ADA Sent from exchange shows transferred back out only hours later

English Community Technical Support
1

Back in February I bought 6,222 ADA from Binance. I transferreed 100 to my desktop wallet first to test out the transfer and everything showed up on my desktop wallet so I transferred the rest successfully. Later that evening (same day of a major wallet update for what it’s worth) all amounts show that they were transferred out to another address. I’m meticulous with my secret keys, phrases, keystores, etc. and feel very strongly this is not a hack job. Using the block explorer, I searched with this data from my desktop wallet:

From addresses

DdzFFzCqrhszcKrm1pP8TGQ98xZorgZM9KBDJU5RinBaJ2KCeCuB6C4jxrZjFmXgqgdv7nJdFW5a5fSddHtUVue8vmfGUkTwMLjcSxni
To addresses

DdzFFzCqrhsfYmKnC4CjpHRZ3PyQimbtGoQzuoJaH4WPaBVp9QNWwmY7W9GWN9vqDb1mMYFCMkfkLMY78pXkWoYcS4dTdxwymY4xk74J
Transaction assurance level

High. 258513 confirmations.
Transaction ID

710dd2647ca9a8184f228d3a1447da9c06b2de1331efc688fa94568fcd4eacb2

This is where I need help. One destination appears to be a dead end and never loads the webpage, while the other shows only the two addresses and one appears to belong to Binance (someone helped me with this using a different block explorer that I can’t remember the name of). Is it possible for a transaction to “bounce” back to where it came from? I sent my logs into tech support and they have yet to provide any help. It has been several months and I tried many times to “nudge” them. Any ideas?

1 Like
2

No, if your secret key was not compromised. No one can send and transaction from your address, without having an access to the secret key (12 words).

3

Please show the address you sent the first 100 ADA to, i cannot find it, screen shots of your wallet that contain the transactions would be good to see also, the address that you are showing to have received and sent your ADA only shows 2 transactions while you are saying there should be 3 - the first 100 - the larger transaction - and then all of it leaving, there are holes in your scenario that I cannot follow, when math does not add up i can’t even begin to understand what is going on.

I agree with @vantuz-subhuman

P.S. I like to use adatracker @ https://adatracker.com/richest when I use the block explorer.

1 Like
4

Also it was a span of like 5 minutes that the 6,222 was transferred in and out of the wallet.

5

Something fishy going on…that address does not show the first “100”…but the second address where the 6,222 ADA was send the explorer flashes “That address does not exist” before going back to look like reloading…and it is not 6222…it actually says 6,445.863699 was transferred out within 5 minutes, just like @anon20038177 said

2 Likes
6

Thanks! That was the tracker I couldn’t remember. Much more user friendly. Anyway I’ve attached the entire wallet worth of transactions from most recent to most distant. There were some earlier transactions in the wallet but they were so much earlier I didn’t think them relevant. Also, as for the hours vs mins timeline, I guess I remembered incorrectly and looking at it now it was clearly more than a 100 for the test but the intent was to make sure before moving in a larger amount. It’s been several months since this happened. I thought them lost but have since gained renewed hope in trying to recover the ADA.

-6,223.197000

From addresses

DdzFFzCqrhszcKrm1pP8TGQ98xZorgZM9KBDJU5RinBaJ2KCeCuB6C4jxrZjFmXgqgdv7nJdFW5a5fSddHtUVue8vmfGUkTwMLjcSxni
To addresses

DdzFFzCqrhsfYmKnC4CjpHRZ3PyQimbtGoQzuoJaH4WPaBVp9QNWwmY7W9GWN9vqDb1mMYFCMkfkLMY78pXkWoYcS4dTdxwymY4xk74J
Transaction assurance level

High. 258798 confirmations.
Transaction ID

710dd2647ca9a8184f228d3a1447da9c06b2de1331efc688fa94568fcd4eacb2

+2,517.00

From addresses

DdzFFzCqrht1aTTUxCzgeK3gRj9Sd3RjpACrM9FNajuaoqbkTbGxR96ZXGUuYVNvXbWhE6jxAzBbbfekLrhtJ4ak4q1JVRRBzTiQU7aF
To addresses

DdzFFzCqrhsmALqCvXeufKmVHXqrNN8YShU88Xm78ud2aYs5fBrFj3yUkoCWwnZFputJ99g82Wqkm1Rb9AGHW8EHYAQ7f5YfUd3jbyAv
DdzFFzCqrhszcKrm1pP8TGQ98xZorgZM9KBDJU5RinBaJ2KCeCuB6C4jxrZjFmXgqgdv7nJdFW5a5fSddHtUVue8vmfGUkTwMLjcSxni
Transaction assurance level

