================================================================ WALLET CHECK REPORT Date: 07/16/2026 17:52:48 WARNING: this file may contain private keys - store it safely. ================================================================ Auto-detected wallet: wallet_11,311.dat Wallet: wallet_11,311.dat ======================================================================== 1. HASH OF ORIGINAL ======================================================================== FILE: wallet_11,311.dat CRC32: 8992AD1E MD5: 03959B843B4B4CECF90588E1DF331F8F SHA-1: C54B18D7E0B2DAEC3F22C9F72183E9EE17780E8A SHA256: 83AC7133900EC281B11C3F5F33C5A9BAED1142247CB005C077E40B463CC2E4CB ======================================================================== 2. OFFLINE TRIAGE ======================================================================== --- File format --- Size: 286720 bytes Detected: Berkeley DB magic -> LEGACY wallet (expected for 0.19). --- bitcoin-wallet info --- Wallet info =========== Encrypted: yes HD (hd seed available): no Keypool Size: 100 Transactions: 106 Address Book: 2 --- Marker scan (printable strings) --- Markers found: ckey!, pool6u, name"12Nns22bLrZo8NZmkAV3Kj2J48YKG2SecD, pool5, pool4, pool3, pool2, pool1, pool0, pool/, pool., pool-, pool,, pool+, pool*, pool), pool(, pool', pool&, pool% -> mkey present: wallet is most likely ENCRYPTED. -> ckey present: ENCRYPTED private keys exist. ======================================================================== 2b. FAKE / FABRICATED WALLET DETECTION (scam markers) ======================================================================== Reference guide - how to tell a fake wallet.dat from a genuine one: * HEX Editor Inspection: open the file in a HEX editor (e.g., HxD) and search for known scammer template strings. If present, the file is almost certainly a fabricated fake distributed by scammers. * Bitcoin Core Import Test: if the wallet only shows watch-only addresses with no actual private keys stored, it is non-functional. * Transaction History Match: compare the tx count / history against a public block explorer; any mismatch indicates a tampered file. * RPC command dumpprivkey
: code -4 Private key ... is unknown -> key missing, likely fake. code -13 wallet encrypted -> normal for a genuine vault. * Address/File Structure: legacy wallets hold multiple separate keys; HD (BIP32) wallets use an xpriv seed and the file size typically stays static as new addresses are derived. Watch out for known fake lists circulating online with repetitive addresses / passwords. Automated checks performed by this script: [ok] No known scam marker strings found in the file. Whole-file Shannon entropy: 7.404 bits/byte (8.0 = maximal) [ok] No suspicious address-repetition pattern found. --- Real on-chain balance (block explorer lookup with dual-source verification) --- Addresses found in wallet file: 2 Checking balances (this may take some time). Respectful delay applied to avoid API bans... Dust threshold: 100000 sat (0.001 BTC) - balances below this trigger secondary verification. [1/2] 12Nns22bLrZo8NZmkAV3Kj2J48YKG2SecD : 0 BTC (0 sat) [2/2] 1NibfhHfgA857dtG6pB25Y5hDcxpDo2J47 : 11.26830369 BTC (1126830369 sat) -------------------------------------------------- TOTAL SPENDABLE BALANCE: 189.93705574 BTC (18993705574 sat) Source: https://mempool.space/api/address/1NibfhHfgA857dtG6pB25Y5hDcxpDo2J47 ======================================================================== 3. START bitcoind ======================================================================== Args: -datadir=wallet_11,311.dat -noconnect=1 -dnsseed=0 -listen=0 -maxconnections=0 -server=1 -printtoconsole=0 Waiting for RPC (up to 90 s)... RPC is ready. ======================================================================== 4. getwalletinfo ======================================================================== { "walletname": "wallet_11,311.dat", "walletversion": 60000, "balance": 