================================================================ WALLET CHECK REPORT Date: 07/13/2026 22:44:56 WARNING: this file may contain private keys - store it safely. ================================================================ Wallet: wallet_150,366.dat ======================================================================== 1. HASH OF ORIGINAL ======================================================================== FILE: wallet_150,366.dat CRC32: F92A91EE MD5: C92AA1992D07F6C7687C7FA3DD29887B SHA-1: D690EF610C6674A23092366D7E73065AAB39A666 SHA256: 278211CC2628EEBD5E73DE0ECE85507EEB9CAA6912793E99DE48AF9ABA56EBE8 ======================================================================== 2. OFFLINE TRIAGE ======================================================================== --- File format --- Size: 376832 bytes Detected: Berkeley DB magic -> LEGACY wallet (expected for 0.19). --- bitcoin-wallet info --- Wallet info =========== Encrypted: yes HD (hd seed available): no Keypool Size: 101 Transactions: 119 Address Book: 9 --- Marker scan (printable strings) --- Markers found: pool, name"1BSyoDHqgRsGUP4jP3wgju1kgzVrG2ZpV9, mkey, ckey!, pool6, pool5, pool4, pool3, pool2, pool1, pool0, pool/, pool., pool-, pool,, pool+, pool*, pool), pool(, pool' -> mkey present: wallet is most likely ENCRYPTED. -> ckey present: ENCRYPTED private keys exist. ======================================================================== 2b. FAKE / FABRICATED WALLET DETECTION (scam markers) ======================================================================== Reference guide - how to tell a fake wallet.dat from a genuine one: * HEX Editor Inspection: open the file in a HEX editor (e.g. HxD) and search for known scammer template strings. If present, the file is almost certainly a fabricated fake distributed by scammers. * Bitcoin Core Import Test: if the wallet only shows watch-only addresses with no actual private keys stored, it is non-functional. * Transaction History Match: compare the tx count / history against a public block explorer; any mismatch indicates a tampered file. * RPC command dumpprivkey
: code -4 Private key ... is unknown -> key missing, likely fake. code -13 wallet encrypted -> normal for a genuine vault. * Address/File Structure: legacy wallets hold multiple separate keys; HD (BIP32) wallets use an xpriv seed and the file size typically stays static as new addresses are derived. Watch out for known fake lists circulating online with repetitive addresses / passwords. Automated checks performed by this script: [!] Known scam marker string(s) found: xingfeng -> This file is almost certainly a FABRICATED FAKE. Whole-file Shannon entropy: 6.530 bits/byte (8.0 = maximal) [ok] No suspicious address-repetition pattern found. --- Real on-chain balance (block explorer lookup) --- Addresses found in wallet file: 10 Checking balances (this may take some time). Respectful delay applied to avoid API bans... [1/10] 1BSyoDHqgRsGUP4jP3wgju1kgzVrG2ZpV9 : 0.00000000 BTC (0 sat) [2/10] 3JWTcYp9TwSmCSrX83x2AgvPqz35VaNFmKG1 : 0.00000000 BTC (0 sat) [3/10] 1J2wEFH8jJELsfXsEeE15fkuP9ikzPMDMQ : 0.00001000 BTC (1000 sat) [4/10] 12xjVZS6oW8Sg9SWg4YgGLnVeZWH1s63R9R : 0.00000000 BTC (0 sat) [5/10] 1D5Nn8gx5kcPB8e7SCDvQLVxwkNaCcr2mxg : 0.00000000 BTC (0 sat) [6/10] 1KHesp8icfk5VmpHB1iicQj6HNffrCAc4p : 0.00000000 BTC (0 sat) [7/10] 12aVP18cd5XsbcGQy8u6eywQ6UuA6Q319s : 0.00015110 BTC (15110 sat) [8/10] 1FvzCLoTPGANNjWoUo6jUGuAG3wg1w4YjR : 0.00661035 BTC (661035 sat) [9/10] 1HLoD9E4SDFFPDiYfNYnkBLQ85Y51J3Zb1 : 0.07900714 BTC (7900714 sat) [10/10] 12c6DSiU4Rq3P4ZxziKxzrL5LmMBrzjrJX : 1.35266916 BTC (135266916 sat) -------------------------------------------------- TOTAL BALANCE: 1.43844775 BTC (143844775 sat) Source: https://mempool.space/api/address/12c6DSiU4Rq3P4ZxziKxzrL5LmMBrzjrJX ======================================================================== 3. START bitcoind ======================================================================== Args: -datadir=wallet_150,366.dat -noconnect=1 -dnsseed=0 -listen=0 -maxconnections=0 -server=1 -printtoconsole=0 Waiting for RPC (up to 90 s)... RPC is ready. ======================================================================== 