Pages:
Author

Topic: [GOX] Crime Scene Investigation, Case #MG744 - page 12. (Read 47008 times)

member
Activity: 97
Merit: 10
what is even stranger is those 0.00777 received btc to the addresses named above, seem to have happened only recently, on February the 6th 2014 and later.

edit: the 0.00777 theory being related might be a false after checking random top 100 richlist addresses. Too many of them received exactly 0.00777 btc. (mostly on febr the 6th 2014)

Maybe it is some troll or part of how the btc protocol works, resulting in many such 0.00777 transactions
sr. member
Activity: 332
Merit: 253
member
Activity: 97
Merit: 10
This raises the question, who is lying?

In the Gox leaked crisis plan, it stated they had 2,000 Bitcoins to their name. This means either the document was false, Mark or an employee had lied in the document in an attempt to hide the funds or the firm have lost the private keys for the wallets rendering them nothing more than eye candy.

We are not claiming they didn't lose some coins legitimately to the malleability bug but there is no way that 500,000 coins could have been stolen. Even the planets worst auditor wouldn't have missed such a large amount of Bitcoins disappearing from the companies reserve.

Could this be an attempt to walk away with stashed Bitcoins or has the company been running on lies after finding out their wallets were missing funds and/or they lost the private keys.

This is exactly what i have been saying and everyone just calls me names and stuff.
If you watch the video: https://bitcointalksearch.org/topic/gox-braking-news-karpeles-admits-he-is-working-on-retrieving-cold-storage-493858
He says he has 'identified the problem' and is 'working on it'
What else could that mean other than - they screwed up their wallets/keys and are trying to fix it now.

Great work you guys are doing. If we can prove they still have the coins then something surely can be done.

There is the question remaining still, why if this is the case, he simply does not tell us and points us to the cold storage wallets. Either manipulation or gag order or blackmail or a mix of all that.
sr. member
Activity: 339
Merit: 250
This raises the question, who is lying?

In the Gox leaked crisis plan, it stated they had 2,000 Bitcoins to their name. This means either the document was false, Mark or an employee had lied in the document in an attempt to hide the funds or the firm have lost the private keys for the wallets rendering them nothing more than eye candy.

We are not claiming they didn't lose some coins legitimately to the malleability bug but there is no way that 500,000 coins could have been stolen. Even the planets worst auditor wouldn't have missed such a large amount of Bitcoins disappearing from the companies reserve.

Could this be an attempt to walk away with stashed Bitcoins or has the company been running on lies after finding out their wallets were missing funds and/or they lost the private keys.

This is exactly what i have been saying and everyone just calls me names and stuff.
If you watch the video: https://bitcointalksearch.org/topic/gox-braking-news-karpeles-admits-he-is-working-on-retrieving-cold-storage-493858
He says he has 'identified the problem' and is 'working on it'
What else could that mean other than - they screwed up their wallets/keys and are trying to fix it now.

Great work you guys are doing. If we can prove they still have the coins then something surely can be done.
member
Activity: 97
Merit: 10
additional to what i post in here before, the addresses i linked that follow the pattern of having all zeroes in front of the dot (except the first/front digit), there is a second pattern

the second pattern is, all of the addresses that were linked to the 424k proof address karpeles sent the 424k in to proof that the exchange has all funds still have at least one transaction received of exactly 0.00777 btc

additional to this, there are many of the addresses which i linked that also include both patterns.

Quoting myself from another thread

Quote from:
i already mentioned those in this thread

https://bitcointalksearch.org/topic/m.5437308


You will see that many of those wallets i linked follow two patterns.

One is all digits in front of the dot being zero (except the front digit of course)

The second pattern is, MOST of those wallets getting a 0.00777 receive transaction in.

examples

the ones that wre mentioned in that thread

https://blockchain.info/address/1P3S1grZYmcqYDuaEDVDYobJ5Fx85E9fE9 50k
https://blockchain.info/address/1cXNTyXj4xPGopfYZNY5xfSM1EPJJvBZV 40k
https://blockchain.info/address/12HddUDLhRP2F8JjpKYeKaDxxt5wUvx5nq 40k
https://blockchain.info/address/16Ls6azc76ixc9Ny7AB5ZPPq6oiEL9XwXy 40k
https://blockchain.info/address/1MyGwFAJjVtB5rGJa32M6Yh46cGirUta1K 30k


others i linked in my thread following those two patterns


https://blockchain.info/address/13ssxUjmQqemuiBfJSBsr7gFX7UWU7uXNK 20k
https://blockchain.info/address/1LDWDufjU5ATbozDZY3uChb7oPAbDaiB7K 15k

https://blockchain.info/address/1MeCzxxB8eDd17DaocFLQaQtH8seVjNM67 10k
https://blockchain.info/address/19PPeuu4jPjqtefSQ2FDgKmNJ88Z5wiuJt  10k
....
a lot more 10k cold storages following the two patterns


wasn't 777 some illuminati symbol?

