Pages:
Author

Topic: [GOX] Crime Scene Investigation, Case #MG744 - page 7. (Read 47008 times)

hero member
Activity: 588
Merit: 501
http://www.coindesk.com/gox-money-moving-through-block-chain/


$113m in Gox Money Believed To Be Moving Through Block Chain

Danny Bradbury (@dannybradbury) | Published on March 7, 2014 at 23:24 GMT | Blockchain, Companies, Exchanges, Mt. Gox, News,
 


Large amounts of bitcoins previously handled by Mt Gox, which have lain dormant for years, have started moving on the block chain.

Since the exchange blew up at the end of last month, people have been wondering where the stolen coins went, and have tried to trace some movements between Gox addresses. One participant on the bitcoin talk forum recalled an IRC conversation between Gox CEO Mark Karpeles and various users, which allegedly took place on June 23, 2011.

During their conversation, Karpeles (a.k.a. MagicalTux) offered to demonstrate that the exchange owned large numbers of coins, by sending a uniquely identifiable amount to a given address. He sent 424242.42424242 bitcoins to a specific address beginning with 1eHhgW6vquBY. Sure enough, they showed up.

A few weeks later, that large amount of bitcoins was broken into two smaller amounts. Then, more transactions occurred, peeling off 50,000 bitcoins at a time into separate wallets, possibly as a means of moving them into cold storage.

Most of these 50,000 bitcoin wallets were recombined on 16 November, 2011, into two separate wallets. One of these contained 500,000 bitcoins, while the other contained 50,000.

The 50,000 bitcoin address was created on that date, and was then dormant until July, 2012, when it began receiving small transactions along with several other outputs. However, no coins left that wallet, until today, when its 50,000 bitcoins were sent to another address, as part of outputs from various bitcoin addresses totalling 180,000 bitcoins ($113 million).

Since then, these coins have been rapidly splitting, with coins being subdivided repeatedly. One branch was found to have been splitting every 30 minutes in what appeared to be an automated fashion. This suggests that there may be some code splitting the coins.

We don’t know for certain that the 50,000-bitcoin address is indeed owned by Mt Gox, but it seems likely. The other, larger, wallet went through several transactions, with the bulk of the coins being sent to an address that was verified as Mt Gox-owned on the block chain.

The leaked Mt Gox crisis strategy document claims assets of 2,000 bitcoins, contained in a hot wallet, adding that the cold storage had been wiped out.

Why now?

So, why is this happening now? One explanation is that it makes the coins easier to use for a high volume of transactions. When bitcoins are sent, all the funds held in a particular address are sent, and the ‘change’ – the part that is surplus to requirements – is sent to a change address, usable by the sender. However, the block chain has to confirm that the change has been returned before it can be reused.

If you were to try and send bitcoins to lots of users very frequently from one address containing a lot of bitcoins, then you would have to wait 10 minutes or more for the block chain to confirm your returned change, before conducting your next transaction.

Core bitcoin developer Gregory Maxwell also suggested that this was a Mt Gox transaction, based on interactions that he had with the Mt Gox API.

Maxwell also argued that the splitting behaviour is consistent with a function in the leaked source code from Mt Gox. This suggests that some of the coins have been dropped into the Mt Gox online wallet, and that the system is now automatically breaking them up, he said.
member
Activity: 74
Merit: 10
If it's actually using the splitBigOutputs() function they should end up in 30k different addresses holding less than 10 BTC each.
It seems that exactly this happened. The addresses that already are down to below 10 BTC have stopped splitting. Others that still contain more are continuing to split. I think this implies pretty strongly that Gox still controls the coins. The good thing is that they still exist. That bad thing is that they chose to lie about it so they probably weren't planning on returning them..
sr. member
Activity: 294
Merit: 250
Someon on Reddit made a binary tree of the coins. It's a beautiful thing, I take no credit,I just stole it.



Its so beautiful  but it makes me feel Grin Cry Honestly been waiting to start seeing the abstract art in bitcoin come to life.

I guess that's the one good thing to come from this goxxing.
sr. member
Activity: 364
Merit: 250
American1973
[...]

as the Edward Snowden of cryptocurrency.

[...]

I would like to see EDWARD HIMSELF, become the Edward Snowden of cryptocurrency, unless he is a technical dumbshit?  Why does this man get to sit back as "Admin Prime" and not give his in depth opinion about tech in general?

Edward:  In order to remain smart, you need to show your smartness, not just run and hide.  This is hilarious, we have a technical revolution front with a leader who lives in a Marxist country and has ntohing to say about theft in general.

