Someone has stolen my account!

[TTBit]

I should say theymos has told me that the original "HeavyMetal" account and "Real Heavy Metal" new account were always connected via Tor, and not much help.

[1713252359]

1713252359

[evlew]

This does not look good.

We must remember, just because a new member comes around and has really good feedback, doesn't mean they are not up to a bigger plan (scam).  how big were your previous deals with him?  Significantly smaller?  An escrow could have prevented this whole ordeal.  I'm not trying to twist a knife but hopefully I make a couple other people think twice before committing to a purchase on here.

What I don't get is... Heavy Metal obviously owns a lot of assets and is probably well off judging by the amount of precious metals he has been selling.  Is 7k really worth being hunted down by internet folk.... not that you guys stand much of a chance based on the few facts I've read.  The fact he's been using Tor make me seriously doubt he was using real name and return address on his packages.

my 2 cents.

[sadpandatech]

You know what's funny....

The Real Heavy Metal's BTC address, magicly happens to have 14 SENT taints to the supposed hackers address..

Evidenced here;

http://blockchain.info/taint/1AuAgBTyRED81JX5PMsekeTjLYiaDo9Fii?reversed=true


This page shows the addresses which have received bitcoins from 1AuAgBTyRED81JX5PMsekeTjLYiaDo9Fii. The greater the taint the stronger the link between the addresses.
2 1AuAgBTU8FJ2oHM4iwRRa5SJVTbuKV8htr    0%    14


So you were so distraught by getting hacked that you sent the hacker all your coins, HeavyMetal?!?!

To prove I am the real Heavy Metal I am signing this message with the address 1AuAgBTyRED81JX5PMsekeTjLYiaDo9Fii which I used in several transactions prior to leaving. My last post was: https://bitcointalk.org/index.php?topic=103091.msg1152231#msg1152231 ALL posts after that are not me! Someone please go to the threads this impersonator has created and give warning to people there! I am not sure if I am signing this correctly, please tell me if I am not.
HNczqA+jodW+AMsWfiUAJJ2UmldxEu6sNr+TFYk2OB1Lls/fZ4DjjAb8M5Pwyi7ZnQ+S/wN5M0nfT8hDdCSgxrs=

The supposed hacker's new address that he replaced the 'real' one with, is evidenced here in a current picture of HeavyMetal's profile and matches the address that the orginal heavymetal's coins taint to undeniably;

[sadpandatech]

You're fuggin busted buddy. You better hope these people don't have your real name and address....

[TTBit]

This does not look good.

We must remember, just because a new member comes around and has really good feedback, doesn't mean they are not up to a bigger plan (scam).  how big were your previous deals with him?  Significantly smaller?  An escrow could have prevented this whole ordeal.  I'm not trying to twist a knife but hopefully I make a couple other people think twice before committing to a purchase on here.

What I don't get is... Heavy Metal obviously owns a lot of assets and is probably well off judging by the amount of precious metals he has been selling.  Is 7k really worth being hunted down by internet folk.... not that you guys stand much of a chance based on the few facts I've read.  The fact he's been using Tor make me seriously doubt he was using real name and return address on his packages.

my 2 cents.

I had done 2 prior trades. Total was about 140 btc, first one ~20, 2nd one about 120. I can pull up the transactions if it helps when I get a chance.

The Tor issue was a blow to my investigation as well, I had thought he was an honest guy that went bad when faced with a 600 coin windfall. But I still can't figure out why he tried to save face with the new account, it would be more profitable for him to keep quiet.

[TTBit]

You know what's funny....

The Real Heavy Metal's BTC address, magicly happens to have 14 SENT taints to the supposed hackers address..

Evidenced here;

http://blockchain.info/taint/1AuAgBTyRED81JX5PMsekeTjLYiaDo9Fii?reversed=true


This page shows the addresses which have received bitcoins from 1AuAgBTyRED81JX5PMsekeTjLYiaDo9Fii. The greater the taint the stronger the link between the addresses.
2 1AuAgBTU8FJ2oHM4iwRRa5SJVTbuKV8htr    0%    14


So you were so distraught by getting hacked that you sent the hacker all your coins, HeavyMetal?!?!

