How can I know if my IOTAs were stolen?

Question

I see that my balance is 0i, yesterday there was a positive balance. I see a transaction confirmed going out that I didn't make. I created my seed using an offline /urandom command and mixing up few results + changing random letters. I kept the seed secret. How can I be 100% sure that my IOTAs were stolen, and not missing for other problems (e.g. claim, node not synced, etc)

Answer 1

From your comment on mihi's question I saw that this is your address.

And I think the funds were stolen:

If you follow the outgoing transactions (again and again and again) you end up at these 3 addresses:

address 1
address 2
address 3

(2018-01-02)

The thief tried to move the funds from address to address with different inputs and outputs in order to blur his traces. (They didn't do a very good job at that.)

3 Possibilities:

• the thief is is waiting for MAM/private transactions. When they are released they will transfer the Iotas to one of his own addresses or to an exchange to sell them.
• the thief lost the seeds/private keys of the 3 addresses while sending the funds back and forth
• the 3 addresses are already addresses of exchanges and the thief already sold your Iotas
  (this is unlikely because all exchanges I know immediately empty their addresses)

Answer 2

Do you want to share your address the tokens were "stolen" from? To troubleshoot this, it is generally helpful to know the address where the IOTA have resided on last.

To avoid problems with the node, switch it and see if it changes anything. You can also compare the milestone numbers in the status bar with other nodes to see if a node is lagging behind others, or check iota.dance which list sync status of several public nodes.

If that does not fix it, look up your addresses on a tangle explorer like thetangle.org or iotasear.ch.

If the transactions appear there too (and you see a confirmed outgoing transaction that you did not make), they are probably stolen.

In case your balance is "hidden" by a snapshot (and the inability of the current wallet to cope with it), looking up the address on a tangle explorer will not find any transactions at all (not even the one that attached it). In that case, attach addresses until there is a transaction on that address again.

If after successfully attaching your balance is missing, there probably has been a snapshot where your IOTA have been frozen for one reason or another. Check some recent list of frozen addresses, and if you find your address there, claim it using the reclaim tool.

In case you have attached lots of addresses but the address you expect is not in there, it can have three reasons:

• your seed is wrong (you used the wrong seed)
• you last used IOTA in August 2017 or before, where the tangle still used CURL for signing. Therefore the new KERL signing algorithm creates different addresses. In that case you have to claim your seed, too.
• you need to generate more addresses :-)