Topic: Lost seed recovered BTC stolen (Read 747 times)

Yes this is only possibility any the theft is not from outside but inside , As i follow crypto cases i have found a person that can hack people hardware wallet and therefore we cant says that hardware wallet is 100% safe but if you lose then there is a little chance that anyone in the future can stole your crypto ,
Friends in the field of crypto we are our banks our owner and its our responsibility to protect our self from scam .

FYI, OP already stated his words/seed phrase doesn't even work.


Aside from what @nc50lc said, technically most devices are susceptible to hacking.

Electrum isn't a company, it an open-source client which is being developed by volunteer developers.
For reference, here's their license: github.com/spesmilo/electrum/blob/master/LICENCE
In other words, they aren't liable to any lost funds caused by either a bug or a vulnerability in the client.

Electrum isn't a custodial wallet either so there's no way to verify the cause of lost of funds but the user himself.
The users' seed phrase, password, passphrase, etc. aren't stored in any server; the public "servers" are just there to provide Electrum clients data from the blockchain.
Those servers aren't owned by Electrum either, those are by users who have a public Electrum Server.

10.78134 is huge, I hope you are being sincere here. Many factors might be responsible for that and electrum is in the best position to furnish you with accurate answers. First, you might be careless with the seed phrases and someone close to you might have discovered them unnoticed to steal from you.

But in case electrum confirms to you that your wallet was indeed hacked, then there is nothing you can do as Bitcoin wallets are also susceptible to hacking. You might only want to try compensation from electrum if indeed is not your fault. They might also try on their path to trace the transaction, unfortunately, hackers are smarter these days.

You probably misspelled your 12 word phrase or something like that, which is why it your seed-phrase doesn't work in wallets. In any case, some mistake was made, otherwise you would have already gained access to your funds.

It seems to me that there is nothing strange in this, because 12 words doesn't contain errors, which means that it works for Electrum or Mycelium.

Good decision. Perhaps a break will do you good and you will notice those details that you might have missed.

I think i've reached the end of the road with this search. My main 12 word phrase does not seem  to work in either mycelium, electrum, bitaddress.org. Not tried Multibit; but I'm sure it won't work there either. I'm gutted; and also annoyed because I know it should work.

The thing I found strange was that my other 12 word phrase that worked for Electrum and revealed historical transactions also worked in  Mycelium.
 
I'm going to park this problem for a while till i get fresh ideas; but thank you to everyone that helped esp. nc50lc and ETFbitcoin.
Thank you.

This doesn't add up. You either used a poem, and something like a brain wallet, or you used a random seed represented in the form of 12 words to reduce mistakes writing it down. Wallets don't generate poems.

That's the part I don't get: "weave circle round thrice close your eyes holy dread honey hath jan" is indeed accepted, which means all words are on the 2048 word list. It could be a coincidence all words in the poem are on the list, but that still doesn't explain how you ended up with the words from a poem. I don't believe a random seed ends up this close to a poem.

If you know the exact amount and approximate date, you might be able to find your transaction on-chain. Blockchair has data dumps for this.

Have you looked at old topics on Bitcointalk? To get you started, here's a list of the first 10,000 topics: loyce.club/other/titles.html.

@ETFbitcoin, MultiBit Classic has been around since April 2011, but it's a non-HD version - the MultiBit HD version was created sometime in 2014. For all we know from history, the OP didn't use Electrum or MultiBit - unless there were some unofficial versions of which all written traces have been lost.

It's pretty much everything we said in the first page: the dates in your memory are off.

Another issue is you're still trying 0.3 while the version that doesn't have a word list is the initial release up to a couple of commits.
Version 0.3 is way past the version when a fixed word list is introduced so your unique seed phrase wont work there.

A fixed word list was only introduced in this commit: https://github.com/spesmilo/electrum/commit/93c27a62d47d9aab6b5502999df2ff184482e1e0 [2]
Prior to that, Electrum will ask for a 20-character-minimum "seed", or "passphrase" in the earlier commits (check my screenshot above testing the first commit)
So, you should only be trying the versions before that commit, only the last page of the commit history [1] (excluding "use random seed; do not trust the user for entropy" and earlier).

