Bitcoin Forum

http://i.imm.io/eskO.jpeg


Hello everyone.

I am working with two other people, Jonathan Ryan Owens and TT on this forum, on an investigation into the activities of MyBitcoin.  We will be attempting to do the following: (although we may not be able to get all of it done on our own)

> Publishing a hopefully-full address list, consisting of addresses that can be directly linked to MyBitcoin deposit addresses
> Allowing others to add their MyBitcoin address to our list
> Publishing statistics on this list of addresses, including # of coins moved by this wallet on specific days
> Analyzing the list and the statistics for further interesting information, such as exchange activity
> Exposing a public API to track stolen coins, for the use of Bitcoin businesses and exchanges
> Making a new Bitcoin monitor which charts only transactions consisting completely of stolen coins
> Doing our best to make information on MyBitcoin public.

Also, yes, I had to call it MIB, just because.

Updates

Jan 11 '12: We note that the address list, in text format, has already reached a size of 2.5 MB.  We believe that this list should be fairly complete :)
Jan 12 '12: Address list has been released.  A total of almost 100,000 addresses were found by our blockchain search.  
http://www.megaupload.com/?d=58DV7075
Jan 12 '12: TT comments that money has been moved between and out of some of these addresses today.

I hope to see more come of this.  Good work!

LoL. Too bad I deleted all mines

FYI, I would be willing to pay a modest premium for coins that can be traced directly back to notable events.  The less mixed the better.

A final address list has been released.
http://www.megaupload.com/?d=58DV7075

Preliminary statistics
Addresses found: 94438
Total received including change: BTC 38,243,033.770666
Total sent including change: BTC 38,228,161.404752
Remaining balance: BTC 14,872.365914166

Are they going to more mybitcoin addresses or to external addresses? (file blocked on work comps)

I'm not entirely sure.  Coins are trickling out of the MyBitcoin wallet.  About 300 were moved from yesterday to today.

Further update: The address list is, surprisingly, STILL NOT COMPLETE.  We are about to release a few hundred thousand more addresses that belong to MyBitcoin.

I don't know if this is any help http://www.megaupload.com/?d=6YGA0REA. Unfortunately I can't make it live as it takes about 10 minus to generate the page.

how did you managed to gather all those addresses ...  ? and btw could you correct posted totals and balance, the numbers don't seem right. Thanks

The numbers look right to me...
We gathered these addresses by assuming that if two addresses both appear as inputs in the same transaction, then they are from the same wallet.

maybe you should look again...

It's entirely possible that MyBitcoin has sent over 38 million BTC, if that's what you're talking about.

piuk: Thanks for the IPs!  They might help in tracking Tom down.

Dunno, you sure is bitcoins what we're talking here...  .365914166 !?!

edit: would be possible to show us some code of the tools you we're using, please

wasn't it already concluded that tom williams is bruce wagner?

Nice work!

Almost certainly no.  I thought the evidence that it was some guy last named Owen in Canada was pretty strong.

It was very interesting that 1) 'madhatter' on this forum threatened Wagner without much by way of anonymity, and 2) Wagner made the threat public on this forum.  Also, I seem to recall that Wagner admitted to getting all his coins back.  My conjecture was that Owen and Wagner knew each other slightly (likely through Wagner acting as a feeder), and Owen had a suspicion that Wagner had even more skeletons in his closet than he actually did so Wager called his bluff successfully.

Another search has revealed over 10,000 more addresses.  Feel free to post your MyBitcoin addresses in this thread so we can keep investigating.

The "Remaining balance" has 9 decimal places of precision. Bitcoin only allows 8.

Minor floating-point precision error... the figures are definitely very close to the correct numbers.  We will be publishing more detailed and precise statistics soon.

How does anyone know an address was a MyBitcoin address?

How does anyone know an alleged address is really not a MyBitcoin address?  What if someone just scrapes addresses from the block chain and claims they are MyBitcoin?  Seems like quite a stretch to me.

I was about the ask the same question.  :)

1.  We took addresses from posts that were posted prior to our announcement.  These people had no reason to fake their MyBitcoin address.
2.  The large amount of money transferred through and still residing in these addresses confirms, to some degree, the identity of the wallet.
3.  The wallet contains many publicly-posted addresses, posted by different people.

Help me understand how a post would make a MyBitcoin address distinct from any other one.  This would make sense if everyone who posted such an address advertised they were using MyBitcoin, but I don't suspect that's the case.

A few people said this like "my MyBitcoin address is 1____ if anyone wants to investigate," or something of the sort.

How did this yield a 2.5 MB list with 100000 entries?

I would assume that they followed the chain of transactions.

So, I presume something like this:

Take the list of addresses you know belonged to MBC;
For each address in list:
    For each outgoing transaction from that address:
        If transaction has more than 1 input:
            Add any input addresses to the list if they aren't already there

Seems quite reasonable

repeating myself: would it be possible to show us some code of the tools you we're using ? please

This is correct.

This is nice attempt to work against the original intentions of Bitcoin - anonymity and irreversibility. Still it does not help in any way, as mybitcoin does not seem to be concerned about obscuring them. That was the users fault of trusting his coins to someone else, in this case mybitcoin.

Ok, so now you have a list of addresses which all somewhat questionably but probably correctly once belonged to mybitcoin.

What now? What is it exactly that you are trying to do here?

good luck... laaawl.

are you sure about that? I guess Tom Williams has a good reason to corrupt your data

The data can be corrupted in so many ways it is pointless.  Not only can bad people put in GOOD addresses into your database, but someone holding 'bad' bitcoins can spend them at any number of stores (like mine) is SOMEONE ELSES name.  If they want to finger their enemy, they just place an order for stuff with the address and all contact info to that persons address.  Pretty much any data you can scrape from this process is pointless.

1. This data was generated from one address.
2. Therefore we can be sure that all of the addresses in that list are from the same wallet.
3. Therefore that wallet has processed over 38 million coins and contains 14k coins.

How many wallets in the Bitcoin world have processed over 38 million coins and contain 14k BTC?  Not many, and I think that reduces the chance of an inaccurate list by a lot. 

I think you're underestimating the power of having all transactions connecting any two addresses permanently recorded in the blockchain.

If a malicious agent just threw up a list of unrelated addresses, and somehow they got added to the main list... they'll eventually be ignored anyway when they don't connect to the core group of addresses within a certain range of blocks.

And if the thief gets lazy or stupid ("Screw it, let's just consolidate all these coins to one address to make moving them to cold storage easier,") then the addresses that aren't related become immediately obvious: they're the ones not being sent to 1MyBTCThiefAddress. Even something a bit more subtle than that can result in useful information. All it's going to take is one send, even accidental, to one address with a public identity who's willing to help to shake up the whole game.



That sounds like a good opening to voice a couple of my concerns about the whole process:

1) That there will be some attempt to "taint" or "mark" the funds. IMO, this is both morally objectionable, and just a bad idea on a number of levels. If the thief is caught, and is somehow made to return the coins still in his possession, fine. But any coins spent to others not involved with this or knowledgeable of it should NOT be sought after.

2) If the number of coins that moved through that wallet is at all close to accurate, it represents a disturbing amount of money. Enough that my hope that this can be resolved peacefully is almost gone... once the thief is caught, then what? What if most of the coins have already been spent? I suspect bloodshed may come of this; not that "Tom Williams" facing that bothers me, what bothers me is what the consequences of such actions would be, both for those engaged, and for the image of Bitcoin overall.

Food for thought.

Indeed.  What the future holds for 'Tom Williams' may be quite valuable to some group who, for whatever reason, wants to further sully the reputation of Bitcoin and destroy the myth of anonymity in one fell swoop.  That's probably more of a likelihood than is some irritated former BTC holder getting revenge.

Sleep as well as you can scumbag...

It's been far too long to get any useful information out of the blockchain.

hahahahahaahahahahaahahahaahahaha

Why doesn't someone just call Tom Williams and ask? Christ.

I recall seeing some mention in this forum that MyBitcoin doesn't follow the usual coin-selection and change-making rules, presumably because its Bitcoin-handling code was custom-written; and that it shuffles coins around between its own addresses. Given this list of addresses, it should be possible to learn some things about it; and I strongly suspect that its transactions are distinctive in some way, which should make it possible to find *all* the MyBitcoin addresses.

Another theory - the reason MyBitcoin came back briefly and returned some coins, was to get plausible deniability when spending the coins that were stolen.

Great point. And it might have worked, had all the coins been spent ASAP. But these recent spends from old MyBitcoin addresses aren't going to go unnoticed... I suspect the folks tracing them are going to hunt them to the end.