Bitcoin Forum

Hi all, first post.

So by now I assume you've heard of the alleged "hack" of Romney's tax returns and the demands for 1 mill USD worth of bitcoins. Recall that the anons said you could donate bitcoins to one address if you want the records kept secret and another address if you want them released. Here are the blockchain.info links for each:

If you want them kept secret:
http://blockchain.info/address/1HeF89wMjC48bWNgWvVo7Wu3RaLW8XVsE8

If you want them released:
http://blockchain.info/address/12AP6iCwRNFQqKLStH3A4b4hw3SL6RaNgB

For both addresses there is a string of transactions of amounts that are binary numbers that correspond to ascii characters, so each address received a message through the transactions in ascii. I haven't seen anyone comment on this yet so I translated the binary strings to ascii characters and this is what I found:


If you look at the transactions to the "release" option, the message says:
"prove it"

If you look at the transactions to the "keep secret" option, the message says:
"gnp.fR6k5/moc.rugmi.i//:ptth"

which is "https://i.imgur.com/5k6Rf.png (https://i.imgur.com/5k6Rf.png)" backwards.

If you go to that web address you get this image:

https://i.imgur.com/5k6Rf.png

I put up a mirror here:
http://s16.postimage.org/jxr8st6md/5k6_Rf.png

2nd mirror:
http://i48.tinypic.com/2n9ml1i.png

And that's it. Unfortunately I am from the stone age so I don't have a smartphone that can "read" this, so if anyone interested can I would appreciate to know what it says.

Update: Okay after some astute googling, I used an online QR decoder to read the image. It gives the following:
"0110100001110100011101000111000000111010001011110010111101101001001011100110100 1011011010110011101110101011100100010111001100011011011110110110100101111011010 01"

which with binary-to-ascii converter is https://i.imgur.com/i (https://i.imgur.com/i) which is an image that no longer exists I guess.

QR Code gives binary back

0110100001110100011101000111000000111010001011110010111101101001001011100110100 1011011010110011101110101011100100010111001100011011011110110110100101111011010 01

That turns into

https://i.imgur.com/i


And it cuts off at a half URL, the only other assumption is, that te binary is something other than text, or there's another hint.

only other thought is the message might not be complete yet?

I think the URL was truncated. Is there another QR code somewhere perhaps?

Maybe the message isn't complete or there is another QR code... I have no idea! (I detailed all my workings in the first post. If anyone has any suggestions on pertinent info glossed over on those pages, please share ;D )

Follow up:

I figured that maybe the anons replied somehow. How would the reply? sending messages back using bitcoins of course! I.e. back to the addresses that sent them the bitcoins. There are a few of these address though, and most of them are completely emptied out, but if you look at this address:
1A68Zamnv9yCHEYKbrvyPW6TQ8oANhhQ1y
http://blockchain.info/address/1A68Zamnv9yCHEYKbrvyPW6TQ8oANhhQ1y (http://blockchain.info/address/1A68Zamnv9yCHEYKbrvyPW6TQ8oANhhQ1y)

It got back the message:
.00032
.00024
.00008

in binary:
00100000
00011000
00001000

Which AFAIK are just spaces.

Update: Also found something similar at 1LwLbxQUqVv4gS1anbDU3wY6jakih8s8Jc,
http://blockchain.info/address/1LwLbxQUqVv4gS1anbDU3wY6jakih8s8Jc (http://blockchain.info/address/1LwLbxQUqVv4gS1anbDU3wY6jakih8s8Jc)

Message:
.0003

again just a space when translated to binary

Found another one (.0003) to
http://blockchain.info/address/1LwLbxQUqVv4gS1anbDU3wY6jakih8s8Jc (http://blockchain.info/address/1LwLbxQUqVv4gS1anbDU3wY6jakih8s8Jc)

Found another one (.00032, .00024, .00008)
http://blockchain.info/address/1A68Zamnv9yCHEYKbrvyPW6TQ8oANhhQ1y (http://blockchain.info/address/1A68Zamnv9yCHEYKbrvyPW6TQ8oANhhQ1y)

Update 2: I started looking at possible responses to the "for release" option, and it seems to be a process that is on going:
http://blockchain.info/address/1NNpaaasYkogJEuUidrpKigFEPFdn5z6jy (http://blockchain.info/address/1NNpaaasYkogJEuUidrpKigFEPFdn5z6jy)

(Here you see the .00032 already sent a few minutes ago.)

Update 3: Due to lack of interest, I'll stop updating this and go on with life, but for completeness I found several of those .00032, .00024, .00008 responses to different addresses that had sent the anons money. Also, 615-762-9138 seems to be a phone number someone wants the anons to call. (Look at the BC transaction that is .07629138 then just use the area code of the PricewaterhouseCooper's branch that was hacked, which is 615).

