Bitcoin Forum

A couple of my friends have gotten into a very bad car accident and I have not been using the forum for some time now. I tried to log into my account "Heavy Metal" this morning and it would not take my password, I  tried the "Forgot password" button but it never went to my e-mail. Then I saw that my account was being used by someone else and that the person is scamming people under my name! To prove I am the real Heavy Metal I am signing this message with the address 1AuAgBTyRED81JX5PMsekeTjLYiaDo9Fii which I used in several transactions prior to leaving. My last post was: https://bitcointalk.org/index.php?topic=103091.msg1152231#msg1152231 ALL posts after that are not me! Someone please go to the threads this impersonator has created and give warning to people there! I am not sure if I am signing this correctly, please tell me if I am not.
HNczqA+jodW+AMsWfiUAJJ2UmldxEu6sNr+TFYk2OB1Lls/fZ4DjjAb8M5Pwyi7ZnQ+S/wN5M0nfT8hDdCSgxrs=

Interesting. So what you're saying is that the 'impersonator' is so strangely good at impersonating that he does the exact same very specific, very weird and very unique thing that you consistently do when writing down BTC prices?

That's one damn good impersonator.

Did you seriously just take the time to accuse me, yet not even bother to go the the threads this guy has made and give a warning? Nice priorities.

In regards to your question yes, I am suggesting an impersonator read my prior posts and mimicked me(It is sort of what they do). NOW GO WARN PEOPLE AT THE ACTIVE THREADS THIS GUY HAS MADE!

GPG identity is your friend.

Are you sure you have had an account on these forums before?  ???

If you had been, you would surely know that warning people about possible scams is heavily frowned upon by forum regulars and results in the warner being heavily shouted at in most insultory terms. A very unpleasant and distressing situation.

All in all this seems very misleading.

Only Love.

-1

+1

Why is it someone elses repsonsibility to warn people that your account has been hacked?  Surely, if they are scamming in your name, you should be the one to tell people?  Although I suppose its easier to get someone else to do all the work for you I suppose.

well in fairness with only 2 posts where can he warn people but the newbies forum?
though if I was in this situation I would be contacting senior forum staff urgently not creating a new account :)

But hasn't the fake Heavy Metal been still selling actual gold and silver with good feedback?

So the person stole your account, and then has continued to keep your reputation in tact?

I'm not saying you are lying, I'm just a bit confused.

ahh, would be nice to know the timeframe we're talking here. Something more accurate than, 'for some time now'.

Gonna peek at the activity on the addy he posted;  1AuAgBTyRED81JX5PMsekeTjLYiaDo9Fii    should give us an indication.

You expected something unexpected coming up in your life?

I am out 596 coins, please get in contact with me to help file a police report.

That bastard who took over your account even used the same image uploader that you've used in the past--postimage.org. But I guess (It is sort of what they do) may apply here.

That said, when Dog the CoinHunter makes his visit to ask you a few questions to help solve this crime, I suggest you be truthful with him.

Concerning this:


I had a very close friend of mine pass away a couple months back. When I learned about my lost I, too, stayed away from BitcoinTalk. It took me near close to ten minutes of grieving before I was able to revisit this forum.

~Bruno~

I am out 596+ coins. Let me get the story straight:

• This person supposedly doesn't know you, and...
• This person is into bitcoin enough that he is able to generate a 6 char vanity address very similar to the vanity address that you completed several trades with (1AuAgBT..), and...
• This person hacks your account and posts a large thread taking offers on gold, while...
• This person somehow got astronomically "lucky" that you were indisposed for a week so he could pull off this elaborate scheme, not while you were logging in every few hours

The perfect timing of this means it is quite obvious you either "know" the hacker or it is you. I mean, if I hacked Theymos's password, how many fake posts could I generate before it stopped? Hmmmm... your new name was created 1 minute and 50 seconds within the original HeavyMetal's last login (screen caps in: https://bitcointalk.org/index.php?topic=105810.0 post #28)

• neither the "fake" or "real" HeavyMetal will reply to my PMs. If my username was hacked, I would want to see what the hacker had posted so I could get in touch with any dealings right away. But not HeavyMetal, just spew out an "omy gosh! I been hacked, warn the others! I won't bother to check what he did, but I was hacked!" in the newbie forum and leave.
• Was that your real name and address on the label you sent me the few times we made a trade? I think it is, otherwise why the hack story? If it was an elaborate hoax, just disappear - why try to save face?
• I hope I'm wrong and the real HeavyMetal and I can figure out who took my coins. Maybe you would like to "refund" the coins from your own pocket, since you are responsible for your own account.

