<p>You do not explain why you believe your bitcoin core process sent the bitcoins. It is perfectly possible (from looking at your logs) that it was not sent from your bitcoin core, but from elsewhere on the bitcoin network. It may be possible to track down where the tx was sent from if enough nodes log the IP address of where the transaction was initiated, but there is nothing in your logs to suggest it was initiated from your node. In fact, your logs suggest that it was not initiated from your node.</p>

<p>Therefore, at some point the private keys for your bitcoin address were obtained. This could have been done if your computer contains malware, perhaps a key-logger, which was able to capture your wallet password, in combination with the wallet file.</p>

<p>The output that was spent was populated on 2018-12-28 19:12, but the private key associated with the address could have been created years earlier, as Bitcoin Core by default creates 100 addresses when it is first started, so the private key to this address could have been stored on a computer of yours for some time, perhaps even in an wallet with no password, if you initially didn't enable the password until later. So the time of intercept (of the private key) is theoretically any time between when you first ran Bitcoin Core and when the theft occurred.</p>

CC BY-SA 4.0
2020-03-01T19:50:53.797Z
The reason I am convinced that the bitcoin core process sent the bitcoin is because bitcoin core was running at the time. 

I quite often just run it because I read that it's good practice. I noticed a message pop up on the screen that it had sent the bitcoins.

I saw it with my own eyes! 

To say I was shocked is an understatement!

I shut down bitcoin core, and removed the wallet.dat file.

After re-running virus and malware checks, I re-booted the PC
Sal P
CC BY-SA 4.0
2020-03-01T20:02:09.893Z
I transferred the balance of my wallet to an exchange, to guard against any more leaks from my wallet.  So, I could start again with a new download of bitcoin core, and a thorough virus check.  Would that be enough, or should I buy a hardware wallet?,
Sal P
CC BY-SA 4.0
2020-03-01T20:08:38.180Z
My first use of bitcoin core was in 2013, and I  **believe** I never used bitcoin core unencrypted
Sal P
CC BY-SA 4.0
2020-04-01T00:46:03.967Z
@SalP: What you describe actually doesn't prove that Bitcoin Core sent the coins.  If I remember correctly, I believe the same popup will appear when Bitcoin Core notices a transaction broadcast on the network that spends your coins.  The precautions you took are sensible, but even so, what you describe is also consistent with someone having obtained your private keys some other way, and spending them from a completely different node.
Nate Eldredge
CC BY-SA 4.0
2020-04-01T13:13:39.563Z
@SalP indeed - when you run bitcoin core, it has to download the blocks to catch up with the blockchain. When it downloaded the block containing the transaction you're referring to, it would notify you at that point. The point of download, not necessarily the point in time that the transaction was broadcast to the network.
Rebroad
CC BY-SA 4.0
2021-09-23T15:36:10.440Z
See in https://github.com/bitcoin/bitcoin/blame/971cad475f38011cf33a66671f1d5e570fd8df33/src/wallet/scriptpubkeyman.h#L48 at the time you wrote this post it was 1000 addresses already, instead of 100.
Mercedes
CC BY-SA 4.0
2020-03-01T17:02:12.180Z
2020-03-01T17:14:28.603Z
2020-03-01T17:14:28.603Z
Rebroad
<p>I am running Bitcoin Core version v0.19.0.1 (64-bit) on Windows 7, and on 27 February I noticed that it sent 0.0045 bitcoins on its own.</p>

<p>The wallet is encrypted at all times and I enter the passphrase to send as required.</p>

<p><strong>I did NOT initiate the Send</strong>.</p>

<p>I am greatly concerned. The PC is regularly checked for virus and malware.</p>

<p>The transaction details are:-</p>

<p>Status: 320 confirmations
Date: 27/02/2020 16:37
To: bc1qz944eascuflps4nmsc0w5cpz9p3cxdyqjmmqw7
Debit: -0.00447194 BTC
Transaction fee: -0.00002806 BTC
Net amount: -0.00450000 BTC
Transaction ID: 3c138afea7d634ce5e8b608e1a751122d6d33ba9bd8e00a02de02cb57aad039d
Transaction total size: 214 bytes
Transaction virtual size: 133 bytes
Output index: 0</p>

<p>The previous transaction:-</p>

<p>Status: 455 confirmations
Date: 26/02/2020 18:27
From: unknown
To: 3Hb61TTkbxPTUCA6EvUStb8PPMZUjPASfd (own address, label: coinfloor)
Credit: x.xxxxxxxx BTC
Net amount: +x.xxxxxxxx BTC
Transaction ID: 5697d9b298647c216a727f95dbdecfc658a9f8da3c45f98bc8c8a2439c8f1cfc
Transaction total size: 404 bytes
Transaction virtual size: 214 bytes
Output index: 1</p>

<p>The last time I sent was with this:-</p>

<p>Status: 43126 confirmations
Date: 17/05/2019 07:25
To: Coinfloor 5 10 13vk63282b4FkhyyV9mmgQTxpao9ECnnmB
Debit: -x.xxxxxxxx BTC
Transaction fee: -x.xxxxxxxx BTC
Net amount: -x.xxxxxxxx BTC
Transaction ID: d23b6c3f42339ace670d0ebdca4eabcfe45c34b0ccab44c9767a519682e415ba
Transaction total size: 932 bytes
Transaction virtual size: 530 bytes
Output index: 1</p>

<p>I would like to know how this could have happened, because I definitely did <strong>NOT</strong> initiate this send.</p>

<p>Any suggestions about how to diagnose this? I expect there's no way to recover the 0.0045 coins.</p>

CC BY-SA 4.0
2020-03-01T12:21:04.807Z
Check if it is really Bitcoin Core. Check if you really don't have Trojan horse.
CoperNick
CC BY-SA 4.0
2020-03-01T12:33:40.653Z
When was the last time when you enter the password on your PC for your wallet?
CoperNick
CC BY-SA 4.0
2020-03-01T13:01:16.417Z
Didn't you reveal priv key to one of your addresses? Looks like BTC from only one address was sent. BTC from other addresses were not stolen.
CoperNick
CC BY-SA 4.0
2020-03-01T14:50:04.040Z
I last used my passphrase on 17th May 2019.
Sal P
CC BY-SA 4.0
2020-03-01T14:51:50.590Z
So, there was more than 0.0045 in my wallet. Why was a larger amount not taken?
Sal P
CC BY-SA 4.0
2020-03-01T15:04:49.350Z
My debug log also shows strange entries at the time, see below
Sal P
CC BY-SA 4.0
2020-03-01T15:07:27.600Z
cache=35.4MiB(261525txo) warning='56 of last 100 blocks have unexpected version.'
2020-02-27T16:37:13Z socket recv error An existing connection was forcibly closed by the remote host.  (10054)
2020-02-27T16:37:42Z [default wallet] AddToWallet 3c138afea7d634ce5e8b608e1a751122d6d33ba9bd8e00a02de02cb57aad039d  new
2020-02-27T16:38:15Z tor: Thread interrupt
2020-02-27T16:38:15Z torcontrol thread exit
2020-02-27T16:38:15Z opencon thread exit
2020-02-27T16:38:15Z addcon thread exit
2020-02-27T16:38:15Z Shutdown: In progress...
2020-02-27T16:38:15Z net thread exit
2020-02-27T16:38:15Z msgh
Sal P
CC BY-SA 4.0
2020-03-01T15:09:22.147Z
I always download new versions from https://bitcoin.org/en/download
Sal P
CC BY-SA 4.0
2020-03-01T15:13:31.360Z
The "warning='56 of last 100 blocks have unexpected version" seems odd. Is this significant?
Sal P
CC BY-SA 4.0
2020-03-01T15:14:29.523Z
I've done virus scan with 2 different checkers, Trend Micro and Eset NOD32. Also Malwarebytes scan. None of these show any problems
Sal P
CC BY-SA 4.0
2020-03-01T15:29:49.167Z
@SalP Block versions are not relevant, it's a technique miners apply to increase their efficiency, called Asicboost.
MCCCS
CC BY-SA 4.0
2020-03-01T15:54:40.123Z
Adding to CoperNick's answer - Check the build signatures. ie sha256() some files, and compare it to the release signatures. there are guides on-line, and it's mentioned in the bitcoin-core download page.
best of luck
Paul Kania
CC BY-SA 4.0
2020-03-01T22:52:45.257Z
The SHA256 for the bitcoin-qt.exe matches
Sal P
CC BY-SA 4.0
2020-03-01T23:00:01.930Z
The SHA256 for bitcoin-qt.exe matches a clean install from the setup.exe, and its SHA256 is as given on the download page of bitcoin.org.  That would indicate that the bitcoin core is as created by the developers.
Sal P
<security><wallet-security>
My Bitcoin Core Sent Bitcoins Without My Authorisation
Sal P
# My Bitcoin Core Sent Bitcoins Without My Authorisation

