I see that my balance is 0i, yesterday there was a positive balance. I see a transaction confirmed going out that I didn't make. I created my seed using an offline /urandom command and mixing up few results + changing random letters. I kept the seed secret. How can I be 100% sure that my IOTAs were stolen, and not missing for other problems (e.g. claim, node not synced, etc)

  • Make a minuscule transaction if it's going through your connection to the IOTA network is fine. And your IOTAs gone.
    – Helmar
    Dec 3, 2017 at 13:42
  • Check the two links to the transaction below. I tried to do a 1Gi transaction that was in pending. Then the thief was able to confirm a transaction while the other was still in pending. See comment below.
    – overkill22
    Dec 4, 2017 at 3:35
  • Couple days ago I went to check my Iota wallet, and it was empty. Haven’t use any seed generation or something similar. Can somebody check my address if really my Ioatas weren’t stolen? 9SGSFDWQUNPUXCJN9LZBOEXJTMM9QKHLMWWFYXGIXHOR9IQLGAZSVFADWLP99MPZGXQLCHWFCPFMIFGGAXSI99ZASX
    – Armands
    Apr 19, 2018 at 19:31
  • @Armands They were transferred here: thetangle.org/bundle/… If you did not transfer them, it must have been somebody else.
    – mihi
    Apr 19, 2018 at 20:56

2 Answers 2


From your comment on mihi's question I saw that this is your address.

And I think the funds were stolen:

If you follow the outgoing transactions (again and again and again) you end up at these 3 addresses:

address 1
address 2
address 3


The thief tried to move the funds from address to address with different inputs and outputs in order to blur his traces. (They didn't do a very good job at that.)

3 Possibilities:

  • the thief is is waiting for MAM/private transactions. When they are released they will transfer the Iotas to one of his own addresses or to an exchange to sell them.
  • the thief lost the seeds/private keys of the 3 addresses while sending the funds back and forth
  • the 3 addresses are already addresses of exchanges and the thief already sold your Iotas
    (this is unlikely because all exchanges I know immediately empty their addresses)

Do you want to share your address the tokens were "stolen" from? To troubleshoot this, it is generally helpful to know the address where the IOTA have resided on last.

To avoid problems with the node, switch it and see if it changes anything. You can also compare the milestone numbers in the status bar with other nodes to see if a node is lagging behind others, or check iota.dance which list sync status of several public nodes.

If that does not fix it, look up your addresses on a tangle explorer like thetangle.org or iotasear.ch.

If the transactions appear there too (and you see a confirmed outgoing transaction that you did not make), they are probably stolen.

In case your balance is "hidden" by a snapshot (and the inability of the current wallet to cope with it), looking up the address on a tangle explorer will not find any transactions at all (not even the one that attached it). In that case, attach addresses until there is a transaction on that address again.

If after successfully attaching your balance is missing, there probably has been a snapshot where your IOTA have been frozen for one reason or another. Check some recent list of frozen addresses, and if you find your address there, claim it using the reclaim tool.

In case you have attached lots of addresses but the address you expect is not in there, it can have three reasons:

  • your seed is wrong (you used the wrong seed)
  • you last used IOTA in August 2017 or before, where the tangle still used CURL for signing. Therefore the new KERL signing algorithm creates different addresses. In that case you have to claim your seed, too.
  • you need to generate more addresses :-)
  • here's the address. The outgoing confirmed outgoing transaction is not made by me. The first 3 attempt yes. If you follow the money you'll see that they split and they come back together into another account. thetangle.org/address/…
    – overkill22
    Dec 3, 2017 at 14:10
  • There were two bundles that spent from this address: thetangle.org/bundle/… using Android wallet did not confirm, and thetangle.org/bundle/… confirmed. Just to make sure, neither was done by you?
    – mihi
    Dec 3, 2017 at 14:18
  • @Alessio see my comment above (not sure if StackExchange notifies you if I do not mention you)
    – mihi
    Dec 3, 2017 at 14:33
  • the first one (thetangle.org/bundle/…) is an attempt to transfer 1Gi to an exchange, made by me. This transaction was in pending, so I did reattach 3 times. It never get confirmed. I thought to do a reattach the day after. But meanwhile in the night, someone steal the money, and his transaction get confirmed, this one (thetangle.org/bundle/…)
    – overkill22
    Dec 4, 2017 at 3:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.