<p>I would not trust the Electron Cash software. Unless you experience one of the wrong server selected bugs, as other people describe in the linked questions, I would guess that the wallet sent your coins to someone elses address.</p>

<p>There is a warning about Electron Cash from Electrum:</p>

<blockquote>
  <p>The person who distributes the Electron Cash binaries has decided to
  remain anonymous, and uses the fake name "Jonald Fyookball" in order
  to sign Electron Cash binaries. Thus, if these binaries contain code
  that is designed to steal your bitcoins, the author of the theft will
  be anonymous and walk away safely with your funds.</p>
</blockquote>

CC BY-SA 3.0
2017-08-09T09:22:42.267Z
I indeed now have strong doubts about the security of Electron Cash wallet software. Are there more users of Electron Cash (v 2.9.2)  with similar (negative) experience, that their retrieved BCCs have been "automatically"  transferred to a unknown address by a transaction that they didn't initiate themselves (shortly after the BCCs were received in the Electron Cash wallet)?
user57052
CC BY-SA 3.0
2017-08-14T22:35:43.890Z
@ Ramon: My conclusion is the BCCs have been stolen. How it exactly has been done is unfortunately still not clear (but I don't trust Electron Cash anymore).
user57052
CC BY-SA 3.0
2017-08-08T22:21:12.580Z
2017-08-08T22:21:12.580Z
Loreno Heer
<p>Your <code>.498</code> BCH were sent to <a href="https://bitcoincash.blockexplorer.com/address/19uUo2Ppdxj241pd9r2DWeQgFQUVJEpbSB" rel="nofollow noreferrer">19uUo2Ppdxj241pd9r2DWeQgFQUVJEpbSB</a> and then on to <a href="https://bitcoincash.blockexplorer.com/address/3Kaj5tacWQdz65JuWMNuEfictjAtTGj6Pv" rel="nofollow noreferrer">3Kaj5tacWQdz65JuWMNuEfictjAtTGj6Pv</a>.  Unusual to see addresses starting with a <code>3</code> used for BCH - probably a multisig. Interestingly, multisig <a href="https://twitter.com/ElectrumWallet/status/892731209259864064" rel="nofollow noreferrer">was broken in Electrum Cash software</a> (but there is no way to know how that P2SH address was created, so just speculating here).</p>

<p>Others have reported strange behavior with Electron Cash, but it is unclear if they were affected by same crypto-stealing malware or an issue in Electrum Cash itself. Furthermore, the developer of Electrum has <a href="https://twitter.com/electrumwallet/status/891935330235973633" rel="nofollow noreferrer">warned users about the unknown developer and code changes made</a>.</p>

<p>Sorry, I have no further info to share.</p>

CC BY-SA 3.0
2017-12-16T15:34:02.060Z
I see that my stolen BCH (on Aug.7, 2017) has been transfered on Dec 7, 2017 to a new address.
user57052
CC BY-SA 3.0
2017-12-16T15:44:53.480Z
I see (on https://www.blocktrail.com/BCC/address/3Kaj5tacWQdz65JuWMNuEfictjAtTGj6Pv/transactions) that my stolen BCH (on Aug.7, 2017) has been transfered on Dec 7, 2017 to a new address:   1GxXZqS737quMaXWxuEH2sFT3Zv7H8DaX5. I see furthermore that the thief collected here for 14.76 of (stolen?) BCH (now worth about $26000) from 7 other addresses. Who is this thief? Anybody any idea? Some recognizes this adress?
user57052
CC BY-SA 3.0
2017-12-16T15:55:00.637Z
By the way: the seven adresses all start with a "3". I don't know if this has any meaning (but I mention this, because Jonathan Cross made remark about "3" in relation to "multisig"). The (input) 7 adresses are (P2SH):
3EzaSJNYQN87KhLA1CSNGZkpi3uiHfZqQw(1.04295252)
3Q3rVGht7azs3CcH1eoW4EU253YiNuWxR4(3.29047404)
3Kaj5tacWQdz65JuWMNuEfictjAtTGj6Pv(0.49862345)
3PzurWPWhsHTwqMEvviD7rZdimDdbhWMP2(4.15503946)
3LMN6JdskX22zJdiE1a1KrkSoLWExCyKy1(0.18951550)
3Q4XPvYwqzDo465ALsEfnqiQXPyU1TQpFq(5.08970062)
33ZkwQ5BQAYfNHUYFb6bqND1ksikFkiAR8(0.50274277) 
Anybody's BCH's stolen from these adresses?
user57052
CC BY-SA 3.0
2017-11-18T01:39:55.580Z
2017-11-18T01:39:55.580Z
Jonathan Cross
<p>I installed the Electron Cash Wallet on my laptop (version 2.9.2 downloaded from official site "electroncash.org" with the correct checksum). Then I retrieved my BCCs (from an imported BTC adress in my Blockchain.info wallet) into my Electron Cash Wallet, using the (Electron Cash) Wallet/Private Key/Sweep command (with the private key for the BTC adress as argument). After the "Broadcast" of the transaction the BCC's were added to my Electron Cash balance (on 7 Aug. 01.07 hour). So far so good. After that I closed my (password protected) wallet and put my laptop to sleep. In the morning I started my computer again, opened the Electron Cash wallet again, but saw to my great dismay that at 3:50 hour - when I was sleeping - a transaction has been done (by a unknown person/computer/hacker?) in which all my BCCs have been transfered to a for me unknown adress. So now my BCC balance is 0 again! (see screendumps of the wallet history and the unknown/illegal transaction below). My first impression was that I 'm robbed.</p>

