text:
Who's exploiting Merkle Root?
What kind of software is going to use a merkle root to know if a transaction is in a block ? I know Thin nodes are doing this but this is a little bit useless since major branches are required.
Why don't just do a SHA256(SHA256(...ALL TXs IN A COMPACT WAY...)) nowadays ?

Why don't just do a SHA256(SHA256(...ALL TXs IN A COMPACT WAY...)) nowadays ?

Even if the premise of your question (that using the Merkle structure is useless) is true, this isn't something that can just be changed.
Changing how block headers commit to transaction data would be a very invasive change, which would be a hard fork, but would also just break literally every piece of Bitcoin software ever written. Unless not changing this means a near-fatal bug for Bitcoin, this isn't even worth discussing.
This isn't even that. Concatenating the hashes instead of using a Merkle tree is maybe a few milliseconds speedup per block, on weak hardware.

I know Thin nodes are doing this

Yes.

but this is a little bit useless since major branches are required.

I have no idea what this means.

Moreover, all wallets that use the Electrum protocol fetch a Merkle Tree to make sure a transaction is indeed confirmed. It's definitely not useless.

"which would be a hard fork":
Agreed.
"but this is a little bit useless since major branches are required.":
I was refering to the merkle proof.

"Concatenating the hashes [...] is maybe a few milliseconds speedup per block, on weak hardware."
This seems incorrect: with an optimized program using SHA256double on ONE core of Intel(R) Core(TM) i9-10900K, you can perform ~1,500,000 HASH/sec. Blocks contain now ~3500 TXs. So if you want to download ~200 blocks/sec, you will have to perform ~2,000,000 HASH/sec. I just want to show you that the limit can be reached easily. With concatenation you'll just have to do 3500 * 200 + 1 = ~700,001 HASH.

I don't follow your math. Mine is: concatenating is 32 bytes per txid; the current Merkle root structure is (after padding, and accounting for double hash) around 192 bytes per txid. At 3500 transactions, that's 3500*(192-32)=560000 bytes. Unoptimized SHA256 implementations on x86 need around 15 CPU cycles per byte, or 8.4M cycles, which is a few ms at modern CPU speeds. Hardware-accelerated SHA256 is an order of magnitude faster than that even.

Just see here: https://pastebin.com/rPyxxeDm. with 1.5 * 10^6 HASHs (double-SHA256) / second.

Yes, I agree with the roughly 4x faster for the Merkle root checking vs. concatenation (I get 5x faster, even), but that still shouldn't be more than a few milliseconds per block.


text:
Does Electrum store my seed in their server?
I am new to Bitcoin. I used Electrum software to create my first wallet. When the software generated 12 words, I had written down that in paper. These word are very important, right? But the software can see these words and stores them somewhere in their server. So how do I know that they don't use my wallet because they have my seed? Sorry if it's a dumb question.

Electrum does not store your seed, the server is run by volunteers, and you can run your own if you wish.
You needn't take my word for it: Both Electrum and electrumx are open source, and you can verify the functionality, and build a version from code you have verified.

So I trust Electrum because it is run by volunteers and open source. But there are many others sofftware and apps in Google store claim that they are bitcoin wallet softwares. If I try using those other apps and provide my seed to those. How can I know that these apps won't store my seed somewhere else like Electrum?

You don't, unless they are open source, and you have reviewed the source, and compiled the app yourself from source you had reviewed to verify the binary matches the one being offered on Google Play or the app store.

source: Stack Exchange

license: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/4.0/

sort: votes


text:
I just buy some bitcoin and this is how I see from Electrum, what should I do now to receive the bitcoin?
The first time I receive bitcoin, should I wait until it's confirmed

You don't have do anything. That transaction will confirm in due course of time. You don't have to keep electrum or even your PC running.
On average it takes 10 minutes for the first confirmation. More confirmations happen all the time as the blockchain gets extended.
Note that you bought 0.001 bitcoins. The unit of account displayed there is mbtc which is 1/1000th of a bitcoin. If you want to change it to btc you can do so via tools > preferences > appearance tab > base unit option.

all_licenses: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/4.0/


text:
Deriving Child from Public Key
I'm reading Andreas Antonopuolus's "Mastering Bitcoin" and I have some confusions regarding the derivation of child keys.
This picture is showing how private child keys are derived.
https://github.com/bitcoinbook/bitcoinbook/blob/develop/images/mbc2_0510.png
It all makes sense to me except for the fact that the parent private key points directly to the child private key. However the left side of the HMAC-SHA512 already provides the full 256 bits for the private key. How is the parent private key directly involved in creating the child private key?
I guess it also has to be directly involved, otherwise it would be possible to generate all the child private keys only with the Public Extended Key.
According to the book public Extended keys can only be used to generate the public keys of children.
https://github.com/bitcoinbook/bitcoinbook/blob/develop/images/mbc2_0511.png
In this image it seems more obvious that the Parent Public Key influences the Child Public key directly, not only because of the arrow pointing, but also as the left side of the HMAC-SHA512 function only provides 256 of the 264 bits, but unfortunately I cannot find any details of that interaction.
I would be happy if anyone can share some knowledge about the details of that interaction.
Thanks in advance and all the best :)

The original doc might help.


text:
I am just wondering what are the methods which can hide all the transactions and also able to validate transactions in an block chain?
I am new to block chain and was looking at how block chain work mainly proof of stake based . They check validity by going through all the transactions which is something concerning as everyone can see the transactions. So what are ways to hide all transactions and also make everyone able to check validity of new block.
This question is not only for block chain relm but also for cryptography.

Generally, what you want to hide is the correspondence between outputs and inputs. So, for example, say you send me one unit of currency and then I send one unit of currency to someone else. What we don't need to hide:

You had one unit of currency to send.
You wanted to send that one unit of currency somewhere.
You no longer have the one unit of currency you had in step 1.
I had one unit of currency.
I want to send that one unit of currency somewhere.
My transfer of one unit of currency will prevent me from sending one unit of currency that I could previous send.

What we don't want to reveal:

The one unit of currency that I transferred is the same unit of currency that you transferred.

There are various cryptographic techniques that can be used to reveal the six things we do need to reveal without revealing the one thing we don't want to reveal. Zcash, for example, does this by having a person prove that they rendered unusable one output that they previously could have used without revealing which output they've rendered unusable. So if you send me one unit of zcash and I send one unit of zcash somewhere, it is not possible to connect the unit you send me with the unit I sent. All you know is that I previously had one unit of zcash I could send and now I do not, but it can be any unit of zcash send previously.

So what are ways to hide all transactions

In the blockchain used by Bitcoin it is not ever possible to hide transaction details because the integrity of the whole system depends on those being public.
However the sensitive parts of those details are mostly Bitcoin-addresses and amounts. There is a privacy issue if observers can infer information by comparing use of the same address across multiple transactions.
This is why Bitcoin (for example) is often described as not anonymous but as psedonymous. You can't see people's names in transaction data but you can see the Bitcoin-addresses.
Generally people hide their identity by

never re-using Bitcoin-addresses and by
using coin tumblers.

This makes it very very difficult for third-party observers to associate a transaction with a specific person.


text:
Is hashing an optional step to use with public key cryptography for blockchain
I am confused by the public key cryptography versions that I've read so far. Are the steps optional, dependable on the types of blockchain or they are referring to different methods?
Version 1 =========
Alice to Bob
Step 1. Content > Hash > Digest > Encrypt with Alice's private key > Digital Signature
Step 2. Digital Signature > Encrypt with Alice's private key + Bob's public key > Digest
Step 3. Send digest to Bob
In the above steps, Alice uses private key TWICE. First to encrypt the content's digest. Second time encrypt together with Bob's public key.
Is hashing optional?
Is the hash generated automatically once it is encrypted with Alice's private key?
Or encrypting with Alice's private key step is optional?
Is step 2 optional too? or are all the above steps automated?
Bob received
Step 1. Digest > Alice's public key > Content
Step 2. Digest > Bob's private key > Content
=
=
Version 2 =========
Alice to Bob
Step1. Alice generates the keys pair
Step2. Alice gives Bob her public key
Step3. Alice encrypts content with her own private key
In the above steps, Alice didn't hash the content first.
Bob received
Step1. Bob decrypts with Alice's public key
What if someone else has Alice's public key, aren't they able to decrypt it too?
=
=
Version 3 =========
Alice to Bob
Step1. Alice encrypts with Bob's public key
Bob received
Step1. Bob decrypts with his own private key
=
=

Questions like this cannot be answered without specifying the digital signature scheme you're using.
In general
In general, a digital signature scheme consists of 3 algorithms:

KeyGen() -> (PrivKey, PubKey): generates a private key and a corresponding public key.
Sign(PrivKey,Message) -> Signature: signs a message with a given private key.
Verify(PubKey,Message,Signature) -> Bool: verifies a signature against a public key and a message.

What the data types involved are depends on the specific scheme.
ECDSA
In ECDSA, the digital signature scheme used in Bitcoin, the private key is a number, the public key is a point on an elliptic curve, the message is a byte array, and the signature is a pair of two numbers.
ECDSA does require a hashing step. In fact, without the hashing step, it is completely broken.
However, nowhere is there any encryption involved. There is simply a signing algorithm, and a verifying algorithm.
RSA
The mistake you're making, calling signing "encrypting with the private key" is a very common one, because it is often how digital signature schemes are explained.
It is true for some specific signature schemes, but not all. Most notably it is true for RSA. The private and public keys are interchangeable there, so indeed, by swapping them, the encryption scheme turns into a signature scheme.

Pieter. Thanks. I am confused. After reading so many articles on blockchain uses public key cryptography. I have assumed all data on Blockchain are encrypted. Or blockchain will, by default, encrypts all data. Since encrypting is not part of the ECDSA, that means nothing is encrypted on Bitcoin? Is the hashing step an automated process triggered by the signing of private key?

There is no encryption anywhere in the blockchain. That's not possible, since all data must be public. If data on the chain was encrypted, it wouldn't be possible to verify by everyone (which is the whole point, auditability).

Both the signing operation and the verifying operation include a hash in ECDSA.

I think I have to relearn most of the things I have been reading on blockchain. Most of the references I came across online referred to the keys to encrypt and decrypt data on blockchain. Do you happen to have some references that can help with understanding on how blockchain handles data?

