Hi! I have a problem with my chia. I don’t know what happened but the wallet address has changed and my chia have disappeared. The 24 words are right, the sync is complete. I have no outbound call transactions from the list. I am desperate
Many thanks, Mec
Do you have/know the original wallet address (the one the XCH disappeared from) before the change?
Check it on https://xchscan.com/, see what’s there.
Very strange indeed, no transactions in the wallet. Even if someone got a hold of your 24 words somehow and stole your XCH that should be visible in the wallet.
Is the wallet completely emptied? How many XCH disappeared?
Did you use the light wallet beta for a transactions yourself?
Hi! thank you for the response. yes i have. I tried on another PC and I ve the same issue.
I check and my chia was ended up in this wallet xch12r2g65ptuymgf0mpekshjkvlm5wgwzd8d75dxmfacsmfye8d2czspt4zzh . probably stolen
how it’s possible?
Not sure what you mean.
Did you check on xchscan.com with your wallet address and found a transaction to this address you mentioned (xch12r2g65ptuymgf0mpekshjkvlm5wgwzd8d75dxmfacsmfye8d2czspt4zzh)?
But this transaction was not visible in your GUI’s wallet?
xch12r2g65ptuymgf0mpekshjkvlm5wgwzd8d75dxmfacsmfye8d2czspt4zzh has a lot of transactions, two latest ones where 8 days ago. Was one of those from your wallet?
If this is a hacker stealing XCH he’s pretty succesful…
How… he (or she) must have gotten hold of your mnemonics, by means of physical access to your system, hacking into it, finding it somewhere else you put it (paper?).
Sorry for my English. the last 2 transactions are those from my wallet (end with 0l4y6d) to the thief one (end with 4zzh). I don’t have the keys marked anywhere.
These two operations do not appear in the GUI’s wallet list.
maybe some unofficial pool that I used have stolen them.
Thank you very much for your support
After you leave any pool I’d always check your payout addresses and make sure they are yours.
If the coin was actually in your wallet, but got transferred out, I very much doubt it was done by a pool as they don’t have your pvt keys.
If it was a pool, the coin should never have got to your wallet.
1 Like
clear. thank you so much.
But why I can see the outgoing transaction on my chia wallet?
In that case I would consider your pvt keys or computer compromised .
I’d set up a cold wallet address, and direct payout addresses there so any coin you earn gets sent straight there and see if it saves you from replotting and losing more.
NOT see the transactions on your wallet your mean?
Sure you never set up another set of keys for a cold wallet?
The …0l4y6d address seems to have gotten regular incoming transactions on a 3 - 4 day basis. Looks like payouts from some pool maybe? That also stopped 8 days ago when the outgoing transactions took the 5.88 XCH. So maybe someone got access to that cold wallet, not being the one with your 24 word mnemonics used for farming… and changed your pools payout address at the same time.
Even stranger, 2 hours ago another outgoing transaction of 0.01 XCH happened?!?
the last transaction of 0.01 was made by me after generating a new wallet. all the transactions you see in my wallet (… 0l4y6d) are from a pool. At some point, after a power outage, I had to redo the chia installation and sync, after that found myself without a chia. today I found out where they ended up, in the wallet (… 4zzh). 
The address your coins are now in is no doubt not yours, from your mining income I doubt you ever had 58 coins at one time in your wallet?
It has alot of varying incomes of seemingly random amounts, so possibly is indeed a wallet getting stolen coins.
Only being transferred out when a fairly large collection.
no no no my wallet was 6 chia max 
OK, well unfortunately I would consider those coins gone forever.
I’ve no idea why you can’t see the outgoing transaction.
( possibly the thief somehow removed it, hid it from the wallet in the hope of you not noticing).
I’d do a clean os and chia install just to be safe, but thats up to you.
Then set up future payments to a cold wallet.
If it happens again after, might mean needing to replot which nobody wants to do.
Did you install anything just before the coins went, or click any email links that could have done it?
I think why maybe you can’t see the 5.88 and 0.006463482026XCH outgoing transactions, both confirmed in the same block [1,486,579].
The 0.006463482026 could well be a fee, going to the person who farmed that block.
Assuming someone got a hold of your keys, he/she could install the chia light wallet Beta and generate a new address with that. Due to incompatibility of the addresses generated by the light wallet and the default client wallet, transactions to/from those new addresses can’t been seen on the default wallet.
In chia version 1.3 the new wallet will be integrated.
If you want to test this sooner you can install the light wallet Beta yourself -ON ANOTHER PC than the one you’re farming on!!! - enter the mnemonics and let it sync (half an hour or so, depending on number of transactions in your wallet). Then you can see all transactions, by the default as well as the light wallet.
Only thing I’m not sure of is how the block explorer (like xchscan) can account for the transaction on the default wallet’s address… Maybe they already implemented the new type of addresses and do some kind of mapping… I’m guessing now.
Do you have another system to try the light wallet with?
https://www.chia.net/download/ Just scroll all the way down.
OK, so I tried this myself.
Send 100 mojo’s to a new, otherwise empty wallet.
Then on another system installed the light wallet (beta) and entered the mnemonics. Found the 100 mojo’s as expected and then transferred 10 of those to my cold wallet.
This worked out in two transactions, 10 mojo’s to the cold wallet and 90 mojo’s change back to a fresh address on the light wallet (with the same mnemonics, remember).
After which:
A) In the default client the outbound transactions are not visible, but the wallet contents show zero!
B) In the light client, the transactions are visible, the wallet (same wallet!) contents show 90 mojo’s.
C) The blockchain explorer xchscan shows transactions as if made from the original wallet address!!!
A.
B.
C.
1 Like
@AleMec81
So I think someone has your mnemonics, installed a light wallet beta and transferred the 5.88 XCH to his wallet. Not sure what the 0.006463482026 XCH is, could be change back to the (your!) light wallet or a fee set with the 5.88 XCH transaction to speed up its processing.
1 Like
in other words, I still lost my Chia.
thank very much for your support, for me it is a failed experiment and I will leave chia farming.
Have a nice weekend.
Mec
There is no doubt your XCH is gone.
What I don’t understand is if there are no transactions showing where your XCH went, how did you find the destination wallet currently holding it? Something doesn’t add up.
1 Like
Have you tried to check your Chia balance using latest light wallet beta? It is possible that your Chia change goes to addresses which are observable-keys. If you fire up using Chia light wallet beta, or later Chia v 1.3, you should be able to see all the change balances.
Understanding the Changes in the New Light Wallet (chia.net)
You can see the transactions in a blockchain explorer website like xchscan or chiaexplorer.
He knew the wallet-address the XCH went missing from so could check and found where it went.
Definetly a wallet from some kind of hacker, many incoming transactions of several XCH at once so no pooling or farming rewards. He must have some malware that installs on farmers systems and steals keys. Then uses the light wallet to (at the surface) obfuscate his doings.
1 Like