References:

• [1] First commits: github.com/spesmilo/electrum/commits/master?after=bdbd59300fbd35b01605e66145458e5f396108e8+14035 (November 5, 2011)
• [2] Mnemonic was added: github.com/spesmilo/electrum/commits/master?before=bdbd59300fbd35b01605e66145458e5f396108e8+14036 (November 8, 2011)

---

Well, memory isn't all reliable IMO.
It could add or remove details based from what you've read, heard or saw.

For other wallets before 2011, I second the "Brainwallet" idea.

Even if it could be a lot of work the best would be to use all different wallets that were available in that time and try to put in the seed words that you have. You say that the only time you touched your bitcoin was in 2016, so there is a chance that you send them away at this time so if you check your wallets and they display the amount 0 you should also check if you see transactions in 2016 (or any other time if your wallet was compromised).

Did you have several addresses or just one?
Could you have generated an address / private key with a brainwallet? https://bitcointalksearch.org/topic/brainwallet-defcon-attack-discussion-advice-qa-brainflayer-info-etc-1148611
I am not sure when they came into use so I don't know if it was even possible.

The only other wallet I can think of from back then that used words is multibit. They have been gone for years to the point even the discussion here has been put into the archive. But you can still read it here: https://bitcointalk.org/index.php?board=99.0

-Dave

Thanks again nc50lc. I raised an issue https://github.com/spesmilo/electrum/issues/7893. The responses have been very interesting although somewhat disheartening. They're saying that prior to version 2.0 Electrum used a fixed word list; and if my word list is not in that list it could not have been generated by Electrum; so basically I must have used a different wallet to Electrum.

Well, I know the date of purchase 100% during 2011 or before 2011.
I know 100% I used a wallet that generated the 12 word seed which I wrote down and found in my note books.
I know 100% when I plug those seeds into Electrum they're accepted by Electrum without issue; but wallets display zero balance.
I know 100% I successfully transferred coins between the wallets over a very short period of a week or 2 max and then never touched the wallet or Bitcoin again until 2016 or so. By then my PC were long broken and got rid off.

I'm now trying to understand whether my 12 word seed was generated by a post 2.0 version of Electrum or some other wallet type.
Does anyone have an idea what wallet type that had the same look and feel as Electrum existed in or before 2011?
There has to be an answer to this mystery. Let's solve it.

That seems to be the previous version that you launched (v0.30) and not the alpha version.
It should ask for a passphrase before the password, plus the first version has "electrum" not "electrum.py".

I'm afraid I can't help you with the alpha version since it's not continuing nor creating the wallet in my tests either.

You can find the developers in Electrum's GitHub repository, here: github.com/spesmilo/electrum
Contributors are in "Insights->Contributors".

Thanks for your suggestion nc50lc. I tried your suggestion but electrum crashes whether restoring wallet or creating new wallet the following error:
 python electrum.py create
Password (hit return if you do not wish to encrypt your wallet):
in order to use wallet encryption, please install pycrypto  (sudo easy_install pycrypto)
server (default:ecdsa.org):
port (default:50000):
fee (default 0.005):
if you are restoring an existing wallet, enter the seed. otherwise just press enter:
Your seed is 12f2458bab0372ecc4d2097f0df39167
Please store it safely
Traceback (most recent call last):
  File "electrum.py", line 715, in
    wallet.create_new_address(False, None)
  File "electrum.py", line 295, in create_new_address
    secexp = ecdsa.util.randrange_from_seed__trytryagain( seed, order )
  File "/usr/local/lib/python2.7/dist-packages/ecdsa/util.py", line 193, in randrange_from_seed__trytryagain
    extrabyte = int2byte(ord(generate(1)) & lsb_of_ones(extrabits))
  File "/usr/local/lib/python2.7/dist-packages/ecdsa/util.py", line 98, in __call__
    a = [next(self.generator) for i in range(numbytes)]
  File "/usr/local/lib/python2.7/dist-packages/ecdsa/util.py", line 109, in block_generator
    ("prng-%d-%s" % (counter, seed)).encode()
UnicodeDecodeError: 'ascii' codec can't decode byte 0xb6 in position 7: ordinal not in range(128)

I tried to reach out to thomasv; however it said he does not accept messages from newbies. So I'm wondering if one of you guys can point him out to this post.
I feel like we're getting close to solving this mystery.