One piece of advice: ignore any writing that talks about "blockchain is X". Blockchain is a buzz word that may mean anything from "a database with hashes" to "a cryptocurrency whose security derives from economic incentives" to "adding some cryptography to business logic". Actually well-engineered systems often have no relation to the hype around blockchains.


text:
data confidentiality on blockchain
How does blockchain promise data confidentiality when the data is not encrypted?
Or data confidentiality is not part of blockchain feature?

The traditional answer for Bitcoin to this question is "pseudonymity, not anonymity".
All the data published on the blockchain is necessary for the world to validate that transactions are valid, no theft occurs, no money is being printed, ... but not more. In particular, there are no identities on the chain, and reuse of (otherwise visible) addresses is discouraged.
Of course, this is a very brittle and delicate balance. It turns out that it is in fact very hard to publish enough to let the world validate, but simultaneously not reveal enough to leak substantial portions of information.
Systems like Monero and Zcash go a step further. They "encrypt" certain portions of the transaction data, but include a complicated mathematical proof that the encrypted data is still valid. This lets them hide amounts, and the links between transactions. However, such techniques come with their own tradeoffs in performance, bandwidth, and scalability in general.

Most blockchains do not promise confidentiality.
Those that do usually employ some form of zero knowledge or encryption, such as with ZCash. The exact specifics of the implementation will vary wildly case by case.


text:
Is blockchain the only technology for p2p decentralised global network?
Are there any p2p decentralised cross border network structure out there?

One may also note that Blockchain is not a P2P technology per se, but rather just a  data-structure designed to reach global consensus provided with transactions acquired from a P2P network. Validation rules which govern the updates to this data-structure are consensus rules.
The actual Bitcoin P2P layer is similar to other P2P protocols(Gnutella, IPFS etc.), and is a messaging protocol designed to acquire and propagate public data with peers. Theoretically, a validating Bitcoin full-node may acquire its transaction/block updates from another channel/P2P protocol and still be in consensus.

There are many p2p application. One prominent one is Bittorrent (https://en.m.wikipedia.org/wiki/BitTorrent) which allows users to store, distribute and download files from peers. Bittorrent at some point made up more than half of the internet‘s traffic.
Skype also used to be a P2P application but has since switched to a server based model.


text:
Why would running a light node riskier and subject to more frauds than a full node? We don't NEED a full ledger, do we?
I've been reading on light node and many have pointed out that the light node doesn't have the full blockchain and is riskier because they can't verify the transactions fully.
First, we can verify or validate the transaction on the website. I don't understand why do we need a full blockchain if we are not mining.
Second, doesn't miner verify the transactions before including into the block? In addition to that, the process of validating the block served like a double validation?
Third, when the block is added to the network, isn't it a third validation?
Forth, when the block has several more confirmations, isn't that a forth validation?
In this case, why do we need a full ledger? After a certain time lapse, many of the preceding blocks are seem redundant.
A light node, although doesn't have the full ledger since the genesis block, keeps a section of the most recent blocks, isn't that sufficient?
Why would a light node be riskier? Realistically, what are the chances of receiving incomplete or invalid blocks?

I am not implying full node is not necessary. I am wondering why is it riskier as a light node and the need of having a full ledger if you are not mining. Shouldn't the validation protocols sufficient to prevent fraudulent transactions? The full ledger is only an additional/optional step and without that will not actually make you riskier than a full node.

First, we can verify or validate the transaction on the website. I don't understand why do we need a full blockchain if we are not mining.

What website? There's no website that defines the blockchain. All blockchain explorers just show the information. If you are relying on a website to check that your transaction is valid, then that is a central point of failure. What if whatever website you are using mistakenly says an invalid transaction is valid? Do you just blindly trust the website? This has happened many times in the past, especially with blockchain.info.
The whole point of the blockchain is to remove central points of failure and to remove trust in third parties. Relying on a website to tell you what is correct defeats that purpose.

Second, doesn't miner verify the transactions before including into the block? In addition to that, the process of validating the block served like a double validation?

Miners are supposed to verify transactions before including them in a block. Just because they are supposed to verify does not mean that they actually do. Just accepting a transaction that has been included in a block does not guarantee that the transaction is valid. What if a miner included an invalid transaction?
Again, the point of a blockchain is to remove trust in third parties. By trusting miners to have validated transactions, you are trusting a third party. Verifying a block after you receive it from someone else removes that trust in a third party because you yourself has checked that the block is valid.

Third, when the block is added to the network, isn't it a third validation?
Forth, when the block has several more confirmations, isn't that a forth validation?

Kind of (to both). But again, you yourself are not verifying the blocks if you are not running a node. You are trusting that someone else has verified the blocks. That is trust in a third party, which is what the blockchain is designed to avoid.

A light node, although doesn't have the full ledger since the genesis block, keeps a section of the most recent blocks, isn't that sufficient?
Why would a light node be riskier?

No. If I had sufficient hash rate, I could produce a block that has an invalid transaction and send it directly to your light node. This block with the invalid transaction that spends a nonexistent input and could be something that defrauds you. If you have not verified the entire blockchain and constructed the UTXO set, then you do not know that the transaction is invalid because it spends an nonexistent input. You cannot verify this for yourself. You are trusting a miner that the transactions is valid. This is riskier because you could inadvertently accept an invalid transaction and thus lose money.

Realistically, what are the chances of receiving incomplete or invalid blocks?

Pretty low. But the whole point of the blockchain is to remove centralization and trust in third parties. By using a light node, you are now trusting third parties and this increases your risk for being defrauded.

I understand your point on 'trust' and eliminate 'intermediary' but realistically, isn't that duplicating effort and a waste of resources?

@Samantha yes, it is a duplicate effort relative to a centralized system where you just trust the central third party to behave honestly (eg Paypal), but I wouldn't say it is therefore wasteful - it just uses more resources in order to achieve a different goal. Building a networked system of value where you don't have to trust a third party is non-trivial, and the solution provided by Bitcoin allows users to independently validate the state of the network. As a user, you can trust someone else to do this validation for you, or you can do it yourself.

I understand this is based on the concept of blockchain. Let's not take into consideration to trust or not to trust. Technically, based on the validation protocols, is there a need to use the full ledger to validate?

Also, don't forget that the reason you can trust miners (by using light clients) is because they have an incentive to validate transactions before including them in a block. The reason that they have that incentive is because people (but perhaps not you) do run full nodes and would reject their blocks. While you, personally, may not actually have much reason to run a full node, the ecosystem as a whole very much does.

@PieterWuille I was thinking along this line too. From what I read, I am fairly new to this, the protocols are sufficient to prevent fraudulent transactions and that is the whole point of these protocols. The full ledger is only an additional/optional step, it is not a needed step.

It is certainly not a needed step for everyone. But it is absolutely essential that enough parties do, otherwise the protections for everyone disappear.

These comments need to be wrapped up into an answer - either into Andrew's or as a new one.


text:
Why can't an ISP ban access to a blockchain network?
I read that blockchain sits on top of the internet and is decentralised. We still have to access the blockchain network via an ISP. Without ISP, we can't access the internet so why can't an ISP block access to a blockchain network completely?
Many has talked about p2p but without ISP, how can we connect to other nodes? Isn't it an easy feat for an ISP to block blockchain?

Thanks for the reference link. However, that was in 2013 and now is the end of 2018. Is the answer still applicable?

Luckily not much of the P2P protocol has been changed in regards to it. The default ports are still the same, and Tor can still be used as an alternative. This thread also has some related information.


text:
Is BitCoin controlled by China?
Recently, the CEO of Ripple stated that more than 50% of the BitCoin miners are in China, therefore, were the Chinese
government to interfere, they could control BitCoin (I assume via a 51% attack, I didn't check details).
"“I’ll tell you another story that is underreported, but worth paying attention to. Bitcoin is really controlled by China. There are four miners in China that control over 50% of Bitcoin,”"
Is it true that 4 Chinese miners can control all of BitCoin?

ViaBTC, a mining pool that favors Unlimited, tweeted “hashpower is law”.
Greg Maxwell (from the Core side) replied “Bitcoin’s security works precisely because hash power is NOT law”.
Introduction
There are lots of people scared of the 51% attack, but in practice, thanks to some changes that have been implanted for years, performing this attack would be harmful to the attacker (in a game theory sense they lose), and not that much to the cryptocurrency user.
How 51% used to be a problem
The main danger that the 51% attack used to face was consistent mining by the 51%. Since everyone takes the longest chain as ground truth, the 51% could mine by itself and not publish any blocks, wait for their chain to be longer, and publish all the blocks, selecting all the transactions inside, and getting all the block rewards.
What if they try
Let's say some team of miners buy all the equipment and accomplishs to have more than 50% of the hashpower in a network, what can they do?
They could in theory perform the attack for a while, and they would get the rewards for mining, effectively fucking over the other miners.
What about the cryptocurrency users? the most damage they could do is to censor transactions for a while, but not consistently, since as soon as one of the other miners can at some point publish a block they could include the transaction.
Can miners change the rules of the game?
No, not even if they have 100% of the hashing power. Client-side validation means that many attempts at mischief that the miner might want to engage in are by default rejected, this is the main difference between blockchains and services like Paypal.
What happens to the attackers
It's important to note that this attack would be fairly easy to detect, not only that, but there are people that base their living on mining, so we would hear about it pretty quickly.
As soon as this happens, users could decide to change move their assets, kick off malicious miners, even modify the protocol (the latter one would be the hardest). This would also cause FUD and the price would drop, making the miners, specially the malicious ones to lose money.
Conclusions
A 51% attack takes much more than a 51% of the network to execute nowadays, they barely hurt the end users (delay transactions), it would be easily detected,and it would hurt (economically) malicious miners the most.
Source miners power: https://vitalik.ca/general/2017/05/08/coordination_problems.html

Great answer, but could you explain this a little more please? Client-side validation means that many attempts at mischief that the miner might want to engage in are by default rejected, this is the main difference between blockchains and services like Paypal.

Bitcoin has a set of rules, every node checks that the blocks meet those rules, if any node changes the rules and starts behaving differently, they are essentially creating a different blockchain with a different set of rules.
For example, business that are running a regular non mining node, or the node that you could be running in your house will reject all their blocks.
Therefore if they change the rules they are effectively kicking themselves out of the network.
On the other hand, Paypal or Ripple could change the rules and you cannot do anything about it.

To be fair, miners could implement themselves a soft-fork unilaterally (This has never happened and it would be an outrage) and restrict the rules, but never to expand or add them.

