1

A bitcoin trader opened a blockchain wallet for me and then sent me my profit but it is non-spendable. I know they can no longer get into my account because I changed the password and I have two-step verification. And I don't see them created passphrase, that means no private key was stolen?

Can they still access to my wallet? I'm the simlar situation as below thread, but how do I know private key was taken? Non-spend Blockchain.com How to unlock private key of bitcoin

tom
  • 11
  • 1

2 Answers2

4

Yea they can still access your wallet.

When the scammer created the wallet, they will have written down the mnemonic seed phrase for the wallet. With this seed phrase, they can recreate your wallet using some other software, since the seed phrase will allow them to derive all of the same addresses. They do not need the password to do this, and changing the password will not stop them either.

Think of it like this: you have a secret (the seed phrase) hidden in a box, and your password is the lock on the box that protects that secret. If the scammer steals the secret before you lock the box, they won’t need your password. They already have the secret!

So, the best thing to do is just never use that wallet (or seed phrase) again, and stop talking with the scammer.

chytrik
  • 18,170
  • 3
  • 19
  • 48
0

There is no point in them accessing your wallet. The wallet doesn't hold the key needed to transfer the bitcoin anyway -- that's why they show as non-spendable. They didn't send you any profit, they sent profit to their own account and showed it to you. Let's walk through what you said:

A bitcoin trader opened a blockchain wallet for me and then sent me my profit but it is non-spendable.

So it's not your wallet. They opened it. It's their wallet. They configured it so it could see the profits they transferred but not transfer them. That's why they show as non-spendable.

I know they can no longer get into my account because I changed the password and I have two-step verification.

You don't have an account. You never created one. You locked a wallet, but there's nothing in that wallet. They never put anything into that wallet except to allow it to watch their account.

And I don't see them created passphrase, that means no private key was stolen?

No private key was stolen because they hold the private key and never put it anywhere you could get it. They hold the private key and then they created a wallet for you that did not contain that private key.

Can they still access to my wallet?

No, but so what? The wallet doesn't have the private key anyway.

I'm the simlar situation as below thread, but how do I know private key was taken?

It wasn't. You never had a private key. That's why the funds show as non-spendable. You do not have and did not ever have the private key.

David Schwartz
  • 51,554
  • 6
  • 106
  • 178
  • 1
    As far as I understand these scams, the scammer will ask the victim to send money to the wallet in order to ‘unlock the private key of the non-spendable’ funds. If the scammer set the wallet up, they could be running scripts to insta-empty any funds sent to any address the wallet does have a key for. So while what you wrote about the victim not having the key for the non-spendable funds is true, I don’t think you should downplay the risk of the attacker having the privkeys that the wallet does control. The wallet should definitely be abandoned. – chytrik Mar 16 '20 at 22:51
  • In this case, they don't need any scripts to do anything. The funds are sitting in an address 100% owned and controlled by the scammer. The scammer will show the mark funds at that address, convincing the mark those funds are theirs but "locked" until the mark sends more funds. – David Schwartz May 19 '20 at 17:26