Unexplained spend from Wasabi wallet on Dec 18, 2025

[ArneRantzen]

I am trying to understand an unexplained transaction that occurred in Wasabi Wallet.

Timeline:

• Dec 18, 2025
• Transaction 552d46c995c5daa2ab552cb5dd1c38947aeb9388a9373cd187ebe6eae851ae14 arrived in my Wasabi wallet from Bisq.
• The receiving address was:
  bc1qgf5fj6ftagrdu29wrm1dms37teu097w1wvutk8

What I observed:

• I saw the coins arrive in Wasabi.
• I did not initiate a send.
• I did not enter a password.
• I did not see a confirmation dialog.
• While watching the wallet, I saw the displayed amount gradually decrease until it reached zero.
• The decrease was not at a constant rate. Sometimes it moved slowly and sometimes faster.
• This happened while I was watching the wallet.
• Later I experienced repeated Wasabi crashes and instability.

About 13 minutes later, transaction:

7ad4545d1020bcf089ae0c7dc4e701116dee050aadfb36d2a30f43cb0c69213d

spent the coins and sent them to:

bc1qeryq05pplmex5wug0lyznklwxu6pa630qfh5hc

Additional findings:

• One backup wallet file from Jan 2, 2026 contained:
  AutoCoinJoin = true
  Label = "After CoinJoin"

• I have searched my remaining Wasabi, Sparrow and Electrum files extensively and have not been able to determine why transaction 7ad454 was created.

My question:

Can anyone identify a Wasabi process, CoinJoin behavior, bug, wallet state transition, or known issue that could explain this sequence of events and the creation of transaction 7ad454 without a normal send confirmation workflow?

Thank you.

[ArneRantzen]

Thank you for your response.

My question was not whether Wasabi is generally secure.

I am trying to understand a specific historical event.

Could someone please comment on the following facts:

• Transaction 552d46 arrived in my Wasabi wallet.
• Approximately 13 minutes later transaction 7ad454 spent those coins.
• I did not initiate a send.
• I did not receive a confirmation prompt.
• I observed the displayed amount decreasing while watching the wallet.
• A backup wallet file from Jan 2, 2026 contains AutoCoinJoin=true and a label "After CoinJoin".

Can a Wasabi process, CoinJoin workflow, wallet state transition, or known issue explain the creation of transaction 7ad454?

I am seeking a technical explanation of the transaction behavior rather than a general statement about wallet security.

Thank you.

[ArneRantzen]

Thank you for your response.

My question was not whether Wasabi is generally secure.

I am trying to understand a specific historical event.

Could someone please comment on the following facts:

• Transaction 552d46 arrived in my Wasabi wallet.
• Approximately 13 minutes later transaction 7ad454 spent those coins.
• I did not initiate a send.
• I did not receive a confirmation prompt.
• I observed the displayed amount decreasing while watching the wallet.
• A backup wallet file from Jan 2, 2026 contains AutoCoinJoin=true and a label "After CoinJoin".

Can a Wasabi process, CoinJoin workflow, wallet state transition, or known issue explain the creation of transaction 7ad454?

I am seeking a technical explanation of the transaction behavior rather than a general statement about wallet security.

Thank you.

[Kruwed]

7ad4545d1020bcf089ae0c7dc4e701116dee050aadfb36d2a30f43cb0c69213d is not a coinjoin transaction, it's a regular spend. The recipient address has been reused for 31 transactions, and was active 3 weeks ago.

What version of Wasabi were you using on December 18th? The transaction that spent your coins used BIP125 signalling. Versions after v2.7.0 (released August 30th) no longer use this fingerprint, so the tx must have been sent from some other software.

[ArneRantzen]

One additional observation:

We have data up to transaction 7ad454 and can identify the receiving address:

bc1qeryq05pplmex5wug0lyznklwxu6pa630qfh5hc

After that point, we lost the trace except for the receiving address itself and its continued activity, but without me being able to access the new address content.

On Dec. 18, I saw the coins leaving my transaction screen 13 min. after it arrived, gradually over 1 min. in a gradually decreasing way, like a stop watch count down.

The receiving address remained active and was involved in approximately 31 transactions. Rather than the funds being moved once and disappearing, portions of the funds were repeatedly spent and later returned, typically reduced by transaction fees. This pattern continued over many months, with activity still occurring about three weeks ago.

Does this pattern provide any indication whether the destination was likely associated with a wallet service, exchange infrastructure, CoinJoin-related system, payment processor, some other type of managed wallet or a bug of some sort?

I am asking because this behavior appears different from a simple one-time transfer to a single personal wallet.
I wonder how I lost control over my coins.
I am sure that no one was around me at that time to have access to my seeds, except maybe being hacked, but I don't think so.
Also my Wasabi crashed a few times after this spending

Thank you.

[Kruwed]

On Dec. 18, I saw the coins leaving my transaction screen 13 min. after it arrived, gradually over 1 min. in a gradually decreasing way, like a stop watch count down.

This behavior could be explained by RBF (Replace By Fee). While the transaction is unconfirmed, the spender can create a new version of a transaction spending the same coins with a higher fee rate. Since the coins are being double spent, the higher fee transaction replaces the lower fee one. The transaction used a fee rate of 4 sat/vbyte, so it could have been replaced a few times (e.g., from 1 sat/vbyte -> 2 -> 3 -> 4).

[ArneRantzen]

Thank you.

I understand how RBF could explain multiple updates to a transaction once a spend had already been created.

My question is what could have caused the spend to start in the first place.

Approximately 13 minutes after the coins arrived, the entire balance began leaving the wallet. While watching Wasabi, I saw the displayed amount decrease over about a minute until the balance was gone.

In addition, Wasabi experienced several crashes after this event.

Do the blockchain evidence, the spending pattern, or the later crashes suggest any explanation for how the original spend transaction was initiated?

Thank you.

[Kruwed]

My question is what could have caused the spend to start in the first place.

Someone stole the coins. Crashes are unrelated to this.

[ArneRantzen]

Thank you.

I understand your conclusion that the blockchain shows what appears to be a normal spend.

However, I am still struggling to reconcile that with what I personally observed.

I watched the coins arrive in Wasabi. Approximately 13 minutes later, while Wasabi was open, I watched the displayed balance decrease over about a minute until the entire amount was gone. It was not removed with one action. It gradually decreased over 1 minute of time, so I did not witness a 1 transaction. I did not initiate a send, receive a confirmation prompt, or enter a password.

In addition, Wasabi experienced several crashes after this event.

I understand that the blockchain itself cannot prove a software issue.

My question is simply this:

Is there any known Wasabi bug, wallet-state corruption, synchronization issue, transaction-construction issue, or other software malfunction that could cause a wallet to create and broadcast a spend without the user intentionally initiating it?

I am not asking whether you think that happened in my case. I am asking whether such a failure mode is known to have ever existed in Wasabi.

Thank you.

[lontivero]

My question is simply this:

Is there any known Wasabi bug, wallet-state corruption, synchronization issue, transaction-construction issue, or other software malfunction that could cause a wallet to create and broadcast a spend without the user intentionally initiating it?

No.