Post
Topic
Board Electrum
Re: Fraudulent transaction along with the correct one(Ledger Nano S + Electrum)
by
Lucius
on 11/02/2020, 10:54:37 UTC
Thanks for your reply.
Indeed, I searched my PC trying to find traces of the address string and I didn't get anything, thus either a script injected it then deleted itself either it was derived by Ledger somehow with a wrong derivation path.

The hardware wallet should be safe to use even on an infected computer, but it's just an assumption based on what we know, which certainly doesn't mean that some clever hacker didn't find a way to circumvent the protection that Nano S should provide.

Now that you have shown us both transactions, I can see that these are really large amounts and that you may be the victim of a very targeted attack, so you have to wonder who all knew that you owned such a significant amount of BTC.

On the other hand, when I look at the first legitimate transaction, I notice that second transaction is had fee of only 200 satoshi, compared to the first one that had a 5x higher fee. Hackers in such cases usually place a maximum fee to get confirmations as soon as possible. Considering this, it is possible that this is some kind of bug in Ledger or in Electrum, and that coins are still in your wallet, but in an address that you can't see for some reason.

I can confirm that both of the pages you cited are really blocked by MB, one because it contains exploit and the other because of phishing. If MB is blocking those sites, do you visit them or this is happening when you surf on some other site which is maybe try to redirect you to that sites?

Can you confirm that you downloaded Electrum from the official site https://electrum.org/#home , and did you maybe verify GPG signatures of downloaded files before installing?