To prove I am the real Heavy Metal I am signing this message with the address 1AuAgBTyRED81JX5PMsekeTjLYiaDo9Fii which I used in several transactions prior to leaving. My last post was: https://bitcointalk.org/index.php?topic=103091.msg1152231#msg1152231 ALL posts after that are not me! Someone please go to the threads this impersonator has created and give warning to people there! I am not sure if I am signing this correctly, please tell me if I am not.
HNczqA+jodW+AMsWfiUAJJ2UmldxEu6sNr+TFYk2OB1Lls/fZ4DjjAb8M5Pwyi7ZnQ+S/wN5M0nfT8hDdCSgxrs=

The supposed hacker's new address that he replaced the 'real' one with, is evidenced here in a current picture of HeavyMetal's profile and matches the address that the orginal heavymetal's coins taint to undeniably;

Great find! I can confirm that the 1AuAgBt....Fii contains 2 successful transactions, but I was scammed with 1AuAgBT....htr.

If it helps, my prior 2 successful trades txid:
#1) a85707d9507f97399201444d63a3660dc84ea24b2d83b9c7e1894a1f5d37aa15
#2) b1c924d16e85a012badc53d58bb473681a916906e9bdfe0204b46b564bb969eb

Thanks for the help!

[sadpandatech]

Great find! I can confirm that the 1AuAgBt....Fii contains 2 successful transactions, but I was scammed with 1AuAgBT....htr.

That's my point. The same guy owns both of those addresses!

A large amount of the coins that were sent to the orginal AuAG-Fii have later been sent by the owner of AuAG-Fii to AuAg-htr!

[greyhawk]

Yeah, it was pretty obvious from the get go that there is no hacker involved at all.

To explain what I did here:

Interesting. So what you're saying is that the 'impersonator' is so strangely good at impersonating that he does the exact same very specific, very weird and very unique thing that you consistently do when writing down BTC prices?

Normally when someone writes down prices they do it like this:

42 BTC


Now when Heavy Metal writes down prices he does it like this:

42BTC


This is of course by no means a unique thing, but you will find that only a very very very small percentage of people use the lower variant.

This is also something that is done subconciously. When trying to impersonate someone this is not something you easily notice as something you'd have to copy or even if you notice, it is not easy to consistently keep up.

Now when we check Heavy Metal's posts before and after the supposed hack, we will find that he consistently uses the lower variant.

Which makes the chance of an imposter infinitesimal really.

[TTBit]

Which makes the chance of an imposter infinitesimal really.

I think the impostor angle was easy to dismiss early on.

My question: Why create another username and claim to be hacked if you were scamming all along? Why not just bail? This makes me believe he wasn't careful with his scam.

[makomk]

You know what's funny....

The Real Heavy Metal's BTC address, magicly happens to have 14 SENT taints to the supposed hackers address..

Evidenced here;

http://blockchain.info/taint/1AuAgBTyRED81JX5PMsekeTjLYiaDo9Fii?reversed=true


This page shows the addresses which have received bitcoins from 1AuAgBTyRED81JX5PMsekeTjLYiaDo9Fii. The greater the taint the stronger the link between the addresses.
2 1AuAgBTU8FJ2oHM4iwRRa5SJVTbuKV8htr    0%    14


So you were so distraught by getting hacked that you sent the hacker all your coins, HeavyMetal?!?!

OK, if I'm reading that correctly 0% of all coins sent to 1AuAgBTyRED81JX5PMsekeTjLYiaDo9Fii later passed through 1AuAgBTU8FJ2oHM4iwRRa5SJVTbuKV8htr. That can't be right for obvious reasons.

[greyhawk]

Which makes the chance of an imposter infinitesimal really.

I think the impostor angle was easy to dismiss early on.

My question: Why create another username and claim to be hacked if you were scamming all along? Why not just bail? This makes me believe he wasn't careful with his scam.