The alpha release used "passphrase" instead of a mnemonic.
Perhaps your invalid menmonics are actually passphrases used to generate old Electrum wallets.


See if you can run it: https://github.com/spesmilo/electrum/tree/368fa7980f74db07e22eb32edf292abeb98b8d82
(I can't create a wallet though)

Great comments from ETFbitcoin, and yes it's a line from Kubla Khan, and as I said; I was using it for practice purposes only; sending and receiving small amounts of bitcoin. I don't remember the exact steps for purchasing the coins; but roughly, back then; when you purchased the coins from bitcoin.org I think, you then had to transfer them from your purchase account to a wallet. I'm 99% sure that the wallet was electrum. When setting up the wallet it generated the seed automatically; but it offered you the option to enter your own 12 word seed and that I remember very clearly.
I used my favourite poem at the time and words from a favourite song (not shared that yet). For my main account I used default seed generated by Electrum.
It also said that you must never write the words anywhere in case someone discovered them and used them to still your coins. I wrote them down anyway and forgot about them for years until my interest was aroused by the sudden increase of Bitcoin value; then began the long search for the seed. I turned the house and garage over and under looking for them and eventually after  years  of searching I spotted them, scribbled so nonchalantly it's a wonder I ever found them. The excitement was electric. I could barely breathe when I typed them into electrum; but my heart sank as the BTC balance came up as zero.
Then began the search for proof of purchase. You see; if I could get the date of purchase and amount I paid I could at the very list go to blockchain explorer and locate my address and my coins because they would still be on the blockchain; with very few transactions clustered around the date of purchase. Needless to say, I was not able to find any proof; banks only keep records for 6 years so they could not help either. So I was back to square one. The only thing I have is a bunch of stupid meaningless words; but potentially worth a fortune. So I'm not ready to give up yet.
The latest breakthrough was finding those 12 words with the 10.7mBTC. That proved to me that the seed works under the correct circumstances.

1. Yes it's possible I downloaded a dodgy Electrum copy and someone stole all my coins. Then let's find the trail on the blockchain. I don't think this happened because nobody cared about Bitcoin to want to steal it back then.

2. Electrum wasn't available before 2011, nobody but  spesmilo knows that for sure; his first commit on github is bumping up the version number.
from distutils.core import setup
version = "0.29"
version = "0.30"
So question, might be when did github to allow developers to push their code first come out. He might have been using SVN before that.
3. If not electrum then what other wallets were there, in shall we say 2011. Just bitcoin core and electrum right, I don't think there was anything else. I suspect I might have used a beta version; but honestly I don't really remember.
I know 100% that I bought the coins before or at the latest 2011; because I was working for this one company and I left that company in 2011 and I had already bought the coins by then.

I have now managed to check all my seeds against version 0.3 and most of the words are rejected. So  now back to square one.
Maybe it was a different version of Electrum, maybe it was some other random wallet type whose name I can't remember. What a nightmare.

As explained: that's not possible.

That's not wallet from 2010: the transaction happened in 2021.

If you're sure about that: forget about Electrum, and try to remember what you actually used. Electrum didn't exist, so it must have been something else. Have you ever used brainwallets?

That's not a seed phrase, it's not even random. It comes from a poem by Kubla Khan:
Only "jan" is missing from the poem.

What I explained is a possibility for all Electrum wallets created pre-v0.31 or 0.34 versions in general.
However, your situation is a bit unclear because one of your "old wallets" can't be from 2011 since it has a native SegWit address which is only became available in v3.0 (Nov 2017).

And just like all of us said, Electrum wasn't even released yet on the alleged creation date of your seed phrases.

• Here's the announcement thread: https://bitcointalksearch.org/topic/m.607510 (dated November 5, 2011)
• Here's the initial release (source code): github.com/spesmilo/electrum/commits/master?after=bdbd5...+14035 (dated November 5, 2011)

How to lose your Bitcoins with CTRL-C CTRL-V

Download, verify the wallet and if the signature is correct, install the wallet.
[Guide] How to Safely Download and Verify Electrum

https://en.bitcoin.it/wiki/Electrum


There is a VERY small chance you have one from LATE 2011 0% chance you have one from pre-2011

You can get older versions from here: https://download.electrum.org/
And even older versions can be found scattered around the internet if you search.

