<p>It looks like, using just the 17nu address here: </p>

<p><a href="https://longhorn.bullpay.com/?gateway=2&amp;data=17nu7oViEtGCYaYwrKKVGyrs7jkcNwpVf2" rel="nofollow noreferrer">https://longhorn.bullpay.com/?gateway=2&amp;data=17nu7oViEtGCYaYwrKKVGyrs7jkcNwpVf2</a></p>

<p>Only 2 transactions occurred. This transaction:</p>

<p><a href="https://longhorn.bullpay.com/?gateway=2&amp;data=fae9171eea55eb69cbe73f8a23003f9267b71e5a7292d2bcd7b396a58aa82827" rel="nofollow noreferrer">https://longhorn.bullpay.com/?gateway=2&amp;data=fae9171eea55eb69cbe73f8a23003f9267b71e5a7292d2bcd7b396a58aa82827</a></p>

<p>Resulted in the UTXO for 1 BTC to 17nu.</p>

<p>That UTXO was then used in this one:</p>

<p><a href="https://longhorn.bullpay.com/?gateway=2&amp;data=4837f44e4169f287ca6802c45ceab2dfef36ab7d8ecaa0eaebfa59ea6c76e17b" rel="nofollow noreferrer">https://longhorn.bullpay.com/?gateway=2&amp;data=4837f44e4169f287ca6802c45ceab2dfef36ab7d8ecaa0eaebfa59ea6c76e17b</a></p>

<p>But it was combined with other transaction unrelated to the wallet. I'd say your wallet was compromised. Your transactions got bundled in with other UTXO's elsewhere not related to your wallet. </p>

<p>The address it was sent to: </p>

<p><a href="https://longhorn.bullpay.com/?gateway=2&amp;data=1NqJgMT4eLPycaD2i7T7xzbd9F9fycWE9u" rel="nofollow noreferrer">https://longhorn.bullpay.com/?gateway=2&amp;data=1NqJgMT4eLPycaD2i7T7xzbd9F9fycWE9u</a></p>

<p>had a flurry of activity on 5/6/14 within a 2 hour time period. In some cases with massive bundling of UTXO's. 34 inputs, 56 inputs. The transactions moving BTC from that wallet out left it with a zero balance. </p>

<p>Almost all of this funnels into address 17gH1u6VJwhVD9cWR59jfeinLMzag2GZ43:</p>

<p><a href="https://longhorn.bullpay.com/?gateway=2&amp;data=17gH1u6VJwhVD9cWR59jfeinLMzag2GZ43&amp;grid-page=1" rel="nofollow noreferrer">https://longhorn.bullpay.com/?gateway=2&amp;data=17gH1u6VJwhVD9cWR59jfeinLMzag2GZ43&amp;grid-page=1</a></p>

<p>Which processed 17,990 transactions between March 2014 thru October 2014. The entire wallet was left empty with 120,347 BTC passing through it. </p>

<p>Either this address is used to launder BTC or simple as a convergence point for distribution. Either way this address is tied to a number of google search results in people getting hacked. Eg: <a href="https://bitcointalk.org/index.php?topic=754624.0;all" rel="nofollow noreferrer">https://bitcointalk.org/index.php?topic=754624.0;all</a></p>

<p>Final answer. You were hacked in some way.</p>

<p>Note: I added all the text in here to show how i traced his BTC from his address to an address known for hacking. This was to demonstrate how i came to the conclusion it was a hack and not an anomaly, software error, bug or something other.</p>

CC BY-SA 4.0
2018-12-21T18:16:18.553Z
2018-12-21T18:16:18.553Z
cleanmarker
<p>That symbol means that you sent the bitcoin to yourself, i.e. the key for the destination address <code>1NqJgMT4eLPycaD2i7T7xzbd9F9fycWE9u</code> is also in your wallet. Is your wallet fully synced? Because there was  <a href="https://blockchain.info/tx-index/55940257" rel="nofollow noreferrer">another transaction</a> showing the subsequent spending of the coins, which is not in your screenshot.</p>

<p>It looks like maybe you imported the key for this address after the coins had already been spent from it?</p>

