1

four years ago I've bought 1 BTC, made wallet.dat file and stored in the cloud. Now I wanted to check balance and after syncing on Bitcoin Core found negative transaction with no address.

enter image description here

enter image description here

I did not make second transaction. It has no address. What it is? What the second negative transaction means? Why strange icon? Here's second transaction ID 4837f44e4169f287ca6802c45ceab2dfef36ab7d8ecaa0eaebfa59ea6c76e17b

enter image description here

I have 2 public keys. I've tried to dumpprivkey. After obtaining private keys I've tried to import to one local Bitcoin service (spectrocoin) but after 24 hours nothing changed.

Does it mean that I've lost BTC? Is there anything else I can do? Thank you for your help.

Improve this question
4
  • 1
    It looks like someone who had access to your private key transferred your bitcoin in April of 2014. But it's hard to tell with just what you've given us.
    – David Schwartz
    Commented Nov 26, 2017 at 6:00
  • Here is transaction ID of the negative transaction: 4837f44e4169f287ca6802c45ceab2dfef36ab7d8ecaa0eaebfa59ea6c76e17b
    – tadaspadas
    Commented Nov 26, 2017 at 6:55
  • Which cloud company BTW?
    – MCCCS
    Commented Dec 20, 2017 at 13:36
  • Checked dates, I've put file to cloud later after BTC was stolen. I didn't check balance then.
    – tadaspadas
    Commented Dec 20, 2017 at 13:38

3 Answers 3

Reset to default
2

It looks like, using just the 17nu address here:

https://longhorn.bullpay.com/?gateway=2&data=17nu7oViEtGCYaYwrKKVGyrs7jkcNwpVf2

Only 2 transactions occurred. This transaction:

https://longhorn.bullpay.com/?gateway=2&data=fae9171eea55eb69cbe73f8a23003f9267b71e5a7292d2bcd7b396a58aa82827

Resulted in the UTXO for 1 BTC to 17nu.

That UTXO was then used in this one:

https://longhorn.bullpay.com/?gateway=2&data=4837f44e4169f287ca6802c45ceab2dfef36ab7d8ecaa0eaebfa59ea6c76e17b

But it was combined with other transaction unrelated to the wallet. I'd say your wallet was compromised. Your transactions got bundled in with other UTXO's elsewhere not related to your wallet.

The address it was sent to:

https://longhorn.bullpay.com/?gateway=2&data=1NqJgMT4eLPycaD2i7T7xzbd9F9fycWE9u

had a flurry of activity on 5/6/14 within a 2 hour time period. In some cases with massive bundling of UTXO's. 34 inputs, 56 inputs. The transactions moving BTC from that wallet out left it with a zero balance.

Almost all of this funnels into address 17gH1u6VJwhVD9cWR59jfeinLMzag2GZ43:

https://longhorn.bullpay.com/?gateway=2&data=17gH1u6VJwhVD9cWR59jfeinLMzag2GZ43&grid-page=1

Which processed 17,990 transactions between March 2014 thru October 2014. The entire wallet was left empty with 120,347 BTC passing through it.

Either this address is used to launder BTC or simple as a convergence point for distribution. Either way this address is tied to a number of google search results in people getting hacked. Eg: https://bitcointalk.org/index.php?topic=754624.0;all

Final answer. You were hacked in some way.

Note: I added all the text in here to show how i traced his BTC from his address to an address known for hacking. This was to demonstrate how i came to the conclusion it was a hack and not an anomaly, software error, bug or something other.

Improve this answer
0

That symbol means that you sent the bitcoin to yourself, i.e. the key for the destination address 1NqJgMT4eLPycaD2i7T7xzbd9F9fycWE9u is also in your wallet. Is your wallet fully synced? Because there was another transaction showing the subsequent spending of the coins, which is not in your screenshot.

It looks like maybe you imported the key for this address after the coins had already been spent from it?

Improve this answer
6
  • Thank you. I've tried to dumpprivkey 1NqJgMT4eLPycaD2i7T7xzbd9F9fycWE9u but it stated that address is not known (code -4), it's not my address then? My wallet is fully synced. It might be that private address was already empty, but then if it's transaction to my self, how to find that missing balance?
    – tadaspadas
    Commented Nov 26, 2017 at 7:22
  • Hmm strange. In the transactions window, can you right click on the transaction and "show transaction details"? What is the output?
    – Adam Millerchip
    Commented Nov 26, 2017 at 7:27
  • Here is all information from the transaction Status: 196738 confirmations Date: 2014-05-06 21:31 Debit: -1.00000000 BTC Net amount: -1.00000000 BTC Transaction ID: 4837f44e4169f287ca6802c45ceab2dfef36ab7d8ecaa0eaebfa59ea6c76e17b Transaction total size: 635 bytes Output index: 0
    – tadaspadas
    Commented Nov 26, 2017 at 7:30
  • Sorry I don't know. If you "copy full transaction details", does it say "Payment to yourself"? Your output is slightly different to mine, maybe you could update Bitcoin Core to the latest version (if you've got an older version there's a a database upgrade that will take a long time). But it looks like your BTC was lost or stolen. :-(
    – Adam Millerchip
    Commented Nov 26, 2017 at 7:36
  • That's the point, there is nothing more like "Payment to yourself". It's full information. I will insert print screen on the main question. I'm using the latest Bitcoin Core version v0.15.1. Thank you for your time.
    – tadaspadas
    Commented Nov 26, 2017 at 7:39
-1

Stored in the CLOUD? Someone accessed your "cloud" years ago and stole your coins...

Improve this answer
1
  • It's not the cloud problem. Checked dates. I've put it on cloud later after BTC was stolen. Didn't check balance then.
    – tadaspadas
    Commented Dec 20, 2017 at 13:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.