Urgent Help. recover stuck transaction from phishing attack??

o_e_l_e_o

legendary

Activity: 2268

Merit: 18711

Quote from: PrimeNumber7 on June 03, 2021, 03:05:27 PM

While this is technically feasible according to consensus rules, however, I don't think many (any) wallet devs want to implement what you describe because it would allow users to double-spend transactions in a way that would involve the recipient not receiving the original amount of coin as was in the original transaction. I think most devs do not want to be involved in helping users conduct that kind of activity.

But that is exactly what RBF allows as per the implementation of BIP 125. Wallet devs aren't encouraging any kind of activity - they are simply implementing agreed upon features. No one should be accepting zero confirmation transactions if they are RBF enabled anyway.

Quote from: bob123 on June 04, 2021, 03:50:18 AM

Having an unused output of exactly the amount you'd contribute to the fee is quite unrealistic IMO. At least not if you consolidate and/or mix UTXO's regularly (which you should).

Then pull a 0.001 BTC chip from ChipMixer. Sure, it's an expensive fee, but if you are using RBF it's probably because the mempool is full and whatever situation you have found yourself demands it. Spending 0.001 BTC to save 1.5 BTC from being stolen as in OP's case is a tiny price to pay.

My point is there are too many situations to consider where someone might be able to use RBF privately, or be happy to sacrifice some privacy to be able to use RBF. Putting a blanket ban on it for all users is counterproductive.

nc50lc

legendary

Activity: 2534

Merit: 6080

Self-proclaimed Genius

Quote from: PrimeNumber7 on June 04, 2021, 10:24:33 PM

Quote from: hosseinimr93 on June 04, 2021, 09:22:56 AM

-snip-
Electrum (as one of the best and most popular wallets) allow users to double-spend a transaction to themselves. This feature can be used for bad purposes.

How can electrum be used to easily create a double spend transaction? I am not aware of this being possible unless both transactions are created prior to one being broadcast.

Electrum v4.0.4 [Oct. 15, 2020] has a "Cancel (double-spend)" option in the right-click menu of an RBF flagged transaction.
That's basically the same as "increase fee" but instead of sending to the same output(s), the wallet will send it back to the owner's wallet.

PrimeNumber7

copper member

Activity: 1652

Merit: 1901

Amazon Prime Member #7

Quote from: hosseinimr93 on June 04, 2021, 09:22:56 AM

Quote from: PrimeNumber7 on June 03, 2021, 03:05:27 PM

I don't think many (any) wallet devs want to implement what you describe because it would allow users to double-spend transactions in a way that would involve the recipient not receiving the original amount of coin as was in the original transaction.

I don't think that's why they don't add such options.
Electrum (as one of the best and most popular wallets) allow users to double-spend a transaction to themselves. This feature can be used for bad purposes.

How can electrum be used to easily create a double spend transaction? I am not aware of this being possible unless both transactions are created prior to one being broadcast.

pooya87

legendary

Activity: 3472

Merit: 10611

Quote from: BlackHatCoiner on June 04, 2021, 09:31:11 AM

Wallets such as Wasabi and Electrum are already complicated if you compare them with Exodus. This complexity tops everything.

I don't use Wasabi but Electrum is the simplest wallet that exists while being feature rich for advanced users. It starts getting complicated when you start accessing those "advanced" features such as setting/changing the fee, paying multiple addresses, coin control, LN,... otherwise it is just paste address and enter amount and click send.
BTW a closed source wallet like Exodus doesn't top anything.

hosseinimr93

legendary

Activity: 2380

Merit: 5213

Quote from: BlackHatCoiner on June 04, 2021, 09:31:11 AM

Quote from: hosseinimr93 on June 04, 2021, 09:22:56 AM

--------

But, it can also save someone. It's the way you look at it. Weight privacy and confirmation boosting and you can make your own conclusions of what is better.

You are 100% right. I myself have used both "Increase fee" and "Cancel (double-spend)" features many times. These options are really helpful and I didn't mean electrum shouldn't allow users to do so.
I was only saying that it's not true that wallets don't have options mentioned by o_e_l_e_o in this post, because they don't want people to be able to change the outputs and use the feature for scamming others. If that was the reason of not adding such options, electrum wouldn't allow users to cancel (double-spend to themselves) transactions at all.

