Bitcoin Forum

So, I have been playing around with Neo4j lately and was wanting to experiment using a large dataset. The blockchain struck me as the best dataset for performing analysis. I was always intrigued by this address specifically : 1933phfhK3ZgFQNLGSDXvqCn32k2buXY8a which has around 111114.60025818 BTC with nothing spent. From the recent disclosures on Silk Road and about DPR having safely locked up 600000 BTC into an encrypted offline wallet, I was hoping to find some connect between this address and the address he unwittingly leaked out 1LDNLreKJ6GawBHPgB5yfVLBERi8g3SbQS in this post: https://bitcointalk.org/index.php?topic=6460.msg94424#msg94424

Long story short, I think, if my analysis is not wrong, the address 1933phfhK3ZgFQNLGSDXvqCn32k2buXY8a belongs to DPR. He used a tumbler to mix his coins but looks like it wasn't good enough to hide the trail. I just used a shortest path algo to find the path that leads to the final destination. So here is the trail:

1LDNLreKJ6GawBHPgB5yfVLBERi8g3SbQS (tx: afeecd8e47d6c3912d6c2e5f7a2ceafdecc9d4ad221480fe90847c23f81c8892) ->
1BG9jDV3pA1MsJUnvRyWuA2b7PfGd4MZaw (tx: acb4608da3e06bb787682c7b2f5c4808b831301617cdf5986fd2693970c8040e) ->
12h6TzwPNBvDnppbsqpyXwW4oo5UUKaKSa (tx: fb059f1acfe0399ca2d5090ff9264dfe88b918230c01f09391eaefa83082f4fb) ->
1EG9HJG9aGqzgGujfNQMiNbyqpKnFxafvE (tx: f3b6040fd5c2f70d4be82e5a97b9fcad67a1ebdfa20af8c7915b82afdd8aa174) ->
1AHki5AbZYiz4fHkGSTVKN3T1Tv5PwZpnh (tx: 758b776dec1851a94a6c4ee1782aaf7210a59ae1e8c184d2b469d8039ff1773c) ->
15TEAwEMxVS3BK718HhwgJg7nxwyJ2ib9y (tx: 70d46f768b73e50440e41977eb13ab25826137a8d34486958c7d55c5931c6081) ->
1933phfhK3ZgFQNLGSDXvqCn32k2buXY8a

What do you guys think?

its pretty impressive that you found that. i also didn't know that dpr is thought to be username altoid.  I guess in theory he could have just used a random address in the thread but unlikely.  now if we could only figure out the private key...

I found the same link too. The 1933ph..... could be DPR's address but I think the evidence is not strong enough. It's possible that he just spent 2000BTC with the tx afeecd8e47d6c3912d6c2e5f7a2ceafdecc9d4ad221480fe90847c23f81c8892.

BTW, someone sent 2 x 1.73632986BTC to 1933phfhK3ZgFQNLGSDXvqCn32k2buXY8a on 2013-10-09.

the SR arrest warrent of DPR mentions that altoid is DPR.. and thats how he was caught.. altoids email address was Ross Ulbricht@gmail

Very Impressive

You can verify that the first ever transaction to 1933phfhK3ZgFQNLGSDXvqCn32k2buXY8a came from DPR's address: http://blockchain.info/tx/70d46f768b73e50440e41977eb13ab25826137a8d34486958c7d55c5931c6081

Notice that all the inputs came from this address: 15TEAwEMxVS3BK718HhwgJg7nxwyJ2ib9y. I'm pretty sure if you go backwards you can land at DPR's other addresses.

Also, I don't think DPR just spent it (to someone elses address) as the trail has only addresses that were used for mixing... all the intermediate addresses have exactly 2 transactions... 1 receive from previous mixing address and 1 to the next mixing address all the way to its destination 1933phfhK3ZgFQNLGSDXvqCn32k2buXY8a.

