Do I have someone else's private key in my wallet, or has my wallet been compromised?

Question

Apologies for the vagueness of my memory.

I started using Bitcoin in mid-2015. I believe I installed Bitcoin Core at that time but got bored waiting for it to sync the blockchain, so I instead used MultiBit

Last week (April 2017) I decided to migrate off what is now called MultiBit Classic, since it's no longer supported. I upgraded Bitcoin Core to the newest version, waited for it to sync the blockchain, and was surprised to see two transactions from October 2016, both involving the address 1QKcPYdiDfPgNH4dYnC99uZqTszU4gndnn.

Dumping my wallet shows this address was generated back in 2015, and is marked as "reserve":

[private key deleted] 2015-04-29T18:42:36Z reserve=1 # addr=1QKcPYdiDfPgNH4dYnC99uZqTszU4gndnn

I'm sure these transactions have nothing to do with me. I wasn't using Bitcoin in October 2016, and I don't believe I ever performed any transactions at all with Bitcoin Core. What's going on?

Answer 1

This is indeed strange.

What you should have done before upgrading Bitcoin-Core (if your old Core wallet didn't had any funds in it) delete the wallet.dat file.

Because you are using now keys that where exposed on your hard drive since 2015.

This is the case because Bitcoin-Core uses "key pool". Once you launch Bitcoin Core the first time, it will pre-generate 100 keys (these are the reserve=1 keys in your dump).

My recommendations would be creating a new wallet (these steps assume you currently have funds in your wallet):

1. Stop Bitcoin-Core
2. Move your wallet.dat to somewhere save (rename it wallet.old.dat)
3. Start Bitcoin-Core (a new wallet will be created)
4. Encrypt your wallet with a secure passphrase
5. Copy out a new address to send your old funds to.
6. Stop Bitcoin-Core
7. Move your wallet.dat to somewhere same (rename it wallet.new.dat)
8. Move back your wallet.old.dat to your datadir and rename it back to wallet.dat 9 Start Bitcoin-Core and send all your funds to the address in your new wallet (step 5)
9. Stop Bitcoin-Core, move away your old wallet and move back your wallet.new.dat to your datadir
10. Start Core, and check if your funds are there