# My ADA from my YOROI Wallet are gone

**URL:** <https://forum.cardano.org/t/my-ada-from-my-yoroi-wallet-are-gone/84073>\
**Category:** Community Technical Support\
**Created:** [9 November 2021 14:48 UTC](https://forum.cardano.org/t/my-ada-from-my-yoroi-wallet-are-gone/84073 "2021-11-09T14:48:44Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Stemski](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/stemski/32/46025_2.png) [@Stemski](https://forum.cardano.org/u/Stemski)\
**Post date:** [9 November 2021 14:48 UTC](https://forum.cardano.org/t/my-ada-from-my-yoroi-wallet-are-gone/84073/1 "2021-11-09T14:48:44Z")

</div>

Hi there,  
I have 860 ADA but on Saturday 500 ADA were transferred elsewhere. Now I only own 360 ADA. But I was the only one who had the recovery phrase. First 25 ADA, then 125 ADA, then 150 ADA and finally 200 ADA were transferred. A total of 500 ADA. I need help. Even if it sounds like little to one or the other, 500 ADA is a lot to me. I am a student. Can someone please explain how it could happen. I’ve had my Yoroi wallet for more than a year and on Saturday of all times my 500 ADAs will be transferred elsewhere. Any answer from you would be helpful …

---

<div class="post-metadata">

**Author:** ![Alexd1985](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/alexd1985/32/23759_2.png) [@Alexd1985](https://forum.cardano.org/u/Alexd1985)\
**Post date:** [9 November 2021 14:57 UTC](https://forum.cardano.org/t/my-ada-from-my-yoroi-wallet-are-gone/84073/2 "2021-11-09T14:57:49Z")

</div>

sorry to hear ☹  
you may check this post also, it seems your wallet/PC was compromised… I will recommend to move the 360ADA back on exchange (out of the compromised wallet)

> [@Lost all ADA from my YOROI Wallet - HACKED!](https://forum.cardano.org/t/lost-all-ada-from-my-yoroi-wallet-hacked/58170):
>
> Hello everyone, I found out that my YOROI wallet has been hacked by someone and lost all my ADA. They all have been moved to this address listed below, listed is the path the tokens were moved Mine : addr1q8wxlfg9vra4hf9jqgd0xj78earts8hdm52r7f688eyx8sxud7js2c8mtwjtyqs67d9u0n6xhq0wmhg58un5w0jgv0qqwzlrc4 First xfer to: DdzFFzCqrht85GCz9AGXCUpbuUv8YqiB5t9RtXwC76iEXYzQCrUfccMh2NdyiVU318dSDuqgnTi7xMxKJc53nRZ7gsjQ5hHWDJQXQ2AL Second xfer to: “DdzFFzCqrhszAisfe4k7wNnA8Ue4L3AyHVpdeewZkyrfScRqRptz6…

---

<div class="post-metadata">

**Author:** ![tomdx](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/tomdx/32/44498_2.png) [@tomdx](https://forum.cardano.org/u/tomdx)\
**Post date:** [9 November 2021 17:01 UTC](https://forum.cardano.org/t/my-ada-from-my-yoroi-wallet-are-gone/84073/3 "2021-11-09T17:01:48Z")

</div>

It happens too often …

> [@Use a HW wallet If you have more ADA than you're happy to loose](https://forum.cardano.org/t/use-a-hw-wallet-if-you-have-more-ada-than-youre-happy-to-loose/79363):
>
> This forum is full of sad stories from folks having lost their funds in software wallets. Yes, software systems do get attacked. Not only the direct code of the wallet implementation but also its dependencies. Not only past and current releases but also future releases will get attacked. The attack surface is massive especially on a phone. Only give your private key to a piece of software when you can be absolutely sure that it will never be compromised - in fact you can’t. Instead, put your k…

---

<div class="post-metadata">

**Author:** ![Stemski](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/stemski/32/46025_2.png) [@Stemski](https://forum.cardano.org/u/Stemski)\
**Post date:** [9 November 2021 18:10 UTC](https://forum.cardano.org/t/my-ada-from-my-yoroi-wallet-are-gone/84073/4 "2021-11-09T18:10:44Z")

</div>

The 360 ​​ADA have already been transferred to another wallet. I just wonder why a hacker doesn’t take everything, and only 500 ADA. That does not make sense. Is there any way I can get my 500 ADA back? Like I said, I’m a student and I only had 860 ADA and now only 360 ADA.

