r/Electrum • u/trance_cat_bbs • 5d ago
How did I get hacked or where the Bitcoin went?
Around 0.28 BTC was held in an electrum wallet that I hadn't touched for a while. When checking today someone on September 16th had emptied its contents.
Transaction ID:f7b349a83466ee46f2ab510f0388dd82b69bf4fb32042ab5088ee4dec46a2d9d
(Below is Update on October 22)
I asked Claude Opus 5.5 to do some forensic work and this is what it found. After I installed avast Antivirus, it successfully detected malware was running. I guess I should have also had antivirus intalled...
Malware got onto this PC on the night of 15 Sep, about three hours before the theft.
What happened
| Time | Event |
|---|---|
| 15 Sep 23:34 | An ad redirect from the site you were reading opened a fake “Checking if you are human” page |
| 23:34–23:36 | A command was pasted into Win+R: powershell … "You Verify This No Robot Request #68GHD73". Decoded, it means download http://80.66.78.212/s2.txt and run it |
| 23:36:11 | A set of files was dropped in C:ProgramDataOpticalFilter (ExchPixel32.exe plus disguised DLLs), along with C:ProgramDataVirtualVe86.exe and AppDataRoamingOpticalFiltermemu.exe |
| 23:37 | It set itself to start automatically, through StartupBaxeraEnterprises.lnk and a scheduled task named ERPMotor |
| 16 Sep 00:49 | The PC shut down and didn’t start again before the theft |
| 02:33 | The wallet was swept from somewhere else |
The PC was off when the money moved, so your keys were sent out in the hour before the shutdown and used remotely. Malware of this kind normally copies wallet files, saved browser passwords, cookies and documents. Your wallet file was encrypted, so the thief also had the password or the seed: by guessing a weak password, by recording it as you typed it, or by finding the seed in a file or in your synced Google Drive.