Topic: Using leaked data to uncover the max amount of transaction malleability fraud (Read 1943 times)

I have thought about this.   I think that using the file is OK for preliminary inquries to get a feel for the database.   The problem we are going to run into is that since it is leaked data it won't be admissable in court even if the data is complete and accurate.  We have reason to believe it may not be accurate because certain columns are missing.   Also any leak that contains wallet stealing malware should be treated with a large grain of salt.    We are going to have to analyze the block chain first and identify TM transaction candidates and then dig deeper from there.   I've been discussing this on Reddit.   I got some suggestions from their users


[–]andypagonthemove 2 points 1 day ago

I think you'd be better looking at Ken Shiriff's blog. (www.righto.com I think. Google it) He explains how to spot TM in the blockchain using push2 (I forget the details, but you'll see what I mean). A better methodology would be to link those transactions back to user accounts rather than speculate over withdrawal patterns that might result in false accusations.

and another user said we should look at the blockchain and try to identify cloned transactions. Here is what Inovy said:

[–]lnovy 2 points 21 hours ago

You are doing it wrong™.

What btc_xfer_report cointains are rows of internal balance sheet for users bitcoin wallet. There are 6 possible type of record in this table: withdrawal, deposit, in, spent, out, earned and fee. We were leaked only record of type withdrawal and deposit and I also presume that some rows are either missing or the database from tainted. Account balance was counted as a sum of all rows of specific wallet and therefore if there were a successful double withdrawal performed on it and both two record would be present in a table, account balance would show this and no possible loss of coin was possible. What was actually done is that the first row was deleted to cancel the transaction and new one was inserted to force a new bitcoin transaction to be broadcasted.

Other things that you were not aware of include internal transactions which were done outside of blockchain. You should also match found transaction which you presume to be a clone to it's two versions in blockchain.

is it really possible to make the calculations this way? is the whole data there or this will be just an assumption?

I agree with what you said.    When you get down to it, beyond all the technology, we are dealing with issues that are fundamentally human.   Who is the real "Robert Marie Mark Karpeles" beneath all that adipose tissue?  What is his nature?  What does he do?  

He lies.  He is a liar.  That is what he does.  First and foremost.   That is his nature, his criminal nature.  He never accepts responsibility for any of his actions and scapegoats others.  He has zero empathy for human beings.   Even when it was evident that his exchange was insolvent he never warned people and unconscionably continued to accept new deposits while simultaneously disallowing withdrawals.  In this case he scapegoated bitcoin itself by saying that bitcoin had a "bug" in the protocol and as such he wasn't responsible for unbelievably massive losses that he knows are fabrications.  He is currently moving 180k bitcoins possibly to circumvent an asset freeze. http://www.forexnews.com/blog/2014/03/07/behind-historical-180000-bitcoin-transfer-mtgox-satoshi-early-adopter/

From the article:
In this regard, such an event could mean both positive or negative connotations.  Among those that believe that MtGox is in control of missing customer bitcoins but had lost private keys of its cold storage addresses, today’s transactions could be interpreted as them achieving success in reaccessing a portion of those funds.  On the other hand, the transactions may be the result of insiders shuttling funds out of the company’s control before a court ordered liquidation seizes control of all assets. -


When his exchange was hacked in June 2011, he claimed "force majeure" as if the hack was an "Act of God."   In the post he demonstrated a callous disregard for the victims saying "I'd prefer being working on 'Stuff that matters®.'"  https://bitcointalksearch.org/topic/mtgox-and-void-trades-force-majeure-20535 He declared trades invalid and oddly said, "we resisted most hack attempts, this one was 'strong' enough to go through."   He demonstrated a misunderstanding of the law that is revealing.  He uses the word criminality when what happened in that case was cause for a civil action, not a prosecution.  Strangely he was concerned with criminal liability even though that wasn't in the cards.   This misplaced concern may stem from an earlier episode that shaped his life, forcing him to flee France for another country.   His blog (now removed) was titled "Magical Tux in Japan." "Geekness brought me to Japan!"  The truth was his criminal conviction in France for "computer fraud" made it difficult to continue to swindle others.  Hence the move to Japan.  