I am not convinced that Edward Snowden has much ability to analyze any fucking thing except his own definitions of America, which I MIGHT share, if he or any of these supposed heroes, would fucking step to the mic and TALK.

Anyway, TBI used to mean Throttle Body Injection like what puts fuel into my Chevy.  Now TBI means Two Bit Idiot, and I like that.  Go man.  Go.  Because when smart people speak up, it becomes obvious how few smart people are in charge.
hero member
Activity: 588
Merit: 501
Whistleblower Threatens to Expose Corruption at Bitcoin Foundation
http://valleywag.gawker.com/whistleblower-threatens-to-expose-corruption-at-bitcoin-1538965958/@laceydonohue



If a breathless car chase wasn't cinematic enough to make you care about Bitcoin, how about a whistleblower threatening to publish an expose about corrupt elders and ominously signing off: "You have 72 hours"?

An "entrepreneur and former venture capitalist" who goes by the handle the Two-Bit Idiot declared "war" today in a blog post entitled Coup or Death for the Bitcoin Foundation? The blogger, whose name is Ryan Selkis, previously talked to Fortune's Dan Primack about leaking documents about Mt. Gox. In today's post, he threatened to publish a searing expose on Monday unless two of its board members resign. TBI also claims that the foundation's corporate sponsors "discouraged" him from airing Bitcoin's filthy laundry.

According to TBI, chairman Peter Vessenes and executive director Jon Matonis are not "ethically entitled" to retain their board seats in the Seattle-based non-profit because conflicts of interest and gross negligence. The most damning allegations are related to the disastrous implosion of Mt. Gox. In the early days, Mt. Gox was the largest Bitcoin exchange and a tent pole for the budding economy, hiding questionable practices.

TBI says Vessnes and Matonis got their money out through connections with Mt. Gox CEO Mark Karpeles, while $473 million swirled down the blockchain drain (emphasis mine):

On Monday, I plan to publish a full article which elaborates on these damning facts and much more:

1) The Foundation never once warned Bitcoin investors about keeping deposits in Mt. Gox, despite clear red flags dating back to at least April 2013. Nor did the Foundation craft or advocate for best practices such as technical transparency, deposit audits, or appropriate consumer protection disclosures. This was a colossal failure of leadership.

2) There is evidence that Bitcoin Foundation board members may have had direct access to Mark Karpeles which allowed them to personally deposit and withdraw funds from Mt. Gox, despite persistent delays for other customers.

3) There is a troubling and inappropriate overlap between Peter Vessenes' staff at his private company, CoinLab, and the Bitcoin Foundation's staff, which goes far beyond shared office space.

4) The current leadership has shown a stunning disregard for proper communications with its members. The importance of immediate resignations (rather than gradual) is highlighted by the Board's secret plans to move the Foundation's headquarters to London without input from members and sponsors.

5) Peter Vessenes has had a nine month conflict of interest regarding Mt. Gox given that his company CoinLab was involved in an active multi-million dollar lawsuit against Mark Karpeles and Mt. Gox, following a failed partnership. Both men remained on the board of directors, and the Foundation failed to draft adequate by-laws that would allow them to address situations such as this where directors had material conflicts, which would compromise their ability to act in the best interests of its members.

This egregious behavior and negligence may not be the worst of the information to come. I have been unable to reach representatives of the Foundation for comment on a myriad of other accounting issues related to the treatment of member donations.
True believers like to tout the fact that Bitcoin is intentionally decentralized, so an industry group like the foundation is about as close to an authority figure or overseer as you're going to get. The agency's website says:

Bitcoin Foundation standardizes, protects and promotes the use of Bitcoin cryptographic money for the benefit of users worldwide.

TBI claims Vessenes and Matonis are at fault, rather than the foundation itself. But it's worth noting that both Krebeles and Charlie Shrem, the indicted founder of BitInstant, were formerly board members:


And for better or for worse, with all of its blue-chip sponsors and leading role to date in events such as the Senate Bitcoin hearings and NYDFS BitLicense hearings, the Foundation is the mouthpiece for the entire industry.

Peter Vessenes and Jon Matonis are not scapegoats. They are not innocent bystanders. And they are not ethically entitled to remain in their board seats through later this year.


TBI also claims that the foundation's corporate sponsors told him to keep his mouth shut, but doesn't name said sponsors. This list of platinum, gold, and silver foundation members mainly includes Bitcoin startups. Previous donors to the foundation include Wordpress and Fred Wilson from Union Square Ventures. Among investors, the most prominent and full-throated support has come from Andreessen Horowitz, which recently invested $25 million in Coinbase.