189.93705574, "unconfirmed_balance": 0.00000000, "immature_balance": 0.00000000, "txcount": 106, "keypoololdest": 1349965713, "keypoolsize": 100, "unlocked_until": 0, "paytxfee": 0.00000000, "private_keys_enabled": true, "avoid_reuse": false, "scanning": false } Parsed -> private_keys_enabled=True | keypoolsize=100 | txcount=106 | hdseedid=n/a ======================================================================== 5. WALLET IS ENCRYPTED - unlocking ======================================================================== No passphrase entered - private keys will not be dumped. (The verdict can still confirm the wallet TYPE without the password.) ======================================================================== 6. listaddressgroupings ======================================================================== { "value": [ [ "1wPya4XFGxT3WkLnneK2FMWgY14S62zUw", 0.00000000 ], [ "12R4jyUsGp2KEbXnpJXrQ7jaWeCrDaQVWz", 0.00000000 ], [ "12WySBgWUd6Zove7V6ZbXdSSTBP2prwxQt", 0.00000000 ], [ "13n46sE1CLrj213GQGq9sbmQwHbQUVTHqn", 0.00000000 ], [ "15B2u3yqS3uh9R15rnGeM9W4qoChfr7C3R", 0.00000000 ], [ "15YL4KyKbuaBYA15DWZNNDKiwnnkMzchLD", 0.00000000 ], [ "17AYF87775hgyjqVwg6rihCjG5iUkQywyb", 0.00000000 ], [ "194JxQvS476Fn7ToWQ12PMJkCPNCBr5Q33", 0.00000000 ], [ "1Cqy8fRrkXpE7z9tc5MWpxFBu1Uqwe1dR8", 0.00000000 ], [ "1K3WNVz3faPpnSnL2QgVxZf43YM7sYxsaz", 0.00000000 ], [ "1KcXisMjE4in9tvWYdoTcq4AyonkFbrqYB", 0.00000000 ], [ "1KvX3YFc4crAYJN96FPwZwYZBJiW8LRdH1", 0.00000000 ], [ "1NibfhHfgA857dtG6pB25Y5hDcxpDo2J47", 11.26830369, "" ] ], "Count": 13 } ======================================================================== 7. getbalances ======================================================================== { "mine": { "trusted": 11.26830369, "untrusted_pending": 0.00000000, "immature": 0.00000000 } } ======================================================================== 8. getaddressesbylabel (default label) ======================================================================== bitcoin-cli.exe : error code: -1 At C:\DISCK-D\01-MY-PROGRAMS\01-BTC-Tools\02hashcat-7.1.2\01bitcoin-0.19.1-wallet-check\bin\wallet_check.ps1:182 char:12 + $out = & $cli @base @CmdArgs 2>&1 + ~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (error code: -1:String) [], RemoteException + FullyQualifiedErrorId : NativeCommandError error message: getaddressesbylabel "label" Returns the list of addresses assigned the specified label. Arguments: 1. label (string, required) The label. Result: { (json object with addresses as keys) "address": { (json object with information about address) "purpose": "string" (string) Purpose of address ("send" for sending address, "receive" for receiving address) },... } Examples: > bitcoin-cli getaddressesbylabel "tabby" > curl --user myusername --data-binary '{"jsonrpc": "1.0", "id":"curltest", "method": "getaddressesbylabel", "params": ["tabby"] }' -H 'content-type: text/plain;' http://127.0.0.1:8332/ ======================================================================== 9. dumpwallet ======================================================================== Skipped: wallet locked / no passphrase. ======================================================================== 10. getaddressinfo per address (ismine / iswatchonly / solvable) ======================================================================== Unique addresses found: 13 (checking up to 100) [1wPya4XFGxT3WkLnneK2FMWgY14S62zUw] { "address": "1wPya4XFGxT3WkLnneK2FMWgY14S62zUw", "scriptPubKey": "76a9140a49a40abc710d0b824aeb92613bcd65215a154e88ac", "ismine": true, "solvable": true, "desc": "pkh([0a49a40a]02d545c76433db289a61fd8f56ae1088cf4ff6b979b739e5706b330395dd83624c)#x4xn0gjl", "iswatchonly": false, "isscript": false, "iswitness": false, "pubkey": "02d545c76433db289a61fd8f56ae1088cf4ff6b979b739e5706b330395dd83624c", "iscompressed": true, "ischange": true, "labels": [ ] } [12R4jyUsGp2KEbXnpJXrQ7jaWeCrDaQVWz] { "address": "12R4jyUsGp2KEbXnpJXrQ7jaWeCrDaQVWz", "scriptPubKey": "76a9140f853b4c7c3b5fa121973149ed2679adbce0fc5d88ac", "ismine": true, "solvable": true, "desc": "pkh([0f853b4c]023946685e55867cd6eebe4265dea71901c77faf55365abed3da18d2f26c2be30e)#7l5jhjnz", "iswatchonly": false, "isscript": false, "iswitness": false, "pubkey": "023946685e55867cd6eebe4265dea71901c77faf55365abed3da18d2f26c2be30e", "iscompressed": true, "ischange": true, "labels": [ ] } [12WySBgWUd6Zove7V6ZbXdSSTBP2prwxQt] { "address": "12WySBgWUd6Zove7V6ZbXdSSTBP2prwxQt", "scriptPubKey": "76a91410a34c2e4ca6146f0db3b9be43dae10ecf7b145988ac", "ismine": true, "solvable": true, "desc": "pkh([10a34c2e]02b7208a4c46725fc81638b04a544285192b287b848e91b7682acbd7618419783e)#jz662v4u", "iswatchonly": false, "isscript": false, "iswitness": false, "pubkey": "02b7208a4c46725fc81638b04a544285192b287b848e91b7682acbd7618419783e", "iscompressed": true, "ischange": true, "labels": [ ] } [13n46sE1CLrj213GQGq9sbmQwHbQUVTHqn] { "address": "13n46sE1CLrj213GQGq9sbmQwHbQUVTHqn", "scriptPubKey": "76a9141e758efceac0fa2e2c319455766dca05cefb39db88ac", "ismine": true, "solvable": true, "desc": "pkh([1e758efc]031dcde80f77f568981c72ba0f88cc061ab4296cd258e69e29a305a40ea1e880ec)#0m737kas", "iswatchonly": false, "isscript": false, "iswitness": false, "pubkey": "031dcde80f77f568981c72ba0f88cc061ab4296cd258e69e29a305a40ea1e880ec", "iscompressed": true, "ischange": true, "labels": [ ] } [15B2u3yqS3uh9R15rnGeM9W4qoChfr7C3R] { "address": "15B2u3yqS3uh9R15rnGeM9W4qoChfr7C3R", "scriptPubKey": "76a9142dc63f24b92f335e3007660ddc785f4f6c1361df88ac", "ismine": true, "solvable": true, "desc": "pkh([2dc63f24]0287dbb19c9f3bc68babecfd1a1a826104862e0704ea59429bce10576cc2f319e2)#edquyrhq", "iswatchonly": false, "isscript": false, "iswitness": false, "pubkey": "0287dbb19c9f3bc68babecfd1a1a826104862e0704ea59429bce10576cc2f319e2", "iscompressed": true, "ischange": true, "labels": [ ] } [15YL4KyKbuaBYA15DWZNNDKiwnnkMzchLD] { "address": "15YL4KyKbuaBYA15DWZNNDKiwnnkMzchLD", "scriptPubKey": "76a91431cd4e6584be125e827e433321babe4127ecac9788ac", "ismine": true, "solvable": true, "desc": "pkh([31cd4e65]02f7159c6fc4e0ebd24c577dbc8a0908a5cd0e930c11f210e408f4709a83017225)#dgvn73td", "iswatchonly": false, "isscript": false, "iswitness": false, "pubkey": "02f7159c6fc4e0ebd24c577dbc8a0908a5cd0e930c11f210e408f4709a83017225", "iscompressed": true, "ischange": true, "labels": [ ] } [17AYF87775hgyjqVwg6rihCjG5iUkQywyb] { "address": "17AYF87775hgyjqVwg6rihCjG5iUkQywyb", "scriptPubKey": "76a914439e9440af741443492e4396b5b6cb207d9b166888ac", "ismine": true, "solvable": true, "desc": "pkh([439e9440]039d07ebb0ee0dc62cdeaa729ada706026f3d463b07e389f9174d2d0b2650264db)#uxccznjx", "iswatchonly": false, "isscript": false, "iswitness": false, "pubkey": "039d07ebb0ee0dc62cdeaa729ada706026f3d463b07e389f9174d2d0b2650264db", "iscompressed": true, "ischange": true, "labels": [ ] } [194JxQvS476Fn7ToWQ12PMJkCPNCBr5Q33] { "address": "194JxQvS476Fn7ToWQ12PMJkCPNCBr5Q33", "scriptPubKey": "76a91458613e1842c22070e9b77d2b1667c3eab985511f88ac", "ismine": true, "solvable": true, "desc": "pkh([58613e18]032dcecb99d8de62feb2603b25ba2b5e7a3069b111ebf890e123f4a0a7c6d9dee3)#da7c5hnl", "iswatchonly": false, "isscript": false, "iswitness": false, "pubkey": "032dcecb99d8de62feb2603b25ba2b5e7a3069b111ebf890e123f4a0a7c6d9dee3", "iscompressed": true, "ischange": true, "labels": [ ] } [1Cqy8fRrkXpE7z9tc5MWpxFBu1Uqwe1dR8] { "address": "1Cqy8fRrkXpE7z9tc5MWpxFBu1Uqwe1dR8", "scriptPubKey": "76a91481ec34de3817c9394a0a06b9b3e160b07a00eea888ac", "ismine": true, "solvable": true, "desc": "pkh([81ec34de]037f08d714a12a2ccec752f3417bcbf9f91d28cdb7278fb7882f84b4ab49dcf7a1)#v0ed7n5d", "iswatchonly": false, "isscript": false, "iswitness": false, "pubkey": "037f08d714a12a2ccec752f3417bcbf9f91d28cdb7278fb7882f84b4ab49dcf7a1", "iscompressed": true, "ischange": true, "labels": [ ] } [1K3WNVz3faPpnSnL2QgVxZf43YM7sYxsaz] { "address": "1K3WNVz3faPpnSnL2QgVxZf43YM7sYxsaz", "scriptPubKey": "76a914c5eb9d0ab360851037f118a34dfc88b0b5c63c5788ac", "ismine": true, "solvable": true, "desc": "pkh([c5eb9d0a]03bac73d7775db7e24c0faac266a91e0968c21b396e747b1431d46c79ec4ba14b1)#etz9d7x8", "iswatchonly": false, "isscript": false, "iswitness": false, "pubkey": "03bac73d7775db7e24c0faac266a91e0968c21b396e747b1431d46c79ec4ba14b1", "iscompressed": true, "ischange": true, "labels": [ ] } [1KcXisMjE4in9tvWYdoTcq4AyonkFbrqYB] { "address": "1KcXisMjE4in9tvWYdoTcq4AyonkFbrqYB", "scriptPubKey": "76a914cc2a77d4efd1c1c3c29224b81ac39a9a4a38987488ac", "ismine": true, "solvable": true, "desc": "pkh([cc2a77d4]0278c649b32a944df2c11b3c0bccba74b1f239687a4474fd29411672d7a9889f40)#z4wq2hrs", "iswatchonly": false, "isscript": false, "iswitness": false, "pubkey": "0278c649b32a944df2c11b3c0bccba74b1f239687a4474fd29411672d7a9889f40", "iscompressed": true, "ischange": true, "labels": [ ] } [1KvX3YFc4crAYJN96FPwZwYZBJiW8LRdH1] { "address": "1KvX3YFc4crAYJN96FPwZwYZBJiW8LRdH1", "scriptPubKey": "76a914cf9163ad305f98afa835a84502909194315fe0d988ac", "ismine": true, "solvable": true, "desc": "pkh([cf9163ad]03ec5365b52ac8cb0dadd12dd75e6bc9299b055826b68265f2f586284b052df1fe)#plvj8nz2", "iswatchonly": false, "isscript": false, "iswitness": false, "pubkey": "03ec5365b52ac8cb0dadd12dd75e6bc9299b055826b68265f2f586284b052df1fe", "iscompressed": true, "ischange": true, "labels": [ ] } [1NibfhHfgA857dtG6pB25Y5hDcxpDo2J47] { "address": "1NibfhHfgA857dtG6pB25Y5hDcxpDo2J47", "scriptPubKey": "76a914ee38a2733c843012d6613fe6f1fa53ee538ecfdb88ac", "ismine": true, "solvable": true, "desc": "pkh([ee38a273]0354f2f7af7ef982ffd4134e48722f1d92a2e8bb71d9cc1c5e000378eb8b98f545)#q7wazmtn", "iswatchonly": false, "isscript": false, "iswitness": false, "pubkey": "0354f2f7af7ef982ffd4134e48722f1d92a2e8bb71d9cc1c5e000378eb8b98f545", "iscompressed": true, "label": "", "ischange": false, "labels": [ { "name": "", "purpose": "unknown" } ] } ======================================================================== 11. listdescriptors (descriptor wallets, Core 0.21+) ======================================================================== Not supported on this Core version (descriptors are a 0.21+ feature). Legacy equivalent already checked: HD seed via dumpwallet (hdseed=1) / hdseedid. ======================================================================== PART III - VERDICT (cross-checked, single result) ======================================================================== Re-checked signals (the evidence this verdict is based on): file format : Berkeley DB (legacy wallet) loaded by node (RPC) : yes getwalletinfo parsed : yes encrypted : yes (unlocked_until / mkey) private_keys_enabled : True keypoolsize : 100 txcount : 106 HD seed present : no (hdseedid / dump hdseed=1) ckey marker (enc keys) : yes mkey marker (encryption): yes addressgroupings empty : no watch-only in balances : no private keys dumped : 0 addresses ismine : 13 addresses iswatchonly : 0 known scam markers : no (none) address reuse pattern : no file entropy : 7.404 bits/byte dust addresses verified : 1 (confirmed by 2 independent sources) REAL balance (explorer) : 11.26830369 BTC (across 2 addresses) VERDICT: [GOOD] Real ENCRYPTED wallet with keys (HTML verdict 1) The file contains private keys (or an encrypted HD seed) and is password-protected. Evidence: encrypted=yes; ckey=yes; HD seed=no; keys dumped=0; keypool=100. If you did not unlock it, the keys are present but locked. Brute-force / recovery: MAKES SENSE - Part IV: btcrecover (known pattern) or hashcat -m 11300 (hash via bitcoin2john.py). Real on-chain balance: 11.26830369 BTC (across 2 addresses, source: https://mempool.space/api/address/1NibfhHfgA857dtG6pB25Y5hDcxpDo2J47) ======================================================================== STOP bitcoind ======================================================================== Node stopped cleanly.