I am sure we will be able to compose a full list of those 0.00777 transactions containing cold storage wallets.

Many of those will NOT be MtGox wallets as 777 is like 666 a heavily used number, not just by the illuminati, but also by satanists and master trolls

source

https://bitcointalksearch.org/topic/m.5454694


the 0.00777 pattern i read about in another thread, so i just wanted to connect this with what i figured out so far.
member
Activity: 98
Merit: 10
I'm linking in my other thread, but will post here now.
https://bitcointalksearch.org/topic/m.5456922


What tool allows me to take the ledger on disk and parse out records...I read from the paper i mentioned there is some python tool from Gavin.  Can anyone point to the specific script please.
zyk
full member
Activity: 224
Merit: 101
hero member
Activity: 588
Merit: 501
Have you looked at this analysis?

Devon Weller • 2 days ago

"I followed the 500,000 BTC for a bit beginning at https://blockchain.info/tx/b26....

The coins go through a sequence of events, where the majority is sent to a fresh address and a small bit is sent away from Mt.Gox. This repeats a few times until the majority is paid back to the main Mt.Gox address.

This happens several times, until this transaction:

https://blockchain.info/tx/478...

Here is where it starts to get interesting.

What's left of the 500,000 (429.9k) is split into roughly half and sent to 2 new address. And then each of those address splits the coins in half and sends to two new address.

The end result is that the 429k was split again to many address which each now contain less than 1,000 BTC each. I stopped following the transactions there.

Why take 429k and split it into many addresses each containing less than 1,000 BTC each?

I'd like to see someone trace all of these coins and see if they end up coming together somewhere."

End
-----------------------------------------------------------------------------------------------------

Wow My amateur 10 mins on blockchain might have been on the right track. Maybe tomorrow I should actually learn about this stuff then start following this.


That's good and it certainly counts.   As people examine various parts of the block chain many things will be discovered, most of which will be rather easy to explain some of which won't but all of it will be necessary to examine. 

The more we know the less we we need to blindly trust.
hero member
Activity: 644
Merit: 500
One Token to Move Anything Anywhere
Have you looked at this analysis?

Devon Weller • 2 days ago

"I followed the 500,000 BTC for a bit beginning at https://blockchain.info/tx/b26....

The coins go through a sequence of events, where the majority is sent to a fresh address and a small bit is sent away from Mt.Gox. This repeats a few times until the majority is paid back to the main Mt.Gox address.

This happens several times, until this transaction:

https://blockchain.info/tx/478...

Here is where it starts to get interesting.

What's left of the 500,000 (429.9k) is split into roughly half and sent to 2 new address. And then each of those address splits the coins in half and sends to two new address.

The end result is that the 429k was split again to many address which each now contain less than 1,000 BTC each. I stopped following the transactions there.

Why take 429k and split it into many addresses each containing less than 1,000 BTC each?

I'd like to see someone trace all of these coins and see if they end up coming together somewhere."

End
-----------------------------------------------------------------------------------------------------

Wow My amateur 10 mins on blockchain might have been on the right track. Maybe tomorrow I should actually learn about this stuff then start following this.
hero member
Activity: 588
Merit: 501
-snip-

I think the work you have been doing is invaluable and I would hope (but have no confidence!) that the Bitcoin Foundation has already put expertise into this to provide to investigators.

I strongly advise you to work with the other members of the community who have been putting so much effort into this and gather the information into a report, to send to the Japanese officials in charge of administering Mt Gox.


Yes, multiple efforts need to be mounted from many different directions for many different reasons. 

- the main reason is to make the Mt Gox users whole so that no one looses,
- but also to show the world that the cryptocurrency system in general and the bitcoin system specifically works, that it can protect itself and can be self governed
When a department store's security department finds a thief they turn them over to police, who in turn turn them over to prosecutors, who in turn turn them over to prisons.

This is an opportunity for btc to be taken seriously on a totally different level


hero member
Activity: 644
Merit: 500
One Token to Move Anything Anywhere
-snip-

I think the work you have been doing is invaluable and I would hope (but have no confidence!) that the Bitcoin Foundation has already put expertise into this to provide to investigators.

