Cryptocurrency mystery

  • Resolved acaknoxville

    (@acaknoxville)


    12 months ago

    We have the “WooCommerce Stripe Gateway” plugin enabled on one of our websites. Primarily it is used by patrons purchasing artwork. Last week, someone transferred a funds to a crypto wallet that was connected to the button on the website in order to purchase artwork.

    To my knowledge, we do not have a wallet to accept this amount.

    Can anyone advise what steps I should take next? The transaction does not appear on our Stripe account.

Viewing 13 replies - 1 through 13 (of 13 total)

  • Hi @acaknoxville,

    Thank you for reaching out and detailing the issue you’re experiencing. It’s quite unusual for a transaction to be directed to a crypto wallet without a clear setup for such payments. Let’s try to resolve this mystery together.

    Firstly, could you please confirm if there have been any recent changes to your payment gateway settings or any updates to the plugin that might have coincided with this issue? It’s also important to check if there are any other payment plugins or custom code snippets that could have altered the default behavior of the Stripe Gateway.

    Additionally, could you provide more details about the button that was used for the transaction? Is it a standard part of the WooCommerce setup, or was it added through customization or another plugin?

    If the transaction is not showing up in your Stripe account, it might be worth checking the Stripe logs within your WooCommerce site to see if there’s any record of the transaction attempt. To enable logging, go to WooCommerce → Settings → Payments → Stripe and enable the Log to debug messages checkbox.

    Please let us know the outcome of these checks or if you need further assistance. We’re here to help!

    Thread Starter acaknoxville

    (@acaknoxville)

    Thank you! Our WooCommerce plugin enabled “Cash on delivery” as a Payment Method, which also included “Pay with crypto -25%” which I didn’t realize. I have since disabled that option.

    Anything on this site would have been a standard part of the WooCommerce setup, as I did not customize anything.

    I just went to Debug mode and have enabled “Log error messages”.

    I have no idea where the crypto funds would have ended up; do you?

    Hey, @acaknoxville!

    Thank you! Our WooCommerce plugin enabled “Cash on delivery” as a Payment Method, which also included “Pay with crypto -25%” which I didn’t realize. I have since disabled that option.

    Do you mind sharing a screenshot of where you saw this option?

    Furthermore, I’d like to understand your site properly. Please share with us the System Status Report which you can find via WooCommerce > Status > Get system report > Copy for support.

    Looking forward to your reply.

    Have a wonderful day!

    Thread Starter acaknoxville

    (@acaknoxville)

    Thank you; please see the attached screenshot below.

    Here is our system report:

    ` WordPress Environment

WordPress address (URL): https://www.knoxalliance.store<br>Site address (URL): https://www.knoxalliance.store<br>WC Version: 8.7.0<br>REST API Version: ? 8.7.0<br>Action Scheduler Version: ? 3.7.2<br>Log Directory Writable: ?<br>WP Version: 6.5<br>WP Multisite: –<br>WP Memory Limit: 512 MB<br>WP Debug Mode: –<br>WP Cron: ?<br>Language: en_US<br>External object cache: – Server Environment

Server Info: Apache<br>PHP Version: 7.4.33<br>PHP Post Max Size: 516 MB<br>PHP Time Limit: 60<br>PHP Max Input Vars: 1000<br>cURL Version: 8.7.1<br>OpenSSL/1.1.1w

SUHOSIN Installed: –<br>MySQL Version: 5.7.23-23<br>Max Upload Size: 512 MB<br>Default Timezone is UTC: ?<br>fsockopen/cURL: ?<br>SoapClient: ?<br>DOMDocument: ?<br>GZip: ?<br>Multibyte String: ?<br>Remote Post: ?<br>Remote Get: ? Database