If anyone is an expert at looking at the block chain, I'd like to pay a few cents to tell me anything about the transactions and if they are correlated.

ask admin to do an ip check. if the ip's are the same, well...

Thank you.

I have made the request to an admin. Unfortunately, I believe admins are busy people these days.

try pm theymos.

he is responsive

I was considering buying gold from this guy, good thing i stayed away.

this all seems very suspicious...

ha.  I did, and he has sent me 2 PMs already, very helpful. Thanks theymos.

Taken at board time: September 12, 2012, 05:17:44 PM

http://www.c0ffer.com/screenshots/hm1.png

http://www.c0ffer.com/screenshots/hm2.jpg

Amazing timing the "hacker" has with the "real" person.

It is also interesting that all of the withdrawal transactions from the "hacker"'s receiving address are relayed through the US west coast. With the "real" person shipping from the west coast in Canada, it is another interesting coincidence that has appeared here.

This is hardly proof of anything, but what an interesting series of events  ???

I should say theymos has told me that the original "HeavyMetal" account and "Real Heavy Metal" new account were always connected via Tor, and not much help.

This does not look good.

We must remember, just because a new member comes around and has really good feedback, doesn't mean they are not up to a bigger plan (scam).  how big were your previous deals with him?  Significantly smaller?  An escrow could have prevented this whole ordeal.  I'm not trying to twist a knife but hopefully I make a couple other people think twice before committing to a purchase on here.

What I don't get is... Heavy Metal obviously owns a lot of assets and is probably well off judging by the amount of precious metals he has been selling.  Is 7k really worth being hunted down by internet folk.... not that you guys stand much of a chance based on the few facts I've read.  The fact he's been using Tor make me seriously doubt he was using real name and return address on his packages.

my 2 cents.

You know what's funny....

The Real Heavy Metal's BTC address, magicly happens to have 14 SENT taints to the supposed hackers address..

Evidenced here;

http://blockchain.info/taint/1AuAgBTyRED81JX5PMsekeTjLYiaDo9Fii?reversed=true


This page shows the addresses which have received bitcoins from 1AuAgBTyRED81JX5PMsekeTjLYiaDo9Fii. The greater the taint the stronger the link between the addresses.
2 1AuAgBTU8FJ2oHM4iwRRa5SJVTbuKV8htr    0%    14


So you were so distraught by getting hacked that you sent the hacker all your coins, HeavyMetal?!?!


The supposed hacker's new address that he replaced the 'real' one with, is evidenced here in a current picture of HeavyMetal's profile and matches the address that the orginal heavymetal's coins taint to undeniably;
http://www.c0ffer.com/screenshots/hm2.jpg

You're fuggin busted buddy. You better hope these people don't have your real name and address....

I had done 2 prior trades. Total was about 140 btc, first one ~20, 2nd one about 120. I can pull up the transactions if it helps when I get a chance.

The Tor issue was a blow to my investigation as well, I had thought he was an honest guy that went bad when faced with a 600 coin windfall. But I still can't figure out why he tried to save face with the new account, it would be more profitable for him to keep quiet.

Great find! I can confirm that the 1AuAgBt....Fii contains 2 successful transactions, but I was scammed with 1AuAgBT....htr.

If it helps, my prior 2 successful trades txid:
#1) a85707d9507f97399201444d63a3660dc84ea24b2d83b9c7e1894a1f5d37aa15
#2) b1c924d16e85a012badc53d58bb473681a916906e9bdfe0204b46b564bb969eb

Thanks for the help!