Trade -> Build reputation -> get 6000 USD order -> stuff underpants with 6000 Dollares -> roll on bed in underpants -> claim to be hacked -> continue trading under "re-instated" account -> wait for next underpants-sized order -> repeat from step 4

[casascius]

Yeah, it was pretty obvious from the get go that there is no hacker involved at all.

To explain what I did here:

Interesting. So what you're saying is that the 'impersonator' is so strangely good at impersonating that he does the exact same very specific, very weird and very unique thing that you consistently do when writing down BTC prices?

Normally when someone writes down prices they do it like this:

42 BTC


Now when Heavy Metal writes down prices he does it like this:

42BTC


This is of course by no means a unique thing, but you will find that only a very very very small percentage of people use the lower variant.

This is also something that is done subconciously. When trying to impersonate someone this is not something you easily notice as something you'd have to copy or even if you notice, it is not easy to consistently keep up.

Now when we check Heavy Metal's posts before and after the supposed hack, we will find that he consistently uses the lower variant.

Which makes the chance of an imposter infinitesimal really.

I don't take a position as to whether or not this is a scam or imposter, but your assertion that leaving out a space between "42" and "BTC" is specific, unique, or weird, corresponds with any "infinitesimal" chance of an imposter, is being egregiously oversold.

A related habit worth looking into is whether an author puts one or two spaces after a period between sentences.  But even this would not result in any conclusion that could be "infinitesimal" anything.  It is, however, part of how I can usually tell if e-mail from my ex-wife was written by her (she does two spaces), or somebody else on her behalf (most people seem to do one space).

EDIT: HeavyMetal and supposed imposter both use one space after a period, but something that would lend support to what greyhawk is pointing out is another pattern that HeavyMetal and the "imposter" seem to have in common: whenever using parentheses in a sentence, failing to put any spaces around the left parenthesis (so it is the only thing separating two words).  While that doesn't constitute anything to do with infinity, it is an unambiguous mistake (with respect to the English language) rather than a simple style preference, and therefore apt to be more rare.

Here is another strong pattern common to both HeavyMetal and alleged impersonator:

 - Formulating
 - lists
 - like
 - this
 - with each entry
 - starting out
 - with space-dash-space
 - rather than using the board's list tag
 - or one of many other ways to do it
* like this
 * or this
-or this

[RodeoX]

An even more telling development is Heavy Metals absence. I am not accusing anyone of anything, but disappearing rather than explaining these observations is a bit weird.

[Parliament]

Trade -> Build reputation -> get 6000 USD order -> stuff underpants with 6000 Dollares -> roll on bed in underpants -> claim to be hacked -> continue trading under "re-instated" account -> wait for next underpants-sized order -> repeat from step 4

First time I giggled today, +1.

[bitcool]

hmmm, another hero-member turned scammer?

One thing in common is they all joined right after the Spring 2011 bubble -- attracted by money, consumed by greed?

[vampire]

hmmm, another hero-member turned scammer?

One thing in common is they all joined right after the Spring 2011 bubble -- attracted by money, consumed by greed?

Huh? That dude joined in August 2012

[bitcool]

hmmm, another hero-member turned scammer?

One thing in common is they all joined right after the Spring 2011 bubble -- attracted by money, consumed by greed?

Huh? That dude joined in August 2012

You're right, time to stop bitching and get some sleep
 

[TTBit]

I have pieced together a name and address from return labels, and according to google, the name and location exist. Did HeavyMetal (scammer) use his neighbor's name or some random address in the phone book? Quite possibly. However he did successfully send me an insured package international (Canada to US) and declare a $1,000+ value. Not sure how he would have claimed insurance if names and addresses didn't match.

If you're good at tracking down people or just want to do some googling yourself, PM or email me at auto31524412 at hushmail.com for his name and address. Include a btc address for any reward payment. If it turns out it is this guy, I can weigh my legal/non-legal choices.

HeavyMetal's early out: refund 447 coins (75%) to this address: 16Hc9LVLrAX3uRudAXAn6iccPEjcheCYoc and I will drop this. I am giving away 33% of what I receive at this address to those who have helped in any way.

[TECSHARE]

Any updates?