Please take a moment to read the following two articles:

1. Robert Marie Mark Karpeles is a criminal convicted of "computer fraud" in  France who fled that country to live in Japan
source: http://gawker.com/does-mt-goxs-ceo-have-a-secret-history-of-online-payme-1534752110

2. Robert Marie Mark Karpeles is a con artist who preys on others. The Mt. Gox "bankruptcy" will be his biggest scam yet. One half of a billion dollars scammed from customers.
source: http://www.cryptocoinsnews.com/2014/03/03/exclusive-tibanne-co-ltd-sentenced-2013-mark-karpeless-lies-new/

Mark Karpeles, CEO of Mt. Gox is claiming in sworn bankruptcy declarations that 750,000 bitcoins (roughly half of a billion dollars) were lost due to transaction malleability.   He falsely claims that transaction malleability is a "bug" in bitcoin and that the money was lost through no fault of his own.  In fact transaction malleability is a known issue since 2011 and is handled without difficulty by most implementations of Bitcoin.   There has no doubt been some losses due to his poor implementation of bitcoin from transaction malleability but it is impossible to believe that a significant fraction of 750k bitcoins could have been lost this way.  

This bankruptcy is not a liquidation.  http://www.scribd.com/doc/212476729/Chapter-15-Petition-Filed-by-Mark-Karpeles It is a Chapter 15 reorganization very similar to Chapter 11 reorganization.   Only Mt. Gox KK has filed for bankruptcy.   The parent company Tibanne, and its US subsidiary mutum sigillum LLC have not filed for bankruptcy.  Nor has Mt. Gox the Delaware corporation filed for bankruptcy.  Mark Karpeles has not filed for individual bankruptcy either.  All of this taken together means that Mark Karpeles is likely planning to use this bankruptcy of one isolated entity to clear all debts and then reopen the exchange under a new name in order to fleece everyone again.  He recently registered the domain Gox.com and is planning to relaunch the exchange under a new brand which already has a new logo.  (source:http://www.scribd.com/doc/209050732/MtGox-Situation-Crisis-Strategy-Draft)      The next bankruptcy hearing is on April 1, 2014 (how appropriate a date).   We need to make ourselves heard.   If we are lucky we can get this bankruptcy dismissed or at least throw a big monkey wrench into the proceedings.  I brought this thread to the attention of Theymos and asked for help:

-Theymos

The best way to arm ourselves is with information.  I asked Theymos how we could check for transaction malleability in the block chain.  According to Theymos it seems like with standard encodings it is really easy to rule out TM at least with Bitcoin-Qt.  As he said we couldn't get an exact count of TM but we could at least establish an upper bound by ruling out all the standard transactions.  That might be enough.   Other things we could do would be to cross-reference transactions listed in btc_xfer_report.csv against suspected TM transactions.  

I'm interested in this enough to be willing to coordinate the effort and possibly provide bounties for meeting milestones.   I welcome any suggestions to making this work and to ensure that our methodology is perfectly sound.   There's no reason to do this analysis unless it is rock solid.


PM me or respond publicly if you are interested.  

Even if TM was the cause of those 750k vanishing, there is no way this was done without anyone noticing it. It would be them stealing their own coins and blame it on TM after.

Also we are to believe that they had no personal data of supposed thief when they were asking an arm and a leg for someone to withdraw large funds.

Furthermore, if they REALLY did not notice because they are so extremely incompetent, then why all this secrecy, instead of providing us with all the information/data required to check for ourselves?
Cold wallets, thief ID (probably stolen).

It just does not add once again, why we are left in the dark if TM really was the reason, or anything else was the reason for the theft.

A liar will try to release as little information as possible, because if he releases information, someone could verify it and possibly detect the lie.

There is either some government involvement possibly blackmailing him or his family,

OR he screwed up badly in trying to trade the BTC in an attempt to pay off liabilities for court cases/licenses etc with customer funds, he believed he would be able to get back easily with fees/arbitrage between exchanges and other ways to abuse exchange powers.
He then got surprised by BTC shooting up to 1200 when he already sold out all the BTC, resulting in him having to retreat into illegal activity in a desperate attempt to regain the funds which would explain why he keeps silent about it.

What we do know is that 160k passed through the MtGox API just recently, which unless there is some other mysterious explanation, is a clear indication that MtGox is in control of at least 160k BTC still.