BlackHatCoiner

legendary

Activity: 1512

Merit: 7340

Farewell, Leo

Quote from: hosseinimr93 on June 04, 2021, 09:22:56 AM

Electrum (as one of the best and most popular wallets) allow users to double-spend a transaction to themselves. This feature can be used for bad purposes.

But, it can also save someone. It's the way you look at it. Weight privacy and confirmation boosting and you can make your own conclusions of what is better. To me, there isn't one. Sometimes, I need privacy and some others I have to double-spend it, because the mempool got full and my transaction is stuck with low priority. As it's being said, there should be an option, but not complete abjuration.

Quote from: hosseinimr93 on June 04, 2021, 09:22:56 AM

As stated in previous posts by others, I think wallets don't add such features because they don't like to make their wallet complicated for newbies.

Wallets such as Wasabi and Electrum are already complicated if you compare them with Exodus. This complexity tops everything.

hosseinimr93

legendary

Activity: 2380

Merit: 5213

Quote from: PrimeNumber7 on June 03, 2021, 03:05:27 PM

I don't think many (any) wallet devs want to implement what you describe because it would allow users to double-spend transactions in a way that would involve the recipient not receiving the original amount of coin as was in the original transaction.

I don't think that's why they don't add such options.
Electrum (as one of the best and most popular wallets) allow users to double-spend a transaction to themselves. This feature can be used for bad purposes.
As stated in previous posts by others, I think wallets don't add such features because they don't like to make their wallet complicated for newbies.

bob123

legendary

Activity: 1624

Merit: 2481

Quote from: o_e_l_e_o on June 03, 2021, 01:50:58 PM

Why? Let's say I have a transaction spending 0.1 BTC, paying 0.066 to one address and 0.033 to another address, and 0.001 BTC in fees. I bump it by including a second input of 0.001 BTC, all of which goes to the fee. The two outputs remain unchanged.

Having an unused output of exactly the amount you'd contribute to the fee is quite unrealistic IMO. At least not if you consolidate and/or mix UTXO's regularly (which you should).
So you'd have to add an UTXO which is larger, either resulting in a higher change output or creating a 3rd output which is then guaranteed to be the change.

Quote from: o_e_l_e_o on June 03, 2021, 01:50:58 PM

But the option should be available for those who understand the risks.

I personally would like to have that feature.
However, lots of people would use RBF because they believe they know how to handle that while in fact they don't. These people will inevitably compromise their privacy.
And i believe that was the reason to not include RBF.

And let's be honest.. if you know what you are doing, you rarely ever need to use RBF anyway.
I can't remember the last time i had to bump a fee.

BlackHatCoiner

legendary

Activity: 1512

Merit: 7340

Farewell, Leo

Quote from: o_e_l_e_o on June 03, 2021, 01:50:58 PM

Sure, but this is for people who know what they are doing, and will know only to link another input from the same address or from a standalone address which does not compromise their privacy by linking to the previous inputs.

In my opinion, that's the very reason they should implement it, or at least allow it as an option. The thinking behind this is false. You shouldn't create only what's being known from the majority that is unaware of the subject. Oppositely, you should push them learn. I mean, you're trying to make the most privacy providing wallet, you shouldn't expect it to be easy on its use by those who only want to just send and receive. Isn't your purpose to maximize privacy for the ones that respect it? As I said, an option should be the least the could do.

PrimeNumber7

copper member

Activity: 1652

Merit: 1901

Amazon Prime Member #7

Quote from: o_e_l_e_o on June 02, 2021, 02:06:40 PM

Quote from: hosseinimr93 on June 02, 2021, 12:24:24 PM

When you increase the fee and create a new transaction for implementing RBF, the added fee is deducted from the change.

While this is true for the casual user who just uses RBF to bump the fee, it is not necessarily true if you know what you are doing. You can change the value of both the change and the recipient outputs, so it is not clear which one is which. You can instead include another input and use that to bump the fee, leaving all the outputs the same. You could instead replace the recipient's address with one of your own (unused) addresses, and make a second totally separate transaction to pay the recipient. The transaction may only have 1 output and no change.

While this is technically feasible according to consensus rules, however, I don't think many (any) wallet devs want to implement what you describe because it would allow users to double-spend transactions in a way that would involve the recipient not receiving the original amount of coin as was in the original transaction. I think most devs do not want to be involved in helping users conduct that kind of activity.

o_e_l_e_o

legendary

Activity: 2268

Merit: 18711

Quote from: bob123 on June 03, 2021, 09:47:18 AM

I guess this won't be happening quite often since a transaction usually has a reason. You can't just pay someone less than agreed on.

