<p>The transaction that shows up as confirmed (<a href="https://blockchain.info/tx/8f1fb5fa162e01430a09d49e97aa2f08c41da13f09f565dedfc8c2da8ad30902" rel="nofollow">8f1fb5fa1</a>) was confirmed almost a year ago in block 345970, although your client is showing it with a recent date. I think you might have not synchronized with the network before attempting to transfer the coins to your new wallet, at which point the client still showed the coins in your balance. You later caught up with the blockchain and your wallet noticed that the coins were no longer available, marking your new transaction as a conflict/doublespend.</p>

<p>If this is indeed the case, then this is perfectly normal. If this were your address then the wallet would notice this automatically and credit you with the coins. It could either be that you migrated your funds at some point to a new wallet or that malware was involved.</p>

CC BY-SA 3.0
2016-03-01T20:58:19.393Z
You are correct, that's exactly what has happened. Big brain fart by me (although I feel the UI is a bit confusing in this case). Thanks.
André Risnes
CC BY-SA 3.0
2016-03-01T20:14:37.907Z
2016-03-01T20:14:37.907Z
cdecker
<p>Yesterday evening I installed the Bitcoin Core wallet (v0.11.2 (64-bit) from the Chocolatey repo to my Windows 10 machine). I had some coins in an old wallet.dat that I copied to the data directory. That worked fine. While the Blockchain was downloading, I transferred the balance from the old wallet to a new address (in my MultiBit HD wallet): <code>1JRyKhLLXMeVPpeEw3fvcJbUmrZYtRiojd</code>.</p>

<p>Bitcoin Core wallet created a new transaction to that address in the transaction list. Unfortunately, a few seconds later, it also created a new transaction with the same amount, but to an unfamiliar address: <code>1Msx9dp6uVr1rrz6pUxXwqLL3oxB9fDn1j</code>.</p>

<p>This new transaction was soon confirmed, while the transaction I entered remains with status Conflicted.</p>

<p>Here's (the relevant part of) the transaction list in Bitcoin Core wallet:</p>

<p><a href="https://i.sstatic.net/bbs5n.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/bbs5n.png" alt="Transaction list"></a></p>

<p>Here's the transaction I asked Bitcoin Core wallet to create, and the mystery transaction it created on it's own initiative:</p>

<p><a href="https://i.sstatic.net/UMYNR.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/UMYNR.png" alt="Transaction details"></a></p>

<p>What could have happened here? Is there any way I can find the PK for the mystery address (could it be a change address in the wallet or something like that)?</p>

CC BY-SA 3.0
2016-03-01T19:04:36.820Z
Huge red flags: "Chocolatey repo" and "Windows". Getting the Bitcoin software from anywhere other than the original source (bitcoin.org) is a huge risk. Also I personally would never run a Bitcoin wallet on Windows because of all the malware. Any random piece of malware can steal all your coins. I can't say whether that's what happened here (I hope not), but it surely is my first thought.
Jannes
CC BY-SA 3.0
2016-03-01T19:29:25.743Z
I fear it might be malware, too. But I have run a test transaction (with a smaller amount!) that did not have the same problem (But then again, maybe the malware only strikes when the balance is high enough...). Virus and spyware scans find nothing.
André Risnes
CC BY-SA 3.0
2016-03-01T19:42:02.243Z
Looking at the mystery transaction in Block Explorer: https://blockexplorer.com/tx/8f1fb5fa162e01430a09d49e97aa2f08c41da13f09f565dedfc8c2da8ad30902 -- we can see that the block was mined Mar 3, 2015! How could the wallet software create a transaction on Feb 29th this year, and get it included in a block from 2015?
André Risnes
CC BY-SA 3.0
2016-06-16T21:02:28.823Z
"Chocolatey repo" is typically just source scripts that provide metadata about where the installers are and passing arguments that the installer natively provides. The executables are unchanged and is actualy verified by checksum before install. If you sign into the `chocolatey.org/packages/bitcoin.install#files`, the install files are scanned and displayed by VirusTotal. For this package, it installs from the original source. The choco.exe is open source at `github.com/chocolatey/choco`.... As for Windows, as long as you are careful, there is no harm, just don't use it on a shared PC.
adam
<transactions><bitcoin-core><client>
Why did Bitcoin Core wallet send my coins to this address?
André Risnes
# Why did Bitcoin Core wallet send my coins to this address?

