<p>I can't answer on the why and the how, but when you focus on the receiving address (1CfaunqrVpcXmpLheUVWeSP1KPsKDha1Nb), there is some weird things.</p>
<ol>
<li><p>You can find it in some presentation about &quot;what blockchain is?&quot; &gt; <a href="https://www.bitdegree.org/crypto/tutorials/what-is-blockchain" rel="nofollow noreferrer">What is blockchain</a></p>
</li>
<li><p>You can also find it on some powerpoint presentation about &quot;Blockchains transforming the domain industry&quot; where you can see that typing some domain name can route a payment to an address (this one was taken as example). <a href="https://2019.namescon.global/wp-content/uploads/2019/01/1430_Unstoppable-Domains-NamesCon_Matthew.pdf" rel="nofollow noreferrer">Unstoppable Domains</a></p>
</li>
</ol>
<p>This address is often used as an example in websites and presentations.</p>
<p>Is there any chance it was on your clipboard, following a copy from.. somewhere?
You can search it on a random search engine to see by yourself.</p>

CC BY-SA 4.0
2021-11-06T10:44:02.417Z
I noticed that this address was around the net, also, I noticed that the first transfer towards this address was from   1BoatSLRHtKNngkdXEeobR76b53LETtpyT, another well known address (vanity), but to answer your question, no, I did not have them in my clipboard...
Michael LEVY
CC BY-SA 4.0
2021-11-06T11:51:33.540Z
Also, I inserted my newly generated address into the Coinbase Pro transfer dialog, as you can see from the transaction details. I am not really a newbie in crypto, but this one just left me speachless...
Michael LEVY
CC BY-SA 4.0
2021-11-07T01:04:00.003Z
Yes, for the clipboard, I was thinking about your computer, where you have electrum.
nourou4them
CC BY-SA 4.0
2021-11-07T08:04:23.187Z
No, I did not have anything in the clipboard except the newly generated receiving address.
Michael LEVY
CC BY-SA 4.0
2021-11-05T23:12:37.707Z
2021-11-06T00:10:51.423Z
2021-11-06T00:10:51.423Z
nourou4them
<p>I think you can download a Coinbase cold wallet. You don't need to install Electrum at all. In that case, a handling fee will be incurred. If you don't understand, you can easily lose your coins.</p>

CC BY-SA 4.0
2021-11-08T13:19:24.680Z
2021-11-08T13:19:24.680Z
Alison Irina
<p>Weird... I took out a small amount of BTC from Coinbase Pro, generated a new receiving address in Electrum, and as soon as the transaction came in, the BTC was transferred to an address which I do not control...</p>
<p>Here is the withdrawal transaction:</p>
<p>63b1674c7f62e6c33d342518cc580b86de90ed4f1b77c67c76d1cb80cafe47a6</p>
<p>And here the one that sent the BTC out:</p>
<p>dd7660c0cc1e19f2e42faad42ca4ee8e92a7dc15da083a5277ff33b9a1badaeb</p>
<p>I really do not understand, I have also imported the receiving address into bitcoind, which is still syncing.</p>
<p>Any help would be highly appreciated.</p>

CC BY-SA 4.0
2021-11-05T09:41:30.417Z
There have been fake versions of Electrum that steal money. What is the version number you have and what website did you get it from?
RedGrittyBrick
CC BY-SA 4.0
2021-11-05T10:01:14.717Z
I got it from electrum.org, it was version 4.1.5
Michael LEVY
CC BY-SA 4.0
2021-11-05T10:09:02.990Z
Have you verified the GPG signatures from an independent source?
RedGrittyBrick
CC BY-SA 4.0
2021-11-05T10:10:22.157Z
Yes, I did. This is why I really do not understand how this was possible.
Michael LEVY
CC BY-SA 4.0
2021-11-05T10:11:46.973Z
And also, the outgoing transaction appeared at the very same time as the incoming transaction, with 0 confirmations. What I noticed, is that a much higher fee was paid for the outgoing one.
Michael LEVY
CC BY-SA 4.0
2021-11-05T10:12:18.687Z
Could your computer have been compromised and infected with malware that steals private keys?
RedGrittyBrick
CC BY-SA 4.0
2021-11-05T10:14:23.543Z
Nope. I scanned the computer several times, and I use BitDefender on my Win 10 partition. In my KALI partition, which I went to check after, Electrum was showing the same transactions... Luckily, I tried with a very small amount, but I am afraid some people might loose much more...
Michael LEVY
<client><electrum><malware>
I withdrawed a small amount of BTC from Coinbase Pro to Electrum and it was immediately sent to another address
Michael LEVY
# I withdrawed a small amount of BTC from Coinbase Pro to Electrum and it was immediately sent to another address