From TBI's blog post:

At this week's Texas Bitcoin Conference, I was fortified by near-unanimous agreement (and, at times, applause) that the current leadership must resign or be forced out of their positions on the Foundation. Yet I have also been warned that I am playing a dangerous game, with cunning and ruthless power brokers. I have been discouraged by corporate sponsors of the Foundation not to make a public stink which would be "counter-productive" and "irresponsible" for Bitcoin. Most would prefer to let the Mt. Gox scandal blow over, but I would rather wipe the slate clean definitively, blood or no.
TBI describes himself as a "truth-teller," making "the business case for #Bitcoin on its journey from speculative investment to world-changing utility" and clearly sees himself as the Edward Snowden of cryptocurrency.

What if someone spends Bitcoin to take him out before he can send documents to The Wall Street Journal, The New York Times, and others? TBI's got it covered:

If I get hit by a bus this weekend, my lawyers will release it.
If you have any information to share about the Bitcoin Foundation, please email [email protected].

Update: A previous version of this post said TBI was anonymous. His name is Ryan Selkis, as he acknowledged in this interview with Fortune.
hero member
Activity: 588
Merit: 501
That chart is exactly what the customers of MtGox need to be doing.  We have nothing but rumors, "leaked" documents, IRC chats and official legal documents to work with.

But as we all know, every bitcoin transaction can be tracked on the blockchain and those are the only  FACTS!

So far, this is getting me rather excited today.

Yes, keep to facts and evidence. Discard the noise (''leaked'' documents, irc chats, etc.). Just keep tracking coins.


the funny thing about investigation is sometimes patterns reveal evidence that is not otherwise obvious, sometimes 'side conversations' enable words, phrases, and opinions to be heard in different or more enlightening ways, and just like reading the same study material the 4th time extracts the 'a ha' moment the first 3x didn't.

if everyone contributes what they can, how they can, it will all come together
sr. member
Activity: 378
Merit: 250
Born to chew bubble gum and kick ass
That chart is exactly what the customers of MtGox need to be doing.  We have nothing but rumors, "leaked" documents, IRC chats and official legal documents to work with.

But as we all know, every bitcoin transaction can be tracked on the blockchain and those are the only  FACTS!

So far, this is getting me rather excited today.

Yes, keep to facts and evidence. Discard the noise (''leaked'' documents, irc chats, etc.). Just keep tracking coins.
newbie
Activity: 11
Merit: 0
That chart is exactly what the customers of MtGox need to be doing.  We have nothing but rumors, "leaked" documents, IRC chats and official legal documents to work with.

But as we all know, every bitcoin transaction can be tracked on the blockchain and those are the only  FACTS!

So far, this is getting me rather excited today.
hero member
Activity: 644
Merit: 500
One Token to Move Anything Anywhere

Someon on Reddit made a binary tree of the coins. It's a beautiful thing, I take no credit,I just stole it.


Looks like those coins are partying away in there, oblivious to all the distress they're causing.
hero member
Activity: 588
Merit: 501
Someon on Reddit made a binary tree of the coins. It's a beautiful thing, I take no credit,I just stole it.


hero member
Activity: 588
Merit: 501
Why are we not talking about the fact that the huge transaction is made up of goxcoins?

the input for the 50k is 1 address away from the 550k address that karpeles used.


=====

update:
relevant thread http://www.reddit.com/r/Bitcoin/comments/1zsw1k/while_the_press_is_focused_on_satoshi_180000/

=====




from reddit:
"More importantly, the ฿50,000 output here is zero transactions away from the ฿550,000 proof of reserves that Tux signed back in 2011: https://blockchain.info/address/1P3S1grZYmcqYDuaEDVDYobJ5Fx85E9fE9

That ฿550k transaction was made by Karpeles. The ฿50k output has been sitting there untouched since 2011."

more:

"the 424,242.42 transaction made by karpeles is only 3 transactions away from the address of this transaction (!!!) https://blockchain.info/address/1eHhgW6vquBYhwMPhQ668HPjxTtpvZGPC

these very well may be goxcoins..

source: http://www.reddit.com/r/Bitcoin/comments/1zsjnu/i_believe_karpeles_not_satoshi_caused_the_days/"


wut
member
Activity: 74
Merit: 10
Seems like it's mostly finished already. Some branches went all the way down to addresses with less than 30 BTC, while others stopped at over 2000 BTC. Can't really think of any reasonable logic behind it. Mark does seem to like random functions though, so maybe it just randomized how far each branch was divided.

