-
|
Hi guys. I sent some BTC from one of my wallets to a new Wasabi wallet (v 2.0.4.1). The funds arrived and the client started to coinjoin them. After some time (a few hours) I checked the client again and it said that all the funds had been sent to a certain other address. While I was looking at this, the client crashed (the GUI froze and I had to kill the process to close it). When I restarted the PC, the Wasabi wallet was empty and there were no transactions listed (as if it was new and nothing had been received). I tried to re-sync the client by modifying the .json as explained in the how-to, after restart it showed the sync page, but when it reached 100% the wallet still showed 0 BTC and no transactions listed. I have 12 peers on Tor and good connectivity. I checked the certificate and it is correct, I downloaded the .msi from wasabiwallet.io so it's not a malicious version ( I hope!). Also, my secret words are stored on an encrypted usb key with a complex passphrase which is kept in a safe, so I can't imagine how they could have been compromised. I can see where my funds are with blockchair, they have gone through 3 different wallets and are now just sitting idle in the last one :( Am I missing something? What went wrong? I can provide any log / wallet address / hash you may need, if required. Thanks in advance! Z |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments 7 replies
-
If the wallet is completely empty it means your wallet is not synced, even if your wallet got compromised you should be able to see its history so first try to resync the wallet again by following the steps here carefully: https://docs.wasabiwallet.io/FAQ/FAQ-UseWasabi.html#how-do-i-resync-rescan-my-wallet If you still cannot see the wallet's history then try to recover your wallet using your 12 recovery words + passphrase/password. |
Beta Was this translation helpful? Give feedback.
-
|
Hello yahiheb, thanks. I tried to resync but it didn't work, it reached 100% but it's still empty. Now I will try the recovery process.
|
Beta Was this translation helpful? Give feedback.
-
|
Hi I successfully completed the recovery. The wallet says 0 BTC and shows an outgoing transaction that I didn't do (I wasn't at the PC when it was done)... I didn't find any anomaly in the OS security logs, Defender and Malwarebytes swear that the machine is clean, Wasabi was installed from the official .msi... the PC was locked while I was away and nobody got into the house (I checked the security cameras).... :( Could it be the effect of a coinjoin gone bad / stuck / unfinished? Thanks! |
Beta Was this translation helpful? Give feedback.
-
|
Are you sure you didn't download a malicious version? Try to verify the PGP signatures: https://docs.wasabiwallet.io/FAQ/FAQ-Installation.html#how-can-i-verify-pgp-signatures |
Beta Was this translation helpful? Give feedback.
-
|
This is the .msi that I downloaded on Dec 13 from the .io website and installed:
and this is the .msi that I downloaded today, to double-check:
They look identical to me :/ |
Beta Was this translation helpful? Give feedback.
-
|
I don't know what could be the reason for this tbh. |
Beta Was this translation helpful? Give feedback.
-
|
The client doesn't build and sign non coinjoin transactions on its own, so if your funds were sent and then used in transactions you didn't initiate, you have been scammed in some way. It could be that you were tricked into copying an address that wasn't your own, your OS might have been compromised, you downloaded a scam, and maybe you downloaded the official version when trying to reinstall. Considering your wallet was new, the most plausible explanation is that you downloaded a scam by searching on DuckDuckGo, then sent funds and the malware stole your funds after receiving the first transaction, with some delays to don't look suspicious and risk being RBFed. You can send here the logs if you want https://docs.wasabiwallet.io/FAQ/FAQ-UseWasabi.html#where-can-i-find-the-logs, but there is nothing we can do to help or really investigate further anyway. I'm sorry! |
Beta Was this translation helpful? Give feedback.
-
|
Thank you guys, I think Turbolay is right, I got scammed :( I did in fact search on DDG and by mistake dowloaded a "dropper" from the malicious domain .app This small .msi then downloaded the real .msi but of course did some trick in the background. And this is how they stolen my funds. Lesson learned, thanks for your kind support. |
Beta Was this translation helpful? Give feedback.
-
|
Really sorry for you, we always report those domains but Bing Engine (used by DDG) does nothing to improve the situation. Thanks for understanding. |
Beta Was this translation helpful? Give feedback.
The client doesn't build and sign non coinjoin transactions on its own, so if your funds were sent and then used in transactions you didn't initiate, you have been scammed in some way. It could be that you were tricked into copying an address that wasn't your own, your OS might have been compromised, you downloaded a scam, and maybe you downloaded the official version when trying to reinstall.
Considering your wallet was new, the most plausible explanation is that you downloaded a scam by searching on DuckDuckGo, then sent funds and the malware stole your funds after receiving the first transaction, with some delays to don't look suspicious and risk being RBFed.
You can send here the logs…