The script I wrote followed a path that had addresses with only 2-10 transactions.
So lets break in down:

DPR's known address: 1LDNLreKJ6GawBHPgB5yfVLBERi8g3SbQS
Tumbler's receive address: 1BG9jDV3pA1MsJUnvRyWuA2b7PfGd4MZaw (only 2 transactions)
Tumbler's next mixer address: 12h6TzwPNBvDnppbsqpyXwW4oo5UUKaKSa (only 2 transactions)
Tumbler's next mixer address: 1EG9HJG9aGqzgGujfNQMiNbyqpKnFxafvE (4 transactions but note that the only output is to 1AHki5AbZYiz4fHkGSTVKN3T1Tv5PwZpnh... the remaining transactions are just too small -> this address may have been reused by the tumbler)
Tumbler's next mixer address: 1AHki5AbZYiz4fHkGSTVKN3T1Tv5PwZpnh (only 2 transactions)
Tumbler's final mixer address: 15TEAwEMxVS3BK718HhwgJg7nxwyJ2ib9y (7 transactions -> Note that this has only one output)
Final Destination address: 1933phfhK3ZgFQNLGSDXvqCn32k2buXY8a

There is no other path followed by the tumbler. So possibly the service used by DPR was pretty weak or probably he just manually mixed it himself.

The 1LDNL....... received 11,329.89 BTC, while only 2,000 BTC end up in 1933phf..... Not saying you are wrong but that's not strong enough.

Is there any other known addresses of DPR?

This is because he split the 11K BTC into multiple transactions (one of 5KBTC and the other of 3K and 2K BTC). I'm pretty sure all the dest addresses for those transactions belong to the Tumbler service. The paths taken for each of the above 3 transactions can be different lengthwise. The script I wrote just followed 1 path (which was the shortest) which turned out to be the 2K BTC one (the path taken could have been any of the above transactions).

Unless DPR knew who the receiver was beforehand, it would not be possible for his 2K BTC to end up as the first transaction to 1933phf. The 1933phf address looks like it was used for only storage (probably offline) seeing that there are no coins spent from that address. This way I could conclude that both the sender and the receiver is DPR himself.

bitcoinfog.com is the only deepnet service for this purpose (at least to my knowledge). maybe he used them, if he didn't mix it himself

This was not even existed in 2011

Wow dude, nice work.  :)

So, yet another mistake on DPR's part. For certain the highest-denominated wallet was going to receive this kind of scrutiny eventually.

very good work done by you its apperciated good luck  :)

there was a while ago an address with >500k BTC that was linked
to SR: people just put money on SR and they ended at that 500k address.
There was a lot of discussion about that address which was perhaps
the reason that the owner split it into several - but still rather  large - addresses,
one of which is the still notorious 1933ph

so yeah. It's most probably him.

This was actually already addressed in this thread:

https://bitcointalk.org/index.php?topic=94675.640

The address (1933phf...) is clearly tied to SR. If you follow some of the addresses that feed into that one, they are linked to the "Seized Coins" wallet.

There is not 600,000 coins either btw. That is the total amount of coins the FBI has said SR generated in commission since it was up and running. When you figure that for almost 2 years of SR's life, BTC's were valued at under $20, and he was paying his staff between $1,000-$2,000/week, and was paying for the servers and whatever else was involved in keeping SR secure, there's likely no where near 600,000 coins left. My guess is that the wallet in question was DPR's retirement fund.

I know they said they have been unable to decrypt his large wallet, but I would be willing to bet that it is more likely that they cannot decrypt a file, or partition that they believe contains the secret keys to any other wallets he may have.

Nice work.

Properly promoted, this account balance could be an incentive for thousands (or millions) of new Bitcoin users.

Download a wallet and spin the wheel as many times as you want for a chance to win.

Make lemonade.
https://en.wikipedia.org/wiki/When_life_gives_you_lemons,_make_lemonade

Nice to see others have also come to same conclusion. I'll try running my script against 1DkyBEKt5S2GDtv7aQw6rQepAvnsRyHoYM tomorrow and see if I can come up with something ;) Too sleepy to do this now... but was good fun!


Or they could just get it out of him. Easier and faster.

https://bitcointalk.org/index.php?topic=94675.msg3361705#msg3361705

Also has anyone made any connection between these SR Addresses and BCTST Addewssws?

Can you please share those addresses with us here? I don't know which addresses you are talking about.