WC Database Version: 8.7.0<br>WC Database Prefix: 720_<br>Total Database Size: 44.95MB<br>Database Data Size: 38.31MB<br>Database Index Size: 6.64MB<br>720_woocommerce_sessions: Data: 4.81MB + Index: 0.13MB + Engine MyISAM<br>720_woocommerce_api_keys: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>720_woocommerce_attribute_taxonomies: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>720_woocommerce_downloadable_product_permissions: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>720_woocommerce_order_items: Data: 0.08MB + Index: 0.05MB + Engine MyISAM<br>720_woocommerce_order_itemmeta: Data: 0.56MB + Index: 0.43MB + Engine MyISAM<br>720_woocommerce_tax_rates: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>720_woocommerce_tax_rate_locations: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>720_woocommerce_shipping_zones: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>720_woocommerce_shipping_zone_locations: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>720_woocommerce_shipping_zone_methods: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>720_woocommerce_payment_tokens: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>720_woocommerce_payment_tokenmeta: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>720_woocommerce_log: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>720_actionscheduler_actions: Data: 0.22MB + Index: 0.10MB + Engine MyISAM<br>720_actionscheduler_claims: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>720_actionscheduler_groups: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>720_actionscheduler_logs: Data: 0.16MB + Index: 0.10MB + Engine MyISAM<br>720_commentmeta: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>720_comments: Data: 0.40MB + Index: 0.18MB + Engine MyISAM<br>720_jetpack_sync_queue: Data: 0.02MB + Index: 0.06MB + Engine InnoDB<br>720_jetpack_waf_blocklog: Data: 0.02MB + Index: 0.02MB + Engine InnoDB<br>720_links: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>720_nfd_data_event_queue: Data: 0.02MB + Index: 0.00MB + Engine InnoDB<br>720_options: Data: 4.17MB + Index: 0.28MB + Engine MyISAM<br>720_pimwick_gift_card: Data: 0.02MB + Index: 0.02MB + Engine InnoDB<br>720_pimwick_gift_card_activity: Data: 0.02MB + Index: 0.02MB + Engine InnoDB<br>720_postmeta: Data: 5.82MB + Index: 2.76MB + Engine MyISAM<br>720_posts: Data: 2.90MB + Index: 0.35MB + Engine MyISAM<br>720_posts_backup: Data: 2.59MB + Index: 0.25MB + Engine MyISAM<br>720_termmeta: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>720_terms: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>720_term_relationships: Data: 0.03MB + Index: 0.07MB + Engine MyISAM<br>720_term_taxonomy: Data: 0.01MB + Index: 0.01MB + Engine MyISAM<br>720_usermeta: Data: 0.38MB + Index: 0.22MB + Engine MyISAM<br>720_users: Data: 0.02MB + Index: 0.03MB + Engine MyISAM<br>720_wc_admin_notes: Data: 0.08MB + Index: 0.01MB + Engine MyISAM<br>720_wc_admin_note_actions: Data: 0.04MB + Index: 0.01MB + Engine MyISAM<br>720_wc_category_lookup: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>720_wc_customer_lookup: Data: 0.02MB + Index: 0.02MB + Engine MyISAM<br>720_wc_download_log: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>720_wc_orders: Data: 0.02MB + Index: 0.11MB + Engine InnoDB<br>720_wc_orders_meta: Data: 0.02MB + Index: 0.03MB + Engine InnoDB<br>720_wc_order_addresses: Data: 0.02MB + Index: 0.06MB + Engine InnoDB<br>720_wc_order_coupon_lookup: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>720_wc_order_operational_data: Data: 0.02MB + Index: 0.03MB + Engine InnoDB<br>720_wc_order_product_lookup: Data: 0.03MB + Index: 0.03MB + Engine MyISAM<br>720_wc_order_stats: Data: 0.02MB + Index: 0.02MB + Engine MyISAM<br>720_wc_order_tax_lookup: Data: 0.01MB + Index: 0.02MB + Engine MyISAM<br>720_wc_product_attributes_lookup: Data: 0.02MB + Index: 0.02MB + Engine InnoDB<br>720_wc_product_download_directories: Data: 0.02MB + Index: 0.02MB + Engine InnoDB<br>720_wc_product_meta_lookup: Data: 0.34MB + Index: 0.45MB + Engine MyISAM<br>720_wc_rate_limits: Data: 0.02MB + Index: 0.02MB + Engine InnoDB<br>720_wc_reserved_stock: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>720_wc_tax_rate_classes: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>720_wc_webhooks: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>720_wfblockediplog: Data: 0.02MB + Index: 0.00MB + Engine InnoDB<br>720_wfblocks7: Data: 0.02MB + Index: 0.05MB + Engine InnoDB<br>720_wfconfig: Data: 0.47MB + Index: 0.00MB + Engine InnoDB<br>720_wfcrawlers: Data: 0.02MB + Index: 0.00MB + Engine InnoDB<br>720_wffilechanges: Data: 0.02MB + Index: 0.00MB + Engine InnoDB<br>720_wffilemods: Data: 9.52MB + Index: 0.00MB + Engine InnoDB<br>720_wfhits: Data: 0.27MB + Index: 0.05MB + Engine InnoDB<br>720_wfhoover: Data: 0.02MB + Index: 0.02MB + Engine InnoDB<br>720_wfissues: Data: 0.02MB + Index: 0.06MB + Engine InnoDB<br>720_wfknownfilelist: Data: 4.52MB + Index: 0.00MB + Engine InnoDB<br>720_wflivetraffichuman: Data: 0.02MB + Index: 0.02MB + Engine InnoDB<br>720_wflocs: Data: 0.02MB + Index: 0.00MB + Engine InnoDB<br>720_wflogins: Data: 0.02MB + Index: 0.03MB + Engine InnoDB<br>720_wfls_2fa_secrets: Data: 0.02MB + Index: 0.02MB + Engine InnoDB<br>720_wfls_role_counts: Data: 0.00MB + Index: 0.00MB + Engine MEMORY<br>720_wfls_settings: Data: 0.02MB + Index: 0.00MB + Engine InnoDB<br>720_wfnotifications: Data: 0.02MB + Index: 0.00MB + Engine InnoDB<br>720_wfpendingissues: Data: 0.02MB + Index: 0.06MB + Engine InnoDB<br>720_wfreversecache: Data: 0.02MB + Index: 0.00MB + Engine InnoDB<br>720_wfsecurityevents: Data: 0.02MB + Index: 0.00MB + Engine InnoDB<br>720_wfsnipcache: Data: 0.02MB + Index: 0.05MB + Engine InnoDB<br>720_wfstatus: Data: 0.16MB + Index: 0.11MB + Engine InnoDB<br>720_wftrafficrates: Data: 0.02MB + Index: 0.00MB + Engine InnoDB<br>720_wfwaffailures: Data: 0.02MB + Index: 0.00MB + Engine InnoDB<br>720_wpfm_backup: Data: 0.02MB + Index: 0.00MB + Engine InnoDB<br>720_wpforms_logs: Data: 0.02MB + Index: 0.00MB + Engine InnoDB<br>720_wpforms_payments: Data: 0.02MB + Index: 0.14MB + Engine InnoDB<br>720_wpforms_payment_meta: Data: 0.02MB + Index: 0.05MB + Engine InnoDB<br>720_wpforms_tasks_meta: Data: 0.00MB + Index: 0.00MB + Engine MyISAM Post Type Counts