Some branches like this are still going if someone wants to follow the money:
https://blockchain.info/address/1ASkFuM3ZNU7TPqHNuDTpJch22o5FRPXxS
newbie
Activity: 11
Merit: 0
"Understand, though, that if it stops at 30k addresses with 10BTC in each this could be interpreted as a positive sign, as it would mirror what looks like Gox's hot wallet loading procedure."

I fully agree and that is why I am so excited about this new development.  We can only hope...
sr. member
Activity: 364
Merit: 250
American1973
Understand, though, that if it stops at 30k addresses with 10BTC in each this could be interpreted as a positive sign, as it would mirror what looks like Gox's hot wallet loading procedure.

If it keeps going then I suppose we keep watching, with a sinking feeling.  Undecided

Fingerprint-capture every moment of the blockchain now, robotically.  There are many smart people out there and they will follow the coins like in the Pirates(tm) movies, they will never stop analyzing the blockchain.

Also, indeed, if the Goxxies spent their energy hack SHA-256, they would probably have it done long before the BTC blockchain reaches event horizon.  I think the collegiate-papered-cryptohackkids have a new method now, and they have gotten SHA-256 from 24 rounds to 55 rounds or something, that's a doubling in 3 years?  So, indeed the investors have a technical bottled genie now.  I would say bots will subsume and own the BTC blockchain soon, and this future, is being seeded now, with 10% of the coins being "ghostcoins", essentially lost forever?

What future does it portend?  Well, as Yoda would say: "Always in motion is the future."

But at that point in the Jedi tale, Yoda has already massively lied to the kid anyway, LOL.

Anyway, I will hold BTC and other crypto long.  That is my disclaimer.
hero member
Activity: 644
Merit: 500
One Token to Move Anything Anywhere
The coins are now in several hundred new addresses with 300-2000 BTC each. If it's actually using the splitBigOutputs() function they should end up in 30k different addresses holding less than 10 BTC each.
This.

Yes probably u are right, it's really unfortunately for all people who lost btc in that way.

Understand, though, that if it stops at 30k addresses with 10BTC in each this could be interpreted as a positive sign, as it would mirror what looks like Gox's hot wallet loading procedure.

If it keeps going then I suppose we keep watching, with a sinking feeling.  Undecided
sr. member
Activity: 364
Merit: 250
American1973
@ Finnminer nice post and yes coincidence indeed.

This.  Nice sleuthing Finnminer.
member
Activity: 72
Merit: 10
The coins are now in several hundred new addresses with 300-2000 BTC each. If it's actually using the splitBigOutputs() function they should end up in 30k different addresses holding less than 10 BTC each.

the more the coins are handled the more foot/finger prints are made visible and the more connections could be made

for example, in order to mix you must go to a mixer their computer records will show the coins going in by x isp at y timestamp

that mixer will either cooperate or be materially embroiled in a criminal investigation

now with that isp as the finger print you could look for other places where that isp has engaged other mixers, exchanges, etc ...

eventually the electronic finger prints and foot prints will lead to humans who will need to explain.  If the prints are MK, MG employees, and or relatives of either arrests would be.

AND, whatever "mixer" it would be - it would have to have an at least about equal amount of BTC at the time of mixing to be able to cover any tracks... If 200K + 1K per day go in and 201K go mixed out, this is quite traceable, too.
hero member
Activity: 588
Merit: 501
The coins are now in several hundred new addresses with 300-2000 BTC each. If it's actually using the splitBigOutputs() function they should end up in 30k different addresses holding less than 10 BTC each.

the more the coins are handled the more foot/finger prints are made visible and the more connections could be made

for example, in order to mix you must go to a mixer their computer records will show the coins going in by x isp at y timestamp

that mixer will either cooperate or be materially embroiled in a criminal investigation

now with that isp as the finger print you could look for other places where that isp has engaged other mixers, exchanges, etc ...

eventually the electronic finger prints and foot prints will lead to humans who will need to explain.  If the prints are MK, MG employees, and or relatives of either arrests would be.



member
Activity: 70
Merit: 10
The coins are now in several hundred new addresses with 300-2000 BTC each. If it's actually using the splitBigOutputs() function they should end up in 30k different addresses holding less than 10 BTC each.
This.

Yes probably u are right, it's really unfortunately for all people who lost btc in that way.
member
Activity: 74
Merit: 10
The coins are now in several hundred new addresses with 300-2000 BTC each. If it's actually using the splitBigOutputs() function they should end up in 30k different addresses holding less than 10 BTC each.
Pages:
Jump to: