🎲

Quote from: OscarRu on July 29, 2021, 04:00:07 AM

Does this perhaps look like I fell into a scam, as some people have quoted, and thus getting in touch with the authorities would be to no avail, given how the Blockchain works?

Given all the answers I read in this thread, we could very likely conclude that your transaction did not have its destination in the Coinbase wallet, but that you were a victim of clipboard malware or a fake Electrum wallet. You can try to report the whole thing to the police, but given the time that has passed and the complexity of finding the real owner of that address, the chances of a positive outcome are really minimal.

OscarRu

newbie

Activity: 7

Merit: 5

Hello,

So finally some updates...

After months, I heard back from Coinbase today with the following reply;

"Dear Mr. ...,

Thank you for your patience. Please excuse the delay in getting back to us.

With the help of the transaction hash that you have attached to us, it is possible to publicly trace the route that the transaction has taken, which is also visible to you.

https://www.blockchain.com/btc/tx/ab7cc44f2916ccf0bdd45e95b089b66518344281bea059761b6b1bb56d6db4fb

The specified recipient address of the transaction is 1Q6Boa9VQxxcCCNDKK1dennXSud1m5ALAc.

Each transaction on the blockchain is irrevocable, the correct entry of the recipient address is the responsibility of the user.

If you have any further questions, please feel free to let us know."

Now all this is literally saying is, "there is nothing we can do... Good day sir"

Though, is there really nothing I can do, given the blockchain information at hand?

Does this perhaps look like I fell into a scam, as some people have quoted, and thus getting in touch with the authorities would be to no avail, given how the Blockchain works?

I'd be even willing to pay someone to help me retrieve these funds. Initially I had hoped that I had mistakenly sent my fund to another Coinbase address, though this does not seem to be the case, and now I am a bit downtrodden.

Sincerely appreciated everyone's help thus far though, thank you all.

HCP

legendary

Activity: 2086

Merit: 4363

Sounds like you might have downloaded one of the "fake" Electrum versions that steals your coins... The likely reason for it crashing when the "correct" password was entered would be that the wallet file have become corrupted or the "fake" version was trying to prevent you from seeing that your coins had been stolen...

Given that it works with a fresh install, I'd suspect that it's more than likely that the "fake" version was the source of your issues Undecided

All of this is rather moot at this point... given that the evidence found by hosseiminr93 would indicate that your coins were indeed "stolen". At this point, there really isn't anything you can do to recover those coins Undecided

OscarRu

newbie

Activity: 7

Merit: 5

To OP:

Did a pop-up message ask you to update electrum? If yes, what did you do?
What was the version of electrum?
[/quote]

It was version 3.0.6 when I originally downloaded it, im not sure if it asked me to update.

I crashes now when I put in my password, which is odd, as when I put in a wrong password it prompts the message; 'wrong password', yet when I put in the right password it closes.

Anyways, I re-downloaded Electrum and now it's working fine, though I can't seem to find out for certain if I updated the program at any point

hosseinimr93

legendary

Activity: 2380

Merit: 5213

The address OP's coins sent to belongs to this wallet.
The fifth address of the list (1KwRzmWAX1bX82us1G5uHzC8U5JorQEkPC) has been posted in following reddit thread.

All my BTC stolen from Electrum Wallet

Since both addresses (the one posted in reddit thread and the one posted here in this thread) probably have a same owner, it's likely that it's the same story.

To OP:

Did a pop-up message ask you to update electrum? If yes, what did you do?
What was the version of electrum?

khaled0111

legendary

Activity: 2744

Merit: 3097

Top Crypto Casino

I am not sure about this as I didn't dig deep enough.. But it looks like the sent coins (or coins that were linked to them at one point) ended up on one of Binance's hot wallets (1NDyJtNTjmwk5xPNhjgAMu4HDHigtobu1s)!

@op, do you have, by any chance, a Binance account? You can check your email to see if you've ever received a confirmation email from their part.

o_e_l_e_o

legendary

Activity: 2268

Merit: 18771

Quote from: Findingnemo on March 13, 2021, 04:09:43 AM

-snip-

So, that's certainly a possibility. However, looking at the onwards transaction, it looks much more like an exchange or service consolidating many inputs rather than the wallet of a scammer who has sent out clipboard malware. OP, could you have copied this address from somewhere else? Another exchange? A gambling site or sportsbook? Even a web wallet could consolidate deposits from multiple customers.