amn_om: 3<br>amn_wpforms-lite: 4<br>attachment: 992<br>customize_changeset: 4<br>gift_card: 1<br>jp_img_sitemap: 1<br>jp_sitemap: 1<br>jp_sitemap_master: 1<br>page: 4<br>post: 1<br>product: 532<br>revision: 21<br>shop_order: 1185<br>wp_global_styles: 1<br>wp_navigation: 1<br>wpcode: 3 Security

Secure connection (HTTPS): ?<br>Hide errors from visitors: ? Active Plugins (9)

Akismet Anti-spam: Spam Protection: by Automattic - Anti-spam Team – 5.3.2<br>HTML in Category Descriptions: by Arno Esterhuizen – 1.2.4<br>Jetpack Protect: by Automattic - Jetpack Security team – 2.0.0<br>Jetpack: by Automattic – 13.3<br>The MOJO Marketplace: by Bluehost – 1.7.9<br>UpdraftPlus - Backup/Restore: by UpdraftPlus.Com<br>DavidAnderson – 1.24.2

WooCommerce Stripe Gateway: by WooCommerce – 8.1.1<br>WooCommerce: by Automattic – 8.7.0<br>Wordfence Security: by Wordfence – 7.11.5 Inactive Plugins (0) Must Use Plugins (4)

Endurance Browser Cache: by Mike Hansen – 0.4<br>Endurance Page Cache: by Mike Hansen – 2.2.1<br>SSO: by Garth Mortensen<br>Mike Hansen – 0.4

WP WooCommerce Fast Loader: by Plugin Author – 1.9 Settings

API Enabled: –<br>Force SSL: –<br>Currency: USD ($)<br>Currency Position: left<br>Thousand Separator: ,<br>Decimal Separator: .<br>Number of Decimals: 2<br>Taxonomies: Product Types: external (external)<br>grouped (grouped)<br>pw gift card (pw-gift-card)<br>simple (simple)<br>variable (variable)

Taxonomies: Product Visibility: exclude-from-catalog (exclude-from-catalog)<br>exclude-from-search (exclude-from-search)<br>featured (featured)<br>outofstock (outofstock)<br>rated-1 (rated-1)<br>rated-2 (rated-2)<br>rated-3 (rated-3)<br>rated-4 (rated-4)<br>rated-5 (rated-5)

Connected to Woo.com: –<br>Enforce Approved Product Download Directories: –<br>HPOS feature screen enabled: –<br>HPOS feature enabled: –<br>Order datastore: WC_Order_Data_Store_CPT<br>HPOS data sync enabled: – Logging

Enabled: ?<br>Handler: Automattic\WooCommerce\Internal\Admin\Logging\LogHandlerFileV2<br>Retention period: 30 days<br>Level threshold: –<br>Log directory size: 12 KB WC Pages

Shop base: #6 - /<br>Cart: #7 - /cart/<br>Checkout: #8 - /checkout/<br>My account: ? Page ID is set<br>but the page does not exist

Terms and conditions: ? Page not set Theme

Name: Storefront<br>Version: 4.5.4<br>Author URL: https://woo.com/<br>Child Theme: ? – If you are modifying WooCommerce on a parent theme that you did not build personally we recommend using a child theme. See: How to create a child theme<br>WooCommerce Support: ? Templates

Overrides: – Admin

Enabled Features: activity-panels<br>analytics<br>product-block-editor<br>coupons<br>core-profiler<br>customer-effort-score-tracks<br>import-products-task<br>experimental-fashion-sample-products<br>shipping-smart-defaults<br>shipping-setting-tour<br>homescreen<br>marketing<br>mobile-app-banner<br>navigation<br>onboarding<br>onboarding-tasks<br>product-variation-management<br>product-virtual-downloadable<br>product-external-affiliate<br>product-grouped<br>product-linked<br>remote-inbox-notifications<br>remote-free-extensions<br>payment-gateway-suggestions<br>shipping-label-banner<br>subscriptions<br>store-alerts<br>transient-notices<br>woo-mobile-welcome<br>wc-pay-promotion<br>wc-pay-welcome-page

Disabled Features: customize-store<br>minified-js<br>new-product-management-experience<br>product-pre-publish-modal<br>settings<br>async-product-editor-category-field