No, but you can add in an additional input and then overpay someone buy a few thousand sats for the sake of obfuscating which is the recipient address and which is/are the change address(es).

Quote from: bob123 on June 03, 2021, 09:47:18 AM

This would mix more outputs together which is generally worse. Especially for people who are not that good with coin control.

Sure, but this is for people who know what they are doing, and will know only to link another input from the same address or from a standalone address which does not compromise their privacy by linking to the previous inputs.

Quote from: bob123 on June 03, 2021, 09:47:18 AM

Further this will create one output which is guaranteed to be deemed as a change output by an observer.

Why? Let's say I have a transaction spending 0.1 BTC, paying 0.066 to one address and 0.033 to another address, and 0.001 BTC in fees. I bump it by including a second input of 0.001 BTC, all of which goes to the fee. The two outputs remain unchanged.

Quote from: bob123 on June 03, 2021, 09:47:18 AM

I'd like the option, definitely yes.
But bumping the fee will most likely always result in decreased privacy.

But the option should be available for those who understand the risks. I've never been a fan of software making decisions based on the lowest common denominator. If other users don't want to use advanced features, fine, but I shouldn't be prevented from using them because of their ambivalence and/or ignorance.

bob123

legendary

Activity: 1624

Merit: 2481

Quote from: o_e_l_e_o on June 02, 2021, 02:06:40 PM

While this is true for the casual user who just uses RBF to bump the fee, it is not necessarily true if you know what you are doing.

Unfortunately that's not as easy as it sounds.
Especially since quite a lot of people believe they know what they are doing. Probably way more than actually know what they are doing.

Quote from: o_e_l_e_o on June 02, 2021, 02:06:40 PM

You can change the value of both the change and the recipient outputs, so it is not clear which one is which.

I guess this won't be happening quite often since a transaction usually has a reason. You can't just pay someone less than agreed on.
Therefore in most cases it would need to be subtracted from the change, i assume.

Quote from: o_e_l_e_o on June 02, 2021, 02:06:40 PM

You can instead include another input and use that to bump the fee, leaving all the outputs the same.

This would mix more outputs together which is generally worse. Especially for people who are not that good with coin control.
Further this will create one output which is guaranteed to be deemed as a change output by an observer.

Quote from: o_e_l_e_o on June 02, 2021, 02:06:40 PM

You could instead replace the recipient's address with one of your own (unused) addresses, and make a second totally separate transaction to pay the recipient. The transaction may only have 1 output and no change.

This might work for generic amounts. But for specific amounts (e.g. 164.21$ in BTC at time X) that might be quite easy to reveal.
At least it is by far not as privacy-preserving as just sending a single transaction with that amount.

Quote from: o_e_l_e_o on June 02, 2021, 02:06:40 PM

I think a better idea would be for Wasabi to allow RBF to be enabled with an option hidden in the settings somewhere and with a pop up warning it could decrease privacy, so users who know what they are doing can still use it, while those who don't appreciate the risks wouldn't.

I'd like the option, definitely yes.
But bumping the fee will most likely always result in decreased privacy.
And i believe a lot of people will think they know how to bump it without revealing which output is the recipient and which is the change, while in fact they don't.

Privacy isn't a straight forward topic. It's quite complicated.

pooya87

legendary

Activity: 3472

Merit: 10611

Quote from: o_e_l_e_o on June 02, 2021, 02:06:40 PM

I think a better idea would be for Wasabi to allow RBF to be enabled with an option hidden in the settings somewhere and with a pop up warning it could decrease privacy, so users who know what they are doing can still use it, while those who don't appreciate the risks wouldn't.

I think the only reason why they haven't implemented RBF is because it is going to be a bit complicated since each transaction has multiple signers and when you want to bump the fee each signer has to sign the transaction again and they may not be available anymore.
Otherwise it is trivial to implement the "bump fee" code in a way that it divides the additional fee among all outputs and deducts a fixed amount from all of them (eg. 100 satoshi from each 10 outputs to increase the total fee by 1000). I also think the library they are using (NBitcoin) doesn't have such a feature so Wasabi devs would have to implement it themselves with a workaround!

o_e_l_e_o

legendary

Activity: 2268

Merit: 18711

Quote from: hosseinimr93 on June 02, 2021, 12:24:24 PM

When you increase the fee and create a new transaction for implementing RBF, the added fee is deducted from the change.