You mention "kicking off" malicious miners, but without a POW change there is no way to do so. I'm also not sure about your assertion that "A 51% attack takes much more than a 51% of the network to execute nowadays", what is your basis for that claim?

@chytrik There are ways to kick blocks produced from a malicious pool, just by kicking the initial block where they started cheating, all their work goes to waste (look up invalidate block in the API calls).
As for "A 51% attack takes much more than a 51% of the network to execute nowadays" You are right I shouldn't have said this without specifying it's my opinion and explaining myself, since I need more space I'll do it in the next comment.

Why do you need much more than 51%? Let's say I want to double spend, and I have 51% of hashing power, in that case it would take me 51 blocks on average to catch up, but since I'm mining with only 51% of the total power, blocks would be slower to produce, the math adds up to 1000 minutes, in that time people would notice that blocks are slower, something is going on and block the malicious chain as soon as is broadcasted. With 80% of the power is still talking 33 minutes, people would again notice and just block the malicious chain. This is not the best course of action but a solution

@EnriqueAlcazar there is not a way for the network to reach consensus on dropping the 'initial block' of the attack, so at best this would make the network fork, maybe many times. Also, this is not a way to stop an attack, only a way to react to one. A miner with 51% does not need to mine 51 blocks to catch up, I think you misunderstand the attack. At any given time, a miner with 51% can (with some probability) begin to continuously outrun the rest of the miners, thereby becoming the sole block producer. A miner can also submit blocks anonymously, making this harder to detect.

@chytrik detecting the initial block for the attack is really easy, and any node can decide to drop it, and this would generate a SOFT fork which would only not be followed purposely by the malicious operators, there is no need for everyone to drop the block, that's how a soft fork works. As for the 51% attack I was talking about the time it would take to substitute a single block to double spend, in your point about solo mining, that's even easier to detect, since has nothing to do with the submission of block, and the miners themselves, even being a minority, could fix that problem.

Quick recap, if miners decide to attack they can either 1 censor/solo-mine: which would be really obvious since blocks would take more than double to get mined for a long time. 2 try a quick hidden attack to double spend, which right now would require more than 80% of the network to even have a chance. If they are ever caught, there are mechanisms to make the malicious miners lose all their rewards therefore having wasted a ton of money (around 5M in the case of a double spend with 51% of the network)

@EnriqueAlcazar your understanding is slightly off, hard/soft fork distinction is not important here. Even if every node could identify and drop the right block (they can't, since they are independent), the attacker could simply restart the attack, ad infinitum. This could be effective in disrupting the network, since the attack can only be recognized in hindsight, and a miner cannot be banned due to the anonymous nature of block submission. Normal block variance routinely leads to a few blocks taking 20+ minutes in a row to be found, so a slower rate alone is no reason to suspect an attack.

This is getting childish, my understanding of a hard/soft fork is not wrong, and not only I explained that I didn't mean a solo mining but also explained why solo mining is not viable, and now you come with this?... They can easily detect the right block, is the first one different in the new chain... If the attacker keeps restarting the attack he would be losing 5M a day... Miners are not banned their blocks are... And finally blocks would take an average of 40+ plus for a full day... I explained all of this before, if you have anything interesting please contribute, if not, don't.

Let us continue this discussion in chat.

Here is Blockchain.info's chart showing the current estimated distribution of the bitcoin network's hashrate.
Keep in mind: some pools are composed of many individual miners, so in the event of an attack, those individuals may simply redirect their hashpower to a different pool that is not involved in the attack.
In general, controlling the hashrate is not equivalent with 'controlling bitcoin'. If a single entity got control of 51% or more of the hashpower, then they could launch a 51% attack, meaning they could censor transactions. This is an existential threat to the network, but many developers have proposed countermeasures such as a POW change in the event such a thing ever happens.

I would rather say 'dependent' but not 'controlled'. Meaning, China doesn't control Bitcoin on some governmental level, it's just because many miners are based in China and they have a direct impact on Bitcoin's growth. Sure it's a matter of personal opinion, so correct me if I'm wrong.


text:
Bitpay xPrivKey to private key
Network: BCH testnet
Client: bitcoin-abc-0.18/bin/bitcoind and bitcoin-cli
I want to convert xPrivKey which is from exported Bitpay wallet file to private key for using bitcoin-cli importprivkey
Thank you.

xPrivKey is a BIP32 extended key. This can be used to derive child addresses.
importprivkey expects a WIF Wallet Import Format.
In order to convert to from the extended to compressed format, all you need to do is decode from Base58Check and grab the last 32 bytes (33 for public keys). See BIP32 - Extended Key Serialization and then encode to WIF format:
$ printf "xprv9uHRZZhk6KAJC1avXpDAp4MDc3sQKNxDiPvvkX8Br5ngLNv1TxvUxt4cV1rGL5hj6KCesnDYUhd7oWgT11eZG7XnxHrnYeSvkzY7d2bhkJ7" | base58 -dc | xxd -p 0488ade4013442193e8000000047fdacbd0f1097043b78c63c20c34ef4ed9a111d980047ad16282c7ae623614100edb2e14f9ee77d26dd93b4ecede8d16ed408ce149b6cd80b0715a2d911a0afea
The last 64 characters (32 bytes) represent the hex version of the private key.
edb2e14f9ee77d26dd93b4ecede8d16ed408ce149b6cd80b0715a2d911a0afea
Then convert to WIF:
$ priv="edb2e14f9ee77d26dd93b4ecede8d16ed408ce149b6cd80b0715a2d911a0afea"
$ # 0x80 for mainnet, 0xef for testnet
$ pub_suffix=01 # append 01 if the corresponding public key is compressed
$ mainnet_prefix=80
$ ext_priv_mainnet=$mainnet_prefix$priv
$ wif_enc_mainnet_compressed=$(printf "$ext_priv_mainnet$pub_suffix" | xxd -r -p | base58 -c)
$ echo "WIF Mainnet (Compressed): "$wif_enc_mainnet_compressed

WIF Mainnet (Compressed): L5BmPijJjrKbiUfG4zbiFKNqkvuJ8usooJmzuD7Z8dkRoTThYnAT

where are you getting this base58 program?

Good question, I think it was pip install base58


text:
Negative number of confirmations for a testnet transaction on blockexplorer
I am curious about the test transaction f72f59a32c1bac47ec87bc3678ec44e98eece5e235d29d79cd1f5461ccc5bf38. Depending on which site I view this transaction, the number of confirmations is positive or negative:
On https://testnet.blockexplorer.com/tx/f72f59a32c1bac47ec87bc3678ec44e98eece5e235d29d79cd1f5461ccc5bf38 there are -1797 confirmations.
However on https://live.blockcypher.com/btc-testnet/tx/f72f59a32c1bac47ec87bc3678ec44e98eece5e235d29d79cd1f5461ccc5bf38 there are +1318 confirmations.
Moreover, one of the outputs appears to be spent on blockcypher but unspent on blockexplorer.
I have two questions:

Why is there such a difference in the number of confirmations?
Is there something wrong with this transaction?

If you look closely on blockexplorer.com, you will notice that the site does mention that the transaction was included in block #1484064. The blockexplorer seems to be confused about the height of the blockchaintip, or has some other general issues regarding the confirmation count. For example, it shows all of the transactions in the latest block to have -3562 confirmations:
The transaction in question has some 1300+ confirmations, so this seems to be squarely on blockexplorer.com.


text:
What are the differences between Bitcoin and Libra?
Recently, Facebook announced to launch a  crypto currency called "Libra". Libra is managed by associations under the name "Libra Association", see https://libra.org/en-US/association/.
What are the differences between the Bitcoin and Libra algorithms and protocol?

One is built to restore sovereignty and privacy, the other is built to destroy them.

This question might be considered too broad and too opinion based according to the rules of this forum. However, tackling it from a technical standpoint based on facts rather than opinions might be on-topic and I will try my best to deep dive on that. Let's try to hit the five most important aspects that people might be interested in: security, decentralization, scalability, governance and privacy.
Security
The most important security consideration that needs to be given to a digital currency is preventing double spend (spending the same coin more than once), fraudulent transactions (spending what is not yours) or creating money out of thin air. Bitcoin prevents all three of this by storing its transactions in a blockchain that are almost immutable after
certain blocks due to the proof of work (PoW) algorithm. Supply is capped, coins can only be generated by the mining process, transactions are governed by cryptography and coins can only be spent by providing a valid signature. The PoW is also an important security consideration for preventing double spending that is sometimes overlooked by many. It signifies the inherent cost involved to modify blocks and also means that the malicious party amasses more mining power than rest of the network combined. After a certain number of blocks the transactions becomes extremely difficult to alter which means the they are immutable.
Libra operates on LibraBFT consensus, a class of the classical Byzantine Fault Tolerance (BFT) model. A model that operates on BFT can be trusted as long as there are at least 2/3rd honest nodes operating the network. So 33% of the nodes can come together and launch a malicious attack. They also need not spend money in terms of hash power like PoW in order to do that. So collusion could be an easier possibility with BFT models.
Decentralization
Bitcoin is one of the largest distributed network on this planet. Entire data is public to all the participants of the network and there are no gatekeepers or requirements to become part of the Bitcoin network. Every full node operating the bitcoin software validates all transactions in its entirety from the genesis block. When miners mine a block, every full node ensures that the block is generated according to the consensus protocol and rejects blocks which do not meet them. This ensures full decentralization, and ensures that power is not concentrated in the hands of the miners as claimed by many ignorant people. Try reading about the block scaling debate of 2017 and you will understand how the community played a major role in governing the network.
In Libra's current implementation, 'trusted' validator nodes are core to the security model. The Libra blockchain will be open to the public to read, but closed for writes.
This means that hard power is centralized around these few entities and the protocol itself depends on these entities to validate the protocol. This means the protocol depends on whatever they decide it is. These entities can freeze your coins, take your coins, issue new coins, or really whatever they want - the sky is the limit. Libra claims that in the future it might move to a permissionless model, but it is highly doubtful that such a scheme can succeed.
Scalability
Bitcoin was designed for transactions to be as secure as possible and that comes at a cost of sacrificing scalability for security and decentralization. However, the current Lightning Network implementation solves this issue and ensure that bitcoins can be transferred almost as fast as you can create and transmit them without sacrificing on the underlying security mechanisms.
Libra being 'permissioned' inherently has higher scalability. It is no different than doing a paypal transaction or spending via your credit card.
Governance
Trustlessness is the most important characteristics of Bitcoin. Bitcoin governance  emerges from users through the software they run on their computers. Nobody calls the shots. The entire Bitcoin code is public and you can go and verify the entire program yourself. The governance components also involve the decentralization and the security considerations that have been mentioned above. Also, Bitcoin developers have no special powers to make users switch to a new network. Even if the Bitcoin Core developers were to release a new version of the software to create such a new network, users of the older software implementations could simply ignore the update and continue using the existing protocol as they please. That is the power of decentralization.
Libra being a stable coin, one needs to ensure that for every coin that issued, balances of fiat currency is maintained. So there involves trust in the organization to keep the balance in fiat currency, trust in the fiat currency itself and the instruments (or banks) in which this balance is actually kept. Also, given the centralization involved in Libra, the sky is the limit in terms of what the 'trusted' validators think the protocol should be. Most of these validators are Fortune 500 companies, and they are not there for charity. Their main goal/incentive lies in improving shareholder value and one might now be incorrect to think they can potentially go to any extent to achieve that based on historical precedence.
Privacy
Bitcoin provides pseudo-anonymity. Although, many exchanges ask for KYC while buying bitcoins, the protocol itself does not need any verification. Even after buying from an exchange, you can do a CoinJoin transaction to hide your identity. Preventing address re-use and keeping keys under one's control will then ensure your privacy is protected.
At least from what I have read, the resellers of Libra will have to collect identifying data from users under current FATF recommendation if the amounts being transferred exceed $1,000. This data has to be managed and transmitted out of band from the blockchain. A lot of internet companies have come under flack recently for in-apt data sharing practices. If one were to draw a parallel, this data can overwhelmingly be used for many other business enhancing practices as well.