High. 260802 confirmations.
Transaction ID

da838bffdc27d4df81f12b2642d27c6d75269e7424fbb9d67c8d6f49b886d79e

+1,701.00

From addresses

DdzFFzCqrhssUzCVHzsLuadGzmRYvfTQS5oKWx2stmT4PXtky8dQd8CepN86N5hMgKXEtHPrcGErtDRJBA6kqLAf2YoWhfz7YaHh2fmm
To addresses

DdzFFzCqrhstKC4RKxny7FTgg7zH43UNZNN3EbPyGPEjjesvRsnrxfyY65UBiJkSqTbxEuhtx2WP63QR7TyQE2eGD6nJEgxPZ5ZwoKH5
DdzFFzCqrhtCugv3MmYK7osJMbMwTmyzmUFnECnTq3yC9MsT5kDmmizt9dZuM92MW37f1Ev9uGcHA74cQwDKbzVhpVsMsBghSa61RYjE
DdzFFzCqrht47vgTqrjAK1UgAUMGtZsAnu9tokbbozmSw2XCH7PwLwnKwvVbzdMJ9G8tZbRWVDCEWMuQEdV24ZPdvXer5Q9jsWF8cVGc
DdzFFzCqrhszcKrm1pP8TGQ98xZorgZM9KBDJU5RinBaJ2KCeCuB6C4jxrZjFmXgqgdv7nJdFW5a5fSddHtUVue8vmfGUkTwMLjcSxni
DdzFFzCqrhsuyJcHBLWvZiR1et3qsQhYwzHWhYrGkcHJquiC4EQEJQLQBGNCU9wiGvNZYtfAp2FLDGS89stD3VDna3Ufv4ww9z8yyUqU
Transaction assurance level

High. 289688 confirmations.
Transaction ID

9ddf657a265fa9be4e095122c759fe3bb2f44082421db7ea39cb02bb226bd3f3

+207.00

From addresses

DdzFFzCqrhsiRJ1ibDyYdmzLzNzJMaV31aCkpKSft9tyZbdCGGG3TrSwHqVFdSZXPxTDRqAd7VHoPV1Srt29msZfSvdaYCxBGYnxU9RJ
To addresses

DdzFFzCqrht6wFRFYbSbd5tNcZrtAoiL4dDjkKZZqCE2s7UWQiuVL9dZN2fuAyCjW4iNLJ6MHo15MLQwXGTSTBKgafshqmqfEbG2U8VB
DdzFFzCqrhszcKrm1pP8TGQ98xZorgZM9KBDJU5RinBaJ2KCeCuB6C4jxrZjFmXgqgdv7nJdFW5a5fSddHtUVue8vmfGUkTwMLjcSxni
DdzFFzCqrht3nE76rsfEpYFMHDJ2ScT4wGfneZPFntjx4dgxuHDHxUfriMuTxUfVvJcQGrFjTpJ6JAbepBDEQu6bi1uBUcWdZ8NMdREm
DdzFFzCqrhskPr9aexcyBEaxBDwq4KSqGUZ2ewdSU3cxBYuneAdQzjJjkEpjxvjofKykDWpLunNKedPmriMX6jfruWnzWgxX6mWAC2qZ
Transaction assurance level

High. 408022 confirmations.
Transaction ID

880570b705b59d215f99c65c7cf9eaace031e688e27686b01a451e3a6944d08e

+1,150.847

From addresses

DdzFFzCqrht8X8XkPC4tjhBPF8CoCsHXp3gUoHdWbjL5ErxSvYuG5WTWzyg6gGmtKvMZEabjQUHYvQ2R8kyYUttQzLqBXdjtHkAyPoxN
To addresses

DdzFFzCqrhsp65dgdzxJCLSPX1sxSHuwXDSBmNPZiVzkcu2YPXRshWBzYZwb4bSZC4J9q6yawNziTV8FMpp9uX1HSyKrsH1fCxErEx9D
DdzFFzCqrhszcKrm1pP8TGQ98xZorgZM9KBDJU5RinBaJ2KCeCuB6C4jxrZjFmXgqgdv7nJdFW5a5fSddHtUVue8vmfGUkTwMLjcSxni
Transaction assurance level

High. 450781 confirmations.
Transaction ID

f4f101820fe118445f823cb0dfc776c3e40658a2cd8e6b18a9a304687f0210e4

+637.35

From addresses

DdzFFzCqrhsoCkaG4BvKWAibi4pT8krioNia38TzJfnQCi7sbMkNDaL7ihfCUrdQG8VmutESgi3k93HjnjaDckoxJxjvyx1xrexjEpCB
To addresses

