Unspent outputs get spent automatically

After generating a 2-out-of-3 wallet (using brainwallet http://ms-brainwallet.org/#generator) I am able to store my private/public keys for each of the participants.

Afterwards I send a small amount of BTC to this address (0.0002). The amount is correctly recorded and confirmed in the blockchain and is listed as an unspent transaction.

Afterwards I create a new transaction that spends (0.0001 BTC). This transaction is successful. On the third step I sent more funds to the 2-out-of-3 wallet (0.0003). This is where the issue happens: any funds I deposit in this wallet from second transaction on are automatically spent towards various unknown addresses, and there is never any unspent transactions no matter how much I deposit there.

I have tested this with several wallets already.

What I am thinking of is that there is a change problem. I found some ways that funds can 'evaporate' but I haven't been able to nail the issue completely. Any inputs would be appreciated.

multi-signature

blockbyblock

Posted 2014-11-30T00:52:43.213

Reputation: 33

1I'm not sure I understand what's going on from your description. Could you give the multisignature address, or draw a diagram? – Nick ODell – 2014-11-30T02:04:54.567

Is it 32sQKWebFMMdgmvfyJsUz8Fxbi4HJJaqcf? – amaclin – 2014-11-30T07:28:10.807

You either made a mistake in crafting the multisig transaction, or your private key is compromised somehow (brain wallets in general are just a bad idea). As others have stated, it would help if you post the multisig address in question. – kaykurokawa – 2014-11-30T21:11:40.707

Yes its 32sQKWebFMMdgmvfyJsUz8Fxbi4HJJaqcf – blockbyblock – 2014-11-30T21:42:12.083

Answers

My guess is that you are using weak passphrases to generate your keys. This is a common mistake with brain wallets. It is well known that there are bots that scan the blockchain for any unspent coins contained in an address generated from a weak passphrase and takes it for itself. I've not heard of a bot that looks at multisig p2sh addresses for weak passphrases, but I'm not surprised that it exists. It's not that much different than looking for weak passphrases in a standard pay to pub key transaction.

The reason why I think this is the case is because your coins get taken from the multisig address after you've made one transaction from the multisig address. When you make a transaction from the multisig address, you reveal all the public keys that the multisig address is associated with. If the passphrase associated with the key is weak, the private key can be cracked by the bots and your coins will be gone.

If your coins were taken before you've made a transaction from the multisig address, this could mean that your computer or the brainwallet generator is compromised. It is also possible that there is a bot that can crack a p2sh multisig address without knowing the public keys (this is doable but since the search space is bigger it would be harder for the bot). But since this is not the case, it seems pretty clear that you are using weak passphrases to generate your keys.

kaykurokawa

Posted 2014-11-30T00:52:43.213

Reputation: 1 902

3>>>I've not heard of a bot that looks at multisig p2sh addresses for weak passphrases<<< OK, now you have heard about it :) – amaclin – 2014-12-01T20:43:27.913

That should be the case since I was playing around with small amounts. Thanks! – blockbyblock – 2014-12-02T08:13:51.713