Another developement seen in chat.
17U1LyjKzm2tr8LjpYkFGtvburfyG1rd9q is the return address on the first deposit to the Ninja Address. Someone said, AK claimed its his PD wallet address. Can we get a verification on that?
No I said that the first deposit to the 1Ninja coldwallet was by 184bpd4aMttcUBMV7QXfcPxT9V2nnMdQdQ, which is a return address for a deposit into AK's PD address in
this transactionAnyway, I am 'Imposter' on moneypot/jd/prc(don't use those sites though, have only played with bits for fun on moneypot). Anyway, when the dice.ninja heist happened livechat went wild, as I was bored I started investigating. I have had personal contact with dooglus and eric to confirm some stuff such as access times and IP addresses, however these are my own accusations. I am not financially involved in any of this, I barely ever had 2 coins to my name
I’ll put everything I know in this post, some stuff might not be highly relevant, this is everything I found, I need you guys to verify everything and do additional blockchain analysis, there might also be parts where I screwed up.
First things first, after the doxxing of Jeremy Hise refunds were being issued with
1QAitJvHj5GqzLW6pmheGXTctEwCWR9sNi as a sending address. The funds originate from 1FsVcdeHbpvUVT3gjeuVR2ZSDnpcsJMsLL(a BTC-E hotwallet). Signed messages in refund transactions confirmed the owner of the 1QAitJvHj5GqzLW6pmheGXTctEwCWR9sNi address to being DMF and T04D, the messages were signed with the 1NinjabSP8jQAVaA8y9u5fsjNpB5S22xPv key.
This small point might be relevant somehow: Eric paid profits from 25BTC
MoneyPot investment by DMF to 12zy2xFBDKmP1HAZxQak8uTqQvQHSoXtSM. Together with a bunch of other coins they were sent in
this transaction and ended up in the 1NinjabSP8jQAVaA8y9u5fsjNpB5S22xPv vanity cold wallet address. 1LMVVcBb95xkYJctFMYArHECzSiXNgC58E is one of the sending addresses, that address started making deposits to 17U1LyjKzm2tr8LjpYkFGtvburfyG1rd9q on the 6th of October.(more on that address later)
AKCOINDIGGER was the first person to implicate “Jeremy Hise”, linked the instagram post on prcdice.eu chat, no one else had made the connection DMF->dicemasterflash->jeremy hise before. Akcoindigger was also the first one to bring up ninja.dice in chat back when it launched, a mere 8 hours after it launched.
Back to 17U1LyjKzm2tr8LjpYkFGtvburfyG1rd9q, it is AK’s PD deposit address. Deposits stop at the time of the scam.
1NinjabSP8jQAVaA8y9u5fsjNpB5S22xPv was the
dice.ninja cold wallet, every transaction from
6 oct until it went bust ends up in the 17U1LyjKzm2tr8LjpYkFGtvburfyG1rd9q AK PD deposit address, the return addresses send the remaining funds to AK PD address and so on. Those are incidentally also the last transactions from the 1Ninja address.
Ok back to Akcoindiggers
explananation of the mathing IP addresses.
DMF and AKCOINDIGGER accounts were registered on moneypot.com by ip address 206.174.121.150, Eric knows DMF account is the real DMF, but AK denies the akcoindigger as being his. They used the same ip address on both just-dice.com and moneypot.com for both accounts. AKcoindigger says he runs a tor exit node and that when he signed up on dice.ninja DMF saw his IP-> used his tor exit node. I consulted with the Tor developers, they say the historical exit node data on torproject.org is believed to be complete.
However, the 206.174.121.150 was NEVER used as a Tor exit node, specifically not on July 1st 2014, when DMF logged in using that IP on just-dice.com. AK later changed his story and gave another IP that he was currently using and that he was running tor on in this thread, the atlasproject page shows that the Tor exit node was started a day after the IP accusations...
It makes no sense that DMF would use AKs IP, and even if he did why would AK come up with 2 different explanations that both turned out to be false. He didnt know the Tor project keeps a log of all the active and inactive Tor exit nodes, then he put up a Tor node after he was called out on it not realizing the time it went on would be visible as well.
Back to 1Ninja and 17U1L, the first transaction to 1Ninja is by 184bpd4aMttcUBMV7QXfcPxT9V2nnMdQdQ which is a N.D deposit address, BTC was sent to there by 14rJ52Xi9PHwnAaqCoEZSMHukSRchnRWiX, Last transaction of that address goes to 17U1L on august 25th.