DdzFFzCqrhsnx9m8U5bH1bBzt1Xfm7UikVvAM6CnYkZwxJ1qQu4mmUNybr8JMEtJQhe7zG26k7VkysFotNXmETBss91DVhRT8qSNGf87
DdzFFzCqrhszcKrm1pP8TGQ98xZorgZM9KBDJU5RinBaJ2KCeCuB6C4jxrZjFmXgqgdv7nJdFW5a5fSddHtUVue8vmfGUkTwMLjcSxni
Transaction assurance level

High. 525699 confirmations.
Transaction ID

16a67ea61c2cdff4202965811017d9e07465db2789ad39687cd0ea161f104afb

+10

From addresses

DdzFFzCqrht62RvgBeNfWm8ykE8M3JiXufPXyPMQgLVuMFw7xQFfcHQ6bCqwA9nBUcz911h7D9vTmEnFvCJtwRFaHNBoqd4pSCUUqknX
To addresses

DdzFFzCqrhssN1ts2bgiZLmmxqfmzeDcCZ61Gmu7DGhwXVqJphRe2gYfc6uwA4nT8vHCAt9E2LfQiga9jM12XWs6GigNk3JuYFW8fJKi
DdzFFzCqrhszcKrm1pP8TGQ98xZorgZM9KBDJU5RinBaJ2KCeCuB6C4jxrZjFmXgqgdv7nJdFW5a5fSddHtUVue8vmfGUkTwMLjcSxni
Transaction assurance level

High. 526093 confirmations.
Transaction ID

aa7f94e7458220ae9d6bebadc6c55d43bf5a7ebf4592f18c552d33b47431e4fe

7

adatracker shows this transaction weird - not enough inputs. Just for history: I have reported this issue to them.

https://adatracker.com/tx/710dd2647ca9a8184f228d3a1447da9c06b2de1331efc688fa94568fcd4eacb2

image
image.png1211×452 64.1 KB

1 Like
8

6222 was transferred from this address plus 223 from another address (same wallet):

image
image1230×529 74.2 KB

The whole post seems weird and fishy to me =\

1 Like
9

Yeah part of the problem for me is a simple lack of knowledge on how exactly the wallet system works. One thing I was hoping the logs might be able to reveal is if the transaction was initiated from my desktop wallet, or just my address, from elsewhere, using compromised keys/mneumonic. Is there a way to tell this?

1 Like
10

No. Transactions do not contain this information.

Btw, did you only sent all your ADA in two transactions from Binance: 100 ADA and 6222 ADA, right?

12

This is the wrong thread for your post, I will quote your post in a proper thread.

13

Yeah I did, had multiple things open. Thank you for your explanation too :slight_smile:

1 Like
14

I added another post but it was so long it said it’s under review. Anyway I explain that no, there were many deposits (like 8 or so) but spanned several months. I only mentioned the last few because the others didn’t seem relevant. However, since the wallet was “cleaned out” I supposed all of the transactions may be relevant. The last few though were in a very short timeframe.

15

Original: I cannot see any issues, the only issue I can see is that the adatracker’s databases are inconsistent or their web app cannot handle the blocks properly.

Update: Something is not right. I am checking. The cardanoexplorere shows the proper transaction but cannot show the target address. While adatracker cannot show the proper transaction, but can show the target address.

3 Likes
16

Can you pls take a screenshot of your cleaned Wallet’s Summary, Send, Receive and Transaction pages?
As it seems to me a hack, but it was sent to Binance address, therefore you can ask Cardano/IOHK/Binance to follow that transaction if it was not initiated by you, as to have a Binance account the individual needs to go through some KYC.

Anyway, I will check it further when I get home.

Update: It seems cardanoexplorer’s GUI does not like the long output as the API properly shows the transactions and the address summary. It definitely seems to me a hack. Contact to Binance.

Update2: Those transactions are legit and no any issue /w the blockchain nor the cardanoexplorer except the API design decision of the cardanoexplorer which allows to pull all transactions (ten thousands) for an address in a query, which takes a lot of time. Hopefully, it will be or already is solved in the API v1. So, your wallet is definitely hacked. Seek for some advice/help from Binance, but I doubt that they would do anything.

4 Likes
17

Thanks for your insight. I’ve started a support ticket with Binance. If it was a hack then they were very good. I could not be more careful with my crypto wallets. Hope they make a hardware wallet compatibility soon. As much as I hate to keep my crypto on exchanges, what other choice is there for now?

1 Like
18

Are you saying your Binance ADA wallet hacked or your Daedalus wallet hacked?

19

Neither. His 12 secret words are hacked.

20

That’s too bad, usually the 12 secret words seed is fairly secure

21

It’s exactly as secure as your way of storing it. It cannot be “hacked” by itself, it’s just a 12 random words. It may be stolen from the owner, tho.

1 Like