text:
Execute multiple transactions atomically on Ripple
I would like to execute two transactions, e.g. one from account A to account B and one from account B to itself, atomically, i.e. either include both transactions in the ledger or none of them. This is easily possible on UTXO based blockchains, like Bitcoin, as we can have multiple inputs in the same transaction. But this is not the case on account-based blockchains, like Ripple. Is it still somehow possible?


text:
Verification of untypical scriptSig
I want to be able to redeem a P2SH output with a script doing a multisig but also additional checks. The scriptSig to redeem this output thus has to provide enough signatures, as well as some specific data, that is then compared to what's in the redeem script. To my understanding, a scriptSig like this cannot be constructed using signrawtransaction, but needs to be put together manually. But then it's very prone to errors... Is there still an easy way to check the correctness of this self-constructed scriptSig? Like a RPC call to the verifying function, a miner would call, when validating the transaction?

Assuming that you are able to create the raw redeeming transaction yourself, it is possible to pass a signed transaction to bitcoin core's signrawtransaction (or signrawtransactionwithwallet on new releases), along with a json to describe the utxo being redeemed, to verify correctness.
In this example I'm setting up a json for redeeming a p2wsh scriptpubkey that has the very simple, single opcode redeemscript CHECKSIG, where the input's amount is one BTC.  The input's txid in this example is just FFFF...FFFF.
'[{"txid":"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF","vout":0,"scriptPubKey":"0020EE6BB86B44339392BAE631C8F61DD8F009243C635ADAB33C0B20923A2794BF22","redeemScript":"AC","amount":1}]'

I've built the raw transaction redeeming this utxo, which is :
02000000000101FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000FDFFFFFF01F0B9F505000000002321027777777777777777777777777777777777777777777777777777777777777777AC0347304402203333333333333333333333333333333333333333333333333333333333333333022055555555555555555555555555555555555555555555555555555555555555550121030EFF833692060EB20ABF63FDE930AD0F59BFDDF3FAD321AA5C85435120306FD101AC00000000

To check the validity of this spend, pass both the utxo and transaction to bitcoin core's signrawtransactionwithwallet :
$ printf '%s\n%s\n' 02000000000101FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000000FDFFFFFF01F0B9F505000000002321027777777777777777777777777777777777777777777777777777777777777777AC0347304402203333333333333333333333333333333333333333333333333333333333333333022055555555555555555555555555555555555555555555555555555555555555550121030EFF833692060EB20ABF63FDE930AD0F59BFDDF3FAD321AA5C85435120306FD101AC00000000 '[{"txid":"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF","vout":0,"scriptPubKey":"0020EE6BB86B44339392BAE631C8F61DD8F009243C635ADAB33C0B20923A2794BF22","redeemScript":"AC","amount":1}]' | bitcoin-cli -stdin signrawtransactionwithwallet

{
  "hex": "02000000000101ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000000000fdffffff01f0b9f505000000002321027777777777777777777777777777777777777777777777777777777777777777ac0347304402203333333333333333333333333333333333333333333333333333333333333333022055555555555555555555555555555555555555555555555555555555555555550121030eff833692060eb20abf63fde930ad0f59bfddf3fad321aa5c85435120306fd101ac00000000",
  "complete": true
}

To check the correctness of your script, simply replace the relevant values in the utxo and build the spending transaction.
The situation is a bit more involved when validating constraints such as relative and absolute timelocks.  To have extra assurance, you could use Regtest and Testnet to try out your scripts, and even then, if the script is very exotic (maybe using undefined op_nop codes, or other forms of non standard-ness), the transaction be easily redeemable on regtest\testnet but at the same time almost impossible to redeem on mainnet.


text:
Multi-sig signature computation
I don't understand, how multi-sig signatures are generated.
I've seen that inputs redeeming a multi-sig output, can be signed and signed over repeatedly, with different private keys using bitcoind's signrawtransaction, as it is done here.
But like this, the more and more signed transaction would need to be passed around among the different parties of the multisig.
Isn't it also possible to let the different parties of the multi-sig, individually produce their signatures, send them to one place, where they then are assembled to a scriptSig redeeming the multi-sig output?

Yes you are correct. The signatures are produced separately, by each signer and then combined into the final input script. When an individual is signing, he/she is not signing the a transaction with the signature of others, only the transaction sighash, where no signatures are committed yet.


text:
Does hashing of bitcoin addresses cause collisions?
There are 2^256 possible public keys.
We generate bitcoin addresses by hashing these public keys using SHA256 and then RIPEMD160.
Now, since 160 < 256 won't there necessarily be collisions - multiple public keys will have to map onto one bitcoin address?


text:
How do these inputs/outputs make sense for this transaction?
Using coinbase, I transferred $1 in BCH to my friends BCH address. Now I am studying the transaction on a blockchain explorer as a learning exercise.
See here: https://blockchair.com/bitcoin-cash/address/qparr5k69jkt4nwtac3x56fpj67hvx77c572d45pat
And here: https://explorer.bitcoin.com/bch/tx/4d5b77590205bb11c7f562cdfc50aa2092f3c256b7fe9c85ac1dff7c9c403896
Despite having read "Mastering Bitcoin" I am struggling to see how these inputs and outputs make sense.
In particular, I am confused where it says that 0.00622777 BCH is equivalent to $3.55 on one of the inputs on blockchair.This is just wrong. It's closer to 0.99$.
Also, I am confused as to why there are two transactions which are 6 blocks apart. I only made one transaction. Is it trying to form the transaction over different blocks by aggregating different UTXO'S here and there?

In particular, I am confused where it says that 0.00622777 BCH is equivalent to $3.55 on one of the inputs on blockchair.This is just wrong. It's closer to 0.99$

The dollar value is provided by the block explorer service, that data is not stored in the blockchain record. It seems they may just have a bug in their code that is displaying the wrong dollar value.

Also, I am confused as to why there are two transactions which are 6 blocks apart. I only made one transaction. Is it trying to form the transaction over different blocks by aggregating different UTXO'S here and there?

No, the first transaction is yours, sending the BCH to that address. The second transaction was assumedly initiated by your friend, it spent the UTXO created by your transaction. The address you sent to is now empty.

I can see the $0.99 in my friends coinbase account though. So I know that no second transaction that was explicitly created by them. Also, because I transferred $1 and the total inputs come to $1.18, I would have expected just one output with the change of $0.18 going back to my address. But the inputs look exactly like the outputs here: https://explorer.bitcoin.com/bch/tx/4d5b77590205bb11c7f562cdfc50aa2092f3c256b7fe9c85ac1dff7c9c403896 Another bug?

Ah, I didn't realize your friend was also using Coinbase. In that case, I have no explanation for the movement of the coins, that would depend entirely on Coinbase's system, since they control the keys and you are just asking them to send a tx on your behalf. Being a custodial exchange, the majority of user funds are likely held in offline addresses that do not map 1:1 with user balances. If you would like to use a block explorer to investigate transactions, you should do so using transactions that are not sent to/from/between Coinbase accounts.


text:
How can I refund money that I sent to an address?
I sent a little money to this address 19RTgakS1WZP172vZwn44HnJAKU8ZQcJxm and they said that this link was allready used by someone else. Now he is saying the bitcoins were sent to no one and that they're lost. Can I refund it somehow?

You use the terms "they" and "he" but give us on idea who you are talking about. There's a lot of missing context that you haven't given us, such as how you got the address, why you sent money to it, and so on.

If they control the private keys to that address, they have the ability to refund you. Most merchants generate a new address for each transaction, and even if you pay to the wrong address, they can derive the respective private keys to transfer those funds back to you.
Is the address you paid to from the same merchant?

