================================================================ WALLET CHECK REPORT Date: 07/16/2026 18:11:43 WARNING: this file may contain private keys - store it safely. ================================================================ Auto-detected wallet: wallet_10,21.dat Wallet: wallet_10,21.dat ======================================================================== 1. HASH OF ORIGINAL ======================================================================== FILE: wallet_10,21.dat CRC32: 2911E694 MD5: 232F2C0E4996C236A2A38769B41A8C2E SHA-1: 4780521AB0FA2F4A5A0D0D88930577FFA3B32F60 SHA256: E8569F8A99DC7EE4F853E516DB114CA9C1A449F737C05768D25966D74CC26FDA ======================================================================== 2. OFFLINE TRIAGE ======================================================================== --- File format --- Size: 57344 bytes Detected: Berkeley DB magic -> LEGACY wallet (expected for 0.19). --- bitcoin-wallet info --- Wallet info =========== Encrypted: yes HD (hd seed available): no Keypool Size: 0 Transactions: 10 Address Book: 4 --- Marker scan (printable strings) --- Markers found: ckeyA, name"1L3amZhWgU8vnGzeMKJc4QFqvQhpU53WsV, name"1ED6sisjvTEcaPP39Fbt8sQpKA13ohHehe, name"1BEF212qkY1JjmhiJFPEPcFfbzPHW5KjNk, name"16Xnu7osrxuqzbKCHQPFv8wTcuJiLMznKC, mkey -> mkey present: wallet is most likely ENCRYPTED. -> ckey present: ENCRYPTED private keys exist. ======================================================================== 2b. FAKE / FABRICATED WALLET DETECTION (scam markers) ======================================================================== Reference guide - how to tell a fake wallet.dat from a genuine one: * HEX Editor Inspection: open the file in a HEX editor (e.g., HxD) and search for known scammer template strings. If present, the file is almost certainly a fabricated fake distributed by scammers. * Bitcoin Core Import Test: if the wallet only shows watch-only addresses with no actual private keys stored, it is non-functional. * Transaction History Match: compare the tx count / history against a public block explorer; any mismatch indicates a tampered file. * RPC command dumpprivkey
: code -4 Private key ... is unknown -> key missing, likely fake. code -13 wallet encrypted -> normal for a genuine vault. * Address/File Structure: legacy wallets hold multiple separate keys; HD (BIP32) wallets use an xpriv seed and the file size typically stays static as new addresses are derived. Watch out for known fake lists circulating online with repetitive addresses / passwords. Automated checks performed by this script: [ok] No known scam marker strings found in the file. Whole-file Shannon entropy: 5.077 bits/byte (8.0 = maximal) [ok] No suspicious address-repetition pattern found. --- Real on-chain balance (block explorer lookup with dual-source verification) --- Addresses found in wallet file: 4 Checking balances (this may take some time). Respectful delay applied to avoid API bans... Dust threshold: 100000 sat (0.001 BTC) - balances below this trigger secondary verification. [1/4] 1L3amZhWgU8vnGzeMKJc4QFqvQhpU53WsV : 10.21002231 BTC (1021002231 sat) [2/4] 1ED6sisjvTEcaPP39Fbt8sQpKA13ohHehe : 0.00000000 BTC (000000000 sat) [3/4] 1BEF212qkY1JjmhiJFPEPcFfbzPHW5KjNk : 0.00000000 BTC (000000000 sat) [4/4] 16Xnu7osrxuqzbKCHQPFv8wTcuJiLMznKC : 0.00000000 BTC (000000000 sat) -------------------------------------------------- TOTAL SPENDABLE BALANCE: 10.21002231 BTC (1021002231 sat) Source: https://www.blockchain.com/explorer/addresses/btc/16Xnu7osrxuqzbKCHQPFv8wTcuJiLMznKC ======================================================================== 3. START bitcoind ======================================================================== Args: -datadir=wallet_10,21.dat -noconnect=1 -dnsseed=0 -listen=0 -maxconnections=0 -server=1 -printtoconsole=0 Waiting for RPC (up to 90 s)... RPC is