CC BY-SA 3.0
2017-11-26T07:22:36.363Z
Thank you. I've tried to dumpprivkey 1NqJgMT4eLPycaD2i7T7xzbd9F9fycWE9u but it stated that address is not known (code -4), it's not my address then? My wallet is fully synced. It might be that private address was already empty, but then if it's transaction to my self, how to find that missing balance?
tadaspadas
CC BY-SA 3.0
2017-11-26T07:27:30.323Z
Hmm strange. In the transactions window, can you right click on the transaction and "show transaction details"? What is the output?
Adam Millerchip
CC BY-SA 3.0
2017-11-26T07:30:29.833Z
Here is all information from the transaction 
`Status: 196738 confirmations
Date: 2014-05-06 21:31
Debit: -1.00000000 BTC
Net amount: -1.00000000 BTC
Transaction ID: 4837f44e4169f287ca6802c45ceab2dfef36ab7d8ecaa0eaebfa59ea6c76e17b
Transaction total size: 635 bytes
Output index: 0`
tadaspadas
CC BY-SA 3.0
2017-11-26T07:36:34.610Z
Sorry I don't know. If you "copy full transaction details", does it say "Payment to yourself"? Your output is slightly different to mine, maybe you could update Bitcoin Core to the latest version (if you've got an older version there's a a database upgrade that will take a long time). But it looks like your BTC was lost or stolen. :-(
Adam Millerchip
CC BY-SA 3.0
2017-11-26T07:39:44.627Z
That's the point, there is nothing more like "Payment to yourself". It's full information. I will insert print screen on the main question. I'm using the latest Bitcoin Core version v0.15.1. Thank you for your time.
tadaspadas
CC BY-SA 3.0
2017-11-26T07:42:36.337Z
"Copy full transaction details" is slightly different to "show transaction details". It copies a text version of the transaction to the clipboard. There must be a reason for the double arrow symbol, instead of the normal spend symbol. Sorry I couldn't help further, good luck!
Adam Millerchip
CC BY-SA 3.0
2017-11-26T07:04:16.943Z
2017-11-26T07:09:20.503Z
2017-11-26T07:09:20.503Z
Adam Millerchip
<p>Stored in the CLOUD? Someone accessed your "cloud" years ago and stole your coins...</p>

CC BY-SA 3.0
2017-12-20T13:40:02.890Z
It's not the cloud problem. Checked dates. I've put it on cloud later after BTC was stolen. Didn't check balance then.
tadaspadas
CC BY-SA 3.0
2017-12-20T13:29:10.113Z
2017-12-20T13:29:10.113Z
AnonymousCoward
<p>four years ago I've bought 1 BTC, made wallet.dat file and stored in the cloud. Now I wanted to check balance and after syncing on Bitcoin Core found negative transaction with no address. </p>

<p><a href="https://i.sstatic.net/6QwVF.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/6QwVF.png" alt="enter image description here"></a></p>

<p><a href="https://i.sstatic.net/TCl8d.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/TCl8d.png" alt="enter image description here"></a></p>

<p>I did not make second transaction. It has no address. What it is? What the second negative transaction means? Why strange icon? Here's second transaction ID 4837f44e4169f287ca6802c45ceab2dfef36ab7d8ecaa0eaebfa59ea6c76e17b</p>

<p><a href="https://i.sstatic.net/3EaIX.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/3EaIX.png" alt="enter image description here"></a></p>

<p>I have 2 public keys. I've tried to dumpprivkey. After obtaining private keys I've tried to import to one local Bitcoin service (spectrocoin) but after 24 hours nothing changed. </p>

<p>Does it mean that I've lost BTC? Is there anything else I can do? Thank you for your help.</p>

CC BY-SA 3.0
2017-11-26T06:00:52.150Z
It looks like someone who had access to your private key transferred your bitcoin in April of 2014. But it's hard to tell with just what you've given us.
David Schwartz
CC BY-SA 3.0
2017-11-26T06:55:39.203Z
Here is transaction ID of the negative transaction: 4837f44e4169f287ca6802c45ceab2dfef36ab7d8ecaa0eaebfa59ea6c76e17b
tadaspadas
CC BY-SA 3.0
2017-12-20T13:36:22.913Z
Which cloud company BTW?
MCCCS
CC BY-SA 3.0
2017-12-20T13:38:52.510Z
Checked dates, I've put file to cloud later after BTC was stolen. I didn't check balance then.
tadaspadas
<transactions><lost-bitcoins>
BTC missing after strange negative transaction
tadaspadas
# BTC missing after strange negative transaction

(Asked by: username_0 on 2017-11-25)

four years ago I've bought 1 BTC, made wallet.dat file and stored in the cloud. Now I wanted to check balance and after syncing on Bitcoin Core found negative transaction with no address.

[![enter image description here](https://i.sstatic.net/6QwVF.png)](https://i.sstatic.net/6QwVF.png)

[![enter image description here](https://i.sstatic.net/TCl8d.png)](https://i.sstatic.net/TCl8d.png)

I did not make second transaction. It has no address. What it is? What the second negative transaction means? Why strange icon? Here's second transaction ID 4837f44e4169f287ca6802c45ceab2dfef36ab7d8ecaa0eaebfa59ea6c76e17b

[![enter image description here](https://i.sstatic.net/3EaIX.png)](https://i.sstatic.net/3EaIX.png)

I have 2 public keys. I've tried to dumpprivkey. After obtaining private keys I've tried to import to one local Bitcoin service (spectrocoin) but after 24 hours nothing changed.

Does it mean that I've lost BTC? Is there anything else I can do? Thank you for your help.