That's my point. The same guy owns both of those addresses!

A large amount of the coins that were sent to the orginal AuAG-Fii have later been sent by the owner of AuAG-Fii to AuAg-htr!

Yeah, it was pretty obvious from the get go that there is no hacker involved at all.

To explain what I did here:


Normally when someone writes down prices they do it like this:

42 BTC


Now when Heavy Metal writes down prices he does it like this:

42BTC


This is of course by no means a unique thing, but you will find that only a very very very small percentage of people use the lower variant.

This is also something that is done subconciously. When trying to impersonate someone this is not something you easily notice as something you'd have to copy or even if you notice, it is not easy to consistently keep up.

Now when we check Heavy Metal's posts before and after the supposed hack, we will find that he consistently uses the lower variant.

Which makes the chance of an imposter infinitesimal really.

I think the impostor angle was easy to dismiss early on.

My question: Why create another username and claim to be hacked if you were scamming all along? Why not just bail? This makes me believe he wasn't careful with his scam.

OK, if I'm reading that correctly 0% of all coins sent to 1AuAgBTyRED81JX5PMsekeTjLYiaDo9Fii later passed through 1AuAgBTU8FJ2oHM4iwRRa5SJVTbuKV8htr. That can't be right for obvious reasons.

Trade -> Build reputation -> get 6000 USD order -> stuff underpants with 6000 Dollares -> roll on bed in underpants -> claim to be hacked -> continue trading under "re-instated" account -> wait for next underpants-sized order -> repeat from step 4

I don't take a position as to whether or not this is a scam or imposter, but your assertion that leaving out a space between "42" and "BTC" is specific, unique, or weird, corresponds with any "infinitesimal" chance of an imposter, is being egregiously oversold.

A related habit worth looking into is whether an author puts one or two spaces after a period between sentences.  But even this would not result in any conclusion that could be "infinitesimal" anything.  It is, however, part of how I can usually tell if e-mail from my ex-wife was written by her (she does two spaces), or somebody else on her behalf (most people seem to do one space).

EDIT: HeavyMetal and supposed imposter both use one space after a period, but something that would lend support to what greyhawk is pointing out is another pattern that HeavyMetal and the "imposter" seem to have in common: whenever using parentheses in a sentence, failing to put any spaces around the left parenthesis (so it is the only thing separating two words).  While that doesn't constitute anything to do with infinity, it is an unambiguous mistake (with respect to the English language) rather than a simple style preference, and therefore apt to be more rare.

Here is another strong pattern common to both HeavyMetal and alleged impersonator:

 - Formulating
 - lists
 - like
 - this
 - with each entry
 - starting out
 - with space-dash-space
 - rather than using the board's list tag
 - or one of many other ways to do it
* like this
 * or this
-or this

An even more telling development is Heavy Metals absence. I am not accusing anyone of anything, but disappearing rather than explaining these observations is a bit weird.

First time I giggled today, +1.

hmmm, another hero-member turned scammer?

One thing in common is they all joined right after the Spring 2011 bubble -- attracted by money, consumed by greed?

Huh? That dude joined in August 2012

You're right, time to stop bitching and get some sleep
 :)

I have pieced together a name and address from return labels, and according to google, the name and location exist. Did HeavyMetal (scammer) use his neighbor's name or some random address in the phone book? Quite possibly. However he did successfully send me an insured package international (Canada to US) and declare a $1,000+ value. Not sure how he would have claimed insurance if names and addresses didn't match.

If you're good at tracking down people or just want to do some googling yourself, PM or email me at auto31524412 at hushmail.com for his name and address. Include a btc address for any reward payment. If it turns out it is this guy, I can weigh my legal/non-legal choices.

HeavyMetal's early out: refund 447 coins (75%) to this address: 16Hc9LVLrAX3uRudAXAn6iccPEjcheCYoc and I will drop this. I am giving away 33% of what I receive at this address to those who have helped in any way.

Any updates?