segwitaddress icon indicating copy to clipboard operation
segwitaddress copied to clipboard

Receiving address automatically changed, coins lost

Open anandks111 opened this issue 4 years ago • 8 comments

I was trying to transfer my coins through segwitaddress.org. My address 3Ka____ was created using this website. I tried to transfer the coins to 3PX1____. But the receiving address automatically changed to 3Nw___ and my coins are lost. Can anyone help?

anandks111 avatar Jul 05 '21 12:07 anandks111

That is very concerning. Are you sure you were using segwitaddress.org and not a phishing site? Any other details you can provide? Have you checked your machine for viruses? I know this doesn't help at all but preferably you should only download the segwitaddress.org source files from github and run it on your own machine so you can be sure of what is running. Putting your private key into a live browser can be risky.

coinables avatar Jul 05 '21 13:07 coinables

I am 100% sure that it is not a phishing site. Because I am using it for the last 12 months and have transferred the coins several times. The URL is bookmarked in my browser. I had used Google Chrome (as I had done before). Haven't checked my system for trojans and spyware yet. I thought that since I have anti-virus, it won't be an issue.

This is what I did: My wallet had around 0.01 BTC. I browsed to https://segwitaddress.org/#entropyRef, and tried the "Sweep SegWit Private Key" option by inputting the private key and destination address. The first time, I noticed that the address got changed when I clicked the "Transfer all funds" option. Again, since I had done this so manytimes, I thought that it was a mistake and I just manually changed the address to my destination address and again clicked on "Transfer all funds". But the coins were sent to the other address.

anandks111 avatar Jul 05 '21 14:07 anandks111

Have you added any browser plug-ins recently?

coinables avatar Jul 05 '21 14:07 coinables

No.. checked again... no new plugins and extensions.

anandks111 avatar Jul 05 '21 14:07 anandks111

Unless my server was compromised, which it doesn't appear to be, I'm leaning towards some sort of spyware/malware on your machine. Did this happen to you on two transactions? The receiving address has received two transactions today. Were they both yours?

coinables avatar Jul 05 '21 15:07 coinables

Yes... both the transactions done from the same laptop. Anyway, I am not sure whether my laptop is infected or not. I will wait for a couple of days. If no other users are reporting such issues, that mean that something is wrong with my laptop.

anandks111 avatar Jul 05 '21 16:07 anandks111

Checking in to see the results of the virus scan on your machine. Any updates?

coinables avatar Jul 14 '21 00:07 coinables

Got one of my friends to check everything. Didn't found any spyware or trojans.

anandks111 avatar Jul 14 '21 04:07 anandks111