(Asked by: username_0 on 2021-11-05)

Weird... I took out a small amount of BTC from Coinbase Pro, generated a new receiving address in Electrum, and as soon as the transaction came in, the BTC was transferred to an address which I do not control...

Here is the withdrawal transaction:

63b1674c7f62e6c33d342518cc580b86de90ed4f1b77c67c76d1cb80cafe47a6

And here the one that sent the BTC out:

dd7660c0cc1e19f2e42faad42ca4ee8e92a7dc15da083a5277ff33b9a1badaeb

I really do not understand, I have also imported the receiving address into bitcoind, which is still syncing.

Any help would be highly appreciated.

**Tags:** client, electrum, malware

> **Comments:**
> **username_1**: There have been fake versions of Electrum that steal money. What is the version number you have and what website did you get it from?  
> **username_0**: I got it from electrum.org, it was version 4.1.5  
> **username_1**: Have you verified the GPG signatures from an independent source?  
> **username_0**: Yes, I did. This is why I really do not understand how this was possible.  
> **username_0**: And also, the outgoing transaction appeared at the very same time as the incoming transaction, with 0 confirmations. What I noticed, is that a much higher fee was paid for the outgoing one.  
> **username_1**: Could your computer have been compromised and infected with malware that steals private keys?  
> **username_0**: Nope. I scanned the computer several times, and I use BitDefender on my Win 10 partition. In my KALI partition, which I went to check after, Electrum was showing the same transactions... Luckily, I tried with a very small amount, but I am afraid some people might loose much more...  

---

## 2 answers

### Answer by username_2 on 2021-11-05. Score: 2

I can't answer on the why and the how, but when you focus on the receiving address (1CfaunqrVpcXmpLheUVWeSP1KPsKDha1Nb), there is some weird things.

1. You can find it in some presentation about "what blockchain is?" > [What is blockchain](https://www.bitdegree.org/crypto/tutorials/what-is-blockchain)
2. You can also find it on some powerpoint presentation about "Blockchains transforming the domain industry" where you can see that typing some domain name can route a payment to an address (this one was taken as example). [Unstoppable Domains](https://2019.namescon.global/wp-content/uploads/2019/01/1430_Unstoppable-Domains-NamesCon_Matthew.pdf)

This address is often used as an example in websites and presentations.

Is there any chance it was on your clipboard, following a copy from.. somewhere?
You can search it on a random search engine to see by yourself.

> **Comments:**
> **username_0**: I noticed that this address was around the net, also, I noticed that the first transfer towards this address was from   1BoatSLRHtKNngkdXEeobR76b53LETtpyT, another well known address (vanity), but to answer your question, no, I did not have them in my clipboard...  
> **username_0**: Also, I inserted my newly generated address into the Coinbase Pro transfer dialog, as you can see from the transaction details. I am not really a newbie in crypto, but this one just left me speachless...  
> **username_2**: Yes, for the clipboard, I was thinking about your computer, where you have electrum.  
> **username_0**: No, I did not have anything in the clipboard except the newly generated receiving address.  

---

### Answer by username_3 on 2021-11-08. Score: -1

I think you can download a Coinbase cold wallet. You don't need to install Electrum at all. In that case, a handling fee will be incurred. If you don't understand, you can easily lose your coins.


---