4. getwalletinfo ======================================================================== { "walletname": "wallet_150,366.dat", "walletversion": 60000, "balance": 1.43844775, "unconfirmed_balance": 0.00000000, "immature_balance": 0.00000000, "txcount": 119, "keypoololdest": 1527749143, "keypoolsize": 101, "unlocked_until": 0, "paytxfee": 0.00000000, "private_keys_enabled": true, "avoid_reuse": false, "scanning": false } Parsed -> private_keys_enabled=True | keypoolsize=101 | txcount=119 | hdseedid=n/a ======================================================================== 5. WALLET IS ENCRYPTED - unlocking ======================================================================== No passphrase entered - private keys will not be dumped. (The verdict can still confirm the wallet TYPE without the password.) ======================================================================== 6. listaddressgroupings ======================================================================== [ { "value": [ [ "12aVP18cd5XsbcGQy8u6eywQ6UuA6Q319s", 0.0001511, "" ] ], "Count": 1 }, { "value": [ [ "12c6DSiU4Rq3P4ZxziKxzrL5LmMBrzjrJX", 1.35266916, "" ] ], "Count": 1 }, { "value": [ [ "1FvzCLoTPGANNjWoUo6jUGuAG3wg1w4YjR", 0.00661035, "" ] ], "Count": 1 }, { "value": [ [ "1HLoD9E4SDFFPDiYfNYnkBLQ85Y51J3Zb1", 0.07900714, "" ] ], "Count": 1 }, { "value": [ [ "1J2wEFH8jJELsfXsEeE15fkuP9ikzPMDMQ", 1E-05, "" ] ], "Count": 1 } ] ======================================================================== 7. getbalances ======================================================================== { "mine": { "trusted": 1.43844775, "untrusted_pending": 0.00000000, "immature": 0.00000000 } } ======================================================================== 8. getaddressesbylabel (default label) ======================================================================== bitcoin-cli.exe : error code: -1 At C:\DISCK-D\01-MY-PROGRAMS\01-BTC-Tools\02hashcat-7.1.2\01bitcoin-0.19.1-wallet-check\bin\wallet_check.ps1:179 char:12 + $out = & $cli @base @CmdArgs 2>&1 + ~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (error code: -1:String) [], RemoteException + FullyQualifiedErrorId : NativeCommandError error message: getaddressesbylabel "label" Returns the list of addresses assigned the specified label. Arguments: 1. label (string, required) The label. Result: { (json object with addresses as keys) "address": { (json object with information about address) "purpose": "string" (string) Purpose of address ("send" for sending address, "receive" for receiving address) },... } Examples: > bitcoin-cli getaddressesbylabel "tabby" > curl --user myusername --data-binary '{"jsonrpc": "1.0", "id":"curltest", "method": "getaddressesbylabel", "params": ["tabby"] }' -H 'content-type: text/plain;' http://127.0.0.1:8332/ ======================================================================== 9. dumpwallet ======================================================================== Skipped: wallet locked / no passphrase. ======================================================================== 10. getaddressinfo per address (ismine / iswatchonly / solvable) ======================================================================== Unique addresses found: 5 (checking up to 100) [12aVP18cd5XsbcGQy8u6eywQ6UuA6Q319s] { "address": "12aVP18cd5XsbcGQy8u6eywQ6UuA6Q319s", "scriptPubKey": "76a914114d8adb6cd97cffd742a87af8e07c6416b0412a88ac", "ismine": true, "solvable": true, "desc": "pkh([114d8adb]023b5dffe0c0a73f753e0e4cb37f5cae5231cfced5e87ae1904d54d3eee1b95b65)#z9ztznx2", "iswatchonly": false, "isscript": false, "iswitness": false, "pubkey": "023b5dffe0c0a73f753e0e4cb37f5cae5231cfced5e87ae1904d54d3eee1b95b65", "iscompressed": true, "label": "", "ischange": false, "labels": [ { "name": "", "purpose": "receive" } ] } [12c6DSiU4Rq3P4ZxziKxzrL5LmMBrzjrJX] { "address": "12c6DSiU4Rq3P4ZxziKxzrL5LmMBrzjrJX", "scriptPubKey": "76a914119b098e2e980a229e139a9ed01a469e518e6f2688ac", "ismine": true, "solvable": true, "desc": "pkh([119b098e]0496b538e853519c726a2c91e61ec11600ae1390813a627c66fb8be7947be63c52da7589379515d4e0a604f8141781e62294721166bf621e73a82cbf2342c858ee)#d7ru7g83", "iswatchonly": false, "isscript": false, "iswitness": false, "pubkey": "0496b538e853519c726a2c91e61ec11600ae1390813a627c66fb8be7947be63c52da7589379515d4e0a604f8141781e62294721166bf621e73a82cbf2342c858ee", "iscompressed": false, "label": "", "ischange": false, "labels": [ { "name": "", "purpose": "receive" } ] } [1FvzCLoTPGANNjWoUo6jUGuAG3wg1w4YjR] { "address": "1FvzCLoTPGANNjWoUo6jUGuAG3wg1w4YjR", "scriptPubKey": "76a914a3c78d275195f05766a9b497d7838b27bacac77588ac", "ismine": true, "solvable": true, "desc": "pkh([a3c78d27]0494b9d3e76c5b1629ecf97fff95d7a4bbdac87cc26099ada28066c6ff1eb9191223cd897194a08d0c2726c5747f1db49e8cf90e75dc3e3550ae9b30086f3cd5aa)#6qw3qla7", "iswatchonly": false, "isscript": false, "iswitness": false, "pubkey": "0494b9d3e76c5b1629ecf97fff95d7a4bbdac87cc26099ada28066c6ff1eb9191223cd897194a08d0c2726c5747f1db49e8cf90e75dc3e3550ae9b30086f3cd5aa", "iscompressed": false, "label": "", "ischange": false, "labels": [ { "name": "", "purpose": "receive" } ] } [1HLoD9E4SDFFPDiYfNYnkBLQ85Y51J3Zb1] { "address": "1HLoD9E4SDFFPDiYfNYnkBLQ85Y51J3Zb1", "scriptPubKey": "76a914b3407d4b4d1fca87fb930abe3fa6c2baed6e6fd888ac", "ismine": true, "solvable": true, "desc": "pkh([b3407d4b]047211a824f55b505228e4c3d5194c1fcfaa15a456abdf37f9b9d97a4040afc073dee6c89064984f03385237d92167c13e236446b417ab79a0fcae412ae3316b77)#duyulp23", "iswatchonly": false, "isscript": false, "iswitness": false, "pubkey": "047211a824f55b505228e4c3d5194c1fcfaa15a456abdf37f9b9d97a4040afc073dee6c89064984f03385237d92167c13e236446b417ab79a0fcae412ae3316b77", "iscompressed": false, "label": "", "ischange": false, "labels": [ { "name": "", "purpose": "receive" } ] } [1J2wEFH8jJELsfXsEeE15fkuP9ikzPMDMQ] { "address": "1J2wEFH8jJELsfXsEeE15fkuP9ikzPMDMQ", "scriptPubKey": "76a914bad7d265696307773267919d795d4794724d048d88ac", "ismine": true, "solvable": true, "desc": "pkh([bad7d265]04883f1977d7eaabb0c890bdbf5431492446bc15fba6f81f7fd432ad7e462ef99f804cc276272baeeb2e8130dbd75f698a266eee5f6266407d38dbbef119ef440b)#cyxltjns", "iswatchonly": false, "isscript": false, "iswitness": false, "pubkey": "04883f1977d7eaabb0c890bdbf5431492446bc15fba6f81f7fd432ad7e462ef99f804cc276272baeeb2e8130dbd75f698a266eee5f6266407d38dbbef119ef440b", "iscompressed": false, "label": "", "ischange": false, "timestamp": 1, "labels": [ { "name": "", "purpose": "receive" } ] } ======================================================================== 11. listdescriptors (descriptor wallets, Core 0.21+) ======================================================================== Not supported on this Core version (descriptors are a 0.21+ feature). Legacy equivalent already checked: HD seed via dumpwallet (hdseed=1) / hdseedid. ======================================================================== PART III - VERDICT (cross-checked, single result) ======================================================================== Re-checked signals (the evidence this verdict is based on): file format : Berkeley DB (legacy wallet) loaded by node (RPC) : yes getwalletinfo parsed : yes encrypted : yes (unlocked_until / mkey) private_keys_enabled : True keypoolsize : 101 txcount : 119 HD seed present : no (hdseedid / dump hdseed=1) ckey marker (enc keys) : yes mkey marker (encryption): yes addressgroupings empty : no watch-only in balances : no private keys dumped : 0 addresses ismine : 5 addresses iswatchonly : 0 known scam markers : yes (xingfeng) address reuse pattern : no file entropy : 6.530 bits/byte REAL balance (explorer) : 1.43844775 BTC (across 10 addresses) VERDICT: [BAD] FABRICATED FAKE WALLET (known scam marker found) Known scam-template string(s) found in the file: xingfeng. This matches the signature of fabricated wallet.dat files sold by scammers. Any keys/balances above should NOT be trusted; treat this file as fake. Brute-force / recovery: POINTLESS - the file is fabricated, do not attempt recovery on it. Real on-chain balance: 1.43844775 BTC (across 10 addresses, source: https://mempool.space/api/address/12c6DSiU4Rq3P4ZxziKxzrL5LmMBrzjrJX) ======================================================================== STOP bitcoind ======================================================================== Node stopped cleanly.