Check any other accounts you were using around the same time as this deposit was made, if you still have access to them. If not, then I would agree that this could be an atypical clipboard malware, and it would be worth reinstalling your OS to ensure your safety moving forwards.

Findingnemo

hero member

Activity: 2366

Merit: 793

Bitcoin = Financial freedom

Quote from: OscarRu on March 13, 2021, 03:58:40 AM

So I have these in front of me now, and sadly the listed bitcoin address does not match '1Q6Boa9VQxxcCCNDKK1dennXSud1m5ALAc', hence I must have sent it to a wrong address right? All I can remember is that it was generated by Coinbase and that i copy and pasted it.

So your device is infected with clipboard malware which used to replace the destination address you copied with the address injected by the hacker. Your device might be having the issues now as well so the only option is to reflash the OS or reset to factory settings to avoid this atleast in future.

OscarRu

newbie

Activity: 7

Merit: 5

Quote from: Findingnemo on March 06, 2021, 04:44:44 AM

Quote from: o_e_l_e_o on March 06, 2021, 03:03:34 AM

Quote from: Findingnemo on March 01, 2021, 09:45:26 PM

But I guess it is possible to see all the generated address in their account by logging into their desktop site.

Is this possible? I have no idea since I have never and will never own a Coinbase account, but if they do indeed show a list of all your previous deposit addresses then it should be trivial for OP to check if the address he sent coins to - 1Q6Boa9VQxxcCCNDKK1dennXSud1m5ALAc - is indeed associated with his Coinbase account or not.

Yes it is possible, and it can be seen only if user logged into their account and redirect to : https://www.coinbase.com/addresses

So they can see all the previous address used for deposit in the past since the account creation.

So I have these in front of me now, and sadly the listed bitcoin address does not match '1Q6Boa9VQxxcCCNDKK1dennXSud1m5ALAc', hence I must have sent it to a wrong address right? All I can remember is that it was generated by Coinbase and that i copy and pasted it.

Findingnemo

hero member

Activity: 2366

Merit: 793

Bitcoin = Financial freedom

Quote from: o_e_l_e_o on March 06, 2021, 03:03:34 AM

Quote from: Findingnemo on March 01, 2021, 09:45:26 PM

But I guess it is possible to see all the generated address in their account by logging into their desktop site.

Is this possible? I have no idea since I have never and will never own a Coinbase account, but if they do indeed show a list of all your previous deposit addresses then it should be trivial for OP to check if the address he sent coins to - 1Q6Boa9VQxxcCCNDKK1dennXSud1m5ALAc - is indeed associated with his Coinbase account or not.

Yes it is possible, and it can be seen only if user logged into their account and redirect to : https://www.coinbase.com/addresses

So they can see all the previous address used for deposit in the past since the account creation.

o_e_l_e_o

legendary

Activity: 2268

Merit: 18771

Quote from: seoincorporation on March 01, 2021, 04:14:19 PM

You should contact their support at the right time, now is a little late after 2 years. But maybe they can try to fix your problem,

It shouldn't matter. If he has sent coins to the correct address, then Coinbase have possession of them. Doesn't matter if it has been 2 days or 2 years; refusing to credit them to his account if they are in possession of them is theft.

Quote from: Findingnemo on March 01, 2021, 09:45:26 PM

But I guess it is possible to see all the generated address in their account by logging into their desktop site.

Is this possible? I have no idea since I have never and will never own a Coinbase account, but if they do indeed show a list of all your previous deposit addresses then it should be trivial for OP to check if the address he sent coins to - 1Q6Boa9VQxxcCCNDKK1dennXSud1m5ALAc - is indeed associated with his Coinbase account or not.

hulla

hero member

Activity: 1834

Merit: 566

Quote from: Findingnemo on March 01, 2021, 09:45:26 PM

Quote from: hulla on March 01, 2021, 04:49:11 AM

Quote from: Findingnemo on February 28, 2021, 11:02:56 AM

AFAIK, Coinbase webwallet will give new address everytime when you click the deposit address it doesn't mean if you send the coins to previously generated one was sent to a wrong address.

