web3.eth.sendTransaction sending to random address

Question

I've been trying since near 2 weeks to make my users able to deposit and send ethereum on site. I use geth mostly, and more recently web3.js.

I face a very weird issue. All seems well, transaction send, it return a tx, balance update etc. But it send to a random address! Both happen with json rpc sentransaction as well web3js.

I've read that some other people had this issue (https://www.reddit.com/r/ethereum/comments/4a8c2h/geth_sent_the_transaction_to_the_wrong_address/), but I'm pretty sure I don't make the mistakes they talk about as "" typos etc, because last eth I sent was sending to good address BUT 2 tx returned (last to another unknown address) and no found received.

Here my code:

var web3 = connect();
    var contract = buildcontract();
    //don't mind of theses functions, I can post if needed

     function sendEth() {


        var fromAddr = "<?php echo $_SESSION['wallet'];?>";
          var pass = "<?php echo $_SESSION['walletpass'];?>";
          web3.personal.unlockAccount(fromAddr, pass, 2);

        var toAddr = $('#destination').val();
         console.log('fromAddr: ' + fromAddr);
         console.log('destination: ' + toAddr);
        var valueEth = $('#sendeth').val();
         console.log('value: ' + valueEth);
        var value = parseFloat(valueEth)*1.0e18;
       // var gasPrice = 1000000000000
      //  var gas = 50000
        web3.eth.sendTransaction({from: fromAddr, to: toAddr, value: value}, function (err, txhash) {
          console.log('error: ' + err);
          console.log('txhash: ' + txhash);
        });
      }

      $('#sendethbut').click(function(){
    sendEth();
});

Anyone can help or had this issue and fixed? I'm sure I make a dumb mistake, I really checked everywhere before post here (I never post here for fun, I respect knowledge and sharing, it's giving me headache and make me miss bitcoind a lot.)

Answer 1

If the code is console.logging the correct address, it's almost certainly malware. Also check where in the transaction it gets hacked. If the transactionID is the same for everything but the send address, then they can hack that part someway. But if they just have your private key, you might see the money briefly hitting your account and then quickly getting drained.

Also check out the testrpc or the testnet until you have it hashed out. If it is malware, they won't be on those networks.