Bitcoins disappeared?

Question

I have the Bitcoin Core client installed on my desktop, and I have encrypted it and backed up the wallet. I rarely, if ever, go into it. I just thought I would bring it up today and it now shows a 0 balance (instead of what was in there).

The last transaction was a series of small debits, that I didn't initiate, that appears to have wiped my account out. What happened? What can i do? Anything?

I have a transaction ID, but no mention in the program of where they went.

windows 7...no malware from several scans...backed up to dropbox, which is only accessible via 2 step authentication...password was 10 characters long and includes numbers, letters (upper and lower)... — Octo1212, Sep 25 '15 at 17:08
Correct me if I'm wrong, you've sent your wallet.dat to the public dropbox and the wallet itself was not password protected and somebody took your coins? — Anlhord Smithson, Jan 26 '16 at 11:25

score 2 · Answer 1 · answered Sep 25 '15 at 14:47

Assuming the transaction was really made and confirmed (try looking up the transaction id on a site like http://blockchain.info), and the destination address isn't one of yours, then it appears your coins have been stolen. Unfortunately, there isn't anything you can do about it, from a technical point of view; one of the features of Bitcoin is that transactions cannot be reversed for any reason. Of course, you can report the theft to the police, but it is probably not likely they will be able to catch the thief or recover your coins.

In order to steal the coins, the thief would have needed access to the private keys stored in your wallet.dat file. From the information you gave, I can only speculate as to how this might have been done. Some possibilities:

You have a virus or some other malicious software on your computer. This software could have sent your encrypted wallet.dat to the thief, and also captured your keystrokes at some time when you typed the passphrase to decrypt it. Then the thief would be able to decrypt it as well.
The thief obtained your encrypted wallet.dat (via malicious software on your computer, or getting access to your backup, etc), and your passphrase was not very complex, so they were able to guess it with a brute-force attack (trying a very large number of possible passphrases until they found yours).
The thief is someone with physical access to your computer, and may have seen you type your passphrase. They could then steal your coins simply by sitting at your computer, entering your passphrase, and sending your coins to their own address.

it doesn't even say where it went: http://screencast.com/t/gdTVRbs0Yqz where did they go? — Octo1212, Sep 25 '15 at 17:18
@Octo1212: You can see the full transaction by entering the ID at a site like blockchain.info, here: https://blockchain.info/tx/09c0ae63f87a59b48e688fd69e4ee5ebb013656224568d2fb6a24b5d3214853a?show_adv=true I think perhaps the issue is that this transaction involved coins sent from other wallets besides yours (more evidence that it was made by someone who'd been gathering private keys from multiple victims) which may be why Bitcoin Core didn't display the usual information about it. — Nate Eldredge, Sep 26 '15 at 02:37

Bitcoins disappeared?

1 Answers1