Blockchain Analysis re: Agora Marketplace (Seeking help)

[st_quistgard]

Hi all,

Any masters of blockchain-analysis want to take a look at my findings below and provide some input? I've been using Wallet Explorer to investigate Agora Marketplace's wallets, and I've found some intriguing/concerning stuff.

Around 24,000 BTC accumulating in Agora-controlled addresses

There are currently around 23,960 BTC sitting in storage addresses that appear to be controlled by Agora. The bulk of this money seems to be drawn from Agora deposit addresses in large chunks, so it doesn't *appear* to be standard market fees. And most of the storage addresses are basically receive-only, so it's unlikely they have any operational use. Also, the hoarding seems to have accelerated in recent months.

For example, after being funded with 536.8 BTC of Agora money on 11/25/14, this address has been receiving 50 BTC chunks regularly since 12/5/14: http://www.walletexplorer.com/address/1923qxU74HWWz75LgWTsPE4FT9Zyd6n6bv. It's balance is currently 14636.8468236. Here's a similar address with a balance of 2350: http://www.walletexplorer.com/address/152p1VPp2UYceP9BLtJRLoMgoErQRCryTt.

Other storage addresses that seem to be controlled by Agora:

• http://www.walletexplorer.com/address/1GE26MHLB3pvtQdV9BFtfPc7tD12b72NtE (2393.10046)
• http://www.walletexplorer.com/address/1AtPMyFrbjvEAZyAHvkQ5SBNyou33m5Eft (1730.00001)
• http://www.walletexplorer.com/address/18p3VadubeccpJnhBQkyrbs6SQPN5WCf8J (1950)
• http://www.walletexplorer.com/address/152p1VPp2UYceP9BLtJRLoMgoErQRCryTt (2350)
• http://www.walletexplorer.com/address/18vssbRHFbSrDttAAg9tX1TtwSvUyCKJwd (900)
• http://www.walletexplorer.com/address/17DhzPwQLvpoB1xy1mSt2XTCFmePgGUh2r
• http://www.walletexplorer.com/address/1CG4oDeiDcm5QSQhbXmfLmPzdZGANymaxS

I'd like to see what percentage of Agora deposits is going to these storage addresses (to determine whether whether it's reasonable profit taking or something more nefarious) but Wallet Explorer doesn't offer a way to filter by incoming transactions. Anyone have a program that can do that? Also, some of the activity in these addresses seems to coincide with downtime in late November (and the current downtime), so the timing is worth looking into further.

Getting a little crazy now: Possible Agora-SR2 connection?

This could use double checking, but it looks like substantial amounts of BTC were sent directly from Silk Road 2 to Agora's operators in the days and weeks leading up to the SR2 seizure.

• From 11/17/14 to 12/11/14, this address accumulated 568 BTC, mostly from known Agora addresses: http://www.walletexplorer.com/address/1MAqDMezJAe1Am4gcZhKc8etYJqSPBoRfD. (This activity looks very similar to the storage addresses discussed above.)
• On 12/17, the entire balance is spent in this transaction: http://www.walletexplorer.com/txid/9a9cf7a153bcf0eac837c7d5c82bd5ec7e803fc6331debd53090f7e4bbfc7a5f. If you check the other addresses spending coins in that TX, you'll see several of them received a bunch of money from SR2, mostly in 30 BTC chunks during late Oct and early Nov. So whoever owns the 1MAqD... address (looks like it might be Agora) also owns the addresses receiving money from SR2 just prior to its fall.

Of course I could be interpreting this wrong (and Wallet Explorer could be wrong!), so if anyone wants to take a look and share your thoughts, I'd appreciate it.

This is all I have time for at the moment, but I have a bunch of notes on this stuff so can provide more info when I get a chance tomorrow. In the meantime, please feel free to tell me if you spot something I missed!