Depend on who sent to you (assume it a merchant) and what software they use. Some merchant apps may allow the address to be reused so they may still receive the funds.
A. They used a merchant app that only allows the address to be used once: Well I guess you're out of luck. If this happens, the bitcoin you sent you will basically be given to the merchant app developers (No such thing as sent to nobody unless the address is unclaimed which is unlikely in this situation) (Bitcoin is a one-way transaction, once sent, it is gone unless the target refunds them directly to you)
B. They use a merchant app that allows multiple uses of address or better yet bitcoin wallet: You can have them check the previous address and see if more funds are added to it and maybe do refund if requested.


text:
HELP: recover my btc funds though all odds against me. someone with Xtra knowledge?
5 months research and a lot of findings indicating it might be possible. I try askin here, like an last effort and Im not expecting fully fix or so but maybe some tips or information that might help me get my stored btc back finally. First I give "good to know" details and then information from my research and the situation. Probably I will have to give more specific info for best understanding, just tell me.
Details

Multibit HD wallet
last updated around 2016
Unfortunately my pc have been formatted twice
I have had a usb with all backup, wallets etc
Usb is lost
Recovery phrase (seed) is lost since 1.5 years
I have done several reovery sessios with differet software and found a lot of interesting files

=================================================
i have found filenames "key.class(keypar.clas etc), "weird filename"(incorrect).dat files, RSAkey.class and so on I can see they belong to the now los partition that I used for multibit hd files I also recofnze the files from the multibithd.jar container. And my last recovery software i got is very good and iim not suprised if it can find any file im ooking for.
so is there any out there that can help me out complicated dilemma. Is there any key file or something I can use for in some way export my private key? or some way to get my tranwqctions recovered if "transaction file" is recovered? and if not ay help is possible from my questions above. Is there anyone know how to open, concert, export or whatever the content of CLASS files(i knoow something about belongs to java) but my knowledge aout java and the process in java applicatina ia zero but if easy or easy explained I might fix it!
Yeah I know my ownfault, and all that My only excuse is that i lost interest but after reading after reading bitcoin raise in value i got my motivation back:P thans for your time and help!
My question is about..

i have found filenames "key.class(keypar.clas etc

Those are Java class files, they are software not data. They are no help in recovering BTC.
See https://multibit.org/help/hd0.1/files.html - you should look for mbhd.wallet.aes or mbhd-YYYYMMDDHHMMSS.wallet.aes etc.
That .aes filename extension implies the file is encrypted. If so, to decrypt it you must have either the password or the "wallet words".
Note Multibit support says:

If you have really, truly lost or forgotten both your password and your wallet words then it is likely that you have lost access to your bitcoin.

is there any out there that can help me?

I doubt it. I expect many tricksters will offer to do so.

Is there any key file or something I can use for in some way export my private key?

No.

some way to get my tranwqctions recovered if "transaction file" is recovered?

No.
Your transaction are not lost, theye are recorded in the public blockchain - every full-node has a copy of all transactions.
What you have lost is the private-key that gives control over the bitcoins in those transactions. Only you had the private key.


text:
bitcoin.conf file is missing
Just installed bitcoin core v0.21.0 on my ubuntu server.
When I run

bitcoind -printtoconsole

It says bitcoin.conf file is missing.

2021-01-30T15:36:58Z Bitcoin Core version v0.21.0 (release build)
2021-01-30T15:36:58Z Assuming ancestors of block 0000000000000000000b9d2ec5a352ecba0592946514a92f14319dc2b367fc72 have valid signatures.
2021-01-30T15:36:58Z Setting nMinimumChainWork=00000000000000000000000000000000000000001533efd8d716a517fe2c5008
2021-01-30T15:36:58Z Using the 'shani(1way,2way)' SHA256 implementation
2021-01-30T15:36:58Z Using RdSeed as additional entropy source
2021-01-30T15:36:58Z Using RdRand as an additional entropy source
2021-01-30T15:36:58Z No wallet support compiled in!
2021-01-30T15:36:58Z Default data directory /root/.bitcoin
2021-01-30T15:36:58Z Using data directory /root/.bitcoin
2021-01-30T15:36:58Z Config file: /root/.bitcoin/bitcoin.conf (not found, skipping)

As I know, it should be in $HOME/.bitcoin folder. But it's not. Should I create it manually?

Yes. It hasn't been created automatically, at least for as long as I remember.
But not in the folder whose screesnhot you've uploaded.


text:
How do I get wallet balance using xPub address with blockain.info api?
I am using blockchain.info api. I know how to get wallet balance using wallet id and password.
Couldn't find how to find wallet balance using my xPub address.

See this link:

Multi Address
https://blockchain.info/multiaddr?active=$address|$address
Multiple addresses divided by |
Address can be base58 or xpub
Optional limit parameter to show n transactions e.g. &n=50 (Default: 50, Max: 100)
Optional offset parameter to skip the first n transactions e.g. &offset=100 (Page 2 for limit 50)


text:
BITCOINJ: how to make my wallet aware again about change of my transaction status after my server restart?
Using bitcoinj, my server created a transaction and it was broadcasted on the blockchain. I can get its history using: walletAppKit.wallet().getTransaction(txHash)
It is in Pending state.
Then I stopped my server before the transaction get confirmed.
Then I started the server again, and I was still getting Pending status when calling walletAppKit.wallet().getTransaction(txHash), although the status is well confirmed on explorer like https://live.blockcypher.com/
I understand that when server was down, there was no more listener for change events on that wallet/transaction. But the question is how make my wallet aware again about the new change of my transaction status after my server restart?
(I am on TestNet by the way)

Ensure that your WalletAppKit is resyncing with the network after the server restarts.  After the wallet is back online, you can explicitly query the transaction status using the transaction hash.
Review the logs from your WalletAppKit for any messages related to syncing and transaction events.
And ensure that your server has a stable and active connection to the TestNet.

Try synchronizing your wallet again, you can delete the file .spvchain


text:
Fail to encrypt scriptPubKey in testnet
I have the following testnet wallet address:
2MsQEtPJ6JJZszMYrD6udjUyTDFLczWQrv9

Which I am trying to encode as pubkeyhash to the coinbase TX in testnet.
When i run decode58, I get this
C401B47E5722F808856A308FA043CCF28323F51711E8165536

I strip it off the version byte prefix and the checksum postfix, and I get:
01B47E5722F808856A308FA043CCF28323F51711

So the scriptPubKey should be
76a91401b47e5722f808856a308fa043ccf28323f5171188ac which is OP_DUP OP_HASH160 01b47e5722f808856a308fa043ccf28323f51711 OP_EQUALVERIFY OP_CHECKSIG

But as a sanity unit test, i verify it Vs. the debug console
decodescript 76a91401b47e5722f808856a308fa043ccf28323f5171188ac

But the debug console gives me this:
  "asm": "OP_DUP OP_HASH160 01b47e5722f808856a308fa043ccf28323f51711 OP_EQUALVERIFY OP_CHECKSIG",
  "reqSigs": 1,
  "type": "pubkeyhash",
  "addresses": [
    "mffyC9xbwyBQUWhV8SbYWpqaiNSSWR2vpo"
  ],
  "p2sh": "2ND12E9b9oa9hvTTckXwNaSJiRZ39eRFWSJ"

So why do I get address "mffyC9xbwyBQUWhV8SbYWpqaiNSSWR2vpo" and not "2MsQEtPJ6JJZszMYrD6udjUyTDFLczWQrv9" as I expect?

First of all, scriptPubKeys are not encrypted and what you are doing is not encryption. This is encoding.
The problem is that you are trying to encode a P2SH address as a P2PKH scriptPubKey. P2SH addresses are different from P2PKH addresses and have different opcodes. You can identify them by looking at the version number of the address which you are not doing. The version number actually has a meaning, it is not ignorable. Your scriptPubKey should actually be
OP_HASH160 01b47e5722f808856a308fa043ccf28323f51711 OP_EQUAL

Thanks!, so if the version byte is "0xc4" then I can tell it's a P2SH address...I now I get https://en.bitcoin.it/wiki/Base58Check_encoding.
What I now wish to understand is why does the opcode are different in P2SH addresses in coinbase transactions

They are not necessarily P2SH. You are probably confusing them with something else.

license: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/3.0/


text:
bitcoin multisig address
I am struggling to find a simple explanation for how to create a multisig address. For single sig, it's clear: double hash function applied to the single pubic key in base code 59. I just can't find any clear explanation for the multisig. Help please.

It's exactly the same procedure but instead of the public key you double hash the redeem script and instead of 0x01 version byte you use 0x05

https://gist.github.com/gavinandresen/3966071 and some research here in the forum :-)

hi Mike - thanks for responding. Alas, same as below, I still don't understand something. In a 2 out of 3 framework, and assuming the multisig address is a function of 3 public keys, how does the system know from just two public keys that I am going to spend the funds associated with that multisig address.

Let me be clearer: compare this with Shamir secret scheme: in that case it is very clear that there is a redundant mathematical relationship between a secret, which by construction can be retrieved by n out of m data points, no matter which n. In multisig case however, I don't understand how signing by two keys only is sufficient for the network to understand that I am spending coins associated with a 2 out of 3 address.

A multisig address is simply a redeem script of the form m <keys> n OP_CHECKMULTISIG.
This redeem script is then wrapped in a P2SH address, which is the HASH_160 of the redeem script presented in the format standardised in BIP16
For instance, a common multisig address is 2of2 (2of3 is also very common). An example redeem script is 522103c9078b8d06d83347b2e7e8cbbdfc24bd50e09ca1a4e5d90d70485a8c4094e5672102d52317afd128305d6fca7bd30b839e821564990c88581ebb432b478cfa95602f52ae, which decodes to:
2 03c9078b8d06d83347b2e7e8cbbdfc24bd50e09ca1a4e5d90d70485a8c4094e567 02d52317afd128305d6fca7bd30b839e821564990c88581ebb432b478cfa95602f 2 OP_CHECKMULTISIG

Producing a HASH_160 for the above redeem script gives us 4aef67ed61d391d6f3d9903ead92386c1efc9925, which when put in the P2SH form is a914(4aef67ed61d391d6f3d9903ead92386c1efc9925)87 (brackets mine).
This finally gives us the address 38XEixUj1QpcqxTWbxvqdbv4Mjre4imw9Z after a Base58Check encode.

Thanks but I still don't get something. If the multisig address is simply a hash 160 of a redeem script based on multiple (say 3) public keys, then in a 2 out of 3 multisig, somehow there must be a mathematical relationship such that this multisig address can be verified only using two keys out of three?

There is no mathematical relation. A redeem script is essentially a small computer program written in Bitcoin Script. This program is executed by the Bitcoin Script Interpreter, and must return TRUE for a tx to be valid.

How is the following problem sorted then:

Assume multisig address A created from public keys 1, 2 and 3 funded with 1 BTC, then assume multisig address B created from public keys 1, 2 and 4 funded also with 1 BTC. When I digitally sign using public keys 1 and 2, how does the bitcoin network know which address (A or B) I am using to spend the BTC?\

You supply the redeem script when spending from a P2SH address. Since each address has a unique redeem script, it is possible to differentiate

Raghav - thanks. The answer was right in front of my eyes all along, in the un-hashed redeem script containing all 3 public keys. I guess that's what happens when trying to learn about this in your spare time after work!


text:
Permissioned blockchains on EVM: are these private ledgers os it all on ETH main net?
Private blockchains using EVM: is this really the equivalent of the library of tools in hyper ledger or do these blockchains run on the public main net?