I strongly advise you to work with the other members of the community who have been putting so much effort into this and gather the information into a report, to send to the Japanese officials in charge of administering Mt Gox.
hero member
Activity: 588
Merit: 501
http://www.hackingdaily.com/2014/02/mtgox-speculations.html

An IRC log posted on Pastebin on June 23rd 2011 there is an insight to some of the 'missing coins'. Here is an important snippet from the logs;

MagicalTux: 432109.87654321 is that pattern random, or was it chosen deliberately?
by patern I mean the fact that it looks like a countdown
probably deliberate so it would be easy to search for
go1dfish: it's deliberate
want me to do it again? Smiley
MagicalTux: yes, if you could send like a tiny amount to an address someone throws out
that would do a huge amount to restore confidence
I broke out the 432109.87654321 already
but I'll make a new one
I wonder if I've reclaimed my account correctly...
do .424242
xelister: 424242.42424242 ?
yeap
just need to see a transaction happen from an account with a huge balance with an amount listed here to an address listed here
connecting the offline storage and decrypting on a firewalled system~
1AbTRVrRYGri1sZvqHBadnXaCHkuXJtV5N
I'll make the transaction and push it manually
this would completely restore a lot of peoples faith
MagicalTux: post an address and I'll send you an amount
MagicalTux, to get the "free month of trading" thing, will that be automatically done based on rolled back trades or do we have to apply somehow?
Ooofo: it'll be automatic
awesome
I got all the data of all the affected users here
go1dfish: no, not practical
ok
go1dfish: I'll send 424242.42424242 bitcoins from a bunch of 50kBTC addresses (and maybe on 42kBTC) to one
well, two actually
one will get the 424k, the other one will get the change
ok, yeah all transactions get split that way as I understand it
ready guys? Don't come after me claiming we have no coins after that
hopefully I'll be able to work without getting too much disturbed after that~
yeah, ready
MagicalTux: wasn't your last tx 432K btc? lost 8k?
no
thats just the amount someone suggested
(the 424242)
ah
42 is the answer
to everything
42 is my password!
lol
hehe ic
42 is the solution to every block to
wait what's going on, is he proving he has our bitcoins still?
shit I just ruined the economy
what does this help
theres a lot of people crying wolf saying gox doesnt have their btc anymore
don't send them to the bitcoin eater please Smiley
mabus: tux is shuffling large numbers of bitcoins to show they are still under his control
anyway, going to send to 1eHhgW6vquBY... the 424242.42424242 btc


We can see from the above log the community were questioning Mark about the amount of Gox claim to have held in 2011 and wanted proof he owned a large amount. We can see that he agreed to send 424242.42424242 to an address beginning with 1eHhgW6vquBY. Funny enough, we've located said transaction and confirmed it happened. It can be seen in the following.

https://blockchain.info/tx/3a1b9e330d32fef1ee42f8e86420d2be978bbe0dc5862f17da9027cf9e11f8c4

The above transaction shows that Gox, at least at one point in time, had a large sum of Bitcoins.

Digging further into the transactions we can see that a few weeks later the large amount of Bitcoins are broken into a smaller amount and placed into two address as seen below;

https://blockchain.info/tx/7a2a6f66e87ed4e72d85ba7a82eda1572605c3330c461e171f58d7ff2763ac63


We can only assume as this point that this address also belongs to Gox.

A short time after this, a transaction occurred which broke the large amount of Bitcoins into wallets, each containing 50,000. We don't know the exact reasoning for this but we can presume they were possibly being moved into cold storage separately.

2 months after this, a transaction occurs from within the addresses that still are connected to Gox which transfer batches of 50,000 into a larger sum of 500,000 apart from 1 address which still contained 50,000 which can be seen below;

https://blockchain.info/tx/29a3efd3ef04f9153d47a990bd7b048a4b2d213daaa5fb8ed670fb85f13bdbcf


If we follow the 500,000 Bitcoin wallet, we can see that they make a large transaction of nearly all of the coins are made and sent to a wallet publicly belonging to Gox on the Blockchain as seen below. This can only prove our theory that Gox had been in control of the coins the whole time.

https://blockchain.info/tx/b269bf1b82dae8a61f7f91dbf7a9d807e30963c1ae00ddd95a8faebea6d0a007


The 50,000 address we mentioned earlier then split the coins into a batch of 40,000 and a batch of 10,000. This wallet also was under the control of Gox and the 40,000 Bitcoin address still remains there, untouched, since 2011.

https://blockchain.info/address/1cXNTyXj4xPGopfYZNY5xfSM1EPJJvBZV


When the wallets had combined to sent the 500,000 + 50,000, there was a wallet which wasn't included and this wallet, to this day, still has 50,000 Bitcoins in the wallet which are unspent.


https://blockchain.info/address/1P3S1grZYmcqYDuaEDVDYobJ5Fx85E9fE9


We can see that all of the mentioned addresses clearly belong to Gox and after slightly digging through them we can see they have 90,000 Bitcoins which have been there since 2011. I'm sure if we dug further and investigated more we would be able to find much more Bitcoins.

This raises the question, who is lying?