Great job.  You just saved Hank Schrader a TON of work. 

https://si0.twimg.com/profile_images/699794908/Hank.jpg

This is one of pirateat40's old payout addresses. 

1LkkxPDNAvnFxc3RSnq4Xk27cTPBcJqBrm

A few defrauded users had send me their pay-in and payout addresses last year when there was small community effort at doing some similar (more rudimentary) block chain analysis to try to find out where some of these funds ended up.  I'll see if I can dig them up.

it's likely he used a tumbler he designed himself... probably the same one that was on SR.

silk road is known to have a tumbler, though considered not strong.. as OP states.
the silk road tumbler is what lead to the money laundering charges listed in the warrant.

Just so that it doesn't go unnoticed, this thread was linked from Forbes: http://www.forbes.com/sites/kashmirhill/2013/10/17/does-this-17-million-bitcoin-wallet-belong-to-alleged-silk-road-mastermind-ross-ulbricht/

nice job...
your government will be very pleased with a citizen like you  :P

I disagree on the 'no where near' claim; 500k is probably low. Please see my analysis in http://www.reddit.com/r/SilkRoad/comments/1obvm2/estimating_dprs_income_after_expenses_exchange/

This is about the conclusion I reached just from a wild-ass guess.  Unless DPR was investing in some other expensive activities or managed to get swindled himself, he doesn't seem to have spent much.  He lived practically like a monk.  While San Francisco is a pretty expensive place even to live like a monk, it's not enough to put a significant dent in his money.  Assuming he saved his non-expense money, and didn't have any other big business-related expenses (like the hits) that we don't know about, he'd of course still have most of it.

its gor moneys now

amazing!

Except for most of his career, BTC was much less valuable; he'd have put significant dents in his wallet up until the last 6 or 10 months when bitcoin really took off. Remember, in June 2012 for instance, a bitcoin was only $7. Every $1000 in expense (hosting, employees, living expenses) would have depleted him of 142 bitcoins which is now worth $27,000.

Between site hosting, paying developers/consultants, paying employees $1000-$2000/wk, taking money for his own expenses, etc,  the true amount that he retained for himself  has got to be far smaller. Especially the early months of his existance, the commissions he received were huge is terms of bitcoins, but they were likely spent long ago just trying to keep the place going.

Well, did you read the post on Reddit? gwern did run through the numbers, exactly the way you suggest: "How many bitcoins did DPR have to spend each week at the back-then exchange rate?".
I find his numbers plausible. Unless, of course, some other big funds drawing positions are not known of.

Ente

No, didn't spot that one... Do you have a link handy or should I click my way through there?

Well, you quoted it already :-P

http://www.reddit.com/r/SilkRoad/comments/1obvm2/estimating_dprs_income_after_expenses_exchange/

Ente

Only by osmosis of reading the same article and discussion threads; first time seeing that page. I'm gonna wager and say that he had far less BTC left over than that estimate. Id say I'd play with the numbers later, but there isn't really a pressing need or anything!

Guys, this address is allegedly SR?
https://blockchain.info/address/1933phfhK3ZgFQNLGSDXvqCn32k2buXY8a

I can tell you that it is 1-hop from my Mt. Gox deposit address from 2011. Basically I deposited to Gox, and within few hours, deposit has been moved to this address and everything is still there. Could it be Mt Gox cold storage?

Very unlikely. It's much more likely that's one DPR's addresses.

So, the other only option would be that few hours after my deposit, Mt. Gox used this coins to process a withdrawal that SR requested? There are no other options to explain this, right?

Knowing nothing else, this seems to be the most likely explanation to me.

Ente

Wonder if it's possible thaty you give us your transaction link? Thanks.

just PM'd you on ##mtgox-chat

When govts claim to seize coins... we should put those in a list...

As a community, the govt is not entitled to exchange values "today" of those coins from OUR money, that they admit to having. They should get $0.01 per coin, or nothing... That is theft from us, the way I see it.

Just got to tell us the wallets and addresses... add that into the exchanges "security do not exchange" list... since that would be the govt laundering stolen/seized money. (Making an app that checks for those "seized" addresses, to auto-reject them until they have been sold for that $0.01 price at an "official" exchange... would be nice too.)