<p><a href="https://i.sstatic.net/Iqzv1.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/Iqzv1.png" alt="enter image description here"></a>
<a href="https://i.sstatic.net/6SNSc.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/6SNSc.png" alt="enter image description here"></a></p>

<p>What happened here? Has anyone stolen my BCCs? And if so, how is this possible? After all I closed my wallet and shutted down my laptop. (Some thoughts: could someone have been able to get my private key for the adress in which I received my BCCs in my Electron Cash wallet? And if, so how? Could it be that Electron Cash (2.9.2) is not save, e.g. when using Private key/Export command, by sending secretly a copy to some unknown receiver? Or else?). Has anybody the same experience with retrieved BCCs in Electron Cash wallet, and/or an idea what could have happened. And more important: is there a possibility to get my (lost/stolen?) BCCs back again (and if so how)? (I my opinion I don't have the problem that Electron Cash is erroneously referring to an Electrum Cash BTC server (mentioned on other posts). To be sure I put the server on manual on "electroncash.cascharia.com", but that does not bring my BCCs back. What can I do to get my BCCs back?  Your answer(s) is (are) highly appreciated.</p>

CC BY-SA 3.0
2017-08-09T21:06:48.730Z
I have the same Issue, but it is still unconfirmed. Is this a software bug or have they been stolen? Did you found out what happened?
Ramon
CC BY-SA 3.0
2017-08-09T23:13:10.573Z
Another possibility is that your computer has some sort of malware which detected that you were typing in a private key and used it to steal the funds.  It doesn't have to be a problem with Electron itself.
Nate Eldredge
<blockchain.info><wallet-security><bitcoin-cash><private-key-import>
Are my retrieved BCCs stolen from my Electron Cash wallet?
user57052
# Are my retrieved BCCs stolen from my Electron Cash wallet?

(Asked by: username_0 on 2017-08-08)

I installed the Electron Cash Wallet on my laptop (version 2.9.2 downloaded from official site "electroncash.org" with the correct checksum). Then I retrieved my BCCs (from an imported BTC adress in my Blockchain.info wallet) into my Electron Cash Wallet, using the (Electron Cash) Wallet/Private Key/Sweep command (with the private key for the BTC adress as argument). After the "Broadcast" of the transaction the BCC's were added to my Electron Cash balance (on 7 Aug. 01.07 hour). So far so good. After that I closed my (password protected) wallet and put my laptop to sleep. In the morning I started my computer again, opened the Electron Cash wallet again, but saw to my great dismay that at 3:50 hour - when I was sleeping - a transaction has been done (by a unknown person/computer/hacker?) in which all my BCCs have been transfered to a for me unknown adress. So now my BCC balance is 0 again! (see screendumps of the wallet history and the unknown/illegal transaction below). My first impression was that I 'm robbed.

[![enter image description here](https://i.sstatic.net/Iqzv1.png)](https://i.sstatic.net/Iqzv1.png)
[![enter image description here](https://i.sstatic.net/6SNSc.png)](https://i.sstatic.net/6SNSc.png)

What happened here? Has anyone stolen my BCCs? And if so, how is this possible? After all I closed my wallet and shutted down my laptop. (Some thoughts: could someone have been able to get my private key for the adress in which I received my BCCs in my Electron Cash wallet? And if, so how? Could it be that Electron Cash (2.9.2) is not save, e.g. when using Private key/Export command, by sending secretly a copy to some unknown receiver? Or else?). Has anybody the same experience with retrieved BCCs in Electron Cash wallet, and/or an idea what could have happened. And more important: is there a possibility to get my (lost/stolen?) BCCs back again (and if so how)? (I my opinion I don't have the problem that Electron Cash is erroneously referring to an Electrum Cash BTC server (mentioned on other posts). To be sure I put the server on manual on "electroncash.cascharia.com", but that does not bring my BCCs back. What can I do to get my BCCs back? Your answer(s) is (are) highly appreciated.