While this is true for the casual user who just uses RBF to bump the fee, it is not necessarily true if you know what you are doing. You can change the value of both the change and the recipient outputs, so it is not clear which one is which. You can instead include another input and use that to bump the fee, leaving all the outputs the same. You could instead replace the recipient's address with one of your own (unused) addresses, and make a second totally separate transaction to pay the recipient. The transaction may only have 1 output and no change.

I think a better idea would be for Wasabi to allow RBF to be enabled with an option hidden in the settings somewhere and with a pop up warning it could decrease privacy, so users who know what they are doing can still use it, while those who don't appreciate the risks wouldn't.

bitbollo

legendary

Activity: 3276

Merit: 3537

Nec Recisa Recedit

Quote from: andybruce on May 23, 2021, 10:53:29 PM

Thanks for all the suggestions guys. The transaction has now been confirmed on the blockchain & I am past the point of no return. I never though I would fall victim to a phishing scam as I'm usually pretty good at spotting these things. Unfortunately it was late & I was tired otherwise I may have spotted it. Therein lies a lesson.

sorry to read that. It's an huge amount and seems a "well done" scam if you get hooked by them...
I think it's could be also useful if you can share some details about this scam and your issue https://bitcointalk.org/index.php?board=83.0 so other people would able to avoid or able to recognize a similar scam.

hosseinimr93

legendary

Activity: 2380

Merit: 5213

Quote from: BlackHatCoiner on June 02, 2021, 12:19:27 PM

Sorry if it's a dumb question, but why would RBF create an unobtrusive transaction fingerprint?

When you increase the fee and create a new transaction for implementing RBF, the added fee is deducted from the change.
With comparing the original transaction and the replacement transaction, it's easy for everyone to find out which output is the receiver address and which one is your change address.

BlackHatCoiner

legendary

Activity: 1512

Merit: 7340

Farewell, Leo

Quote from: bob123 on June 02, 2021, 12:10:14 PM

RBF is turned off to create an unobtrusive transaction fingerprint.

Sorry if it's a dumb question, but why would RBF create an unobtrusive transaction fingerprint?

bob123

legendary

Activity: 1624

Merit: 2481

Quote from: BlackHatCoiner on June 01, 2021, 01:16:48 AM

Recommendation: Use a wallet like electrum that allows you to replace your transaction by fee, instead with wasabi that may have some limitations. (I didn't know that it had that one, though!)

Actually, that's a "feature".

Wasabi is made for people who want to preserve some privacy while using a lightweight client.
RBF is turned off to create an unobtrusive transaction fingerprint.

While i'd like an option to enable RBF for people who actually know what they are doing, i do understand their decision.

pooya87

legendary

Activity: 3472

Merit: 10611

Quote from: BlackHatCoiner on June 01, 2021, 01:16:48 AM

instead with wasabi that may have some limitations. (I didn't know that it had that one, though!)

Wasabi wallet doesn't allow creation of transactions marked by RBF so it doesn't have the option. They claim it leads to privacy leak. You can read more about it here although some of the arguments are old such as the pools not mining RBF transactions https://github.com/zkSNACKs/WalletWasabi/issues/1543#issuecomment-508194801

BlackHatCoiner

legendary

Activity: 1512

Merit: 7340

Farewell, Leo

Quote from: andybruce on May 23, 2021, 10:53:29 PM

Thanks for all the suggestions guys. The transaction has now been confirmed on the blockchain & I am past the point of no return. I never though I would fall victim to a phishing scam as I'm usually pretty good at spotting these things. Unfortunately it was late & I was tired otherwise I may have spotted it. Therein lies a lesson.

Wow, 1.5 BTC seems a huge amount. Sorry for your loss. I wonder how well-made scam was that, that made you broadcast a €45000 equivalent in Bitcoin. Be aware next time of phishing attacks. They're like everywhere trying to rip us off.

Recommendation: Use a wallet like electrum that allows you to replace your transaction by fee, instead with wasabi that may have some limitations. (I didn't know that it had that one, though!)

Topic: Urgent Help. recover stuck transaction from phishing attack?? (Read 449 times)