They are completely separate networks, with a different genesis block.
Geth and parity support running your own private networks that can utilize the features of ethereum (and the ecosystem of tools for it), without having to interact with the public network.


text:
Why do the biggest exchanges reuse Bitcoin addresses if doing so is unsafe?
It's generally accepted that using one address for multiple transactions is unsafe, because sending a transaction reveals your public key (whereas only the hash of your public key is required to receive transactions).
If this is actually a safety concern, why do the biggest exchanges like Binance reuse their core storage addresses for many months, storing hundreds of millions of dollars? For example, Binance cold storage has 100 transactions:
https://blockchain.info/address/16ftSEQ4ctQFDtVZiUBusQUjRrGhM3JYwe
and Binance hot storage makes hundreds of transactions every day:
https://blockchain.info/address/1NDyJtNTjmwk5xPNhjgAMu4HDHigtobu1s
As a side question, in theory everyone knows the public key of these addresses since they have outgoing transactions. Where is this information written? I can't find it on the transaction page of Blockchain.info:
https://blockchain.info/tx/4d5b7175b4553d3239dae830837045adbe880b3d57dfc0c59a1bb8e6991b8ff8

It's generally accepted that using one address for multiple transactions is unsafe, because sending a transaction reveals your public key (whereas only the hash of your public key is required to receive transactions).

It's not unsafe. It is however gratuitously giving up privacy - yours, and that of others you interact with.

all_licenses: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/3.0/


text:
On Blockchain.info, how many addresses can I pass into one API call?
Most of the Blockchain.info API calls (eg Unspent outputs) allow you to specify multiple addresses in one call separated by "|". Is there a limit to how many addresses I can pass in?
If I pass in 1000 addresses, does it still count as one API call toward my rate limits?

rate limit counts each request you send to the server, so doesn't matter what parameters are you passing.
I'm talking about Nginx and apache rate limits techniques which are used by blockchain.info.
Blockchain has no limits for requests but the limit is coming from Nginx and Apache (default config), unlike blockcypher which counts each address as a request.


text:
How To Transfer Coins From Bitcoin Core to Electrum to avoid Sync Process?
I am super new to bitcoin and to be honest am not sure what I'm doing. I needed to buy something via bitcoin, and its recommendation was to download Bitcoin Core Wallet, so I did that and bought bitcoin to the receiving address on there, however I didn't know how much space was needed. So now I have sent the money to my Bitcoin Core address, but the wallet is trying to sync (and its taking forever which apparently is normal) and I'm not even sure my computer has enough space for it all. I read that I should try to transfer it over to Electrum, so I have that downloaded. I tried doing the Sweep Keys thing, but every time I try it, it says "no inputs found (note that input needs to be confirmed)"
Can anybody give me a hand here? I unfortunately will need pretty specific instructions..
Thanks :)

no inputs found means that no funds were sent to the address corresponding to the private key you tried to sweep. make sure the private key is for the address you received coins on. look up the address on blockchain.info to confirm that coins were sent there.

To relieve your space problem, You could either run it on an external drive, or run Bitcoin Core under prune mode. Depending on your OS, you'd need to find a file called bitcoin.conf, modify that, and restart your Bitcoin Core Wallet process. The file would look something like this
The line for prune mode reads
# Enable pruning to reduce storage requirements by deleting old blocks.
# This mode is incompatible with -txindex and -rescan.
# 0 = default (no pruning).
# 1 = allows manual pruning via RPC.
# >=550 = target to stay under in MiB.
prune=550 <- change this number if needed

Electrum is a light-weight wallet that relied on trusted nodes for transaction information. This page explains the steps needed to migrate from Bitcoin core to Electrum. According to that, you'd need to dump your private key from Bitcoin core and sweep that into Electrum.


text:
Can't specify rpcport for testnet
Was there a recent change where it is no longer possible to specify rpcport?
I noticed these two warnings:
Warning: Config setting for -addnode only applied on test network when in [test] section.
Warning: Config setting for -rpcport only applied on test network when in [test] section.
After trying adding a [test] section I got very mixed results as some times it disregarded all options and in general rpcport was still not set.
I could not find any documentation on how to do this.

What software are you running exactly?

I am building the bitcoin daemon from source.

Can you post your bitcoin.conf file? Also, please read https://github.com/bitcoin/bitcoin/blob/master/doc/release-notes-pr12823.md

For any of addnode, connect, port, bind, rpcport, rpcbind, and wallet you should move them into the [test] and/or [main] sections of your bitcoin.conf. You can also move any other setting that you want only applied to mainnet or testnet into the appropriate section.
Example:
server=1
daemon=1

[main]
prune=1000

[test]
rpcport=55555


text:
Physical safety of crypto owner
Let's image a scenario where I buy (or trade) BTC on a regular basis and have a large number of coins in my wallet. Of course I'd like to be able to use my coins whenever possible, exchange with friends or strangers locally. So, I move part of my cryptos to another wallet for petty purchases, exchanges, etc.
My concern is, suppose I have a transaction with a malicious person, they can trace back with relatively high certainty to my account. Now I know this is debatable as they couldn't really tell with certainty but maybe they just don't care. All it matters is they know or I may have cryptos. In this scenario I am left at their mercy. They could threaten me, there's cases of kidnapping, etc.
My question is, is there a reasonable way to go around this problem? Bear in mind I'm talking about local exchanges in a relatively small towns, where people know my face and name, not online where I could keep anonymity.

I'm not sure your question is relevant here but I have fresh answer from Casa.

A reasonable level of general obfuscation can be achieved by cycling amounts through intermediate exchanges, cryptos and wallets.
Send Crypto1 from WalletA to ExchangeA
Convert Crypto1 to Crypto2
Send Crypto2 from ExchangeA to WalletB
Send Crypto2 from WalletB to ExchangeB
Convert Crypto2 to Crypto1
Send Crypto1 from ExchangeB to WalletC
If someone can get exchanges A and B to disclose your transactions, they might be able to connect WalletA and WalletC, this would however require a very determined actor with the law enforcement or hacking power to unravel all that data.
Oh remember to manage your UTXOs as well, dont taint.

If you are worried about physical security and using the above setup (using two wallets, one for savings and one for petty cash), one way to protect anonymity is to CoinJoin the coins when you move them from Savings -> Petty Cash.
In theory, CoinJoining makes it impossible to determine where the coins originated from. It
More information on CoinJoin: https://en.bitcoin.it/wiki/CoinJoin


text:
If i download the 160GB downloading , i will be global node?
i have a question , i've searched a lot but no answers i get
i've installed bitcoin core and after opening the app , it is downloading about 160GB and its gonna take two weeks to be completed
my question is , if i wait this time and the download be completed , am i supposed to be a global node?
my wallet will be saved in global servers?
beacuse now in local version , my wallet will be removed each time i restart the server or backuping the regtest wallet with fake balance , will import me an empty wallet!
thanks a lot

Running a mainnet full node uses up closer to 300 GB as of the time of this answer, not 160 GB.
Once your node is synced, any transactions you make will be part of the bitcoin mainnet, and thus persistent. However, you are still responsible for backing up and maintaining access to your private keys - if you delete or otherwise reset the wallet, you will still lose access to your coins - except, on the mainnet, those coins are worth considerable amounts of money.
The regtest is meant to be a local network for testing various failure modes which are not easy to replicate on the mainnet or testnets frequently. It is not intended to be run as a permanent network.
For testing, you should consider running a testnet node, which has all the benefits of the mainnet, without requiring you to spend actual money and BTC - you will still need to be responsible for your keys, but your transactions will be persistent.


text:
Is there a way to test Blockchain.info APIs?
I'm trying to set up Blockchain.info web APIs to notify me when I
receive a BTC payment:
https://www.blockchain.com/api/api_receive
So say, if I generate a receiving address as such:
https://api.blockchain.info/v2/receive?xpub=<my_xpub>&callback=<callback_url>&key=<my_key>

Can I somehow test how my callback_url will be called?
PS. Sorry, I'm new to this. Before when I was dealing with a fiat currency, PayPal for instance had a developer portal where you can send yourself a test web API request.


text:
How to test my Bitcoin QR code without giving my bank account
I set up a QR code on my website to receive Bitcoin payments. So now I need to test it. I thought that if I install a Coinbase app it would let me scan it with its QR code scanner to see how my QR code looks like, but after giving Coinbase my address, phone number, DOB and last 4 numbers of my SSN, they now want to have access to my checking account.
Is there an app or some way to test my QR code with a smartphone (iPhone) without signing my life away?

Coinbase is a custodial exchange business, that will demand all your KYC info. Use any non-custodial wallet and it will work fine.

@chytrik can you explain what's the difference between custodial and non-custodial wallets?

Non-custodial: the wallet gives you full control of your private keys (which are required to spend the funds stored in the wallet). Custodial: someone else has full control of the private keys (so you must ask them to spend your funds for you). Beware trusted third party solutions, such as custodial wallets. Similarly, I would recommend you at least consider using a self-hosted solution for receiving payments (ie, not the blockchain.com API), this will give you full control of your ability to receive BTC payments, and will be much better for your privacy (and the privacy of your users).

This site has a good list of wallets you could consider using: https://bitcoin.org/en/choose-your-wallet . You could also look at something like BTCpayserver as a means of accepting payments in a self-hosted fashion

@chytrik thanks for the info. I actually created a wallet using Electrum app on my desktop. I think I can send BTC through it, don't I? And I use Blockchain.info web APIs to track any receipts into that wallet. (Still need to find ways to test it.) They provide a free API (without even setting up an account) that can call my PHP script when the payment arrives. So at this stage I'm just trying to test if my generated QR code will be recognized by a crypto-currency app running on a mobile phone. I just need to find one that will let me scan a QR code without giving them all my info :(

Electrum is non-custodial, yes. Using blockchain's API will doxx all your payments to their servers though, and as with most thing "if you're not paying, you are the product". Something to consider, at least. re: QR codes: Even most mobile phone camera apps can scan a QR code these days, it really shouldn't be tough to do. Note: BEWARE any 'bitcoin-specific' QR code reader/generator you may find. Many malicious versions exist, that sub in a scammers address for the one in the QR code.

