Post
Topic
Board Electrum
Re: Receiving Into Offline Wallet
by
bubble1
on 03/03/2020, 14:42:51 UTC
Yes, I'm happy to share.

Fortunately, my loss was only 0.0045BTC.

Briefly, I often run bitcoin core on my PC even when I'm not transacting bitcoins.

I happened to see a message flash up saying that 0.0045BTC had been sent. WTF!!

I reported this on bitcoin.stackexchange, to try to get to the bottom of it.

One expert explained:

You do not explain why you believe your bitcoin core process sent the bitcoins. It is perfectly possible (from looking at your logs) that it was not sent from your bitcoin core, but from elsewhere on the bitcoin network. It may be possible to track down where the tx was sent from if enough nodes log the IP address of where the transaction was initiated, but there is nothing in your logs to suggest it was initiated from your node. In fact, your logs suggest that it was not initiated from your node.

Therefore, at some point the private keys for your bitcoin address were obtained. This could have been done if your computer contains malware, perhaps a key-logger, which was able to capture your wallet password, in combination with the wallet file.

The output that was spent was populated on 2018-12-28 19:12, but the private key associated with the address could have been created years earlier, as Bitcoin Core by default creates 100 addresses when it is first started, so the private key to this address could have been stored on a computer of yours for some time, perhaps even in an wallet with no password, if you initially didn't enable the password until later. So the time of intercept (of the private key) is theoretically any time between when you first ran Bitcoin Core and when the theft occurred
.


My first use of bitcoin core was in 2013, my machine is regularly virus and malware checked, and I believe I never used bitcoin core unencrypted.
 
The full thread is here
https://bitcoin.stackexchange.com/questions/93568/my-bitcoin-core-sent-bitcoins-without-my-authorisation