My email
[email protected] was last accessed from 62.113.219.5 on July 13. The password has not been changed by the hacker (but I have changed just now).
There was an auto-forwarding to
[email protected] (which is another email address of mine). However it has been changed to
[email protected] (which is the email that was used to send the "Bitcoinica is done" email to
[email protected]). Of course I couldn't be notified about any email since the change.
The email account had a heavily-reused password (for the sites that I don't intend to share any private data), *at least* it was used on LinkedIn and many other websites.
I have several email communications between stevejobs807@gmail and other email accounts controlled by me, including a testing ticket for Bitcoinica's ZenDesk trial. The email address has never been publicised.
Important discovery in recent emails (all times are in UTC+8):
The hacker registered a Liberty Reserve account U9236056 at Jul 12, 2012 9:42 PM.
There was several emails from Liberty Reserve mentioning "Verification PIN". It can be seen that the liberty reserve account was accessed by at least: 78.108.63.44, 212.84.206.250 and 31.172.30.1.
There were many transactions done at F1ex.com, possibly used to launder Bitcoin. (I checked just now, F1ex.com provides anonymous fixed-rate BTC exchange service.)
The hacker signed up for OKPAY, with IP 31.172.30.1.
The hacker requested a sell-order on AurumXchange, totalling $5000, using the suspicious Liberty Reserve account mentioned by OP. A Chinese bank account was used (Account name: LIU HAIPENG, Account number: 6222020903006086032, Bank: INDUSTRIAL AND COMMERCIAL BANK OF CHINA).
Order link:
https://www.aurumxchange.com/order/view/34011/e5b466248e041ebdf2ae793181a840dcThe hacker has also opened a ticket under his own name:
https://www.aurumxchange.com/help/ticket.php?track=NLY-9AG-E468&Refresh=24195He mentioned that I sold him the Mt. Gox codes at half price, which is absolutely not true. It seems that the hacker was trying to relate this event to me as an individual, and this possibly explains the reason that he wanted to "hijack" the email account. All my other email accounts did not have any suspicious access records and their passwords are all secure and different.
This is my *own* genuine transaction at AurumXchange:
https://www.aurumxchange.com/order/view/33100/3c05a9a572379bf91620302cc9dd7d22And my ticket to question the funds:
https://www.aurumxchange.com/help/ticket.php?track=J6W-EY3-ZY2U&Refresh=47091It's important to note that the first time I gained any knowledge about the email being misused is through this thread. Neither AurumXchange nor Mt. Gox has provided me any specific information about the suspicion. Otherwise I could have checked that email account earlier.
I'm willing to co-operate with any ongoing investigation and obviously I'm not trying to run away from this. I have already provided Mt. Gox with my certified copy of passport in an attempt to unlock my account with some Bitcoin balance.