Topic: Anyone know what happened to knightmb and his 371,000 BTC? - page 2. (Read 81631 times)

Ugh. I don't know why I didn't post the chain the first time.

Okay. I'm starting @ https://blockchain.info/tx/7d8bfcb9eb523b7fb7357efce70f18f6ff5e74817f4bebe8a8994568f87d953f
>1CfhYwM5ZFTMqWb5QuWujnSx8ttsmXGLa9
>15ZcbLdbVN6x76mcLTAZXo9dQxPZeyY3QD
>1Crz9E3Yd8QYGf4VepnqedAMA7EKXyRn79
>1K5j7TiBxyXERkjRZaUE1D58LaiZZTVK2S (consolidation)
>12oxfArBacQu2jMJTcJAWPCeRaHxJ6Yw1N
>1AFaq82AyuDbTTeK9FEn1Tuza863WuD3Ss (consolidation -- first major taint contributor to 14MtPd)
>1MtAvfvNnSoy5BnMwCRjw69zmKcod6idWe
>1HSmEnAYrK8MLsrqPULLGBUXG9gNKVD9uk
>17jLaLiCxqUUNaf1giqGzPva3AwR45eJP6
>15BsbsERd1Lbk76EKtHiCBKfvybfcKvpWj
>14cRHQzv5X7eJeL4a7y4xUtGJVRBNP4RJv (*send taint to 1Kf1n now apparent* also a significant branch to https://blockchain.info/address/1FufXp6urVAuet6bELKatQwRAVwFWqj1Qy)
>13sth4AnBiPFsfmR2vXQWMidZ9xKnA4toJ
>14MtPdKuhneK3c16fTTESm143CDHD85Jni
>1Kf1nT7jQnFC7N3tSdgg5qKGTV4MucfpBg

So 1AFaq82AyuDbTTeK9FEn1Tuza863WuD3Ss is probably the most interesting. 1GYfSuX3ZkRYRXcwpeY3ULgsiWheQVH4jw taint is on 1Kf1. It's a long list and many of them look like legitimate spends. A lot of them go to SDice, but maybe that's normal.


1FRAUD controls 1Cxob6LwNk9WAztRidTjNDSuaSzhMEfYj7 -- information is given by https://blockchain.info/tx/7d8bfcb9eb523b7fb7357efce70f18f6ff5e74817f4bebe8a8994568f87d953f , too
<1JvzoekksUhPj2bZ1KXvuv8BdcJnwecoFt
<19YgbK75UKhSxySfCKbax48jJfj2fimD4f
<1NoDPxUcXwTzYaxNjPjdRKGDicMAcEMn1T (primary wallet of someone/something -- SD?) -- https://bitcointalksearch.org/topic/m.1352391

This is a much shorter list, and one ID could get us very close to the controller of 1FRAUD. None of this necessarily means anything, though. Could be a bunch of individuals trading with each other... old addresses need to be connected better to newer ones -- this is a crapshoot. (brb, something paying money needing attention -- I'll look more into whether any of that can be connected in ~30m)

1Kf1nT7jQnFC7N3tSdgg5qKGTV4MucfpBg is John's forum treasury address. Which of the inputs is linked to the suspicious address in question? I can tell you the source of most of them.

Lol @ fail

I think it is only a matter of time until people start demanding ransoms from you in the Bitcoin world.

Here's another fun one... here's the address referenced in the alleged ransom letter: https://blockchain.info/address/1HeF89wMjC48bWNgWvVo7Wu3RaLW8XVsE8

There may be some message in the send transaction. If you check the address the send goes to, it's connected to a ton of similarly-bizarre transactions.

Oh - since I don't think this was ever posted... here's the alleged ransom letter (these were on pastebin and picked up by some news sources, so either PWC or MB posted them - or they're fake ):

Dear PricewaterhouseCoopers LLP
Using your Office @ 830 Crescent Centre Drive, Suite 260, Franklin, TN 37067  Telephone: [1] (615) 503-2860 we were able to gain access to your network file servers and copy over the tax documents for one Willard M Romney and Ann D Romney. We are sure that once you figure out where the security breach was, some people will probably get fired but that is not our concern.
All major news media outlets are going to be sent an encrypted copy of the most recent tax years that your company had on file since you did not have them all in a convenient electronic form. The years before 2010 will be of great interest to many. If the parties interested do not want the encrypted key released to the public to unlock these documents on September 28 of this year then payment will be necessary.
The deal is quite simple. Convert $1,000,000 USD to Bitcoins (Google if if you need a lesson on what Bitcoin is) using the various markets available out in the world for buying. Transfer the Bitcoins gathered to the Bitcoin address listed below. It does not matter if small amounts or one large amount is transferred, as long as the final value of the Bitcoins is equal to $1,000,000 USD at the time when it is finished. The keys to unlock the data will be purged and what ever is inside the documents will remain a secret forever.
Failure to do this before September 28, the entire world will be allowed to view the documents with a publicly released key to unlock everything.
Bitcoin Address to Stop Release:
1HeF89wMjC48bWNgWvVo7Wu3RaLW8XVsE8
And the same time, the other interested parties will be allowed to compete with you. For those that DO want the documents released will have an different address to send to. If $1,000,000 USD is sent to this account below first; then the encryption keys will be made available to the world right away. So this is an equal opportunity for the documents to remain locked away forever or to be exposed before the September 28 deadline.
Who-ever is the winner does not matter to us.
Bitcoin Address to Promote Full Release:
12AP6iCwRNFQqKLStH3A4b4hw3SL6RaNgB
Cheers!
Reference to avoid Fakes that only you will have.
1.all these considerations did not deter me from the path of duty
2.[t]he moment I understood the will of my Heavenly Father