**Tags:** transactions, lost-bitcoins

> **Comments:**
> **username_1**: It looks like someone who had access to your private key transferred your bitcoin in April of 2014. But it's hard to tell with just what you've given us.  
> **username_0**: Here is transaction ID of the negative transaction: 4837f44e4169f287ca6802c45ceab2dfef36ab7d8ecaa0eaebfa59ea6c76e17b  
> **username_2**: Which cloud company BTW?  
> **username_0**: Checked dates, I've put file to cloud later after BTC was stolen. I didn't check balance then.  

---

## 3 answers

### Answer by username_3 on 2018-12-21. Score: 2

It looks like, using just the 17nu address here:

<https://longhorn.bullpay.com/?gateway=2&data=17nu7oViEtGCYaYwrKKVGyrs7jkcNwpVf2>

Only 2 transactions occurred. This transaction:

<https://longhorn.bullpay.com/?gateway=2&data=fae9171eea55eb69cbe73f8a23003f9267b71e5a7292d2bcd7b396a58aa82827>

Resulted in the UTXO for 1 BTC to 17nu.

That UTXO was then used in this one:

<https://longhorn.bullpay.com/?gateway=2&data=4837f44e4169f287ca6802c45ceab2dfef36ab7d8ecaa0eaebfa59ea6c76e17b>

But it was combined with other transaction unrelated to the wallet. I'd say your wallet was compromised. Your transactions got bundled in with other UTXO's elsewhere not related to your wallet.

The address it was sent to:

<https://longhorn.bullpay.com/?gateway=2&data=1NqJgMT4eLPycaD2i7T7xzbd9F9fycWE9u>

had a flurry of activity on 5/6/14 within a 2 hour time period. In some cases with massive bundling of UTXO's. 34 inputs, 56 inputs. The transactions moving BTC from that wallet out left it with a zero balance.

Almost all of this funnels into address 17gH1u6VJwhVD9cWR59jfeinLMzag2GZ43:

<https://longhorn.bullpay.com/?gateway=2&data=17gH1u6VJwhVD9cWR59jfeinLMzag2GZ43&grid-page=1>

Which processed 17,990 transactions between March 2014 thru October 2014. The entire wallet was left empty with 120,347 BTC passing through it.

Either this address is used to launder BTC or simple as a convergence point for distribution. Either way this address is tied to a number of google search results in people getting hacked. Eg: <https://bitcointalk.org/index.php?topic=754624.0;all>

Final answer. You were hacked in some way.

Note: I added all the text in here to show how i traced his BTC from his address to an address known for hacking. This was to demonstrate how i came to the conclusion it was a hack and not an anomaly, software error, bug or something other.


---

### Answer by username_4 on 2017-11-26. Score: 0

That symbol means that you sent the bitcoin to yourself, i.e. the key for the destination address `1NqJgMT4eLPycaD2i7T7xzbd9F9fycWE9u` is also in your wallet. Is your wallet fully synced? Because there was [another transaction](https://blockchain.info/tx-index/55940257) showing the subsequent spending of the coins, which is not in your screenshot.

It looks like maybe you imported the key for this address after the coins had already been spent from it?

> **Comments:**
> **username_0**: Thank you. I've tried to dumpprivkey 1NqJgMT4eLPycaD2i7T7xzbd9F9fycWE9u but it stated that address is not known (code -4), it's not my address then? My wallet is fully synced. It might be that private address was already empty, but then if it's transaction to my self, how to find that missing balance?  
> **username_4**: Hmm strange. In the transactions window, can you right click on the transaction and "show transaction details"? What is the output?  
> **username_0**: Here is all information from the transaction  `Status: 196738 confirmations Date: 2014-05-06 21:31 Debit: -1.00000000 BTC Net amount: -1.00000000 BTC Transaction ID: 4837f44e4169f287ca6802c45ceab2dfef36ab7d8ecaa0eaebfa59ea6c76e17b Transaction total size: 635 bytes Output index: 0`  
> **username_4**: Sorry I don't know. If you "copy full transaction details", does it say "Payment to yourself"? Your output is slightly different to mine, maybe you could update Bitcoin Core to the latest version (if you've got an older version there's a a database upgrade that will take a long time). But it looks like your BTC was lost or stolen. :-(  
> **username_0**: That's the point, there is nothing more like "Payment to yourself". It's full information. I will insert print screen on the main question. I'm using the latest Bitcoin Core version v0.15.1. Thank you for your time.  
> **username_4**: "Copy full transaction details" is slightly different to "show transaction details". It copies a text version of the transaction to the clipboard. There must be a reason for the double arrow symbol, instead of the normal spend symbol. Sorry I couldn't help further, good luck!  

---

### Answer by username_5 on 2017-12-20. Score: -1

Stored in the CLOUD? Someone accessed your "cloud" years ago and stole your coins...

> **Comments:**
> **username_0**: It's not the cloud problem. Checked dates. I've put it on cloud later after BTC was stolen. Didn't check balance then.  

---