If you are not sure of the dates / wallet that is fine. But there is no way it's an electrum from that early.

-Dave

Thank you all once again. I liked nc50lc's response which explains what I suspected was happening with my original recovery seed phrase; returning zero BTC. Just to clarify a bit more. I have at least four or 5 very old electrum wallets pre-2011; all of which are displaying zero BTC on recovery and now thanks to one of you I know why. One of those wallets is the one with the 10.7mBTC as I've been corrected to say and for which I shared one of the transactions and one of addresses in my last post.
Am I 100% sure that the wallet belongs to me? Yes definitely; who else would it belong to unless, it's the first private key collision on the BTC blockchain ever. I read somewhere that it would take brute force until the end of the Universe to come up with the same seed or to  hack the private key from the public key. If I managed to do that; then I would be hailed a genius or best hacker on the planet. I'm neither; I can assure you that.
Now that's settled; I will try and follow the suggestions in the link posted by nc50lc (thank you) over the next few weeks.

Just to prove my point, if one of you has the time and inclination you could try and recover the coins in this old electrum wallet given by this old seed. (weave circle round thrice close your eyes holy dread honey hath jan) I reckon it could have anything between 8-12 BTC or have been recently recovered and emptied as I shared it already with a recovery agent in the states. I used the addresses to practice sending and receiving BTC to myself just to understand how the process worked. Remember I'm talking about something that was very novel and didn't make much sense back in 2009,2010 or even 2011. Do I have a tonne of BTC out there that I can't get hold off, because I was too negligent and stupid. Damn right I do.
I don't actually mind that the whole world will now know these particular seed phrases; as I want proof that they once held my BTC and that they must trace back to the original address with at least 800-1500 BTC. Does that make sense?

For clarification, you had 10.78134 mBTC which is actually only 0.01078134 BTC, Electrum displays mBTC by default.

---

Hmm... The dates are off, but at least earlier than Electrum v0.3 so this could really happen.
When restoring a funded old seed (made before v0.31 and v0.34) to the latest version, it will really result with an empty wallet due to an old "seed derivation bug".

More info here: /index.php?topic=5379817.msg58904925#msg58904925 (read page 2 to 3 for the potential solution).

That's not how to identify private key collisions, you'll have to present two different prvKeys that derive the same address.
If that how it works, then every "hacked" coins can be claimed as a collision.

And "Bitcoin Foundation" isn't some sort of a centralized body that governs Bitcoin, BTW.

I don’t know if you are trying to fool us or you just don’t really know how a Bitcoin works.

Check carefully your wallet I can't even seem to find the transaction of 500 to 1500 BTC from the address you posted.
If your Bitcoin came from this address 17HF2zJE5SWezC5VJF3uXfve3CuxPdDAUA then the total amount of this address is 0.32290541BTC and the first transaction of this wallet was Apr 25, 2021, which is far from what you said.

Are you sure that you own this wallet?

And native segwit bc1q addresses did not exist until 2017.
Either the OP is very off with their dates or
electrum did not exist until late 2011 and it took a bit of time before people started using it so early 2012 is a more realistic date.

-Dave

@retroverseworld: your story doesn't add up. Electrum didn't exist yet in 2010, so there were no seed words to write down at that time.
The transaction you posted happened last year, and the inputs were not years old. Address bc1qmuuc762cw02gg9j7fmqrw0wcmr0ffm5xkxjnln had a 0.01078134 Bitcoin balance, so I think you meant 10.78134 mBTC (Electrum's default unit).

Wow, I'm impressed by all the responses and kindness of everyone that responded. Thank you all so much, you are amazing people.
To address the questions raised. I bought anything between 500 and 1500 BTC back in 2009 or 2010, can't remember  the amount exactly. I downloaded electrum on my PC, and spent a couple of days teaching myself to transfer between wallets. I wrote down the seed words for each wallet in a note book and once I was successful in making a few transfers I totally forgot about Bitcoin; until 2016 when the price of Bitcoin started rallying like crazy.

Then I spent 5 years searching for the notebook and eventually found it. I restored the wallet but it was empty and showed no transactions ever taking place in the history. That is still the case with that wallet. Then yesterday I was paging through a notebook, for a novel I wrote (Two River Farm and the Cry of the Jackal if anyone is interested); and here I found another set of 12 words. I promptly plugged them into electrum and was pleasantly surprised  to see historical transactions on it; but depressed to see the balance as zero BTC.

Since the chances of someone else having the same seed as me as virtually zero, I can only imagine a scammer; somehow got hold of my seed, quite possible as I was using a windows XP laptop at the time and withdrew all my Bitcoin.
I think I'm in way over my head here; despite more than five years of searching.

Here is one of the transactions, see what you make of it and let me know.49b17aaeb9308d2d314438baf6321033af09f62c0e9914e5b01ac4d7ba481a4d  bc1qmuuc762cw02gg9j7fmqrw0wcmr0ffm5xkxjnln          10.78134

Either my money has been stolen or we've found the first ever key collision in the history of Bitcoin and that's worth the Bitcoin Foundation paying off my kids' student loans and some.

Any comments are fully appreciated.

From similar topics created by newbies and leaving 1-2 posts with a superficial content of their problem, a lot of questions remain, as LoyceV said, and he is definitely right. More detailed information is needed to find a solution. Beginners should take note that it would be nice to report more detailed description of the problems encountered. This will save time for everyone.

Judging by the words of retroverseworld, there is a lot of uncertainty. I even have a suspicion that ~10.78 BTC was not stolen at all, it's just that OP did something wrong and his balance is not displayed. You can easily verify this by checking bitcoin address in the explorer. Of course, if retroverseworld links the address for check where ~10.78 should be.

When was the BTC stolen? (what date?)

If it was around the 2018-2019 era and you were using an old Electrum version, maybe you downloaded a malicious copy by mistake when the phishing dialog came up after you opened the program.

Striked out and corrected.

What exactly do you mean by "now 0"? Does electrum show transaction where 10.78134BTC is stolen/moved away? Does electrum show empty wallet? If it shows empty wallet, it's possible you entered wrong seed.



FYI, Bitcoin protocol and Electrum doesn't have "account" system. There's no authority which can reverse the transaction or have log who accessed your wallet.


What makes you think OP brute force his seed phrase? All he said is "I found my lost seed and ...".

You're going to have to provide more details of how you created your wallet, how you stored it, how you lost your seed and how you found it back. Right now, your short post raises many questions that all have many possibilities depending on what you did.

A lost wallet? How did you know that you successfully brute force the seed phrase?  Likely the seed phrase may not be correct.   probably you found and used another seed phrase.

Sorry about this, do not be careless with your seed phrase backup, having your seed phrase means you have your coins because with the seed phrase you can generate the keys and addresses and be able to recover back your wallet successfully.

Did you use passphrase? If not used along with seed phrase while regenerating the wallet, different keys and addresses will be generated, which means you generate a wrong wallet if your passphrase is not used.

Did your wallet synchronized with the blockchain or fully connected? You have to make sure your wallet fully synchronized

Have you checked your wallet balance? Is the coin sent to an unknown address? If your coin is sent to an unknown address, it means your wallet has been compromised.

Option 1. It may be that you've stored the seed somewhere somebody else had access to it. One of the most common mistakes is to store the seed in electronic systems - cloud, e-mail and so on.
Option 2. Your computer is infected. A malware can look for specific files, a malware can record your keystrokes.. and send everything to its master.
Option 3. You didn't pay attention, you have downloaded a malicious Electrum and also didn't check the signature.

Since the wallet is only a tool handling the keys to your coins, it's not necessary for somebody really access your computer, instead, just by having the seed he can recover to another wallet and spend your funds from there.
I'm really sorry for your loss, it's a huge amount you should have known to keep it on cold storage or at least hardware wallet.

PS. Bitcoin system doesn't have "accounts".

It is only possible if someone else had also access to the seed. It can be that there was a keylogger installed on your machine or that somebody found your records of the seed. On mempool.space you can see when the theft accrued and contact your local law enforcement about it.

I found my lost seed and recovered my electrum wallet; only to find that wallet had been emptied.     10.78134 BTC gone, now 0. Can anyone explain to me how that is possible. How did someone successfully hack my account.