Force the exchanges to reward all accounts equally, with the exchanged coins. (Would promote the exchanges too.)

They are not entitled to our value. They obtained the coins through force and seizure. I believe they are forced to destroy drug-money, not spend it... when obtained.

Once "exchanged", they would have normal value, to the split-users they were divided among. (So they could not just come back and buy their own coins, to resell at our prices.)

1933x is on the move! Entire balance transferred to https://blockchain.info/address/15ihHoGs3onQBNnEH8afDFGvou9nD62Hm7 , and then split in half to send to https://blockchain.info/address/1K191X5eVSRzeecaPQYGgTAbB7NTbqxDTJ and https://blockchain.info/address/1HR42TZ27gSAQUiLEyT7bVThqi5ZbadVie

What's going on? Ross Ulbricht is still in jail, the apparent plea bargain fell through, and the FBI seized his stuff months ago, they should've finished with it.

EDIT: Reddit discussion: http://www.reddit.com/r/Bitcoin/comments/2004fg/111k_coins_just_moved_any_information_on_this/ ; it looks like the coins have stopped moving for now, and have been split across three addresses now: https://blockchain.info/address/1K191X5eVSRzeecaPQYGgTAbB7NTbqxDTJ / https://blockchain.info/address/1DxQdDV6LPjoimiM9MpBBckQKAeeodmKDE / https://blockchain.info/address/15wJARB79G6WMeLbfy8W2nKX8EdeS32DTA

Holy shit! 1933ph is on the move!

https://blockchain.info/tree/114883204

So far, here's how they're moving:

https://i.imgur.com/t3FBWQL.jpg

Nice diagram.

Good news everybody. DPR is bailing out Mt.Gox!  ;D

Looks increasingly likely that this was MtGox cold storage all along. It's being processed in a similar way as the 200k coins a few days ago.

The linkage with DPR may also be explained by a DPR deposit/withdrawal to MtGox? That could also explain why these funds were "unavailable" if there was some sort of SR-related investigation going on over at MtGox.

I thought that it was not being split the same way as the gox coins.

In specific they aren't waiting for 6 confirmations on each split...?

Indeed, 1 confirmation per split. Also each branch appears to be forming one at a time as if someone is doing it manually (not programmatically), or at least manually supervising the process - I suppose that's warranted with such large transactions!

If you look hard enough you will see a number of connections between Gox / Eligius addresses, and DPR addresses if we look hard enough.  Who's controlling the coins now?  Well, let's see... which of these three entities is still technically in business?

Once they are all broken into small amounts per address, it going to get hard and hard to follow the flow.

This address has been linked to a customer appearing in the leaked MtGox transaction history, see this:

https://bitcointalk.org/index.php?topic=508683.msg5614972#msg5614972

Sucks for him, he's now got a target on his back thanks to gox.

Money just moved from that address.

https://blockchain.info/address/15ihHoGs3onQBNnEH8afDFGvou9nD62Hm7

Highlighted for emphasis.

Well whatever the case, this thread certainly motivated someone to cover their tracks.

This address appear here : https://www.scribd.com/document/372445139/Exhibit-4 ||

"(b) The vendor agrees that the paper wallet with address 1933phfhK3ZgFQNLGSDXvqCn32k2buXY8a held
in
escrow will be released
to
the purchaser."

https://www.reddit.com/r/Bitcoin/comments/80e2l9/10_billion_lawsuit_filed_against_craig_wright/

That was probably a really dumb thing to do from the guy. The analysis itself is really impressive I agree. I would love to do that with the Eth blockchain and see where it leads regarding the DAO theft / fork.

Guys, this wallet's funds are on the move again: https://www.reddit.com/r/Bitcoin/comments/9bfnff/near_1b_are_currently_on_the_move_from_a_silkroad/

Worth tracking it.

Holy

Will keep an eye on this. Very interesting...

Thanks for your effort mate, good job.
I am watching this like I am watching horror movies.

Who is controlling the money now? Once all of them are broken up into a small number for each address, it will be difficult and difficult to trace the flow. Anyway, this theme definitely pushed someone to cover up their songs.