================================================================ WALLET CHECK REPORT Date: 07/14/2026 14:51:47 WARNING: this file may contain private keys - store it safely. ================================================================ Auto-detected wallet: wallet_75.dat Wallet: wallet_75.dat ======================================================================== 1. HASH OF ORIGINAL ======================================================================== FILE: wallet_75.dat CRC32: 4FD0CAA6 MD5: AFFB38F3B14A4C15259B1E0970125280 SHA-1: FEB311CCFFD1B5A6410E16879517C20CD634C7D8 SHA256: 5C8E5F61A71CC5FAE65E7BB16D49A93C55FFC643D6787AADD2A731CA3021BCDF ======================================================================== 2. OFFLINE TRIAGE ======================================================================== --- File format --- Size: 114688 bytes Detected: Berkeley DB magic -> LEGACY wallet (expected for 0.19). --- bitcoin-wallet info --- Wallet info =========== Encrypted: yes HD (hd seed available): no Keypool Size: 89 Transactions: 5 Address Book: 6 --- Marker scan (printable strings) --- Markers found: pool, name"1MaKJiu3cSzCq4BftqaZXYuaANar6KPjrT, name"1LFMckkgniDzGTZvq1JQBHZWtxQLd96jkd, name"1E7daPBJWdgrhrGBL6LBsyqeqaXjycunJW, name"19jbyzHUrUzwUfHzB9GtKUeRy3mrYvb6Pu, mkey, ckey!, pool0b, pool0, pool/, pool., pool-, pool,, pool+, pool*, pool), pool(, pool', pool&, pool% -> mkey present: wallet is most likely ENCRYPTED. -> ckey present: ENCRYPTED private keys exist. ======================================================================== 2b. FAKE / FABRICATED WALLET DETECTION (scam markers) ======================================================================== Reference guide - how to tell a fake wallet.dat from a genuine one: * HEX Editor Inspection: open the file in a HEX editor (e.g. HxD) and search for known scammer template strings. If present, the file is almost certainly a fabricated fake distributed by scammers. * Bitcoin Core Import Test: if the wallet only shows watch-only addresses with no actual private keys stored, it is non-functional. * Transaction History Match: compare the tx count / history against a public block explorer; any mismatch indicates a tampered file. * RPC command dumpprivkey
: code -4 Private key ... is unknown -> key missing, likely fake. code -13 wallet encrypted -> normal for a genuine vault. * Address/File Structure: legacy wallets hold multiple separate keys; HD (BIP32) wallets use an xpriv seed and the file size typically stays static as new addresses are derived. Watch out for known fake lists circulating online with repetitive addresses / passwords. Automated checks performed by this script: [ok] No known scam marker strings found in the file. Whole-file Shannon entropy: 6.055 bits/byte (8.0 = maximal) [!] Address reuse pattern detected (same address repeated many times): 12BycRrxPivnhnwfD5qfKaE7ccAc1qhrCb : 12x -> Consistent with batch-generated / templated fake wallet lists. --- Real on-chain balance (block explorer lookup with dual-source verification) --- Addresses found in wallet file: 6 Checking balances (this may take some time). Respectful delay applied to avoid API bans... Dust threshold: 100000 sat (0.001 BTC) - balances below this trigger secondary verification. [1/6] 1MaKJiu3cSzCq4BftqaZXYuaANar6KPjrT : 0.00000000 BTC (0 sat) [VERIFIED by 2 sources] [2/6] 1LFMckkgniDzGTZvq1JQBHZWtxQLd96jkd : 0.00000000 BTC (0 sat) [VERIFIED by 2 sources] [3/6] 1E7daPBJWdgrhrGBL6LBsyqeqaXjycunJW : 0.00000000 BTC (0 sat) [VERIFIED by 2 sources] [4/6] 19jbyzHUrUzwUfHzB9GtKUeRy3mrYvb6Pu : 0.00000000 BTC (0 sat) [VERIFIED by 2 sources] [5/6] 12BycRrxPivnhnwfD5qfKaE7ccAc1qhrCb : 0.00002642 BTC (2642 sat) [VERIFIED by 2 sources] [6/6] 1Afh86YLq9tZWGsQhmDvCoGE2QhwYXxmcY : 0.00011641 BTC (11641 sat) [VERIFIED by 2 sources] -------------------------------------------------- TOTAL BALANCE: 0.00014283 BTC (14283 sat) Source: https://mempool.space/api/address/1Afh86YLq9tZWGsQhmDvCoGE2QhwYXxmcY [ok] 6 dust address(es) cross-verified by 2 independent sources (mempool + blockchain.info). ======================================================================== 3. START bitcoind ======================================================================== Args: -datadir=wallet_75.dat -noconnect=1 -dnsseed=0 -listen=0 -maxconnections=0 -server=1 -printtoconsole=0 Waiting for RPC (up to 90 s)... RPC is ready. ======================================================================== 4. getwalletinfo ======================================================================== { "walletname": "wallet_75.dat", "walletversion": 60000, "balance": 0.00014283, "unconfirmed_balance": 0.00000000, "immature_balance": 0.00000000, "txcount": 5, "keypoololdest": 1516435187, "keypoolsize": 89, "unlocked_until": 0, "paytxfee": 0.00000000, "private_keys_enabled": true, "avoid_reuse": false, "scanning": false } Parsed -> private_keys_enabled=True | keypoolsize=89 | txcount=5 | hdseedid=n/a ======================================================================== 5. WALLET IS ENCRYPTED - unlocking ======================================================================== No passphrase entered - private keys will not be dumped. (The verdict can still confirm the wallet TYPE without the password.) ======================================================================== 6. listaddressgroupings ======================================================================== [ { "value": [ [ "12BycRrxPivnhnwfD5qfKaE7ccAc1qhrCb", 2.642E-05, "" ] ], "Count": 1 }, { "value": [ [ "1Afh86YLq9tZWGsQhmDvCoGE2QhwYXxmcY", 0.00011641, "" ] ], "Count": 1 }, { "value": [ [ "3GrtuWYrA56irW7mu1p1uhaiY5i9BXfiR8", 0.00000000 ] ], "Count": 1 } ] ======================================================================== 7. getbalances ======================================================================== { "mine": { "trusted": 0.00014283, "untrusted_pending": 0.00000000, "immature": 0.00000000 } } ======================================================================== 8. getaddressesbylabel (default label) ======================================================================== bitcoin-cli.exe : error code: -1 At C:\DISCK-D\01-MY-PROGRAMS\01-BTC-Tools\02hashcat-7.1.2\01bitcoin-0.19.1-wallet-check\bin\wallet_check.ps1:186 char:12 + $out = & $cli @base @CmdArgs 2>&1 + ~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (error code: -1:String) [], RemoteException + FullyQualifiedErrorId : NativeCommandError error message: getaddressesbylabel "label" Returns the list of addresses assigned the specified label. Arguments: 1. label (string, required) The label. Result: { (json object with addresses as keys) "address": { (json object with information about address) "purpose": "string" (string) Purpose of address ("send" for sending address, "receive" for receiving address) },... } Examples: > bitcoin-cli getaddressesbylabel "tabby" > curl --user myusername --data-binary '{"jsonrpc": "1.0", "id":"curltest", "method": "getaddressesbylabel", "params": ["tabby"] }' -H 'content-type: text/plain;' http://127.0.0.1:8332/ ======================================================================== 9. dumpwallet ======================================================================== Skipped: wallet locked / no passphrase. ======================================================================== 10. getaddressinfo per address (ismine / iswatchonly / solvable) ======================================================================== Unique addresses found: 3 (checking up to 100) [12BycRrxPivnhnwfD5qfKaE7ccAc1qhrCb] { "address": "12BycRrxPivnhnwfD5qfKaE7ccAc1qhrCb", "scriptPubKey": "76a9140d0b8ab02072c52d74c19ecd768e1deaaa9542ff88ac", "ismine": true, "solvable": true, "desc": "pkh([0d0b8ab0]02564b4009d999ac771aa18e566b33cbfff81f6980a5a757a152f45afdef554886)#z8dlrgks", "iswatchonly": false, "isscript": false, "iswitness": false, "pubkey": "02564b4009d999ac771aa18e566b33cbfff81f6980a5a757a152f45afdef554886", "iscompressed": true, "label": "", "ischange": false, "labels": [ { "name": "", "purpose": "unknown" } ] } [1Afh86YLq9tZWGsQhmDvCoGE2QhwYXxmcY] { "address": "1Afh86YLq9tZWGsQhmDvCoGE2QhwYXxmcY", "scriptPubKey": "76a9146a0a6e58c393b92b57331a1c33d729451e0eda2488ac", "ismine": true, "solvable": true, "desc": "pkh([6a0a6e58]04ed64f5d3b2f9ecbcd7c2566a2aaae329a23d24d23f3c6253ca3caa14d02224f24190492e3fc8bde6031178af04a926cc669fb6ce6ee839a5d6523fdd1f664800)#p4y0s9hf", "iswatchonly": false, "isscript": false, "iswitness": false, "pubkey": "04ed64f5d3b2f9ecbcd7c2566a2aaae329a23d24d23f3c6253ca3caa14d02224f24190492e3fc8bde6031178af04a926cc669fb6ce6ee839a5d6523fdd1f664800", "iscompressed": false, "label": "", "ischange": false, "labels": [ { "name": "", "purpose": "unknown" } ] } [3GrtuWYrA56irW7mu1p1uhaiY5i9BXfiR8] { "address": "3GrtuWYrA56irW7mu1p1uhaiY5i9BXfiR8", "scriptPubKey": "a914a668302d87adc22c7b818016865bc229c04f4ec387", "ismine": true, "solvable": true, "desc": "sh(wpkh([acf78e47]036df58bc982b4b8be1407388dca8de7356225c0591f68b6f07d56d89b9eca372a))#krhuvtru", "iswatchonly": false, "isscript": true, "iswitness": false, "script": "witness_v0_keyhash", "hex": "0014acf78e4755551f3268c8ffbfa3174595dc7ab835", "pubkey": "036df58bc982b4b8be1407388dca8de7356225c0591f68b6f07d56d89b9eca372a", "embedded": { "isscript": false, "iswitness": true, "witness_version": 0, "witness_program": "acf78e4755551f3268c8ffbfa3174595dc7ab835", "pubkey": "036df58bc982b4b8be1407388dca8de7356225c0591f68b6f07d56d89b9eca372a", "address": "bc1q4nmcu364250ny6xgl7l6x969jhw84wp4nlygza", "scriptPubKey": "0014acf78e4755551f3268c8ffbfa3174595dc7ab835" }, "ischange": true, "labels": [ ] } ======================================================================== 11. listdescriptors (descriptor wallets, Core 0.21+) ======================================================================== Not supported on this Core version (descriptors are a 0.21+ feature). Legacy equivalent already checked: HD seed via dumpwallet (hdseed=1) / hdseedid. ======================================================================== PART III - VERDICT (cross-checked, single result) ======================================================================== Re-checked signals (the evidence this verdict is based on): file format : Berkeley DB (legacy wallet) loaded by node (RPC) : yes getwalletinfo parsed : yes encrypted : yes (unlocked_until / mkey) private_keys_enabled : True keypoolsize : 89 txcount : 5 HD seed present : no (hdseedid / dump hdseed=1) ckey marker (enc keys) : yes mkey marker (encryption): yes addressgroupings empty : no watch-only in balances : no private keys dumped : 0 addresses ismine : 3 addresses iswatchonly : 0 known scam markers : no (none) address reuse pattern : yes file entropy : 6.055 bits/byte dust addresses verified : 6 (confirmed by 2 independent sources) REAL balance (explorer) : 0.00014283 BTC (across 6 addresses) VERDICT: [BAD] templated fake wallet lists / FABRICATED FAKE Automated fake/fabricated wallet detection triggered a red flag: - Address reuse pattern detected (consistent with batch-generated / templated fake wallet lists). Evidence of keys/encryption is irrelevant if the file is templated or fabricated. Any keys/balances should NOT be trusted; treat this file as fake. Brute-force / recovery: POINTLESS - the file is fabricated or templated, do not attempt recovery on it. Real on-chain balance: 0.00014283 BTC (across 6 addresses, source: https://mempool.space/api/address/1Afh86YLq9tZWGsQhmDvCoGE2QhwYXxmcY) ======================================================================== STOP bitcoind ======================================================================== Node stopped cleanly. ========================================================================