Mass pending transactions - Can be done without seed/private key? [closed]

Question

Please see the following address and tag:

https://thetangle.org/tag/9999999STOLEN9IOTAS9HELP9US https://thetangle.org/address/FDJJCOVXKPJEHWKXTOVBCBC9WZTMFNOHPDMJCCE9VOALHAJ9FSJQQWZLGLEWOPCQSRZ9VDQLWHUWEFVIA

There is a huge amount of pending TXs on these, including from one of my wallets.

Question: Can an external party initiate a TX from my wallet somehow, without my seed?

I would also like to add that my coins were bought from known exchanges, so I guess it's technically possible that the coins arrived to the exchanges from compromised wallets.

Thanks.

Answer 1

don't panic

Putting it short, these transactions are not actually pending, they are outright invalid bundles with a signature that does not match to either the bundle or the address (or both). Your funds are still safe.

Everybody who knows your address (and has the tools) can forge such bundles and send them to a IOTA node.

But why are they shown as "Pending" on thetangle.org?

Thetangle.org is a community project, and it shows all transactions that have not been confirmed as "Pending" (including invalid transactions, conflicting transactions and incomplete bundles). While multiple people (including me) have notified the author that showing "unconfirmed" transactions as "pending" is confusing, nothing has changed so far (neither by changing the wording, nor by actually adding checks for invalid, conflicting or incomplete transactions).

And why are they transported by the network at all?

Due to design principles of IOTA (or "the tangle"), unlike other cryptocurrency protocols, a "transaction" does not describe the whole transfer of funds, but only an input or an output of it. Therefore, multiple transactions are bundled (to a "bundle") which is then signed. The signature is then split up to the transactions again. However, POW and approvals happen on transaction level (even with incomplete bundles), therefore these transactions need to be transported by the network before the bundle is complete (and the signature can be verified). So they reach tangle explorers like thetangle.org, and they decide to show them (as "pending").

Answer 2

What actually happened

These transactions are invalid since their signatures are not match with ther bundle hashes and/or addresses. There is utility like validateSignatures in iota.js can prove they are invalid signature. Those input addresses are safe and their corresponding private keys are not actually used.

Can an external party initiate a TX without my seed?

Anyone can create transaction bundles with any address they want, but only the seed owner with valid private key is able to sign the transaction. Otherwise, there won't be any transaction chooses them as tips to verify them. What you actually saw are bundles being broadcasted to explorers like thetangle.org and shown as pending forever.