A business owner or comedy artist could take the opportunity to complete the image link with a string of small donations and potentially get world wide media coverage of whatever pic they want.... and probably a knock on the door from the FBI!

Lol... though the picture file would have to end in ".png" or ".jpg"  I think? I'm not actually sure about that

Has anyone done a phonetic or string search of the two messages from Pastebin? Like searching for similar phrasing, misspellings? The second message seems a little more coherent. Another writer? This is a common way to narrow down possible authors of ransom notes.

Sorry if this is stating the obvious it just hasn't been said, could it be a communication between someone and the person who claims to hold the tax return i.e:

Person who claims to hold the tax return via letter to media: blah blah we've got Romnys tax return blah blah
someone: prove it
Person who claims to hold the tax return: www.imager/i....

......either making it look like they tried, ran out of bitcoins, or got bored halfway through posting link.

I saw yesterday the binary and thought of wasting my time to decode it, but then I thought that maybe I was just seeing things...

Thanks for proving to me that I am not mad.

Maybe unfortunately this also proves to me that I am TOO nerd... (if there is such thing)

a ransom for rmoneys tax returns and a negotiation with the black mailes, cool. this story is worthy of mainstream media. wonder if it will get picked up.  :D

ha! interesting theory! can be...

very interesting to see that the image linking was off, however there was a phone number transferred...

I wonder how much more BTC ransom goes on?

Wouldn't surprise me if these criminal genius's hit the $20 mark by the end of the weekend!

According to http://nandbit.com/romney/ (http://nandbit.com/romney/) They've already passed it!

Saw this yesterday thanks for reminding me.

Maybe this is just the beginning of the address, with the rest being revealed if $1M is / isn't collected.

well, obama is probably just trying to get the money on his hands without any ties to him. Romney's relatives tax reports published might be a game-changer for him and give him at least a chance to be re-elected.

By the way, if you appreciate the research from before -decoding, the phone numbers, the activity reported- I am happy to say my username is no longer accurate and I will gladly accept any tips  ;D at 15nkjVFc46bkRVKqfJ8BfEocbxiYQL6buV .

there's a new message flowing in :-)

This is demonstrating the amazing ability of bitcoins to transfer anonymous messages. You just send a series of transactions to a single adress using either binary or binary -> decimal coding (0.00010001 = 0.000000017, contains the same info but costs less). It is convienient that the number of decimals allowed in the bitcoin protocol is 8, the same as one byte of informaiton, which is great for characters! I guess that makes sense since it is a computer based system, so it shares some characteristics with other computer systems.

In chronological order (adding in zeroes where appropriate):

01100111
01101110
01110000
00101110
01001011
01111010
00110101
01001000
01000010
00101111
01101101
01101111
01100011
00101110
01110010
01110101
01100111
01101101
01101001
00101110
01101001
00101111
00101111
00111010
01110000
01110100
01110100
01101000

Seems to have stopped...

gnp.Kz5HB/moc.rugmi.i//:ptth

reversed:

https://i.imgur.com/BH5zK.png

that translates to

http://www.sendspace.com/file/m6crjs

A file called where.wav

has anyone got sandboxie to open it in?

Audio visualiser decodes the wav to a tinyurl link!!!

https://i.imgur.com/9os2f.png

tinyurl links to this place in google maps:

815 Brazos St Ste 500 Austin, TX 78701

GPUMAX LLC business address someone else pointed out, some body trying to roast Pirate.

Mitt Romney is actually Pirateat40, who is actually Satoshi Nakamoto?

Great, thanks for the lead! Wow great investigation guys! I guess Monday all will be revealed...? Of course, the original message may be real and this one fake, playing on the idea everyone is watching for new messages. But that is just a hesitation. What do you guys think?

And I'm somewhat new... I heard some guy pirateat40 had some sort of ponzi scheme, but do you guys think someone would actually try to frame him with something like this?

Anyone else think it strange that the google maps used was maps.google.co.uk? Is someone trying to hide their location or did they accidently give it away. (Strange if some people from the UK might be the hackers).

Considering that they misspelled the search query in Google Maps, I'm leaning towards the latter.

Wait a minute...

09/10/12 All shall be revealed(?)

Isn't that when Matt's bet runs out?

Matt stole Romneys tax records?

I think you can safely say this message relates to pirate and has nothing to do with the original hackers. The message was more than likely sent from people on this forum exploiting the fact they've got an unusual medium to interact with the world through.

