I have an issue. My Bitcoin Core client shows "Impact: unknown rules (versionbit 2) have been activated". Bitcoin Core made a transaction by itself and sent all my bitcoins from my wallet to an address I don't recognize. I don't know what's happening. Can I do something with this issue and get my bitcoins back?
Add a comment
|
2 Answers
"unknown rules (versionbit 2) have been activated"
This means that you are probably using an old version of Bitcoin Core that doesn't understand new types of Bitcoin transaction. The current version is 0.21.1.
It almost certainly has nothing to do with the second part of your question.
Installing a new version of Bitcoin Core from the genuine website should make the message go away. It won't get your money back though.
Bitcoin Core made a transaction by itself
If you didn't make the transaction, either someone else has access to your wallet or to a copy of your wallet (that is, they have had some kind of access to the private keys in the wallet). It is possible your computer has malicious software on it that you were tricked into installing.
Don't download software from trickster websites that use variations of the name such as "BTC Core". Mistakenly installing malicious software is one way of having money stolen. I note that there is a site whose URL spells bitcoincore with an accented ń - I can only assume it is a fake website providing maliciously altered software that steals money. That malicious imposter website seems to have currently bought its way to the top of the Google results (it's an "Ad" result). bitcoincore.org is OK, bitcoińcore.org is fake.
and sent all my bitcoins from wallet to address I don't recognise.
That sounds like theft.
Can I do something with this issue and get my bitcoins back?
You can't cancel, undo or reverse a confirmed transaction. Only the person or business who controls the receiving address can create a new transaction sending the same amount to you. It is possible the money has been moved further.
Beware of fake recovery agents. You are much more likely to be tricked out of further money than to any see any significant amount of stolen money returned to you.
See
- How do I recover from a cryptocurrency scam? (some of the answers will apply to the type of theft you might have been victim to)
- Is there a 'BTC Refund Department'?
answered Jul 24, 2021 at 18:09
As RedGrittyBrick mentioned in the answer you are most probably running malware which looks like Bitcoin Core:
Either someone else has access to your wallet or to a copy of your wallet (that is, they have had some kind of access to the private keys in the wallet).
Your wallet file was copied and shared with attacker if you downloaded malware from the domain which uses punycode for n in its domain which looks similar to n. I had reported the domain to Cloudflare and it shows a phishing warning in browsers now although they can't control the content of the website so forwarded the report to web hosting which may not be helpful.
I downloaded the malware from this link and few things that I observed:
- SHA256 checksum doesn't match with https://bitcoincore.org/bin/bitcoin-core-0.21.1/SHA256SUMS.asc:
certUtil -hashfile bitcoin-0.21.1-win64-setup-unsigned.exe SHA256
SHA256 hash of bitcoin-0.21.1-win64-setup-unsigned-1.exe:
db3d3784e377c14819a5e62ab1d1e0941ae27fcc8fdb684541265b4f7dd70a73
CertUtil: -hashfile command completed successfully.
- If SHA256 checksum doesn't match you should never run this file but I checked other things for research. Verified Publisher name in UAC prompt:
- Scanned the file on virustotal and found it creates a registry key mostly used by malwares:
HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\A70D59A1-8EAD-4F40-AAAB-FBFC460800A4\FriendlyName
- Installed the software and run it. Found it copies wallets every time I restart it which attacker will use later to send bitcoin (nothing in this case because I used regtest):
debug.log:
- Tries to connect to a weird domain according to logs in Wireshark:
- Version details