The last time I checked, coinbase generated new deposit address base on user requests.

But its just norml to get new address every time even if it is unused still you will get new address every time so a complete newbie may think that it was not the address where he send his coins.

Yes, it normal to get new address but the new addresses are not generated automatically cause it was program to generate base on user request and newbieeee only need to be sure the address was the exact deposit address provided on their coinbase account.

Quote from: Findingnemo on March 01, 2021, 09:45:26 PM

But I guess it is possible to see all the generated address in their account by logging into their desktop site.

Certainly.

Quote from: o_e_l_e_o on March 01, 2021, 04:54:15 AM

Quote from: hulla on March 01, 2021, 04:49:11 AM

Yes, it does not look like a wallet that belongss to a big exchange like coinbase. I check an old coinbase wallet I once used back in the year 2016 and it shows coinbase wallet to be 00000014ea not 00052e20f14c2c57.

Coinbase and other big exchanges have an unknown number of hot wallets and an unknown number of cold wallets, each with an unknown number of addresses in them. Only a small number of their wallets are publicly known about, and they will be generating new wallets and new addresses all the time to accommodate new customers and new deposits.

Agreed.

Findingnemo

hero member

Activity: 2366

Merit: 793

Bitcoin = Financial freedom

Quote from: hulla on March 01, 2021, 04:49:11 AM

Quote from: Findingnemo on February 28, 2021, 11:02:56 AM

AFAIK, Coinbase webwallet will give new address everytime when you click the deposit address it doesn't mean if you send the coins to previously generated one was sent to a wrong address.

The last time I checked, coinbase generated new deposit address base on user requests.

But its just norml to get new address every time even if it is unused still you will get new address every time so a complete newbie may think that it was not the address where he send his coins.

But I guess it is possible to see all the generated address in their account by logging into their desktop site.

HCP

legendary

Activity: 2086

Merit: 4363

Quote from: o_e_l_e_o on March 01, 2021, 04:54:15 AM

It is entirely possible that the address you used for Coinbase back in 2016 was part of one wallet "cluster", was consolidated with other deposits to this cluster, and was used to process withdrawals from this cluster, while OP used an address in another "cluster", and the two clusters never mixed.

Yes, re-reading my post, I realise that I perhaps should have made it clear that just because it isn't currently "linked" to Coinbase... does not mean that it isn't a Coinbase wallet... it just means that there is currently no "easy" way to say "This is a Coinbase address/wallet".

Quote from: o_e_l_e_o on March 01, 2021, 04:54:15 AM

...contact Coinbase, state they made a deposit to the address 1Q6Boa9VQxxcCCNDKK1dennXSud1m5ALAc, and ask why it was never credited to their account.

^^^ This

seoincorporation

legendary

Activity: 3346

Merit: 3130

You should contact their support at the right time, now is a little late after 2 years. But maybe they can try to fix your problem,

Bitcoin transactions don't just go to limbo... They get recorded on the blockchain, and that should be enough evidence for you to recover your coins.

o_e_l_e_o

legendary

Activity: 2268

Merit: 18771

Quote from: hulla on March 01, 2021, 04:49:11 AM

Yes, it does not look like a wallet that belongss to a big exchange like coinbase. I check an old coinbase wallet I once used back in the year 2016 and it shows coinbase wallet to be 00000014ea not 00052e20f14c2c57.

Coinbase and other big exchanges have an unknown number of hot wallets and an unknown number of cold wallets, each with an unknown number of addresses in them. Only a small number of their wallets are publicly known about, and they will be generating new wallets and new addresses all the time to accommodate new customers and new deposits.

It is entirely possible that the address you used for Coinbase back in 2016 was part of one wallet "cluster", was consolidated with other deposits to this cluster, and was used to process withdrawals from this cluster, while OP used an address in another "cluster", and the two clusters never mixed.

I'm sure some of the big blockchain analysis companies could analyze this transaction some more and discover whether or not it really did end up on Coinbase (or perhaps someone with a lot of time on their hands), but the quickest option for OP is simply to contact Coinbase, state they made a deposit to the address 1Q6Boa9VQxxcCCNDKK1dennXSud1m5ALAc, and ask why it was never credited to their account.

Topic: Lost Bitcoines In A Transaction to Coinbase (Read 426 times)