At the Texas address from [Suspicious link removed]/9bxyde9, if you zoom out you see the building is business by the name of "Austin Foreclosures in Austin Texas" that links you here: http://www.austinfreeforeclosurelist.com/

At that tinyurl address, on the right hand side, google says two businesses are located there:

Northwest Registered Agent LLC‎
Petro Lucre LLC‎

One is a business that helps set up oversea bank accounts, and the other one has something to do with energy. If this is their answer to prove it, it's possible Romney has some investments that might make him look even worse. Maybe he made money off from the housing meltdown and home foreclosures, alternative energy, or had an account with Northwest... I really have no clue, but it is fun to google. I felt the need to hop on here and add my two cents after spending an hour or so looking through clues.

It has already been found that the address in question is the registration address of GPUMax LLC (Pirateat40's mining company)

I agree, I like the thrill of the speculation and I hope you're having fun!

Has anyone tested the images for stenography? Possibly the f5 algorithm...? I might have some of my old stenography software somewhere on this HD, if I can find it I will check and see...

I see there is also a wav file and I DO in fact still have my stenography software, so I will see if I can find anything hidden within the images AND the wav file...

A message came through in binary again:

0111000101110110011000100110111000101111011011110110001100101110011110000010111 1001011110011101001110000011101000111010001101000

Translates to:
qvbn/oc.x//:ptth

which of course is just http://x.oc/nbvq (http://x.oc/nbvq) backwards

which leads to a .rar file which I downloaded, but it is password protected!  :-\

The message was actually found fully the other day on Reddit with the release of one of the tax forms as evidence. Good call but you’re a little late to the party.

There have been two messages since the ones posted to reddit. One two days after the reddit decrypt, and one last night/this morning (depending on your time zone).You can see this by checking the time stamp (although all the details are in this thread).

The reddit thread died a few hours after their decrypt. It seems everyone decided it was a hoax and lost interest. They are probably right about the hoax part, so if you just wanted Romney's tax returns then chances are slim. But if you are interested in bitcoin itself there is some interesting stuff there. Read through this thread to see what's happened since.

By the way, here is a screenshot of the RAR file from the new message. One thing I find interesting is that the files were all last modified on the same day, January 7, 2012. This, as I understand it, would be before pirateat40's scam, right? Might these actually be Romney's tax returns? (Another possibility, is it possible to fake the modified date?)

http://s7.postimage.org/ug72h2457/Rar_Screen_Shot.png

If you know how to use a program's language, you have the proper code decompiler and hex editor, ANYTHING is possible...

Almost anything. You can't double spend your bitcoins.  ;D

I think the date on those files HAD to be changed if they are, in fact, legit.

According to the pastebin:http://pastebin.com/zdU1TK40:


If the files were obtained on 8-25-12, any copies of said files, especially if they were scanned copies produced by the "hackers" would have a timestamp of 8/25 as being the latest document edit date, not 1/7/12.  So, they either faked the dates or the files were generated by some kind of tax application fraudulently.

I'm willing to agree that the PirateEat40 thing is separate from the Romey tax forms.  Someone is just trying to get the Feds to investigate a false lead to get revenge.  I haven't seen any "reveal" of information as of 9:17 EDT but, might be due to the different time zone.

However, we can all question the validity of said tax forms.  Flat out, if they are legit, Romney probably won't say and if they aren't legit, Romney will be quick to decry them but, not release the real ones to prove the fake ones wrong.  There is also a slight chance that he would release them to prove they are wrong but, I would doubt it.

I'll keep an eye out for some more 0s and 1s in the next hour or so...

I looked at the encrypted rar thing as someone showing their hand to the romney camp - I'm sure they know which files were taken, so if the files in the rar match those that were taken it raises the stakes does it not?

Possibly, although, if the Secret Service has been involved, you can be pretty sure the Romney camp knows about the potential leak and the consequences.

Don't hold your breath too long.  9.10.12 could also be Oct. 9. 

2112 ;) 

 

http://blockchain.info/tx/cec4a1965e5fd48a1c0084f888baab76aaee76f02da9da9b672224db164502c8

^ Has some weird decimals and was posted around 9:12am.  However, was NOT posted in binary and am not sure if conversion will result in a "message"

Why do we keep wasting time watching messages going IN to the hacker posted addresses?

Anyone can send to them.

Only the hackers would be able to send FROM them though. Those messages would be interesting. Anything else is just blahhhh. if even a little neet. ;p  It's still leads those that don't understand the in/out conoctations to the wrong conclusions.

We should atleast specify when sharing such things whether a mesg is FROM or TO the hackers for clarity.

I don't think it is about whining about the messages, as much as it is amusing...

Well, today someone cashed out of both accounts! From one account they had about 3.7 BC and the other about .7 BC, a little short of the goal. I was hoping the password to that RAR file would be broadcast somehow though. I still have it.

I didn't believe it was real, but I'm still disappointed.  Would have been the ultimate troll to pose a non-credible threat (as they did) and then actually produce the documents and take the few coins they've made. ;)