@chytrik yeah thanks. I've noticed that there's so much scam involving BTC. Someone just today was trying to scam me on Twitter. I'm curious about Blockchain API though. Why are you saying it's bad that they'll see all transactions? I was using them just to get notifications when payment was received so that my server-side PHP script can process it. Otherwise I have to do it manually. Do you know of any other services that can do this? If so it'd be nice. Again, I need a web API callback type service for when payment arrives into my BTC wallet(s).

Use another wallet like green wallet or Mycelium and scan the QR code.
Also, you can even verify the content of the QR with Google Lens, or another QR reading app.

Thanks. Google Lens was able to scan it into a string that looks similar to what I put there.

As @paul-kania mentioned, please verify that the string you see in Google Lens is exactly what you expect it to be.

My reputation is too low to comment, but I must tell you that you should make sure not that

Google Lens was able to scan it into a string that looks similar to what I put there

But rather the string should be exactly the same. To do this quickly you can check the first 4-5 characters and the last 4-5 characters of the string, and maybe a quick glance in the middle. Look into novelty addresses and you'll understand what it takes to forge/mimic an address.


text:
Opening Full node
When I try to open my node this is the error that pops up
"Error: Cannot parse configuration file: parse error on line 1: curl https://bitnodes.io/install-full-node.sh | sh."
Does anyone know how to fix this so I can get my node up and running again?

Remove curl https://bitnodes.io/install-full-node.sh | sh. from your bitcoin.conf file

I can't find my bitcoin.conf file. The closest thing I was able to locate was a qt.conf file

Wherever you put this line, remove it. It is a terminal command, not an option to bitcoin nor a command for bitcoin. How are you starting Bitcoin Core?


text:
What happens to bitcoins that are in a ponzi scheme wallet?
I bought bitcoins that are stored in Cloud Token wallet. I found out later on that this crypto currency was part of a Ponzi scheme (shame on me). Currently I've had difficulty withdrawing my coins, and no doubt their support has vanished.
I would like to know, is there any way for those coins to be retrieved, or will they just disappear? And is this also the case for all phony crypto currencies?

Unfortunately as is the nature of Bitcoin and crypto currency if it's not your keys its not your coins. In other words if you're trusting someone else with your coins (even an exchange such as binance) you are at their mercy. In the rare very occasion an investigation may happen and if the perpetrators are convicted they may confiscate the coins and do a reimbursement.

If you send BTC to a custodial wallet (ie, one which you do not control the private keys for), then you no longer have control of your bitcoin (whoever has the private keys is now in control). If you send coins to a website (to buy some tokens, or whatever), then it is the website operators who now have control of your coins.
This is a well-known saying in bitcoin: not your keys, not your coins.

I would like to know, is there any way for those coins to be retrieved, or will they just disappear?

You can ask for the coins back, but if it is a scam, then chances are the scammers will not send you anything. You could report the scam/theft to local authorities, but chances are they will not be able to do much at all.
The coins will not 'disappear', they are just owned by the scammers now.
If you buy a token / cryptocurrency that is created and maintained by some central authority, then you are implicitly trusting that the central authority will not act maliciously. This is quite the opposite of Bitcoin, in which the user can trustlessly interact with the network, depending on no third party to receive/hold/send funds.

Thanks for your response @chytrik. Just to clarify something. I do have the private keys to the wallet (I am assuming thats it is my pincode and Google authenticator), Thing is whenever I try to transfer the bitcoins to another wallet it is stuck in pending.
Unless I am doing something wrong, am I SOL?

No, sorry, the PIN code is not your private keys. Private keys are 256-bit integers, that are used by a wallet to create cryptographic signatures that allow you to spend the coins. A PIN and 2FA (google auth) are just logins for your online custodial wallet account. Most commonly these days, a non-custodial wallet will present the user with a 12 or 24 word mnemonic seed phrase to store as a backup for the wallet (and then privkeys are derived from the seed phrase). If you do not have a seed phrase, you are unfortunately likely out of luck.

@hachemon See https://en.bitcoin.it/wiki/Private_key where it gives the example private key in hexadecimal representation E9873D79C6D87DC0FB6A5778633389F4453213303DA61F20BD67FC233AA33262 It is a secret number that is stored in your wallet. That number provides control over money (without ever being revealed to anyone nor transmitted to other nodes).


text:
For over 4 hours it says payment has not been transmitted yet
Been getting message for over 4 hours that says "This payment has not been transmitted yet. Wallet version 7.47. What do I do?

you could start by telling us what wallet software you are using? there are many different bitcoin wallets, we don't have access to your wallet and can't read your mind.

Probably "Exodus" wallet based on a google search.


text:
getnewaddress with importmulti
I have a question about how the bitcoin core wallet works with descriptors.
I am creating a wallet using the createwallet method and passing in a name (all other args are default).
I then import addresses into Bitcoin Core using importmulti and wsh(sortedmulti(2,[abc123ef/48h/0h/0h/2h]xpubyadayada.../0/*, [abc345ef/48h/0h/0h/2h]xpubyadaya1da.../0/*, [abc567ef/48h/0h/0h/2h]xpubyadaya2da.../0/*))#checksum
When I run deriveaddresses with wsh(sortedmulti(2,[abc123ef/48h/0h/0h/2h]xpubyadayada.../0/*, [abc345ef/48h/0h/0h/2h]xpubyadaya1da.../0/*, [abc567ef/48h/0h/0h/2h]xpubyadaya2da.../0/*))#checksum I get the expected addresses as an output but when I run the getnewaddress command after running importmulti, I get an address but not any of the addresses that were output from deriveaddresses.
I then noticed there is a disable_private_keys option when creating the wallet, so I've setup a new wallet using that flag.
I go through the setup process again with keypool=true when importing multi but when I run getnewaddress I get "Error: This wallet has no available keys". The importmulti call returns success: true, and I get Already have script 522103b403e66... in my logs when I try running the command twice.
Does getnewaddress not work with descriptors? Or am I setting up the wallet incorrectly? I see there is an argument blank to pass in when creating a wallet but when I try that and import I get Error: This wallet has no available keys too.
I would expect getnewaddress to output the first address returned from deriveaddresses on a fresh wallet. Have I overlooked something in the documentation?
I looked at these docs too and I think I've followed them exactly:
https://gist.github.com/achow101/a9cf757d45df56753fae9d65db4d6e1d
Using importmulti with internal set to true does not add any change keys. What am I doing wrong?
Import multisig change addresses into Bitcoin Core using "importmulti" + descriptor
What is the best way to create a wallet with a blank keypool then add keys to it?
Thanks!

Hi, I have the same issue, did you find out how to make it work? cheers

getnewaddress on non-descriptor wallets does not work for non-single key things. Ad descriptor wallets have not yet been released, you are not using a descriptor wallet. When you use importmulti to import a descriptor, it does not actually import the descriptor. Rather it uses the descriptor to construct a bunch of keys and scripts and imports them into the wallet. However this does not mean that those scripts will be accessible with getnewaddress. They are just in the wallet as being watched.
You aren't doing anything wrong, getnewaddress just doesn't work like that for non-descriptor wallets.
If you make a descriptor wallet (using one of the 0.21.0 release candidates, or a build of the master branch), then getnewaddress will work as you expect it to.

Hey Andrew, thanks for clearing that up. I am running 0.20.1, so that makes sense why it isn't working as expected. When you say they are just in the wallet as being watched, does that mean I can still monitor transactions for those addresses using the flow I used above? I haven't rescanned the blockchain yet because I wanted to make sure the addresses I was importing were correct.


text:
What is the difference between transferring and depositing
I'd like to know what the difference is between transferring Bitcoins and depositing them, more specifically to activate a wallet.
I've transfered  a huge amount of BTC into a trading platform. Now the platform requests that I deposit 0.002btc which will be added to my existing balance, before I can withdraw my BTC.
Is this normal?

In the realm of Bitcoin, transferring and depositing is the same. In your relationship with a trading third party, terminology is something you and your third party agree to. You might have accepted their terms of use. You need their customer support, not us.

This also sounds like a scam.

Thank you. That's what I needed to know


text:
Use Bip 39 mnemonic words to restore Samourai wallet to another wallet
I want to access my Samourai wallet from a different type of wallet: either Blue- or Sparrow Wallet by using the 12 word mnemonic and passphrase.
Is this recommended? Is it possible?

In the end I used the Samourai mnuemonic, and wallet password, entered it into Sparrow Wallet. I could use the main Samourai wallet and addresses fully.
The Whirlpool section wasn't available.
No special config in Sparrow needed to import.

I believe this should work so long as both wallets implement BIP-39, BIP-32 etc and so long as both wallets use the same derivation path.

Thanks! I tried in this Sparrow and it worked!


text:
What's the difference between generateblock and generatetoaddress
Both commands generate blocks, and one specifies an address, what is the usage for each? Thanks!

generatetoaddress generates a block using transactions from the mempool. It uses the given address for the coinbase output.
generateblock generates a block with the given transactions in the given order. It does not automatically select transactions from the mempool like generatetoaddress does.
Both RPCs are only relevant on regtest and are used for testing. generatetoaddress is generally used when any unconfirmed transactions can be included in the block. generateblock is used when only some specific transactions should be included. generatetoaddress is also used to generate coins via coinbase transactions.


text:
How to accept the payment with regtest?
I sent some BTC via the regtest network from one wallet to another, and I don't see it using getbalance, but I do see it if I use the command getbalances as untrusted_pending:
{
  "mine": {
    "trusted": 0.00000000,
    "untrusted_pending": 2.00000000,
    "immature": 0.00000000
  }
}

What does it mean? And how can I accept it? Will it also happen in the mainnet?

untrusted_pending means untrusted pending balance (outputs created by others that are in the mempool) according to the bitcoin core source.
If you create a new block and it contains above payment transaction, it will show in trusted.

You're right! I added a block and it worked. I noticed there are two options to generate blocks: generatetoaddress and generateblocks, what's the difference?

The generatetoaddress automatically picks up transactions from the set of transactions in the mempool and creates a block.
generateblock RPC, on the other hand, is an RPC added in 0.21.0. It takes an argument to specify the set of transactions (via txid or rawtx) to be included in the generated block. This is useful to include another Tx in the block that conflicts with the Tx in the mempool, or to create a block where a particular Tx is not mined.