Daily Cron: ? Next scheduled: 2024-04-08 23:52:07 +00:00<br>Options: ?<br>Notes: 199<br>Onboarding: completed Action Scheduler

Canceled: 1<br>Oldest: 2024-03-26 16:46:47 +0000<br>Newest: 2024-03-26 16:46:47 +0000

Complete: 429<br>Oldest: 2024-03-08 15:54:21 +0000<br>Newest: 2024-04-07 18:20:55 +0000

Failed: 25<br>Oldest: 2023-02-15 19:40:12 +0000<br>Newest: 2024-03-26 17:40:59 +0000

Pending: 3<br>Oldest: 2024-04-08 18:20:55 +0000<br>Newest: 2024-04-12 21:15:34 +0000 Status report information

Generated at: 2024-04-08 13:02:09 +00:00<br>`

    Hey, @acaknoxville!

    Thank you for the report and the screenshot.

    The “pay with crypto” option on the cash on delivery is not a default option of WooCommerce, so there must be another plugin adding it.

    Can you please temporarily deactivate all plugins but WooCommerce and check if the crypto message is still there?

    If it isn’t, please activate the plugins one by one, checking which one makes the message show.

    Please let us know how it goes.

    Looking forward to your reply.

    Have a wonderful day!

    Thread Starter acaknoxville

    (@acaknoxville)

    Thank you.

    I deactivated 8 plugins and left WooCommerce activated. When I go to WooCommerce > Settings > Payments, “Cash on delivery?–?Pay with crypto -25%” still appears as an option.

    I have no idea where the crypto funds would have ended up; do you?

    Thread Starter acaknoxville

    (@acaknoxville)

    My real question is: where have these crypto funds gone?? The person who sent them (using Ethereum) is very insistent they cannot be returned, and I have no clue where they are as we didn’t have a wallet set-up.

    Hey, @acaknoxville!

    I deactivated 8 plugins and left WooCommerce activated. When I go to WooCommerce > Settings > Payments, “Cash on delivery?–?Pay with crypto -25%” still appears as an option.

    As I mentioned, crypto is not a default WooCommerce method, so a plugin you have or had enabled it on your website.

    The plugin also changed the name of Cash On Delivery option, and if disabling it does not change the name back to normal, you can do it by clicking on the Cash On Delivery option and changing the title.

    My real question is: where have these crypto funds gone?? The person who sent them (using Ethereum) is very insistent they cannot be returned, and I have no clue where they are as we didn’t have a wallet set-up.

    To figure that out you need to find out which plugin enabled this option on your site.

    When all plugins are enabled, are you able to see on your site/checkout the option to pay with crypto?

    If you can, please disable one by one to check which one is adding the option to the site.

    Also, do you recognize those plugins?

    DavidAnderson – 1.24.2
    Mike Hansen – 0.4

    Looking forward to your reply.

    Have a wonderful day!

    Thread Starter acaknoxville

    (@acaknoxville)

    Thank you – I learned that our website had some spam activity, so I’m guessing that this is how the “pay with crypto -25%” came to be. I removed it in Settings. When I disabled all of the plugins and then enabled them one by one – that text (pay with crypto) was still present until I changed it manually.

    I do not recognize the plugins: DavidAnderson – 1.24.2
    Mike Hansen – 0.4

    I don’t see them on my list of plugins, either. Where are you seeing them?

    Would WooCommerce have set-up a wallet to accept these funds?

    Hey, @acaknoxville!

    I do not recognize the plugins: DavidAnderson – 1.24.2
    Mike Hansen – 0.4

    I don’t see them on my list of plugins, either. Where are you seeing them?

    On your System Status Report.

    Although I looked again, and it seems the full plugin name are:

    SSO: by Garth Mortensen Mike Hansen – 0.4

    Endurance Page Cache: by Mike Hansen – 2.2.1

    UpdraftPlus – Backup/Restore: by UpdraftPlus.Com DavidAnderson – 1.24.2

    The formatting was different than the others, so I did not notice the full name, I apologize for this.

