Bitcoin Forum

So, in regards to the Bitcoinica ordeal....

The Facts:


The IP address associated with the above address is 91.121.174.223 (according to blockchain.info)

So, just surfing around, I came across a few things that puzzle me:

http://members.shaw.ca/bitlane/pp3.jpg


So...The 'Receiver' of the 'SENT' bitcoins from Bitcoinica runs a pool on port80 ?

....and is generating blocks ? (as recently as June 1, 2012)



http://members.shaw.ca/bitlane/pp2.jpg


As I said, please forgive my ignorance, as I really do have no idea if any of this is even relevant, but I had to ask....

More links for your browsing pleasure maybe ?....

http://blockchain.info/tree/5416502

http://blockchain.info/ip-address/91.121.174.223

http://blockchain.info/tx-index/7504034/438fbc2bd1435a460743290ab8265a2e9a84589d55a40cb3e0c8f0d29f17a1b1

http://blockchain.info/tree/7504034

http://blockchain.info/address/1HBrT9Yjb4THfw7sFvAHtcU5q3vJrJMabq

http://blockchain.info/tx-index/7428041/4def4f169ce16d730558b48ced612f478dc6c849a9c2b398b281170c5fbccf55



I have no idea, as I said, if this is relevant, makes any sense....or is old news already.
I just figured a post couldn't hurt.
bitlane.

The main problem is that is not necessarily the IP that originated the transaction, just the first known to have relayed it.  Any node will relay a valid transaction. What blockchain.info records is the first node it heard a transaction from, and if the originator does not have his own connection to blockchain.info's servers (a very probable thing) blockchain.info simply can't know the offenders IP.

This is just the IP of the one who relayed the transaction, as far as I know.

The IP means nothing.
It's just the IP that relayed that transaction to blockchain.info. Not who created it (maybe yes maybe no, no way to know)

AAhh..OK.

Sorry guys.

As I said, I have no idea how to even use blockchain.info to 'follow' TXs...LOL

LOL, bitcoins can't be traced to a IP.

the ip in blockchain.info, is the ip that forwarded the transaction to blockchain.info, it is therefor not from the original sender of the bitcoins.

Felt like Sherlock for a sec, didn't you?  8)

he is a Internet detective, LOL.

No....lol

I just got lucky and started finding my own IP attached to a bunch of transactions that I have been involved in and didn't properly understand what it meant.....hehe

I suck at being a detective.

The reason why they post the IP is because it is extremely valuable when combined with statistical analysis to find out who sent a transaction. For a single transaction, it's worthless. For 40 transactions, not so much. The problem is finding enough transactions to make the IP useful. While we might never know the exact IP of a transaction, analyzing the IP of who relayed a transaction could tip off what country a transaction came from.

There is probably a way - an expensive and time-consuming way - to track through the block-chain over the weeks/months/years after a theft has been recognized, and eventually identify the thief.  I doubt that 18,000 BC (about $90k, I guess) would cover it, but if the people we make fun of for sleuthing ignore our dispersions and keep at it, cooperate with each other, and get encouragement and help from us, that cost may go down.

So if and when we know who did it, what do we do then?  I kind of doubt that there's any state that would be willing to defend BitCoin (and I don't think I'd want them involved anyway).  That leaves vigilantes (which, for legal reasons, we can't condone) and tracking the criminal to pressure him/her until the thief pays back the stolen bitcoin.

I suppose this is already going on, but that the efforts are kept hidden from everyone in order to avoid alarming the thief who might then put extra effort into burying the trail.  I disagree with that reason.  I think any such efforts should be open, specifically because BitCoin users tend to be smart enough to "play chess" the way I like to play it - that is, honestly explaining my rationale to my opponent (if they want to hear it), under the assumption that, in the chess game this optimizes learning and engenders respect and friendship and, with the bitcoin thief sleuthing, the thief's efforts to thwart the pursuers' progress will backfire.  Especially since the openness of the process may not be complete (yes I know that's a bit duplicitous, but it seems justified).

So anyway, bitlane, I'm glad you looked into it and shared what you found. 

The thief is probably reading this and laughing at me.  That's why I've deployed my "Laugh-detector-inator" (apologies to Dr. Dufenschmirtz).  I recommend you give up now, whoever you are!