In the Gox leaked crisis plan, it stated they had 2,000 Bitcoins to their name. This means either the document was false, Mark or an employee had lied in the document in an attempt to hide the funds or the firm have lost the private keys for the wallets rendering them nothing more than eye candy.

We are not claiming they didn't lose some coins legitimately to the malleability bug but there is no way that 500,000 coins could have been stolen. Even the planets worst auditor wouldn't have missed such a large amount of Bitcoins disappearing from the companies reserve.

Could this be an attempt to walk away with stashed Bitcoins or has the company been running on lies after finding out their wallets were missing funds and/or they lost the private keys.
sr. member
Activity: 476
Merit: 250
Would it help to make a directory of every Btcoin address that has been used to send coins to Gox?

I have a few addresses they gave me.

Is it possible to follow the path like that?

Mt Gox was the first exchange, I'm told it started in 2009, at that time on the block chain there should be very few entries as compared to now, so although you can work backwards from now that out again, you can also pretty much start at the beginning.  

My guess is many people, over time, will give their mt gox address to help connect the dots

Given that MG was the first and the biggest exchange a lot of major activity pointing to any single direction will probably be them.  
It was estublished as trading magic cards at 2009. but as a bitcoin exchange mtgox started at 2011. When mark bought it from caleb.
hero member
Activity: 588
Merit: 501
So who stole $300,000,0000 USD worth of Bitcoins and got away with it?

PRIME SUSPECTS:

All Mt. Gox staff:

Mark Karpeles
Gay Butchery Gonzales
+ the rest

ROUND EM UP, LIE DETECTOR THEM


you might be right, but what if you are wrong?

the block chain can help you find the truth, the block chain has the answer
sr. member
Activity: 339
Merit: 250
February 28, 2014, 10:28:00 PM
#14
So who stole $300,000,0000 USD worth of Bitcoins and got away with it?

PRIME SUSPECTS:

All Mt. Gox staff:

Mark Karpeles
Gay Butchery Gonzales
+ the rest

ROUND EM UP, LIE DETECTOR THEM
hero member
Activity: 588
Merit: 501
February 28, 2014, 10:26:28 PM
#13
Would it help to make a directory of every Btcoin address that has been used to send coins to Gox?

I have a few addresses they gave me.

Is it possible to follow the path like that?

Mt Gox was the first exchange, I'm told it started in 2009, at that time on the block chain there should be very few entries as compared to now, so although you can work backwards from now that out again, you can also pretty much start at the beginning. 

My guess is many people, over time, will give their mt gox address to help connect the dots

Given that MG was the first and the biggest exchange a lot of major activity pointing to any single direction will probably be them. 
hero member
Activity: 588
Merit: 501
February 28, 2014, 10:14:40 PM
#12
Quote from:

I think you have shown how evidence can be used to shape a case, however to be fair to all parties the forensics really must start at the beginning and go where it leads, my guess it many interesting things will be found.


Based on what you found Mt Cox will have to account for those transactions -- they may all be legit, all illegit, or some mixture the point is we know where they came from and MG must make an accounting.  Whatever he can't account for must be assumed that he has control over.



I think the main point is, if those addresses could in any way be linked to MtGox, then the coins cannot be stolen.

No thief would be dumb enough to sell all coins in one big chunk to a single entity that is also so  incredibly stupid to keep the coins as one single chunk in one address stored.

If the above addresses are in any way linked to gox, then the coins are retrievable.




You mentioned "one single chunk" you uncovered and delineated several big chunks.  

I suspect the road to finding what happened to be long and hard, but it it's short and smooth, that better for everyone.  

sr. member
Activity: 339
Merit: 250
February 28, 2014, 10:13:35 PM
#11
Would it help to make a directory of every Btcoin address that has been used to send coins to Gox?

I have a few addresses they gave me.

Is it possible to follow the path like that?
member
Activity: 97
Merit: 10
February 28, 2014, 09:36:46 PM
#10
Quote from:

I think you have shown how evidence can be used to shape a case, however to be fair to all parties the forensics really must start at the beginning and go where it leads, my guess it many interesting things will be found.


Based on what you found Mt Cox will have to account for those transactions -- they may all be legit, all illegit, or some mixture the point is we know where they came from and MG must make an accounting.  Whatever he can't account for must be assumed that he has control over.



I think the main point is, if those addresses could in any way be linked to MtGox, then the coins cannot be stolen.

No thief would be dumb enough to sell all coins in one big chunk to a single entity that is also so  incredibly stupid to keep the coins as one single chunk in one address stored.

If the above addresses are in any way linked to gox, then the coins are retrievable.

hero member
Activity: 588
Merit: 501
February 28, 2014, 09:27:07 PM
#9
Pages:
Jump to: