Topic: Missing receiving address in my bitcoin wallet - page 2. (Read 777 times)

Perhaps you just have one of the "original" clipboard malwares that didn't try and use "similar" replacement addresses and simply just pasted a completely different BTC address.

Although, the fact that you said that it doesn't seem to be doing it any more (copy/pasting is currently transferring the correct address right?) might indicate that this isn't even the reason why you ended up with an incorrect address.

Perhaps you didn't actually copy the address from Electrum correctly and, for whatever reason, already had that address on your clipboard (from a different app/website? )


Essentially, you use a completely separate computer that is not connected to the internet or ANY network. You install Electrum on it... and create your wallet with seed/private keys.

You would then use another computer that is connected to the internet... and install what is known as a "Watching only" version of your wallet on it. This enables you to see addresses/transactions/balance etc... but you are not able to spend/sign transactions as it doesn't contain any private keys. Refer: https://electrum.readthedocs.io/en/latest/coldstorage.html

The workflow is then... create unsigned transaction on ONLINE computer... transfer unsigned transaction (via USB) to OFFLINE computer... sign the transaction with the private keys (after checking it is all correct!)... then transfer signed transaction back to the ONLINE computer and broadcast it.

It's obviously a lot more work, but is also a lot more secure. However, it wouldn't necessarily prevent your particular scenario unless you take the time to double check and confirm all the transaction details (amounts+addresses etc) BEFORE you sign/broadcast.

What it does do is reduce the chances of any malware on your online computer from being able to access your wallet/private keys/seed etc.


Hardware wallets essentially make this setup redundant, as they achieve the same goal but in an arguably more streamlined, easy to use manner.

HCP , no, I don't have any address that begins with ""1P24x". The sender always paying with a direct payment to my btc wallet and I always doing the same : open my wallet - go to Receive tab - copy the btc address there - paste it at the email.
I don't have problems when I receive btc payments through my website.

I didn't visit any porn/torrents websites.

About "moving your crypto/wallet stuff to a completely separate (offline) system" - I don't know how to do that and some advice will be helpful.

Generally, once a file is "quarantined"... even YOU won't be able to access them. That's the entire point of quarantine. The antimalware/antivirus software attempts to prevent ANY access to try and prevent any payload from being executed.

To access the files after quarantining them, you would need to "restore" them first.


When you look at all the addresses displayed in your Electrum "Addresses" tab, do you see ANY address that begins with the same 4 or 5 characters as the address you pasted: "1P24x..."?

If so, try copy/pasting THAT address again and see if it gives you the same or different address.

---

Part of that would be trying to identify how you got infected in the first place... and perhaps modifying your computer behaviour. No dodgy websites (porn/torrents etc)... be careful what you download/install...

Consider moving your crypto/wallet stuff to a completely separate (offline) system etc... or investing in a hardware wallet.

Thank you all for the help and advice! I really, really appreciate it.

I understand, that I lost that transaction (with the problem). But now the most important is to keep my wallet safe.

This is one of the way you can update.
Unless you have something important on the wallet like an labels of addresses, you can just store the seed key and uninstall the electrum and download it as DireWolfM14 showed. Then, instead of creating new seed, restore this one. This is more simple however, if your metadata is important, then back up of the wallet file is mandatory.

Locate your wallet files (usually they are in //appdata/roaming/electrum/wallets/) and back them up on a clean thumb drive.
Go to https://electrum.org/#download and download the latest version for your OS, and corresponding signature file.
Follow these instructions to verify the download: https://bitcoinelectrum.com/how-to-verify-your-electrum-download/
Uninstall your old version of electrum.
Install the new version of electrum.
Restore your wallet files to the directory where you found them.

If you are concerned that your current wallet might have been compromised, you should create a new seed, and move all your funds to the new wallet.

If you're suspicious that your system has been compromised, I recommend you reinstall your OS on a freshly partitioned hard drive.  Relying on anti-virus and anti-malware programs is a risk, in my opinion.  A risk I would not be willing to accept. 

o_e_l_e_o, how to update the Electrum wallet?

I receive fund there and don't have problem, because the payments are not direct. Only this one (the missing one, with the problem) was a direct payment.
I know, that the formatting is the best solution, but will need time to find info how to do that. Until then I think to use Malwarebytes running and will update the wallet. Is that a solution for now?

As an aside, Electrum versions before 3.3.4 no longer sync as a security precaution, so even if you had used the correct address, you still wouldn't see the funds in your wallet until you updated Electrum.

My mistake. It's versions before 3.3.0 which wont sync, but versions before 3.3.4 which are vulnerable to a fake phishing message.

To upgrade, simply back up your wallet files, uninstall your current version of Electrum, download and verify the most recent version (3.3.8) from electrum.org, and then install.

Lucius, yes, I am using Electrum version 3.3.3. It seems I have "non-genuine version" of what? I downloaded the Electrum wallet from the official website a long time ago and because some problems with my previous laptop, I restored the wallet on new laptop, with the seeds.

I understand, that removing threats isn't the best solution, but just trying to find the best decision for now. Because I am worried not to lose all my btc in the wallet.
I understand, that formatting of the disk and clean install of OS is the best option, but I will need time to see how to do that, because I am not familiar with that.
That's why I am asking if the MB quarantine is a solution, until I find info about the formatting.

GerGys, do you use Electrum version 3.3.3? I also use Malwarebytes (Premium version), but I don't remember MB ever detecting Electrum as something dangerous (in your case GenericMalware). In this case, you seem to have a non-genuine version, but such false versions usually empty the entire wallet the moment they are installed.

You should consider proactive security measures for your PC, which means that the emphasis is on prevention, not as it is now with you in removing threats. I agree that the safest option at this point is formatting of your disk and clean install of OS.

I recommend you do at least two more things, try to make a full scan with MB in safe mode (check how to enter a safe mode for your PC), and also try to scan with good antivirus. My recommendation is Norton Security: https://in.norton.com/downloads

Regarding MB quarantine, only you have access to those files, and you can restore them at any time.

Malwarebytes does sometimes have false positives (as with Electrum), but if you don't recognize the software it is flagging up as suspicious, then yes, I would quarantine it.

Thanks for the reply, o_e_l_e_o !

Yes, the wallet is downloaded from the official website.
Thanks for the advice about the reformat. I will do that for sure later in the time.

So, should I add the other 25 detections to the MalwareBytes quarantine ?

I didn't use Malwarebytes before and if I understand the info correct (because English isn't my native language), when I add a certain file or program to MalwareBytes quarantine, I will be the only one person with an access to them, correct?

Okay Sir i understand !

Electrum gets flagged as a false positive by malwarebytes. As long as you only downloaded from the official site - electrum.org - and verified the download by following these instructions (https://bitcoinelectrum.com/how-to-verify-your-electrum-download/), then that is nothing to worry about.

25 other detections is a massive issue, though, although the ones visible on your screenshot all seem to be from the same piece of malware. Honestly, if I was that infected I would just reformat.

Here is the image:

https://prnt.sc/ptqd3s

Sorry, I don't know how to add an image here

I just installed the free trial version of Malwarebytes and run it.  I got 26 detections. Check the image here. Should I click on "Quarantine" button? I am asking that, because I see there also the Electrum wallet setup exe

As I said, that's the first time when I got that kind of problem. I often receive btc payments, but not as a direct payment (like this one with the problem), but through my websites and don't have any problems. That make me think, that it's a Clipboard malware.

@ElectrumSupport, read the post just above yours, it is clear that his problem is not caused by the clipboard hijacker malware.
Either his device is compromized or someone else has access to his wallet (private keys)

Free version has a limited feature. It's better to avail premium license. There is some crack version of it but I suggest to buy the official license to support the developer.

Malwarebytes didn't guarantee 100% protection and no anti virus can do that. It's better to reformat your hard disk same as the advice of @oeleo then install malwarebytrs after reformat to make sure that your computer is totally free from malware.

Maybe you download too much file on the internet without antivirus installed or you click porn ads that automatically download a malware file. 

Your computer is infected with a virus that replaces the addresses copied in the clipboard and paste its own addresses.  the virus is called Bitcoin Stealer and you need to install an antivirus to fix the problem otherwise it's good for you. thank you !