---

<div class="post-metadata">

**Author:** ![Alexd1985](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/alexd1985/32/23759_2.png) [@Alexd1985](https://forum.cardano.org/u/Alexd1985)\
**Post date:** [9 November 2021 18:19 UTC](https://forum.cardano.org/t/my-ada-from-my-yoroi-wallet-are-gone/84073/5 "2021-11-09T18:19:48Z")

</div>

Can u share the wallet address (where the ADA were sent)

---

<div class="post-metadata">

**Author:** ![Stemski](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/stemski/32/46025_2.png) [@Stemski](https://forum.cardano.org/u/Stemski)\
**Post date:** [9 November 2021 18:24 UTC](https://forum.cardano.org/t/my-ada-from-my-yoroi-wallet-are-gone/84073/6 "2021-11-09T18:24:58Z")

</div>

Of course.

-25 ADA addr1qyrcsrjataxexzxal55dp8zu400w9f5qgme3478204vs96n3xh8279zrvfywvpynxy5ws8eadee3lgmur6ff358arzhscakhl8

-125 ADA  
addr1qyrcsrjataxexzxal55dp8zu400w9f5qgme3478204vs96n3xh8279zrvfywvpynxy5ws8eadee3lgmur6ff358arzhscakhl8

-150 ADA  
addr1qyrcsrjataxexzxal55dp8zu400w9f5qgme3478204vs96n3xh8279zrvfywvpynxy5ws8eadee3lgmur6ff358arzhscakhl8

-200 ADA  
addr1qya8vluwaefpmzefvulju9x0g4vgguhv8pjpps6fhg5dz3n3xh8279zrvfywvpynxy5ws8eadee3lgmur6ff358arzhs75vu77

One wallet address (ending with “l8”) was transferred 3 times and the other wallet address (ending with “77”) was transferred once. A total of 500 ADA

---

<div class="post-metadata">

**Author:** ![Alexd1985](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/alexd1985/32/23759_2.png) [@Alexd1985](https://forum.cardano.org/u/Alexd1985)\
**Post date:** [9 November 2021 18:27 UTC](https://forum.cardano.org/t/my-ada-from-my-yoroi-wallet-are-gone/84073/7 "2021-11-09T18:27:02Z")

</div>

> [@Stemski](#):
>
> addr1qyrcsrjataxexzxal55dp8zu400w9f5qgme3478204vs96n3xh8279zrvfywvpynxy5ws8eadee3lgmur6ff358arzhscakhl8

Wired … the wallet delegated to PILOT POOL  
Doesn’t looks like a professional hacker

> **[Address...](https://cardanoscan.io/address/0107880e5d5f4d9308ddfd28d09c5cabdee2a68046f31af8ea7d5902ea7135ceaf14436248e604933128e81f3d6e731fa37c1e9298d0fd18af)**
>
> Address addr1qyrcsrjataxexzxal55dp8zu400w9f5qgme3478204vs96n3xh8279zrvfywvpynxy5ws8eadee3lgmur6ff358arzhscakhl8 page shows the balance, controlled stake key, and recent transactions.

---

<div class="post-metadata">

**Author:** ![Stemski](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/stemski/32/46025_2.png) [@Stemski](https://forum.cardano.org/u/Stemski)\
**Post date:** [9 November 2021 18:45 UTC](https://forum.cardano.org/t/my-ada-from-my-yoroi-wallet-are-gone/84073/8 "2021-11-09T18:45:44Z")

</div>

And the person must have transferred 25 ADA to another wallet and then back to his wallet so it says 22.82 ADA. Because of the fees. And a Controlled Total Stake of 497ADA, yesterday it was a smooth 500 ADA.

> **[Addresses - Cardanoscan](https://cardanoscan.io/addresses?stakeKey=7135ceaf14436248e604933128e81f3d6e731fa37c1e9298d0fd18af)**
>
> The addresses page shows all the addresses on the Cardano
> blockchain.

---

<div class="post-metadata">

**Author:** ![HeptaSean](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/heptasean/32/82306_2.png) [@HeptaSean](https://forum.cardano.org/u/HeptaSean)\
**Post date:** [9 November 2021 19:38 UTC](https://forum.cardano.org/t/my-ada-from-my-yoroi-wallet-are-gone/84073/9 "2021-11-09T19:38:45Z")

</div>

> [@Stemski](#):
>
> And the person must have transferred 25 ADA to another wallet and then back to his wallet so it says 22.82 ADA. Because of the fees. And a Controlled Total Stake of 497ADA, yesterday it was a smooth 500 ADA.