ready. ======================================================================== 4. getwalletinfo ======================================================================== { "walletname": "wallet_10,21.dat", "walletversion": 10500, "balance": 10.21002231, "unconfirmed_balance": 0.00000000, "immature_balance": 0.00000000, "txcount": 10, "keypoololdest": 1784218357, "keypoolsize": 0, "unlocked_until": 0, "paytxfee": 0.00000000, "private_keys_enabled": true, "avoid_reuse": false, "scanning": false } Parsed -> private_keys_enabled=True | keypoolsize=0 | txcount=10 | hdseedid=n/a ======================================================================== 5. WALLET IS ENCRYPTED - unlocking ======================================================================== No passphrase entered - private keys will not be dumped. (The verdict can still confirm the wallet TYPE without the password.) ======================================================================== 6. listaddressgroupings ======================================================================== { "value": [ [ "16Xnu7osrxuqzbKCHQPFv8wTcuJiLMznKC", 0.00, "" ], [ "1BEF212qkY1JjmhiJFPEPcFfbzPHW5KjNk", 0.00, "" ], [ "1ED6sisjvTEcaPP39Fbt8sQpKA13ohHehe", 00.00, "" ], [ "1L3amZhWgU8vnGzeMKJc4QFqvQhpU53WsV", 10.21002231, "" ] ], "Count": 4 } ======================================================================== 7. getbalances ======================================================================== { "mine": { "trusted": 10.21002231, "untrusted_pending": 0.00000000, "immature": 0.00000000 } } ======================================================================== 8. getaddressesbylabel (default label) ======================================================================== bitcoin-cli.exe : error code: -1 At C:\DISCK-D\01-MY-PROGRAMS\01-BTC-Tools\02hashcat-7.1.2\01bitcoin-0.19.1-wallet-check\bin\wallet_check.ps1:182 char:12 + $out = & $cli @base @CmdArgs 2>&1 + ~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (error code: -1:String) [], RemoteException + FullyQualifiedErrorId : NativeCommandError error message: getaddressesbylabel "label" Returns the list of addresses assigned the specified label. Arguments: 1. label (string, required) The label. Result: { (json object with addresses as keys) "address": { (json object with information about address) "purpose": "string" (string) Purpose of address ("send" for sending address, "receive" for receiving address) },... } Examples: > bitcoin-cli getaddressesbylabel "tabby" > curl --user myusername --data-binary '{"jsonrpc": "1.0", "id":"curltest", "method": "getaddressesbylabel", "params": ["tabby"] }' -H 'content-type: text/plain;' http://127.0.0.1:8332/ ======================================================================== 9. dumpwallet ======================================================================== Skipped: wallet locked / no passphrase. ======================================================================== 10. getaddressinfo per address (ismine / iswatchonly / solvable) ======================================================================== Unique addresses found: 4 (checking up to 100) [16Xnu7osrxuqzbKCHQPFv8wTcuJiLMznKC] { "address": "16Xnu7osrxuqzbKCHQPFv8wTcuJiLMznKC", "scriptPubKey": "76a9143cab6c067c55c476f224ae38afefe3676f86c4fa88ac", "ismine": true, "solvable": true, "desc": "pkh([3cab6c06]042b1142d3a602e9df9f6bd86844929c4d1fa76aac0e35facb27e23509dd8a33a39dfd085d69af1f8ccb4f82fd8cadead29b4c5212efac726db6503ecc50d1dd3c)#cx3fmuf8", "iswatchonly": false, "isscript": false, "iswitness": false, "pubkey": "042b1142d3a602e9df9f6bd86844929c4d1fa76aac0e35facb27e23509dd8a33a39dfd085d69af1f8ccb4f82fd8cadead29b4c5212efac726db6503ecc50d1dd3c", "iscompressed": false, "label": "", "ischange": false, "labels": [ { "name": "", "purpose": "unknown" } ] } [1BEF212qkY1JjmhiJFPEPcFfbzPHW5KjNk] { "address": "1BEF212qkY1JjmhiJFPEPcFfbzPHW5KjNk", "scriptPubKey": "76a91470325dc94b5270d97f1ea8ed4965fb6da853e57488ac", "ismine": true, "solvable": true, "desc": "pkh([70325dc9]04adf0e1ee65e7c7596987b34f31b70b4fc055983a0a1e3870afcc822a45aa6b4a01281203c879ebe4d1451336aa96ae451201ff4c8b4651d603d9196707cf382a)#36w4vx5f", "iswatchonly": false, "isscript": false, "iswitness": false, "pubkey": "04adf0e1ee65e7c7596987b34f31b70b4fc055983a0a1e3870afcc822a45aa6b4a01281203c879ebe4d1451336aa96ae451201ff4c8b4651d603d9196707cf382a", "iscompressed": false, "label": "", "ischange": false, "labels": [ { "name": "", "purpose": "unknown" } ] } [1ED6sisjvTEcaPP39Fbt8sQpKA13ohHehe] { "address": "1ED6sisjvTEcaPP39Fbt8sQpKA13ohHehe", "scriptPubKey": "76a91490e387d0d5ec4dbbbd344a07636b51fc0044d2ba88ac", "ismine": true, "solvable": true, "desc": "pkh([90e387d0]049f5f6db2c46dc16631af927587208ed29a69e94b3f4a8deccdcc136f9f5ca33d1dee93f0e4cb3b66fd4bbaafa72ad1643bf94f69254a418ee95655cb296b547a)#c8k07r4x", "iswatchonly": false, "isscript": false, "iswitness": false, "pubkey": "049f5f6db2c46dc16631af927587208ed29a69e94b3f4a8deccdcc136f9f5ca33d1dee93f0e4cb3b66fd4bbaafa72ad1643bf94f69254a418ee95655cb296b547a", "iscompressed": false, "label": "", "ischange": false, "labels": [ { "name": "", "purpose": "unknown" } ] } [1L3amZhWgU8vnGzeMKJc4QFqvQhpU53WsV] { "address": "1L3amZhWgU8vnGzeMKJc4QFqvQhpU53WsV", "scriptPubKey": "76a914d0e769034e736376f91b0824710e3f321dfd19a488ac", "ismine": true, "solvable": true, "desc": "pkh([d0e76903]046d38c72be84a3eadc84f593948a3f6fdaacd583e37872ceed885ce32160bd3af55744154c68ea94c2ce94b83afb9ffbfa556fe9e76069c036605591e14f57f7a)#jrxgrtk0", "iswatchonly": false, "isscript": false, "iswitness": false, "pubkey": "046d38c72be84a3eadc84f593948a3f6fdaacd583e37872ceed885ce32160bd3af55744154c68ea94c2ce94b83afb9ffbfa556fe9e76069c036605591e14f57f7a", "iscompressed": false, "label": "", "ischange": false, "labels": [ { "name": "", "purpose": "unknown" } ] } ======================================================================== 11. listdescriptors (descriptor wallets, Core 0.21+) ======================================================================== Not supported on this Core version (descriptors are a 0.21+ feature). Legacy equivalent already checked: HD seed via dumpwallet (hdseed=1) / hdseedid. ======================================================================== PART III - VERDICT (cross-checked, single result) ======================================================================== Re-checked signals (the evidence this verdict is based on): file format : Berkeley DB (legacy wallet) loaded by node (RPC) : yes getwalletinfo parsed : yes encrypted : yes (unlocked_until / mkey) private_keys_enabled : True keypoolsize : 0 txcount : 10 HD seed present : no (hdseedid / dump hdseed=1) ckey marker (enc keys) : yes mkey marker (encryption): yes addressgroupings empty : no watch-only in balances : no private keys dumped : 0 addresses ismine : 4 addresses iswatchonly : 0 known scam markers : no (none) address reuse pattern : no file entropy : 5.077 bits/byte dust addresses verified : 3 (confirmed by 2 independent sources) REAL balance (explorer) : 10.21002231 BTC (across 4 addresses) VERDICT: [GOOD] Real ENCRYPTED wallet with keys (HTML verdict 1) The file contains private keys (or an encrypted HD seed) and is password-protected. Evidence: encrypted=yes; ckey=yes; HD seed=no; keys dumped=0; keypool=0. If you did not unlock it, the keys are present but locked. Brute-force / recovery: MAKES SENSE - Part IV: btcrecover (known pattern) or hashcat -m 11300 (hash via bitcoin2john.py). Real on-chain balance: 10.21002231 BTC (across 4 addresses, source: https://www.blockchain.com/explorer/addresses/btc/16Xnu7osrxuqzbKCHQPFv8wTcuJiLMznKC) ======================================================================== STOP bitcoind ======================================================================== Node stopped cleanly.