Lost Bitcoins while switching from old phone to new with Greenaddress

Hey everyone, I'm new here and pretty clueless about all this. Hoping someone can help: I had my Greenaddress wallet set up on my old Samsung S10. I just switched to a refurbished Samsung S21 and used the Smart Switch app to transfer everything over. After the transfer, I opened Greenaddress, entered my 24-word recovery phrase, and my account showed a zero balance! It looks like a transaction happened while the Smart Switch was running, and I've got this transaction screen showing my account emptied. Here are the screenshots: https://drive.google.com/file/d/1LQa-CvDl9V0xfeHVtH5i7IbyTNbzJPNg/view?usp=sharing https://drive.google.com/file/d/1LL2OwRWDo9VvAU6dTZ_OYz6Ib6l0xhgv/view?usp=sharing https://drive.google.com/file/d/1LmlGrLVWkSpOmqeMRbPJjstaayA26n7f/view?usp=sharing https://drive.google.com/file/d/1LQa-CvDl9V0xfeHVtH5i7IbyTNbzJPNg/view?usp=sharing What do you guys think happened? Thanks a ton to anyone who can help me out. If someone helps me recover my lost satoshis, I’ll definitely reward you generously.

This might be a result of phishing links that must have been connected to your device and perhaps they didn't take action since connection but decided to use the opportunity that you're moving from one phone to another an conducted a transaction. Since the new address is not yours the it's purely a hack. That means you have been scammed and perhaps I haven't used the greenaddress wallets but I learnt it's an open source wallet but that doesn't mean it can't be hacked. For your information, there is no way to get your funds back since it has been transferred to a new address already, even though go to the police to report or try to tack the funds it will only cost you more than the actual amount which you seek. This just another sad news of stolen funds but a means to remind you to always keep your bitcoin safe using a good wallet like Electrum in an offline device (cold storage). Almost every wallet that has to be online is prone to hack because everyday we see new updates on hacks that means the internet is obviously a bait that could catch at any time.

Where was the wallet you imported your seed into downloaded from? Blockstream ended support for GreenAddress wallet in 2021. If you tried to import your seed into a wallet named GreenAddress instead of Blockstream Green, it is very likely that it was a fake wallet that isn’t related to Blockstream at all. Your Bitcoin is gone for good if you inadvertently gave the seed to an attacker.

I never use "transfer software" like this when I get a new phone, but it sounds like the transfer software had access to your wallet files. A PIN is easy to brute-force, so if the transfer software contains malware, it could steal anything it wants. That also means you should consider your new phone compromised now.

I had downloaded greenaddress long before 2021, in fact, then I had uninstalled it when I sold the old phone, and when I installed it again on the Samsung S10 I searched for it on the Play Store and searching for "greenaddress" I found this app: https://drive.google.com/file/d/1MBG7DA46p4Qi6-ja23xJaQBS8ef-Plwb/view?usp=drive_link is it a scam? or is it the phone I bought used here: https://tomatosmartphone.it/ that could contain malware?

I don't know what happened but I don't think your wallet was hacked or someone stole your coins, certainly not because you imported your wallet into a new device! I saw the screenshots you shared and I noticed the notification on your wallet stating that the transaction which moved your coins is "possibly self transfer"! So I looked up the transaction on a block explorer: https://mempool.space/address/3C6J7r24XYim8CwKPvCdU6Dg1NmnwEwFLy It appears your coins were sent back to the address which has sent them to you almost a year ago. As I said, I don't know what happened but if you can remember where you got the coins from then you may figure out what happened.

Is very strange: as you can see here: https://drive.google.com/file/d/1zWKBwz0L9BwvCsQA1R9-SsOoTIuNEZPj/view?usp=sharing https://drive.google.com/file/d/1Gpq7FqyZzJOTKXQ5cmNgXbdIZi59t5Kn/view?usp=sharing You see, they come from my Coinbase account, but that account has been empty since I sent the 679 satoshis to green address, I checked now there's nothing. Sorry, I'm not an expert, but how can you tell that the recipient is the same? I don't see the same address on coinbase... here is my address on coinbase: https://drive.google.com/file/d/1JPiTDe1x3xVWjwNNobzVB04f2TKzrWTI/view?usp=sharing

That is the real Blockstream Green wallet that replaced the old GreenAddress. We can now rule out having installed a scam app. Buying a refurbished phone doesn’t necessarily mean it will have malware, especially if it was factory reset and has the stock operating system from Samsung. You are reading the block explorer wrong. The transaction from a year ago shows him receiving BTC in his Green wallet address 3C6J7r24XYim8CwKPvCdU6Dg1NmnwEwFLy. After that, the funds were swept two weeks ago from this address to a different address which is 1J51SvXqXaCuUb6SeuDPw5d7g6WLkY24rX. Whenever you make a transaction that doesn’t have any change, Blockstream.info’s heuristics will say it is a possible self-transfer. It doesn’t mean you actually transferred to yourself, but it’s an assumption that is sometimes helpful in blockchain analysis. Looking at the address where the funds were swept to it appears to be a Binance deposit address. https://platform.arkhamintelligence.com/explorer/address/1J51SvXqXaCuUb6SeuDPw5d7g6WLkY24rX @amadirok you should check your Binance account to see if you made a recent deposit that you do not remember.

I have never had an account on binance By observing the movements of that Binance account you can see that the incoming BTC are immediately transferred to this address: https://platform.arkhamintelligence.com/explorer/address/bc1qgzrva028eym96uax90j28qj3aqhh3dy8gk6qvp He should be the thief son of a bitch, right?

The address it was moved to is a wallet Binance is using to consolidate deposits. In order to recover your funds you will have to follow the instructions on this page https://www.binance.com/en/support/faq/how-to-report-stolen-funds-transferred-to-binance-360000006051