Not to another wallet. That was an intra-wallet transaction for registering the stake key:

> **[Transaction 717a375ff1dd6c66f1a508dbbeeb71d147e40c36c4bc3ea8953c47177fe932a7...](https://cardanoscan.io/transaction/717a375ff1dd6c66f1a508dbbeeb71d147e40c36c4bc3ea8953c47177fe932a7)**
>
> Transaction 717a375ff1dd6c66f1a508dbbeeb71d147e40c36c4bc3ea8953c47177fe932a7 page with transaction assurance, timestamp, UTXO, 
> certificates, and more.

25 ₳ in, 2 ₳ stake deposit, 23 ₳ minus transaction fee out to an address controlled by the same stake key/in the same wallet.

---

<div class="post-metadata">

**Author:** ![Stemski](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/stemski/32/46025_2.png) [@Stemski](https://forum.cardano.org/u/Stemski)\
**Post date:** [9 November 2021 20:26 UTC](https://forum.cardano.org/t/my-ada-from-my-yoroi-wallet-are-gone/84073/10 "2021-11-09T20:26:15Z")

</div>

What is an intra wallet transaction? I don’t know my way around that well. And why did the person do that? Does that help me any further?

---

<div class="post-metadata">

**Author:** ![Stemski](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/stemski/32/46025_2.png) [@Stemski](https://forum.cardano.org/u/Stemski)\
**Post date:** [9 November 2021 20:27 UTC](https://forum.cardano.org/t/my-ada-from-my-yoroi-wallet-are-gone/84073/11 "2021-11-09T20:27:31Z")

</div>

And do u think the person is a professional hacker? I don’t have any clue…

---

<div class="post-metadata">

**Author:** ![HeptaSean](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/heptasean/32/82306_2.png) [@HeptaSean](https://forum.cardano.org/u/HeptaSean)\
**Post date:** [9 November 2021 21:10 UTC](https://forum.cardano.org/t/my-ada-from-my-yoroi-wallet-are-gone/84073/12 "2021-11-09T21:10:08Z")

</div>

Most important: I’m afraid, I don’t know if and how that might help get your Ada back. Sorry!

As @Alexd1985, I also think, the behaviour would be a bit strange for a professional hacker.

He transferred only part of your Ada in chunks with round values over the course of 20 minutes all to addresses that belong to one account that only contains your Ada, not from anyone else. And two days later, he starts staking that amount to a pool. A “normal” hacker would probably have transferred it around a bit to finally cash out at some exchange.

Not helpful for your case, but as an explanation, since you asked: Intra-wallet transactions are transactions between addresses that all belong to the same wallet, the same account, the same staking key. You do that, e.g., when you start staking – as your hacker did – or when you register for Catalyst. In the case of staking, a deposit of 2 ADA vanishes (and will reappear if you at some point stop staking) and your staking key and the pool you stake to is registered on the blockchain. In the case of registering for Catalyst, the transaction just costs the usual transaction fee and is done to register some metadata on the blockchain.

---

<div class="post-metadata">

**Author:** ![Alexd1985](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/alexd1985/32/23759_2.png) [@Alexd1985](https://forum.cardano.org/u/Alexd1985)\
**Post date:** [9 November 2021 21:10 UTC](https://forum.cardano.org/t/my-ada-from-my-yoroi-wallet-are-gone/84073/13 "2021-11-09T21:10:20Z")

</div>

U can call him a hacker if he accessed your wallet … but til now I never saw one to stake the ada with a pool

---

<div class="post-metadata">

**Author:** ![Stemski](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/stemski/32/46025_2.png) [@Stemski](https://forum.cardano.org/u/Stemski)\
**Post date:** [9 November 2021 21:51 UTC](https://forum.cardano.org/t/my-ada-from-my-yoroi-wallet-are-gone/84073/14 "2021-11-09T21:51:39Z")

</div>

So I’ll be honest with you, they could be two really good friends of mine who I’ve known for over 8 years. But I just can’t imagine that they were. Of course I informed you about it and asked you if it was you, but they said no. Could be a lie, of course, but there is nothing I can do about it … Because if it should be a lie, then it will be difficult for me to find evidence that it really was. I can only watch how you said how much money is in his wallet. Thank you and the others who tried to help me, but unfortunately I can’t do much or do you have another alternative solution? Because one of my two “good” friends could and certainly will have it if, as you already said, it was not a professional hacker.