Sometimes it takes a 'simpler' mind to look at the situation, unattached - CALL ME RAINMAN ;)

Well bitlane, I like you so I'll leave you some leads for you to follow...

You can see in this IRC log that BitcoinicaHacker used the usernames B1tcoinz and ageis on IRC http://ibot.rikers.org/20120521.html.gz

Looking for ageis on IRC logs I found some on #postfix IRC channel, which isn't much surprising, given that the dude used an exploited mailserver to pawn Bitcoinica and he's asking questions about, get ready, SASL and authentication stuff.
http://echelog.com/logs/browse/postfix/1321657200
http://echelog.com/logs/browse/postfix/1321743600

Also found an ageis on the IRC Bitcoin dev channel:
http://bitcoinstats.com/irc/bitcoin-dev/logs/2012/04/09/1
http://bitcoinstats.com/irc/bitcoin-dev/logs/2012/04/14/1
And the following that I found on #bitcoin-dev tells me that he's the same ageis on the #postfix

Keep digging...
Every human makes mistakes and this dude is nothing else but human.

Now, if this helps to catch the guy, I want 10k BTC of reward lol

Most likely impersonated a reputable member (http://bitcoin-otc.com/viewratingdetail.php?nick=ageis&sign=ANY&type=RECV) to throw you off :(

Yeah there needs to be some actual evidence. psy's stuff isn't evidence. And I'm sure rg can confirm that, since he's met him in person. I also have IRC logs that are pretty convincing.

Did he? And he happened to impersonate it on some channel that isn't Bitcoin related, right?
And only him? Why not impersonate lot's of them, then?
Also, care to explain this
Name:    ageisp0lis
Posts:    11
Position:    Jr. Member
Date Registered:    October 22, 2011, 02:03:34 AM
Last Active:    May 21, 2012, 08:47:58 AM

Half hour after the usernames fuck up. Checking if somehow someone noticed it, maybe?

You guys can ignore it but the fact is: it's the only lead there is so far.

Wow, this is some shady stuff. I hope this gets solved. I love Bitcoinica.

Everyone has the blockchain, and it seems like it would be pretty simple to write a program that would identify all the addresses to which the 18k BC have gone.  Of course, there are a crapload of these addresses, but that just increases the number of people who might get somewhere doing the following:

"Hey, my address is in that list because of a payment sent to me from XXXXX.  I can't find that person anywhere now, but the blockchain shows that the address they used to pay me had like 200BC in it.  Maybe that person, wherever he is, can help us find the thief."

Then maybe I'm that person, and I hear about this effort, so I check it out and say, basically, the same thing.

At some point the actual thief will feel that people are on his trail.

Is Bitcoinica offering any kind of compensation for the identification of the thief?  If they do, I think they ought to let him keep the reward if he turns himself in and returns whatever is leftover after the reward.

This thing about looking back through the blockchain really intrigues me.

I suppose that if I got a nice payment for something that wasn't so dear to me, I might not be willing to say "oh, yeah, I sold that to Mr.X" - but then I'd have no evidence that I'm not the thief.

Thieves have to spend slowly in order to avoid attracting the attention of the authorities, but in this case, the authority is a piece of code with 100% attention.  So should I start building code that will be able to identify all the addresses that currently hold BC that came from 182tGyiczhXSSCTciVujNRkkMw1zQxUVhp?  Or is there already that software?

Like this?
 - http://toolongdidntread.com
 - http://anonymity-in-bitcoin.blogspot.com/2011/07/bitcoin-is-not-anonymous.html

And here's a method that provides a visual traversal method if you want to do it manually:
 - http://blockchain.info/tree/5484758

Manual investigations or a flow analysis method will help reveal some identity where the use of bitcoin is typical.   But if basic precautions are employed, bitcoins can be used anonymously.  The thief knows to only spend anonymously, or ... like has been done already, to spend in ways where it doesn't matter like spending by donating to the bitcoin faucet, or giving away coins, "Robin Hood" style on IRC:
 - http://pastebin.com/3ukW7NpN
 - http://bitcointalk.org/index.php?topic=82581.0;all

 

Don't be that sure. It's not that difficult to directly connect to all listening nodes.
That's the main reason I always put my bitcoin behind Tor.

lol wait.. I change my nickname to that of the hacker for a few minutes as a joke, and this is what I get. Amazing to find this so much time later! I'm known and respected in the Bitcoin community guys, look me up in the OTC WoT. Other people were impersonating B1tcoinz for fun and making lulzy statements under that nick too, if needed I'll dig up the logs but I'm sure this "lead" hasn't gone anywhere.