(Asked by: username_0 on 2016-03-01)

Yesterday evening I installed the Bitcoin Core wallet (v0.11.2 (64-bit) from the Chocolatey repo to my Windows 10 machine). I had some coins in an old wallet.dat that I copied to the data directory. That worked fine. While the Blockchain was downloading, I transferred the balance from the old wallet to a new address (in my MultiBit HD wallet): `1JRyKhLLXMeVPpeEw3fvcJbUmrZYtRiojd`.

Bitcoin Core wallet created a new transaction to that address in the transaction list. Unfortunately, a few seconds later, it also created a new transaction with the same amount, but to an unfamiliar address: `1Msx9dp6uVr1rrz6pUxXwqLL3oxB9fDn1j`.

This new transaction was soon confirmed, while the transaction I entered remains with status Conflicted.

Here's (the relevant part of) the transaction list in Bitcoin Core wallet:

[![Transaction list](https://i.sstatic.net/bbs5n.png)](https://i.sstatic.net/bbs5n.png)

Here's the transaction I asked Bitcoin Core wallet to create, and the mystery transaction it created on it's own initiative:

[![Transaction details](https://i.sstatic.net/UMYNR.png)](https://i.sstatic.net/UMYNR.png)

What could have happened here? Is there any way I can find the PK for the mystery address (could it be a change address in the wallet or something like that)?

**Tags:** transactions, bitcoin-core, client

> **Comments:**
> **username_1**: Huge red flags: "Chocolatey repo" and "Windows". Getting the Bitcoin software from anywhere other than the original source (bitcoin.org) is a huge risk. Also I personally would never run a Bitcoin wallet on Windows because of all the malware. Any random piece of malware can steal all your coins. I can't say whether that's what happened here (I hope not), but it surely is my first thought.  
> **username_0**: I fear it might be malware, too. But I have run a test transaction (with a smaller amount!) that did not have the same problem (But then again, maybe the malware only strikes when the balance is high enough...). Virus and spyware scans find nothing.  
> **username_0**: Looking at the mystery transaction in Block Explorer: https://blockexplorer.com/tx/8f1fb5fa162e01430a09d49e97aa2f08c41da13f09f565dedfc8c2da8ad30902 -- we can see that the block was mined Mar 3, 2015! How could the wallet software create a transaction on Feb 29th this year, and get it included in a block from 2015?  
> **username_2**: "Chocolatey repo" is typically just source scripts that provide metadata about where the installers are and passing arguments that the installer natively provides. The executables are unchanged and is actualy verified by checksum before install. If you sign into the `chocolatey.org/packages/bitcoin.install#files`, the install files are scanned and displayed by VirusTotal. For this package, it installs from the original source. The choco.exe is open source at `github.com/chocolatey/choco`.... As for Windows, as long as you are careful, there is no harm, just don't use it on a shared PC.  

---

## 1 answers

### Answer by username_3 on 2016-03-01. Score: 4 | Accepted answer

The transaction that shows up as confirmed ([8f1fb5fa1](https://blockchain.info/tx/8f1fb5fa162e01430a09d49e97aa2f08c41da13f09f565dedfc8c2da8ad30902)) was confirmed almost a year ago in block 345970, although your client is showing it with a recent date. I think you might have not synchronized with the network before attempting to transfer the coins to your new wallet, at which point the client still showed the coins in your balance. You later caught up with the blockchain and your wallet noticed that the coins were no longer available, marking your new transaction as a conflict/doublespend.

If this is indeed the case, then this is perfectly normal. If this were your address then the wallet would notice this automatically and credit you with the coins. It could either be that you migrated your funds at some point to a new wallet or that malware was involved.

> **Comments:**
> **username_0**: You are correct, that's exactly what has happened. Big brain fart by me (although I feel the UI is a bit confusing in this case). Thanks.  

---