---

<div class="post-metadata">

**Author:** ![Alexd1985](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/alexd1985/32/23759_2.png) [@Alexd1985](https://forum.cardano.org/u/Alexd1985)\
**Post date:** [9 November 2021 21:56 UTC](https://forum.cardano.org/t/my-ada-from-my-yoroi-wallet-are-gone/84073/15 "2021-11-09T21:56:16Z")

</div>

I don’t know what to say, without evidence u can’t accuse someone but as I told you will be the first time when a hacker will take only a part from the wallet … perhaps it’s a bad joke… or I don’t know…

---

<div class="post-metadata">

**Author:** ![tomdx](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/tomdx/32/44498_2.png) [@tomdx](https://forum.cardano.org/u/tomdx)\
**Post date:** [10 November 2021 06:43 UTC](https://forum.cardano.org/t/my-ada-from-my-yoroi-wallet-are-gone/84073/16 "2021-11-10T06:43:29Z")

</div>

> [@Stemski](#):
>
> Now I only own 360 ADA

By now, you have moved that to a different wallet (i.e. one with a different mnemonic), right? You can assume that this private key is compromised - you cannot use any of the addresses in the BIP39 hierarchy that are rooted by this key any more. Did the other person really needed to have access to your mnemonic (i.e. in order to restore your wallet elsewhere) or was perhaps a matter of getting access to a computer or even worse a phone that was left unattended?

In any case, in order to prevent such mishaps you need a HW wallet.

---

<div class="post-metadata">

**Author:** ![Stemski](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/stemski/32/46025_2.png) [@Stemski](https://forum.cardano.org/u/Stemski)\
**Post date:** [10 November 2021 20:14 UTC](https://forum.cardano.org/t/my-ada-from-my-yoroi-wallet-are-gone/84073/17 "2021-11-10T20:14:43Z")

</div>

Hello, the 360 ​​ADA are now on a different wallet, but I am still very, very dissatisfied and sad … 500 ADA are probably several thousand euros in the future. And at the moment it would be 1000 €. I’m not a rich guy or anything to get upset about it. No. I am a student who tries to earn his living with cryptos on the side. And I only had 860 ADA, but now the 500 ADA are gone and some guy has them …

2 really very good friends had the Mnemonic Words that I have known for years, because they helped me with it. But these words have also been around for a year. It could be one of them and I got ripped off …

Nobody had access to my PC or my phone, I definitely think so. And according to the others it is not a hacker either or it is very unlikely.

What I do not understand is why that person does not take all my ADA but only 500 ADA (first he transferred 25 ADA, then 125 ADA, then 150 ADA, and at the end 200 ADA) Why in these steps? And who was it? Was it one of my two friends, or someone who might have access to my PC or my phone. I cannot answer these questions. So I ask for your help, please.

---

<div class="post-metadata">

**Author:** ![Stemski](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/stemski/32/46025_2.png) [@Stemski](https://forum.cardano.org/u/Stemski)\
**Post date:** [10 November 2021 20:15 UTC](https://forum.cardano.org/t/my-ada-from-my-yoroi-wallet-are-gone/84073/18 "2021-11-10T20:15:25Z")

</div>

The only thing I want as a student is my 500 ADA back. I am desperate.

---

<div class="post-metadata">

**Author:** ![mcrio](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/mcrio/32/40017_2.png) [@mcrio](https://forum.cardano.org/u/mcrio)\
**Post date:** [10 November 2021 20:40 UTC](https://forum.cardano.org/t/my-ada-from-my-yoroi-wallet-are-gone/84073/19 "2021-11-10T20:40:56Z")

</div>

Unfortunately, nobody here will be able to give you precise answers to these questions. There are too many possibilities of how it may have happened. In the end, maybe it wasn’t any of your friends, but if they had the mnemonics there is a chance it may have leaked from their devices.

Theoretically, you could track those addresses, and maybe at some point in the near or distant future, if that was someone you know, maybe you could connect the dots.

---

<div class="post-metadata">

**Author:** ![ShokhibulBurh4n](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/shokhibulburh4n/32/91273_2.png) [@ShokhibulBurh4n](https://forum.cardano.org/u/ShokhibulBurh4n)\
**Post date:** [10 November 2021 20:53 UTC](https://forum.cardano.org/t/my-ada-from-my-yoroi-wallet-are-gone/84073/20 "2021-11-10T20:53:01Z")

</div>

Have you tried this suggestion to move your remaining ADA to a new wallet with a new phrase?

> [@My ADA from my YOROI Wallet are gone](https://forum.cardano.org/t/my-ada-from-my-yoroi-wallet-are-gone/84073/16):
>
> By now, you have moved that to a different wallet (i.e. one with a different mnemonic), right? You can assume that this private key is compromised - you cannot use any of the addresses in the BIP39 hierarchy that are rooted by this key any more. Did the other person really needed to have access to your mnemonic (i.e. in order to restore your wallet elsewhere) or was perhaps a matter of getting access to a computer or even worse a phone that was left unattended? In any case, in order to prevent…

[Next page](https://forum.cardano.org/t/my-ada-from-my-yoroi-wallet-are-gone/84073.md?page=2)