Here's another:
PWC Office @ 830 Crescent Centre Drive, Suite 260, Franklin, TN 37067
Telephone: [1] (615) 503-2860
 
Romney's 1040 tax returns were taken from the PWC office 8/25/2012 by gaining access to the third floor via a gentleman working on the 3rd floor of the building. Once on the 3rd floor, the team moved down the stairs to the 2nd floor and setup shop in an empty office room. During the night, suite 260 was entered, and all available 1040 tax forms for Romney were copied. A package was sent to the PWC on suite 260 with a flash drive containing a copy of the 1040 files, plus copies were sent to the Democratic office in the county and copies were sent to the GOP office in the county at the beginning of the week also containing flash drives with copies of Romney's tax returns before 2010. A scanned signature image for Mitt Romney from the 1040 forms were scanned and included with the packages, taken from earlier 1040 tax forms gathered and stored on the flash drives.
 
The group will release all available files to the public on the 28 of September, 2012
 
 
This line is on all the package letters for authenticity of the email being sent.
 
all these considerations did not deter me from the path of duty

Yeah. That might be it, but I almost doubt it just because the 1FRAUD address has >1kBTC received. This particularly ridiculous transaction shows a ton of other addresses in the person's wallet, many of which also had a fair number of coins, and have mixing/SDice activities tied to them.

The address activity totally stumps me, because it's almost like the person was trying to mix, but then there are transactions with huge lists of other addresses, almost like they wanted them to all be connected.

ETA: The mixed coins from FRAUD seem to come from https://blockchain.info/address/1LYZfBA7qHXCpbGyx9vmJE1XjucmrHLrQP -- looks like it's just some exchange. The relevant tx from there is https://blockchain.info/tx/def08b834c77c90ce389a2193fde7d9a79d08181406695bc4d5047f6bd1afa65

ETA2: Enough amateur dunno-what-I'm-doing blockchain sleuthing tonight.

Oh, see I read it as someone else calling him out as being a fraud.  Especially with the public note left on the payment.

There's a lot of mixing involved with the fraud address... Here are a couple of the eventual locations: https://blockchain.info/address/1Kf1nT7jQnFC7N3tSdgg5qKGTV4MucfpBg | https://blockchain.info/address/16CvEwBTGfE7zhxKK7dzQEqCG6pSHXfLRe |

The first one has an input from Theymos, so maybe he could shed light. There's not really any way to verify MB actually holds any of that... They could be donations, assuming he's even 1FRAUD - which wouldn't make sense to connect with the donation address. So many mysteries!

That's kind of a good use of an address that starts with 1FRAUD.

o.O Check out the first address sending to https://blockchain.info/address/1Ha43kjkronAPUUyyZNdsgfKFhMgv5Ct5G

https://bitcointalksearch.org/topic/1fraudvn3yp3w51paugbqrtbswupq84egt-127508

Well, that escalated quickly.

That's... really ridiculous.  This guy is a bigger scumbag than we all thought.


I thought SD couldn't effectively launder coins, since they send winnings back to the same address they came from?

All of the donations received at the donation address have been sent to Satoshi Dice....

Looks like we need a bigger door...

http://mbdonationfund.com/

Update July 1, 2013

I appeared before the Magistrate Juliet Griffin to have the indictment read. I entered my "Not Guilty" plea to the court. The prosecutor, Byron Jones wanted to setup a bond to detain me until trial court date (which had not yet be established). The Magistrate only agreed to have a $10,000 Appearance Bond that did not need to be paid (unless I don't show up for future court). The lead prosecutor wanted to suspend my passport, for which none exist. The Magistrate decided to create a special condition for the Appearance Bond that I do not apply for a new passport, for which I agreed. The Magistrate did not create any more special conditions and no reason was created to detain me any longer given the circumstance, so I was free to go after court adjourned.


Your door on "federal aid":

Nice catch!

https://www.google.com/search?hl=en&gl=us&tbm=nws&authuser=0&q=Michael+Mancil+Brown&oq=Michael+Mancil+Brown&gs_l=news-cc.3..43j43i53.17656.17656.0.18652.1.1.0.0.0.0.105.105.0j1.1.0...0.0...1ac.2.u0xrgIbg4ug


I wonder how close Sonny Vleisides' cell will be to MMB's.

That is just straight unbelieveable. I am sure he knows he relogged in I just hope he kept until 250 and sold at least some of them 

It occurs to me that this would be a good set-up if they are just after his Bitcoins, and think he is hiding them.  A good defense would be to show $37 million worth of assets and say "Why would I do this?  I have plenty of money already."

More likely, "P.H." is a typo of "P.G."

Will they sell them?