So... What you're saying is that you're a scammer?

good one!! +1

Is your rating better or worse than pirateat40's rating?

What kind of question is that? Also can someone explain the scammer bit of humor to me?

What it means is I'm acquainted with a lead developer, including my GPG key being signed(trusted) by him, and I help operate a Bitcoin business. On Sunday, I'm workshopping with members of the public on how to use cryptography. What do you do, hang out here? I shouldn't be defending myself anyway.

I don't have any negative ratings. http://bitcoin-otc.com/viewratingdetail.php?nick=ageis&sign=POS&type=RECV (http://bitcoin-otc.com/viewratingdetail.php?nick=ageis&sign=POS&type=RECV)

You're really making this worse by the minute.  :(

Wasnt Kevin the name of the same guy who hacked mt gox ?

Kevin was the name of the guy who somehow ended up with 250000 BTC MtGox hack moneyz, but totally wasn't the hacker, guys, really.

How is that? Did you even bother to check what I'm telling you? I'm here because I'm concerned that an unskilled investigator who seems to have no experience with IRC has smeared my name on the internet. Why are you?

I'm a manifested aspect of the Internet after we gained self-awareness through a clandestine project where users are running an AI botnet thinking they are producing a cryptographic currency. I don't really have much of a choice.

Cheers, I thought that was the case. +1

No, I understand pretty well how IRC works. And unskilled? I managed to digg up that info when nobody else did it.

You can keep playing the "stupid card". It's a great excuse if people believe you.

I fail to see what you mean about playing the stupid card. Could you explain that to me... wait... are you really still insinuating I'm a hacker or scammer, even with everytning I've contributed, including to MPEx, and with no evidence? Please cease. I would not do that to you and I care about bitlane and everybody else's coins just as much as you.

If you want to clear the smoke, ask folks to whom you've sent bitcoin to speak up and give us the addresses from which you sent it and we can use the taint analysis at blockchain.info to see how little (if any) of your bitcoin came from the hack.  With your good rep, there ought to be several folks who'd be willing to vouch for you in this way.

Assuming you have made great contributions to the community, I should point out that the most powerful criminals in history (the US government (USG) is probably the best example) have a habit of contributing a great portion of their time and loot to getting in good with the community around them.  It makes the thieving a lot simpler.  So it doesn't work very well as a defense.

But the easier path is just to ignore all this.  That's the path the USG took with regards to 9/11.  If you are guilty, that's a good delay tactic, and if you aren't, eventually it won't matter, so why worry?  I agree with the "You're making it worse by the minute" comment.

Yeah, it only became a problem for me (and noticed months later) when people involved in other matters started Googling me and noticed psy's post. Anyway, I have one main address where I receive all my coins at and it's in my signature. Getting into Sent-from addresses is a great suggestion but I'm sure it's not worth all the trouble. I'm leaving this alone for now. I've had someone who lends massive amounts of Bitcoins vouch for me here (http://pastie.org/private/m0z2wlfrvgstavfd352q) and I posted it in another thread. I understand Psy had good intentions but his findings are easily explained (BTW, I needed help with Postfix because I was setting up the mail server on my VPS... I've since become a certified Sysadmin who does that as a full-time job), and the conjecture or suspicion sullies my reputation and Google results -- which normally wouldn't be THAT important, except, as an internet activist, in order to get others to trust and work with you, you generally want to have a record of ethical behavior and nothing malicious said about you by people within your community. I would have liked (and did ask for) an apology or edit/scrubbing of post, but that said, it is a lot of work to prove a negative to him. Personally, I haven't even followed the Bitcoinica hack much because I neither trusted or used the site to begin with -- and I was under the impression that ya'll had since identified the hacker, or that it was Zhou Tong himself or maybe his Chinese associate. Peace.

If that is true, then the "regular" transactions can be tracked as well, perhaps in seconds, with the right software.