Here's what Sarah had to say:
"Unfortunately, I wasn't able to find out much. If you follow the stolen bitcoins from the initial 1EMztW address to the main 1Cdc4GY address, you can see a lot of smaller peels coming off this bigger amount to other addresses. If you go look at those other addresses though, a lot of them haven't actually spent their bitcoins at all (and even if they have, if you follow an extra hop, you'll still get to an address that is just sitting on the bitcoins).
So basically, there's just not much to go on, and all I can really say is that it doesn't look they immediately cashed out. The only other, very speculative, thing I can think of is that the "self-change" behavior of all the addresses is the default behavior of MyWallet, so there's a chance the thief is using that wallet service and you might be able to appeal to its operator (as was done earlier this year with Strongcoin; see here: https://bitcointalksearch.org/topic/m.1885921). Then again, using the same address to collect change is also a behavior of many advanced desktop clients, so that's very possibly a dead end.
Anyway, sorry I couldn't be more helpful, and sorry to hear about the theft!"
I didn't recognize MyWallet off the top of my head, so I looked it up and discovered that that's Blockchain's online wallet: https://blockchain.info/wallet. So if her speculation is correct, we could ask them for the money back. Although based on what it says on the My Wallet page, it doesn't look like even they have access to the money stored in there since it's encrypted before it even hits their servers.
So it's *possible* that it's stored on Blockchain's servers somewhere. It's also possible that it's sitting in the thief's Armory wallet, in which case, we're obviously totally out of luck.
I highly doubt the "hacker" would be smart enough to steal the bitcoins but leave 4100 bitcoins in an online wallet. "Unfortunately, I wasn't able to find out much. If you follow the stolen bitcoins from the initial 1EMztW address to the main 1Cdc4GY address, you can see a lot of smaller peels coming off this bigger amount to other addresses. If you go look at those other addresses though, a lot of them haven't actually spent their bitcoins at all (and even if they have, if you follow an extra hop, you'll still get to an address that is just sitting on the bitcoins).
So basically, there's just not much to go on, and all I can really say is that it doesn't look they immediately cashed out. The only other, very speculative, thing I can think of is that the "self-change" behavior of all the addresses is the default behavior of MyWallet, so there's a chance the thief is using that wallet service and you might be able to appeal to its operator (as was done earlier this year with Strongcoin; see here: https://bitcointalksearch.org/topic/m.1885921). Then again, using the same address to collect change is also a behavior of many advanced desktop clients, so that's very possibly a dead end.
Anyway, sorry I couldn't be more helpful, and sorry to hear about the theft!"
I didn't recognize MyWallet off the top of my head, so I looked it up and discovered that that's Blockchain's online wallet: https://blockchain.info/wallet. So if her speculation is correct, we could ask them for the money back. Although based on what it says on the My Wallet page, it doesn't look like even they have access to the money stored in there since it's encrypted before it even hits their servers.
So it's *possible* that it's stored on Blockchain's servers somewhere. It's also possible that it's sitting in the thief's Armory wallet, in which case, we're obviously totally out of luck.