    With the full names, are you able to see them on your plugin list?

    Would WooCommerce have set-up a wallet to accept these funds?

    As I mentioned, since this is not a default option on WooCommerce and not part of the WooCore plugin, we need to figure out which plugin added the crypto option to your site, so you can contact them to find out how to access the funds.

    When you have all plugins active, are you able to see on your website (on the live site, not back end) an option to pay with crypto?

    Are you able to see the order that was paid for with crypto on WooCommerce > Orders?

    If you are, can you please share a screenshot of the order notes and order details? Please remove any sensitive information before sharing it here. I recommend using https://snipboard.io. You can share the direct link to the image as a response to this topic.

    Here’s an example of what we need:

    https://snipboard.io/ga15Gu.jpg

    https://snipboard.io/98aBYL.jpg

    Looking forward to your reply.

    Have a wonderful day!

    Thread Starter acaknoxville

    (@acaknoxville)

    Thank you!

    With the full names, I see UpdraftPlus – Backup/Restore: by UpdraftPlus.Com on my plugin list. It is possible the other two (SSO, Endurance Page Cache) were on the plugin list recently but I may have deleted them within the last few weeks in trying to figure out what is going on. I’m sorry that I don’t recall.

    When I have all plugins active, I cannot see on the live site an option to pay with crypto because I disabled the option.

    “Pay with Crypto” was simply text that was input into the “Title” box in WooCommerce > Settings > Payments > Cash on delivery. Is it possible that a scammer hacked into our site, input that text, and set-up a wallet? Now, when I enable “Cash on delivery” and then try to purchase something in my shopping cart, it doesn’t appear as a payment option.

    I am NOT able to see the order that was paid for with crypto on WooCommerce > Orders. It isn’t listed as Processing, Failed, or Cancelled.

    Please see two screenshots of the order that the buyer sent to me. I can see they used Ethereum to send funds, but I have no idea where those funds went. Can you help?

    Plugin Support Shameem R. a11n

    (@shameemreza)

    Hi @acaknoxville

    “Pay with Crypto” was simply text that was input into the “Title” box in WooCommerce > Settings > Payments > Cash on delivery. Is it possible that a scammer hacked into our site, input that text, and set-up a wallet? Now, when I enable “Cash on delivery” and then try to purchase something in my shopping cart, it doesn’t appear as a payment option.

    Yes, it indeed seems like your site might have been compromised, and the scammer could have added the “Pay with Crypto” option.

    I’d recommend contacting a security expert or your hosting provider to investigate this issue further. They might help you find more information about the plugin or code used to add the crypto payment option and possibly trace where the funds went.

    I am NOT able to see the order that was paid for with crypto on WooCommerce > Orders. It isn’t listed as Processing, Failed, or Cancelled.

    Since you can’t see the order in your WooCommerce > Orders, it’s likely that the order was also processed by the third-party plugin or custom code and not through WooCommerce itself.

    I can see they used Ethereum to send funds, but I have no idea where those funds went. Can you help?

    As my colleague mentioned earlier, WooCommerce itself doesn’t have the functionality to create a crypto wallet or process crypto payments. If a crypto payment option were added, it would have been done through a third-party plugin or custom code.

    Unfortunately, it’s hard to determine where the crypto funds would have ended up without knowing which plugin or code was used to add this option. Typically, these funds would go to a wallet set up by the person who added the payment option.

    I wish I could help more, but hopefully, this gets you going in the right direction to get some further insight/information.

    If you have any further questions or need more help, please don’t hesitate to ask.

    Hi there. We haven’t heard back from you in a while, so I’m going to mark this as resolved – we’ll be here if and/or when you are ready to continue.

Viewing 13 replies - 1 through 13 (of 13 total)
  • The topic ‘Cryptocurrency mystery’ is closed to new replies.

Tags