IF it is not, he would have to explain to us how it is not. Again, he remains silent about it, which makes no sense if this BTC was stolen. It would be in his interest to show us the addresses it was stolen from.

Nothing of what Karpeles does or says makes sense unless you dive into some extreme scenarios which are just more likely as otherwise the puzzle pieces do not connect.

Pure incompetence would not explain why there is all this secrecy about how exactly the coins escaped. Even if they stole them themselves, they could show us the chain of events of the coins escaping.
They are not doing this, because there are some men in black/mafia etc hindering them from doing that OR it would uncover all the fraud involved they were conducting.

If someone wants to bring up a theory which does not involve at least some part of the above, he would have to explain the secrecy of karpeles concerning this case.
He would have to explain why all of the sudden 160k ran through the gox API just recently, which stemmed from the 424k address Karpeles used to prove his exchange was not running a fractional reserve.

I can only repeat that there has to be put pressure on the authorities to interrogate him and squeeze the information out of him, we need to complete the puzzle, one of the most important information being the cold storage wallet addresses the coins were stolen from supposedly.

Karples probly referring to prelim investigation. Could mean anything. And "presumably" leaves enough wriggle room, even for a fat fuck like Karples.

7 days after the BTC withdraw transaction didn't get through, but it was in the end of january 2014

Anyone who used MtGox and had transactions that didn't go through remember how long it would take for MtGox to reimburse?

Mark Karpeles said in sworn declarations: "On February 24, 2014, MtGox suspended all trading after internal investigations discovered a loss of 744,408 bitcoins presumably from this method of theft."  By "method" he is referring to transaction malleability.

Source: http://www.scribd.com/doc/212477228/Karpeles-Declaration

Actually.... if you read what he wrote... he said (oddly enought) "stolen / disappeared" why would he use the word "disappeared....." I'll let you answer that one.

In MtGox2014.zip (available via torrent if you look around; link can't be posted here; if you get it don't run the binaries) there is a file called btc_xfer_report.csv that contains the record of every deposit and withdrawal from Mt. Gox.   Using some rudimentary tools we have taken that 350 megabyte file and removed withdrawals that are likely to be legitimate. For example we removed withdrawals whose BTC value occurs only once in btc_xfer_report.  That was used among other criteria.   We focused on finding sequential withdrawals to the same wallet for the exact same amount of money.  The reason for this is the way TM (transaction malleability) fraud was carried out.  A user would request a withdrawal.   Mt. Gox would then publish the withdrawal transaction.  The user would modify the transaction in an insignificant way so that the result of the transaction remained the same but the TxID would be different.  If the altered transaction made it into the block chain the user would then complain to Mt. Gox customer support that they never received the withdrawal.  Since Mt. Gox only looked at TxIDs they would not see that the funds had already made it to the correct wallet.   They then would issue another withdrawal transaction for the exact same amount of money.  I am sure that some transaction malleability fraud occurred.   However, Mark Karpeles would have us believe that 750,000 BTC was lost this way.   He would have us believe that he didn't notice half a billion dollars in assets walking out the door.  He would have us believe that his customer support team was handling hundreds of these requests a day and no one raised an alarm.  He would have us believe no one raised an alarm when the hot wallet was depleted time and time again.   In sworn statements as part of his bankruptcy declarations, he claimed that the 750k bitcoins were lost due to transaction malleability.  What we are trying to do is establish an upper bound or maximum of the amount of transaction malleability fraud that could have occurred based on the documents we now have.  

This is what we have so far.  You can download it from the following link.  I am putting it up because I think people skilled with databases and block chain analysis could go a lot farther with it.  Even though we have reduced the data set quite a bit we are still over estimating the amount of fraud.  Many of the sequential withdrawals could well be legitimate.   Say you see a withdrawal for 10 BTC one day and then a second withdrawal for 10 BTC 7 months from then.  That probably is not transaction malleability fraud.

https://www.dropbox.com/s/udjc01x845q7tpg/possible%20transaction%20malleability%20transactions.csv

If you see any problems or mistakes with our analysis please point them out to us.   Feel free to work with this data set or the source file btc_xfer_report.csv