<p>So some background as to what happened here. I wanted to claim my bitcoin diamond air drop. I googled and <a href="https://www.youtube.com/watch?v=oo0AA3-ezBg" rel="nofollow noreferrer">this video</a> came up first. </p>

<p>The video played this weird music which I think was hypnotic in some way. It instructed me to paste my blockchain.info restore phrase into this website: mybcdwallet.org.</p>

<p>I foolishly followed the instructions and did not realise at the time that I had handed over the restore phrase of my wallet to a hostile hacker. The next morning I woke up to find that a transaction had been initiated to transfer my bitcoins to <a href="https://blockchain.info/tx/c33f1a65aded13a42b18c659d88e3d7a215de9b05952facb4616be8e5b5c032b" rel="nofollow noreferrer">another address</a> (not owned by me!).</p>

<p>Fortunately the bitcoin mempool is clogged up with lots of transactions and the hacker used a small mining fee. Consequently the transaction had not been confirmed even though it had been initiated 10 hours before.</p>

<p>So what I did was installed Electrum wallet and restored my wallet into it. Electrum correctly assumed that I still had bitcoin in the wallet. I then basically did a "double-spend" i.e. I started another transaction of my own and sent the bitcoins to a paper wallet that I had created. I made sure that I used large mining fee to ensure that my transaction got processed before the fraudulent one.</p>

<p>The next morning I woke up to find that my transaction had been confirmed 13 times which means that <a href="https://blockchain.info/address/1QBN1ESphxUXSVD9jox9QUtTBkrDZuw7Nc" rel="nofollow noreferrer">I had taken back my bitcoin</a>!</p>

<p>Lesson: Be very careful with your back up phrases. Don't type the phrase into a website you don't absolutely trust!</p>

<p>I'm not not sure if I can say the clogged mempool is a flaw of a design feature. But in this case it did save me a lot of money...</p>

CC BY-SA 4.0
2017-12-09T06:15:36.443Z
2019-01-06T07:08:25.917Z
2019-01-06T07:08:25.917Z
Marcus Scipio
<p>This is the transaction.</p>

<p><a href="https://blockchain.info/address/1F8EP97jgQx8QD6XMRg2bCHHrJrZEMUTRt" rel="nofollow noreferrer">https://blockchain.info/address/1F8EP97jgQx8QD6XMRg2bCHHrJrZEMUTRt</a></p>

<p>Which is still unconfirmed.</p>

<p>I am trying to use <a href="https://coinb.in" rel="nofollow noreferrer">https://coinb.in</a> to create a double spend transaction with a higher fee but I am getting several errors such as:</p>

<p>18: txn-mempool-conflict OR
16: mandatory-script-verify-flag-failed (Script failed an OP_EQUALVERIFY operation)</p>

<p>How can I create a double spend transaction using <a href="https://coinb.in" rel="nofollow noreferrer">https://coinb.in</a> to block this attack?</p>

<p>In particular what goes in the transaction id field and the script field.</p>

CC BY-SA 3.0
2017-12-08T17:27:33.193Z
Looks like I managed to hack back my coins of the hacker by using electrum to do a double spend! :)))
Marcus Scipio
CC BY-SA 3.0
2018-02-13T18:52:03.150Z
Don't share your wallet seed with anyone, and beware of any website that asks for your seed.  That `mybcdwallet` website is a scam, see here:  https://bitcoin.stackexchange.com/questions/63688/is-the-bitcoin-diamond-wallet-website-bcdwallet-org-legit
Daniel Nugent
CC BY-SA 3.0
2018-03-24T23:28:57.653Z
Welcome to Bitcoin.SE! You can help the site by marking answers as accepted if they are correct and address the question so that the question does not remain as "unanswered".
Willtech
<doublespend><wallet-security>
My blockchain.info wallet was hacked. How can I create a double send to foil the attacker?
Marcus Scipio
# My blockchain.info wallet was hacked. How can I create a double send to foil the attacker?

(Asked by: username_0 on 2017-12-08)

This is the transaction.

<https://blockchain.info/address/1F8EP97jgQx8QD6XMRg2bCHHrJrZEMUTRt>

Which is still unconfirmed.

I am trying to use <https://coinb.in> to create a double spend transaction with a higher fee but I am getting several errors such as:

18: txn-mempool-conflict OR
16: mandatory-script-verify-flag-failed (Script failed an OP\_EQUALVERIFY operation)

How can I create a double spend transaction using <https://coinb.in> to block this attack?

In particular what goes in the transaction id field and the script field.

**Tags:** doublespend, wallet-security

> **Comments:**
> **username_0**: Looks like I managed to hack back my coins of the hacker by using electrum to do a double spend! :)))  
> **username_1**: Don't share your wallet seed with anyone, and beware of any website that asks for your seed.  That `mybcdwallet` website is a scam, see here:  https://bitcoin.stackexchange.com/questions/63688/is-the-bitcoin-diamond-wallet-website-bcdwallet-org-legit  
> **username_2**: Welcome to Bitcoin.SE! You can help the site by marking answers as accepted if they are correct and address the question so that the question does not remain as "unanswered".  

---

## 1 answers

### Answer by username_0 on 2017-12-09. Score: 4 | Accepted answer

So some background as to what happened here. I wanted to claim my bitcoin diamond air drop. I googled and [this video](https://www.youtube.com/watch?v=oo0AA3-ezBg) came up first.

The video played this weird music which I think was hypnotic in some way. It instructed me to paste my blockchain.info restore phrase into this website: mybcdwallet.org.

I foolishly followed the instructions and did not realise at the time that I had handed over the restore phrase of my wallet to a hostile hacker. The next morning I woke up to find that a transaction had been initiated to transfer my bitcoins to [another address](https://blockchain.info/tx/c33f1a65aded13a42b18c659d88e3d7a215de9b05952facb4616be8e5b5c032b) (not owned by me!).

Fortunately the bitcoin mempool is clogged up with lots of transactions and the hacker used a small mining fee. Consequently the transaction had not been confirmed even though it had been initiated 10 hours before.

So what I did was installed Electrum wallet and restored my wallet into it. Electrum correctly assumed that I still had bitcoin in the wallet. I then basically did a "double-spend" i.e. I started another transaction of my own and sent the bitcoins to a paper wallet that I had created. I made sure that I used large mining fee to ensure that my transaction got processed before the fraudulent one.

The next morning I woke up to find that my transaction had been confirmed 13 times which means that [I had taken back my bitcoin](https://blockchain.info/address/1QBN1ESphxUXSVD9jox9QUtTBkrDZuw7Nc)!

Lesson: Be very careful with your back up phrases. Don't type the phrase into a website you don't absolutely trust!

I'm not not sure if I can say the clogged mempool is a flaw of a design feature. But in this case it did save me a lot of money...


---