Thank you! You made it clear


text:
What is Jailing tx HASH?
I participate in the testnet (I am a validator), and one of the tasks is to force myself to go to jail and write a timestamp, jailing block height and jailing tx HASH, but as far as I know there are no jail transactions on the blockchain. What does this mean? I will be glad to hear any ideas.
The task ends in a couple of hours, so I'll be glad if I get at least some answer.

I have no clue what you are talking about. Do you have a link or reference somewhere? Running a testnet validator just involves downloading and running some software...

@PieterWuille I know, it's just one of the tasks. There were also such tasks, for example: delegate, redelegate, undelegate :)

What network are you talking about? This doesn't sound related to Bitcoin.

I tried googling for some of the terms used in the question, and it looks like it may be about Cosmos. OP, that would be off-topic here.


text:
starting mining with bitcoin core once installed
How do I start mining once installed and running?  I don't see the bitcoin balance changing at all.  What am I doing wrong?

Bitcoin cannot reasonably be mined on commodity hardware, and Bitcoin Core does not include any functionality to mine by itself anymore. The profit would be orders of magnitude smaller than your electricity bill and wear and tear to your hardware.
If you want to mine BTC, you need specialized hardware (called ASICs).


text:
If I sent the USDT to the scammer's ERC20 &TRC20 addresses, is there any chance to get them back?
I was scammed by a man from an online dating site, I lost everything but even in debt...
After he got my trust and started teaching me how to invest in Bitcoin. He sent me a fake platform link, I installed it without any doubt, then the nightmare started...
First of all, I bought a small amount of Bitcoin in Binance and transferred it into USDT, later sent it to the fake platform address for making short or more contracts, all the profits I made on the platform were fake. He was encouraging me to put more deposits to get more stable profits, every time I bought USDT from the legal platform and sent it to his fake platform address, since then there was no way back, always have to put more and more deposits.
In the end I wanted to take out my money, then started all kinds of taxes, fees...I was so frustrated but I still borrowed money from my friend, trying to get out of my money, but it was too late. I lost everything but even in debts... I admitted I was totally blind, all the money was sent to the scammers' addresses (ERC20 and TRC20).
How stupid I was, I'm really hopeless, desperate, every single minute blaming myself...
I only have his phone number and lots of transferred addresses. Now I know it's an international scam group...
Do I have any chance to get them back?
Thank you for all your precious time and your kind advice!

I would report the fraud to police, not expect money to be returned, try to move on with life.

Thank you for your comments! I already contacted the local police. but really no chance at all ? I found some hackers on internet, they said they can get the money back, I don't know if I should give it a try or not :(

99.999% of people who say they can get your money back will be people trying to trick you out of more money. It is almost certain you will just waste a lot more of your time and become more stressed and pressured by them.

Thank you for your advice Mr.RedGrittyBrick!  When hackers say they will not charge money upfront, they gave me a little bit of hope... but deep in my heart, I also feel hopeless ... Thanks again for your honest advice, wishing you all the best and stay healthy!

Unfortunately there is slim chance of you getting back anything. Like  @RedGrittyBrick responded on your question, you need to go to the police report all of it with as much evidence as you have. I know from experience that this is not easy and you may need to relive all the stuff you have experienced. At least you can use this as a sort of closure, knowing you did everything in your power to get something back.
There is ways the police can prosecute this but most cases get dragged out forever and are never closed, because they do not have the capacity or lack the evidences to investigate all the cyber crimes and crypto can be notoriously hard to trace if somebody wants to make the money untraceable.
As i'am an it security workforce person, do not think you can get it back by hackers or other illegal means you may end up being scammed again or make everything way worse in committing crimes or at least helping criminals.
personal opinion

The only thing you will get from this is life lessons.
- Do not trust People you do not know and can not meet.
- Do not invest what you don't have.
- Always do your own research.
- If it's to good to be true, it probably is not good.
(i do realise in hindsight this is easy to say)

You may have issues trusting anybody in the future and you need to speak and process that with people you do trust. Get outside help if you need it.

Sorry to hear your story, it is one that happens to often, not only in crypto but everywhere scams are the plague of today.

Thank you very much AnafiFlyer! I've contacted the local police... I will meet them at the end of next week. It's really sad to hear that you as an IT security workforce person also think it's hard to trace:(  I still get some messages from so-called hackers asking for more details and my phone No. ... I will stop dreaming (get my money back) now.  Thanks again for your personal opinions! I learned a very big lesson, it will affect the rest of my life, I should stop blaming myself and move on. All the best and stay healthy!

Most important part here is exactly that you realise that you need to take your life into your own two hands now. You are not as stupid as you think you are and you should not blame yourself, there have been smart and stupid people falling for scams. If the scammer gets the right sort of situation (sometimes accidentally, sometimes on purpose or maliciously) which gets threw to you as a person and pushes the right button there is no one who is immune to this. People in there harts are trusting, scammers know this. Indeed, do not blame yourself. Just try not to make the same mistake again :-)

If you are into learning how people try to manipulate you, there is some good content over at Youtube (Traditional scams and more advanced ones: Kitboga, Scammer Payback, Jim Browning, Catfished ... Jim Browning was actually almost successfully scammed himself)

Thanks a lot AnafiFlyer! I will never ever repeat it again : (  I will check the Youtuber which you suggested. Thanks again!  BTW, the link which the scammer sent to me was already reported by many people and reported on scamdoc website: https://www.scamdoc.com/whois?id=635621, I would kindly ask your professional opinion, do you think this info will be any of help for the police?  Thank you!

Hi Mona, I am mixed on whether they will trust some random website like scamdoc, you can tell them but if i were a cyber police investigator, i would conduct my own research from your first hand information (like mobile number, payment addresses, any other interesting info that you know for a fact.). I generally mistrust information i can only find once (single occurrence). On the other hand the more they know up front the more likely they can catch a scammer

Hi AnafiFlyer, Thank you for your kind advice! I will provide everything I could for the German police. Hope they could find out something. Thanks again for your concern about my case, wish you and your family all the best!


text:
How many transactions are coin tumblers responsible for?
I see many resources online which explain what coin mixer or tumbler services are and how they work, and why someone would or wouldn't want to use one. But what I'm having trouble finding anywhere, is data or estimates about their overall prevalence.
What fraction of the transactions on a given blockchain, are constituted by tumbler activity? Is there any way of knowing or putting bounds on this number?

A tumbler is a centralized service, different from CoinJoin protocols like Wasabi, Samourai, or JoinMarket. Thus, deposits and withdraws from Tumblers can look like small 1-input-2-ouput transactions, or they can look like batched transactions, more similar to CoinJoins, depending on the Tumbler's design.
Combined with the fact that Tumblers operate in gray if not fully illicit legal conditions, this makes it very hard to produce data about which transactions belong to tumblers.
Measuring CoinJoin use is easier because they have many inputs and many, often equally-sized outputs.


text:
BIP 32 CKDpriv not working in my python implementation
I have been working on implementing BIP 32 in Python. This is my code for deriving normal (not hardened) child keys as part of an HD_Key class:
def CKDpriv(self, index):
    key = bytes.fromhex(self.c) #key for hmac
    K = self.point.sec(compressed=True)
    data = K + index.to_bytes(4, 'big')
    I = hmac.new(key, data, hashlib.sha512).digest()
    L = I[:32]
    R = I[32:]
    ck = S256Field(int.from_bytes(L, 'big')) + S256Field(int(self.k, 16)) #adding two field elements with secp256k1 parameters
    ck = ck.num
    cc = R
    level = int(self.level) + 1
    fingerprint = self.get_fingerprint()
    return HD_Key(str(level).zfill(2), fingerprint, hex(index)[2:].zfill(8), hex(ck)[2:], cc.hex())

Given master key:
level: 00, fingerprint: 00000000, index: 00000000, k: 4b03d6fc340455b363f51020ad3ecca4f0850280cf436c70c727923f6db46c3e, c: 60499f801b896d83179a4374aeb7822aaeaceaa0db1f85ee3e904c4defbd9689, testnet: False

when I try to derive a child key at index 2 using this code, the xprv which is supposed to be this: xprv9vHkqa6EV4sPcjMMuDToT9SVa6UHCwR4pxvYKZdKTqWpcgQqmPuphAbteLtH9GTXaB87d9zYGuVN497UHmPB462kDjovoB7YoYXYKYphJVv
is actually this: xprv9vHkqa6EV4sPcjMMuDToT9SVa6UHCwR4pxvYKZdKTqWpcgQqmPuphAbteLtH9GTXaB87d9zYGuVN497Pku2GX4mxm2YwYKQEr52Q25Z4pip.
When I print out the information for the correct extended private key I get this:
level: 01, fingerprint: bd16bee5, index: 00000002, key: 32b6b93726e1121f2553bb18ff5b9f263067afe01019538fe34db8761cb94ad0, chain: 4a92983ca7cede2311c61bf911c76d662b0257404659872c792448c09453deba, testnet: False

And for the incorrect one which my code generated I get this:
level: 01, fingerprint: bd16bee5, index: 00000002, key: 32b6b93726e1121f2553bb18ff5b9f24eb168cc6bf61f3cba3201703ecef8fe2, chain: 4a92983ca7cede2311c61bf911c76d662b0257404659872c792448c09453deba, testnet: False

This indicates that there is a problem with the key being derived. I've tested my extended key serialization and parsing methods, so I don't think that the issue is contained within those. What could be causing this issue?

It appears S256Field uses the incorrect modulo. You arrive at the correct chaincode, and the first half of the key is correct. So the issue is that when you do the step parse_256(I_L) + k_par (mod n), your n is incorrect.
We can reverse engineer what value you used for n by finding the difference between the expected key and the calculated key, and adding that to the real value of n.
0x32b6b93726e1121f2553bb18ff5b9f263067afe01019538fe34db8761cb94ad0 - 0x32b6b93726e1121f2553bb18ff5b9f24eb168cc6bf61f3cba3201703ecef8fe2 = 0x14551231950b75fc4402da1722fc9baee
0x14551231950b75fc4402da1722fc9baee + 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141 = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f

The n your modulo is computed with is 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f, which is actually the curve parameter p. However the value your modulo needs to be computed with is n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141.
p is the finite field for the curve. It defines that largest value for the coordinates of a curve point. You do mod p when doing arithmetic with curve points.
n is the order of the generator point G. It is the number of discrete logarithms (number of private keys) for the curve. You do mod n when doing arithmetic with scalars (private keys).
Since in this step you are adding two scalars, you need to be doing it mod n rather than mod p.

Thanks for the clear response, it's working now.