An outgoing transaction I didn't make

[Vikora]

Yesterday I opened my Wasabi wallet at about 14:00 and found out that there was an outgoing transaction with significant amount of money at the same day at 2023-09-29 10:47.

Status - confirmed. No labels.

Of course, I didn't make it. Wasabi logs confirm that the program was not launched at all during the transaction, the last launch before it was 2023-09-03.

What has happened?

Wasabi version: Wasabi-2.0.1.4
OS: ArcoLinux

[yahiheb]

First make sure that you have downloaded Wasabi from https://wasabiwallet.io/ and not from any other scam website.
Make sure to also update your Wasabi to the latest version 2.0.4

Did you participate in any coinjoin lately?
If you did try to resync your wallet and see if it fixes your issue (It can be a display bug): https://docs.wasabiwallet.io/FAQ/FAQ-UseWasabi.html#how-do-i-resync-rescan-my-wallet

If none of the above helped and if you did download the correct version, then most likely your recovery words got compromised and the transaction was made from another computer/wallet, because there was no labels for this outgoing transaction.

[Vikora]

Hi, thanks for your reply!

Yes, I downloaded Wasabi from the official site.

Did you participate in any coinjoin lately?

Doesn't coinjoin starts automatically, does it? So it's possible.

most likely your recovery words got compromised

I don't believe this, because I keep my recovery words on a piece of paper and no one has access to it.

On the Internet I found other reports of money disappearance from Wasabi wallet and it looks very disturbing.

[turbolay]

There are no issues of "disappearing money", just sometimes visual bugs that make users believe so.
We are trying to fix the issue, but please perform a resync as suggested by @yahiheb
https://docs.wasabiwallet.io/FAQ/FAQ-UseWasabi.html#how-do-i-resync-rescan-my-wallet

Doesn't coinjoin starts automatically, does it? So it's possible.

You can disable that.

[Vikora]

Yes, I did perform a resync, but it's still the same(

You can disable that.

Yes, I did it immediately after I saw that transaction.

[yahiheb]

@Vikora Any updates on this one?

To check if you have downloaded a malicious version you can verify the PGP signatures:
https://docs.wasabiwallet.io/FAQ/FAQ-Installation.html#how-can-i-verify-pgp-signatures
https://docs.wasabiwallet.io/using-wasabi/InstallPackage.html

Consider also checking this discussion where something similar has happened: #11368

[AAlxcy]

I am having a similar issue, I have two wallets on Wasabi, and after it crashed, both wallet sent to all my BTC to an unknown account at the same time.
What can I do?

[turbolay]

Same as previous author, verify that you didn't download a phishing software, if you are on the official one please paste the logs of the crash here (find the logs https://docs.wasabiwallet.io/FAQ/FAQ-UseWasabi.html#what-is-the-dust-threshold)

If you are on the official software, try to resync https://docs.wasabiwallet.io/FAQ/FAQ-UseWasabi.html#how-do-i-resync-rescan-my-wallet

[AAlxcy]

2023-11-30 08:04:52 ERROR CoinJoinClient (281) System.ArgumentException: Parameter cannot be empty. (Parameter 'allRunningRoundsStates')
at WalletWasabi.Helpers.Guard.NotNullOrEmpty[T](String parameterName, T[] value)
at WalletWasabi.CoinJoin.Client.Rounds.ClientState.UpdateRoundsByStates(ConcurrentDictionary2 exposedLinks, RoundStateResponseBase[] allRunningRoundsStates) at WalletWasabi.CoinJoin.Client.Clients.CoinJoinClient.TryProcessStatusAsync(IEnumerable1 states)
2023-11-30 08:05:21 INFO Global (618) Transaction Notification (Information): Sent - 0.3305816 BTC - 18ac95c4d7fb0f20557a0c8631dccb84acd003fa6d2aa5df737c6dbf208da991

2023-11-30 08:30:37 ERROR CoinJoinClient (281) System.ArgumentException: Parameter cannot be empty. (Parameter 'allRunningRoundsStates')
at WalletWasabi.Helpers.Guard.NotNullOrEmpty[T](String parameterName, T[] value)
at WalletWasabi.CoinJoin.Client.Rounds.ClientState.UpdateRoundsByStates(ConcurrentDictionary2 exposedLinks, RoundStateResponseBase[] allRunningRoundsStates) at WalletWasabi.CoinJoin.Client.Clients.CoinJoinClient.TryProcessStatusAsync(IEnumerable1 states)
2023-11-30 08:30:37 INFO MempoolService (117) Start cleaning out mempool...
2023-11-30 08:30:49 INFO P2pBlockProvider (290) Disconnected node: ::ffff:127.0.0.1. Block downloaded: 0000000000000000000228e668997262cefdbf42da6b8a8a140c354e6c7f30ac.
2023-11-30 08:30:50 INFO Global (618) Transaction Notification (Information): Send Confirmed - 0.00461535 BTC - 732ab0c4d3bf3df6a595407abfad6d3232cbc73d46a9b380d9346c173937f661
2023-11-30 08:30:50 INFO Global (618) Transaction Notification (Information): Send Confirmed - 0.11022425 BTC - e2530020227183a53034e2bab112639f8cc9b48b84511f40d364036028684bb0
2023-11-30 08:30:52 INFO MempoolService (127) 2987 transactions were cleaned from mempool.
2023-11-30 08:31:10 ERROR CoinJoinClient (281) System.ArgumentException: Parameter cannot be empty. (Parameter 'allRunningRoundsStates')
at WalletWasabi.Helpers.Guard.NotNullOrEmpty[T](String parameterName, T[] value)
at WalletWasabi.CoinJoin.Client.Rounds.ClientState.UpdateRoundsByStates(ConcurrentDictionary2 exposedLinks, RoundStateResponseBase[] allRunningRoundsStates) at WalletWasabi.CoinJoin.Client.Clients.CoinJoinClient.TryProcessStatusAsync(IEnumerable1 states)

[AAlxcy]

So wasabi was not showing the transactions for a long time, so I closed the program and then opened it and then both wallets were 0

[AAlxcy]

I also restored using the keys to another computer and they show the same transactions.

[turbolay]

These logs are not normal, it looks like you downloaded a phishing scam. You can confirm by searching your history, or by comparing the pgp signatures: https://docs.wasabiwallet.io/FAQ/FAQ-Installation.html#how-can-i-verify-pgp-signatures.

Sorry for your loss!