(Asked by: username_0 on 2020-03-01)

I am running Bitcoin Core version v0.19.0.1 (64-bit) on Windows 7, and on 27 February I noticed that it sent 0.0045 bitcoins on its own.

The wallet is encrypted at all times and I enter the passphrase to send as required.

**I did NOT initiate the Send**.

I am greatly concerned. The PC is regularly checked for virus and malware.

The transaction details are:-

Status: 320 confirmations
Date: 27/02/2020 16:37
To: bc1qz944eascuflps4nmsc0w5cpz9p3cxdyqjmmqw7
Debit: -0.00447194 BTC
Transaction fee: -0.00002806 BTC
Net amount: -0.00450000 BTC
Transaction ID: 3c138afea7d634ce5e8b608e1a751122d6d33ba9bd8e00a02de02cb57aad039d
Transaction total size: 214 bytes
Transaction virtual size: 133 bytes
Output index: 0

The previous transaction:-

Status: 455 confirmations
Date: 26/02/2020 18:27
From: unknown
To: 3Hb61TTkbxPTUCA6EvUStb8PPMZUjPASfd (own address, label: coinfloor)
Credit: x.xxxxxxxx BTC
Net amount: +x.xxxxxxxx BTC
Transaction ID: 5697d9b298647c216a727f95dbdecfc658a9f8da3c45f98bc8c8a2439c8f1cfc
Transaction total size: 404 bytes
Transaction virtual size: 214 bytes
Output index: 1

The last time I sent was with this:-

Status: 43126 confirmations
Date: 17/05/2019 07:25
To: Coinfloor 5 10 13vk63282b4FkhyyV9mmgQTxpao9ECnnmB
Debit: -x.xxxxxxxx BTC
Transaction fee: -x.xxxxxxxx BTC
Net amount: -x.xxxxxxxx BTC
Transaction ID: d23b6c3f42339ace670d0ebdca4eabcfe45c34b0ccab44c9767a519682e415ba
Transaction total size: 932 bytes
Transaction virtual size: 530 bytes
Output index: 1

I would like to know how this could have happened, because I definitely did **NOT** initiate this send.

Any suggestions about how to diagnose this? I expect there's no way to recover the 0.0045 coins.

**Tags:** security, wallet-security

> **Comments:**
> **username_1**: Check if it is really Bitcoin Core. Check if you really don't have Trojan horse.  
> **username_1**: When was the last time when you enter the password on your PC for your wallet?  
> **username_1**: Didn't you reveal priv key to one of your addresses? Looks like BTC from only one address was sent. BTC from other addresses were not stolen.  
> **username_0**: I last used my passphrase on 17th May 2019.  
> **username_0**: So, there was more than 0.0045 in my wallet. Why was a larger amount not taken?  
> **username_0**: My debug log also shows strange entries at the time, see below  
> **username_0**: cache=35.4MiB(261525txo) warning='56 of last 100 blocks have unexpected version.' 2020-02-27T16:37:13Z socket recv error An existing connection was forcibly closed by the remote host.  (10054) 2020-02-27T16:37:42Z [default wallet] AddToWallet 3c138afea7d634ce5e8b608e1a751122d6d33ba9bd8e00a02de02cb57aad039d  new 2020-02-27T16:38:15Z tor: Thread interrupt 2020-02-27T16:38:15Z torcontrol thread exit 2020-02-27T16:38:15Z opencon thread exit 2020-02-27T16:38:15Z addcon thread exit 2020-02-27T16:38:15Z Shutdown: In progress... 2020-02-27T16:38:15Z net thread exit 2020-02-27T16:38:15Z msgh  
> **username_0**: I always download new versions from https://bitcoin.org/en/download  
> **username_0**: The "warning='56 of last 100 blocks have unexpected version" seems odd. Is this significant?  
> **username_0**: I've done virus scan with 2 different checkers, Trend Micro and Eset NOD32. Also Malwarebytes scan. None of these show any problems  
> **username_2**: @username_0 Block versions are not relevant, it's a technique miners apply to increase their efficiency, called Asicboost.  
> **username_3**: Adding to username_1's answer - Check the build signatures. ie sha256() some files, and compare it to the release signatures. there are guides on-line, and it's mentioned in the bitcoin-core download page. best of luck  
> **username_0**: The SHA256 for the bitcoin-qt.exe matches  
> **username_0**: The SHA256 for bitcoin-qt.exe matches a clean install from the setup.exe, and its SHA256 is as given on the download page of bitcoin.org.  That would indicate that the bitcoin core is as created by the developers.  

---

## 1 answers

### Answer by username_4 on 2020-03-01. Score: 1

You do not explain why you believe your bitcoin core process sent the bitcoins. It is perfectly possible (from looking at your logs) that it was not sent from your bitcoin core, but from elsewhere on the bitcoin network. It may be possible to track down where the tx was sent from if enough nodes log the IP address of where the transaction was initiated, but there is nothing in your logs to suggest it was initiated from your node. In fact, your logs suggest that it was not initiated from your node.

Therefore, at some point the private keys for your bitcoin address were obtained. This could have been done if your computer contains malware, perhaps a key-logger, which was able to capture your wallet password, in combination with the wallet file.

The output that was spent was populated on 2018-12-28 19:12, but the private key associated with the address could have been created years earlier, as Bitcoin Core by default creates 100 addresses when it is first started, so the private key to this address could have been stored on a computer of yours for some time, perhaps even in an wallet with no password, if you initially didn't enable the password until later. So the time of intercept (of the private key) is theoretically any time between when you first ran Bitcoin Core and when the theft occurred.

> **Comments:**
> **username_0**: The reason I am convinced that the bitcoin core process sent the bitcoin is because bitcoin core was running at the time.   I quite often just run it because I read that it's good practice. I noticed a message pop up on the screen that it had sent the bitcoins.  I saw it with my own eyes!   To say I was shocked is an understatement!  I shut down bitcoin core, and removed the wallet.dat file.  After re-running virus and malware checks, I re-booted the PC  
> **username_0**: I transferred the balance of my wallet to an exchange, to guard against any more leaks from my wallet.  So, I could start again with a new download of bitcoin core, and a thorough virus check.  Would that be enough, or should I buy a hardware wallet?,  
> **username_0**: My first use of bitcoin core was in 2013, and I  **believe** I never used bitcoin core unencrypted  
> **username_5**: @username_0: What you describe actually doesn't prove that Bitcoin Core sent the coins.  If I remember correctly, I believe the same popup will appear when Bitcoin Core notices a transaction broadcast on the network that spends your coins.  The precautions you took are sensible, but even so, what you describe is also consistent with someone having obtained your private keys some other way, and spending them from a completely different node.  
> **username_4**: @username_0 indeed - when you run bitcoin core, it has to download the blocks to catch up with the blockchain. When it downloaded the block containing the transaction you're referring to, it would notify you at that point. The point of download, not necessarily the point in time that the transaction was broadcast to the network.  
> **username_6**: See in https://github.com/bitcoin/bitcoin/blame/971cad475f38011cf33a66671f1d5e570fd8df33/src/wallet/scriptpubkeyman.h#L48 at the time you wrote this post it was 1000 addresses already, instead of 100.  

---

