BTC missing after strange negative transaction

four years ago I've bought 1 BTC, made wallet.dat file and stored in the cloud. Now I wanted to check balance and after syncing on Bitcoin Core found negative transaction with no address.

I did not make second transaction. It has no address. What it is? What the second negative transaction means? Why strange icon? Here's second transaction ID 4837f44e4169f287ca6802c45ceab2dfef36ab7d8ecaa0eaebfa59ea6c76e17b

I have 2 public keys. I've tried to dumpprivkey. After obtaining private keys I've tried to import to one local Bitcoin service (spectrocoin) but after 24 hours nothing changed.

Does it mean that I've lost BTC? Is there anything else I can do? Thank you for your help.

tadaspadas

Posted 2017-11-25T18:21:07.930

Reputation: 1

No address? Is 17nu7oViEtGCYaYwrKKVGyrs7jkcNwpVf2 your address? Then that BTC is sent to 1NqJgMT4eLPycaD2i7T7xzbd9F9fycWE9u, according to: https://www.blockchain.com/btc/address/17nu7oViEtGCYaYwrKKVGyrs7jkcNwpVf2. So, that's not as mysterious as "no address". Pretty much sure your bitcoin wallet is stolen, perhaps when you carelessly downloaded some malware or viruses that got your information about this. I'm sorry that this has happened but bitcoin transactions are not likely to be reversed, if you have big amount of money, the bank will be a much safer place.

– Akuta Hinako – 2019-11-16T10:40:29.813

or an offline wallet, a physical btc wallet. – Akuta Hinako – 2019-11-16T10:59:50.467

1It looks like someone who had access to your private key transferred your bitcoin in April of 2014. But it's hard to tell with just what you've given us. – David Schwartz – 2017-11-26T06:00:52.150

Here is transaction ID of the negative transaction: 4837f44e4169f287ca6802c45ceab2dfef36ab7d8ecaa0eaebfa59ea6c76e17b – tadaspadas – 2017-11-26T06:55:39.203

Which cloud company BTW? – MCCCS – 2017-12-20T13:36:22.913

Checked dates, I've put file to cloud later after BTC was stolen. I didn't check balance then. – tadaspadas – 2017-12-20T13:38:52.510

Answers

It looks like, using just the 17nu address here:

https://longhorn.bullpay.com/?gateway=2&data=17nu7oViEtGCYaYwrKKVGyrs7jkcNwpVf2

Only 2 transactions occurred. This transaction:

https://longhorn.bullpay.com/?gateway=2&data=fae9171eea55eb69cbe73f8a23003f9267b71e5a7292d2bcd7b396a58aa82827

Resulted in the UTXO for 1 BTC to 17nu.

That UTXO was then used in this one:

https://longhorn.bullpay.com/?gateway=2&data=4837f44e4169f287ca6802c45ceab2dfef36ab7d8ecaa0eaebfa59ea6c76e17b

But it was combined with other transaction unrelated to the wallet. I'd say your wallet was compromised. Your transactions got bundled in with other UTXO's elsewhere not related to your wallet.

The address it was sent to:

https://longhorn.bullpay.com/?gateway=2&data=1NqJgMT4eLPycaD2i7T7xzbd9F9fycWE9u

had a flurry of activity on 5/6/14 within a 2 hour time period. In some cases with massive bundling of UTXO's. 34 inputs, 56 inputs. The transactions moving BTC from that wallet out left it with a zero balance.

Almost all of this funnels into address 17gH1u6VJwhVD9cWR59jfeinLMzag2GZ43:

https://longhorn.bullpay.com/?gateway=2&data=17gH1u6VJwhVD9cWR59jfeinLMzag2GZ43&grid-page=1

Which processed 17,990 transactions between March 2014 thru October 2014. The entire wallet was left empty with 120,347 BTC passing through it.

Either this address is used to launder BTC or simple as a convergence point for distribution. Either way this address is tied to a number of google search results in people getting hacked. Eg: https://bitcointalk.org/index.php?topic=754624.0;all

Final answer. You were hacked in some way.

Note: I added all the text in here to show how i traced his BTC from his address to an address known for hacking. This was to demonstrate how i came to the conclusion it was a hack and not an anomaly, software error, bug or something other.

cleanmarker

Posted 2017-11-25T18:21:07.930

Reputation: 335

That symbol means that you sent the bitcoin to yourself, i.e. the key for the destination address 1NqJgMT4eLPycaD2i7T7xzbd9F9fycWE9u is also in your wallet. Is your wallet fully synced? Because there was another transaction showing the subsequent spending of the coins, which is not in your screenshot.

It looks like maybe you imported the key for this address after the coins had already been spent from it?

Adam Millerchip

Posted 2017-11-25T18:21:07.930

Reputation: 925

Thank you. I've tried to dumpprivkey 1NqJgMT4eLPycaD2i7T7xzbd9F9fycWE9u but it stated that address is not known (code -4), it's not my address then? My wallet is fully synced. It might be that private address was already empty, but then if it's transaction to my self, how to find that missing balance? – tadaspadas – 2017-11-26T07:22:36.363

Hmm strange. In the transactions window, can you right click on the transaction and "show transaction details"? What is the output? – Adam Millerchip – 2017-11-26T07:27:30.323

Here is all information from the transaction Status: 196738 confirmations Date: 2014-05-06 21:31 Debit: -1.00000000 BTC Net amount: -1.00000000 BTC Transaction ID: 4837f44e4169f287ca6802c45ceab2dfef36ab7d8ecaa0eaebfa59ea6c76e17b Transaction total size: 635 bytes Output index: 0 – tadaspadas – 2017-11-26T07:30:29.833

Sorry I don't know. If you "copy full transaction details", does it say "Payment to yourself"? Your output is slightly different to mine, maybe you could update Bitcoin Core to the latest version (if you've got an older version there's a a database upgrade that will take a long time). But it looks like your BTC was lost or stolen. :-( – Adam Millerchip – 2017-11-26T07:36:34.610

That's the point, there is nothing more like "Payment to yourself". It's full information. I will insert print screen on the main question. I'm using the latest Bitcoin Core version v0.15.1. Thank you for your time. – tadaspadas – 2017-11-26T07:39:44.627

"Copy full transaction details" is slightly different to "show transaction details". It copies a text version of the transaction to the clipboard. There must be a reason for the double arrow symbol, instead of the normal spend symbol. Sorry I couldn't help further, good luck! – Adam Millerchip – 2017-11-26T07:42:36.337

-1

Stored in the CLOUD? Someone accessed your "cloud" years ago and stole your coins...

AnonymousCoward

Posted 2017-11-25T18:21:07.930

Reputation: 1

It's not the cloud problem. Checked dates. I've put it on cloud later after BTC was stolen. Didn't check balance then. – tadaspadas – 2017-12-20T13:40:02.890