**Tags:** blockchain.info, wallet-security, bitcoin-cash, private-key-import

> **Comments:**
> **username_1**: I have the same Issue, but it is still unconfirmed. Is this a software bug or have they been stolen? Did you found out what happened?  
> **username_2**: Another possibility is that your computer has some sort of malware which detected that you were typing in a private key and used it to steal the funds.  It doesn't have to be a problem with Electron itself.  

---

## 2 answers

### Answer by username_3 on 2017-08-08. Score: 1

I would not trust the Electron Cash software. Unless you experience one of the wrong server selected bugs, as other people describe in the linked questions, I would guess that the wallet sent your coins to someone elses address.

There is a warning about Electron Cash from Electrum:

> The person who distributes the Electron Cash binaries has decided to
> remain anonymous, and uses the fake name "Jonald Fyookball" in order
> to sign Electron Cash binaries. Thus, if these binaries contain code
> that is designed to steal your bitcoins, the author of the theft will
> be anonymous and walk away safely with your funds.

> **Comments:**
> **username_0**: I indeed now have strong doubts about the security of Electron Cash wallet software. Are there more users of Electron Cash (v 2.9.2)  with similar (negative) experience, that their retrieved BCCs have been "automatically"  transferred to a unknown address by a transaction that they didn't initiate themselves (shortly after the BCCs were received in the Electron Cash wallet)?  
> **username_0**: @ username_1: My conclusion is the BCCs have been stolen. How it exactly has been done is unfortunately still not clear (but I don't trust Electron Cash anymore).  

---

### Answer by username_4 on 2017-11-18. Score: 0

Your `.498` BCH were sent to [19uUo2Ppdxj241pd9r2DWeQgFQUVJEpbSB](https://bitcoincash.blockexplorer.com/address/19uUo2Ppdxj241pd9r2DWeQgFQUVJEpbSB) and then on to [3Kaj5tacWQdz65JuWMNuEfictjAtTGj6Pv](https://bitcoincash.blockexplorer.com/address/3Kaj5tacWQdz65JuWMNuEfictjAtTGj6Pv). Unusual to see addresses starting with a `3` used for BCH - probably a multisig. Interestingly, multisig [was broken in Electrum Cash software](https://twitter.com/ElectrumWallet/status/892731209259864064) (but there is no way to know how that P2SH address was created, so just speculating here).

Others have reported strange behavior with Electron Cash, but it is unclear if they were affected by same crypto-stealing malware or an issue in Electrum Cash itself. Furthermore, the developer of Electrum has [warned users about the unknown developer and code changes made](https://twitter.com/electrumwallet/status/891935330235973633).

Sorry, I have no further info to share.

> **Comments:**
> **username_0**: I see that my stolen BCH (on Aug.7, 2017) has been transfered on Dec 7, 2017 to a new address.  
> **username_0**: I see (on https://www.blocktrail.com/BCC/address/3Kaj5tacWQdz65JuWMNuEfictjAtTGj6Pv/transactions) that my stolen BCH (on Aug.7, 2017) has been transfered on Dec 7, 2017 to a new address:   1GxXZqS737quMaXWxuEH2sFT3Zv7H8DaX5. I see furthermore that the thief collected here for 14.76 of (stolen?) BCH (now worth about $26000) from 7 other addresses. Who is this thief? Anybody any idea? Some recognizes this adress?  
> **username_0**: By the way: the seven adresses all start with a "3". I don't know if this has any meaning (but I mention this, because username_4 made remark about "3" in relation to "multisig"). The (input) 7 adresses are (P2SH): 3EzaSJNYQN87KhLA1CSNGZkpi3uiHfZqQw(1.04295252) 3Q3rVGht7azs3CcH1eoW4EU253YiNuWxR4(3.29047404) 3Kaj5tacWQdz65JuWMNuEfictjAtTGj6Pv(0.49862345) 3PzurWPWhsHTwqMEvviD7rZdimDdbhWMP2(4.15503946) 3LMN6JdskX22zJdiE1a1KrkSoLWExCyKy1(0.18951550) 3Q4XPvYwqzDo465ALsEfnqiQXPyU1TQpFq(5.08970062) 33ZkwQ5BQAYfNHUYFb6bqND1ksikFkiAR8(0.50274277)  Anybody's BCH's stolen from these adresses?  

---

