My Bitcoin was sent right away from my address after receiving it

Not sure if I’m posting this in the right place, but I could use some help. So, this morning I sent 1.01 BTC from my Xapo wallet to my Bitcoin Core wallet at the address 12iocUthp58E72ZksRmToDFPfM1WCPKv91. I have the private key for that address and my wallet was synced and running fine all day. As soon as the Bitcoin hit that address (even before the transaction got confirmed), the whole amount was sent off to another address 1aa5cmqmvQq8YQTEqcTmW7dfBNuFwgdCD that I don’t recognize and I definitely don’t have the key for it. I honestly thought that wasn’t even possible. What the heck just happened and where did my Bitcoin go?

looks like the destination address is linked to some issues in the past. https://bitcointalk.org/index.php?topic=1175321.msg12715624#msg12715624 https://bitcointalk.org/index.php?topic=1293658.msg13305218#msg13305218 not sure what happened to you but maybe your computer is infected by some kind of malware

Whether it's infected or was in the past, clearly somebody else got OPs private key and transferred out those BTC. It was stolen. Sorry.

Thanks for your replies. I am running Bitcoin-Qt on a mac that I have just recently installed so the possibility of Malware is small. The coins were transferred out the exact same second as they arrived, and before the transaction was confirmed, I did not think that was possible.

The attacker has your private key. Even your wallet knows you've got money in the second they've came in. It's not that difficult to code something similar and when the "money in" notification comes, the money is sent out by a script. It doesn't have to be on your computer. The attacker has your private key and can do all this on his own computer.

You said the Mac OS was recently installed. Did you wipe your computer at some point? Have you ever had malware detected in the past? Also if someone can post some technical details of how you would make a script to monitor a BTC address, that would be really interesting. I'm going to do some research on the topic on my lunch break today. (Is it similar to how miners get notified when they discover a block?)

You do not have exclusive control of the private key.  Someone else has that private key as well. How did you get that address and private key?  Did you generate the address with the Bitcoin Core wallet immediately before sending the transaction? Did you import the private key into Bitcoin Core?  Was it generated with VanityGen?  Was is generated with bitaddress.org?  Was it a "brainwallet", generated from a passphrase?  Did you get the private key from someone else? If you generated the address with the Bitcoin Core wallet, have you ever had that wallet.dat file installed on any other computer in the past? It is. It is a good idea to wait until a transaction is confirmed before you spend the bitcoins that are received from the transactions (just in case the transaction never confirms), but it is not necessary to wait for confirmation.  Unconfirmed bitcoins can be spent.

I was given to understand that it was not possible to spend unconfirmed coins on your address, I still don't understand how they were able to send the coins the instant they arrived. I too am intrigued on how you would go about doing this.

You must have replied the same time as me. I have indeed imported some keys into my wallet. I transferred my entire balance to my Coinbase account and deleted/recreated my wallet.dat file. An expensive lesson but it could have been lot worse.

Where did those keys come from? If it was a source that you thought was trustworthy, then it might be a good idea to warn others not to use that source.

true It was taken. Not stolen. It is possible. Your knowledge about bitcoin network has gaps. Live with it or teach yourself.

OP, I am sorry for your loss, your BTC was taken. In fact, there are MAC malware, but whoever took your BTC did not need it if he had your private key. Since I really cannot see a way to recover your value, I advise you to use additional anti-malware software on your computer and make sure you have exclusive knowledge of your private key to prevent similar cases in the future. I wondered the same some days ago and I was advised to check some BTC block explorer to discover the relations of a BTC address. After the update where you automatically get a new address after each transaction, you may do not want to monitor a BTC address but a person's BTC addresses, but as far as I know, it still is possible with block exploring.

Start with this https://github.com/sebicas/bitcoin-sniffer And ask me anything.

If something is taken, and the taker doesn't have permission to take it, then it is stolen.

OK, seems to me that OP stolen my private key and its address  Should I prove that 12iocUthp58E72ZksRmToDFPfM1WCPKv91 belongs to me?

Although you are Legendary rank, with your trust rating with so much RED, I am inclined to believe that you've got a newbie's private keys (and money), or you are trying to imply that.

You are insulting me undeservedly. I did not touch money. At least you will not be able to prove it. I encourage you to look up words and terms not misleading readers.

I did not say anything I cannot prove. I did not say you did anything. I said that I am inclined to believe you did. And I pointed out your trust rating, which is red, nothing special to prove there.

Oups, sorry. You may also believe that I am a murderer of JFK. I do not care about it. This is your problem to look at the rank, not mine.

One question, you also had said previously that you had imported some keys. Was this one of them? And as DH asked above, where did those keys come from?