AK is claiming it is a D.N return address. First transaction to 1NinjabSP8jQAVaA8y9u5fsjNpB5S22xPv is from 184bpd4aMttcUBMV7QXfcPxT9V2nnMdQdQ, that address is a return address of 14rJ52Xi9PHwnAaqCoEZSMHukSRchnRWiX when it sent to 17U1LyjKzm2tr8LjpYkFGtvburfyG1rd9q in this transaction.
These two transactions go directly from 1Ninja to 17U1L:
https://blockchain.info/nl/tx/dd632e4fa9dfee6fca505c4c46c7710a1ab70bfd97c726d42ca7703917f089cfhttps://blockchain.info/nl/tx/19b9ac283e2cc52b36d84313bd24c7405f415dbdbb6d67438ab71ad19573e560Last transaction from 1Ninja goes to 1HmvDdtxCRksPmWQ88zeKjddfc3VmkkPAm, which sends to 17U1L, the change addresses continue sending to 17U1L until 15JeYmqTKTvykUvkVMy9BZCy33h3FWL5x2 sends it to 1LMVVcBb95xkYJctFMYArHECzSiXNgC58E, a D.N controlled address, the change goes to 17DpZWsTdbSvVMBrx29WrbDT6GWDZgwXDe, which per usual sends to 17U1L again and so on and so on.
Also, 15QESooCEtbeDpDw6hMr5G7gRjMyvhzktP is a D.N address as confirmed by
this transactionPresumable a new deposit address, since it was first used on Oc 8, a day before the scam. First transaction to 15QESoo is from PD, note the 17U1L AK PD address in there?
Last withdrawal from D.N controlled 15QESooCEtbeDpDw6hMr5G7gRjMyvhzktP goes to 1JvBcFjmgPJNRJYP6osMGysjGv7tvSvozD on Oct 9.
Transaction before that on Oct 8 goes from 1JvBcFjmgPJNRJYP6osMGysjGv7tvSvozD to 19V6cRgL3jHBAppRFKosrTHvZjU3mYg8Dk which goes to 1Ninja afterwards, so 19V6cRgL3jHBAppRFKosrTHvZjU3mYg8Dk is also D.N controlled, which means 188oB1TR6gNXxzyxJCyck9BHkU4dBMVmVg is the return address, but why is the same amount of 30 BTC
being sent in this transaction with his own 1JvBc address as the return address? Anyway this tells us that 1JvBc owns 188oB and sends together with
1DMz3S in this transaction to BITDICE.ME COLDWALLET DIRECTLY,
confirmed in this post, 1 day before the heist.
1DMz3 received 10 btc from 1DrJ6L1G72apxrZnmVPSaGmdzi3rLexvqX on Oct 8, a day before the heist, the BTC had been sitting there since June 30th, it was sent to 1Drj6L from 1DwrBhgkxf6Uy8CAtxPiQ9jPAJ61R4VY69, which is a hotwallet of some sort for Just-Dice. 122BNoyhmuUt9G9mdEm3mN4nb73c1UgNKt and 19mh3hMtrhTCkUnvN7o2gi84BGMHEzMM4g are also dooglus controlled wallets.
This transaction shows dooglus Just-Dice wallet sending 126.67 btc to 14dXN2c4R1neEdBAMpbdQSTdrwfCM91cAv,
then this transaction happens, the 3 of those addresses have the BTC still sitting there, 1GsGDn then sends the btc to 19V6c
D.N in this transaction.The return address of the last transaction to the bitdice.me coldwallet is 1CSdizJPsna7RAjfY7D5XJn5CjisHuLheU, which sends btc together with 1KohH9iEhnw2XG2y56NPCd6e3QEqN5yzso in
this transaction. 1Koh also sends 50 btc to bitdice.me coldwallet directly in
this transaction. Both 1 day before the D.N heist.
Also, 19V6 was pretty unactive until 1 day before the heist when 1JvBc sent 27 btc.
I’ve been trying to contact Dooglus to ask who
1DrJ6 and 14dXN are but haven’t been able to talk to him yet,
since that person controls addresses that directly deposit to bitdice.me(not confirmed) I would get my money out of there, just in case it turns out to be AK/DMF.
That's what I got thus far, hope this helps.
