TradeFortress tied to Hashie.co exit scam

[poeEDgar]

http://www.newsbtc.com/2014/12/30/hashie-ltcgear-users-bitcoins/

Hashie.co, a cloud-mining service that claims over 40,000 users, has suspended operations... According to some reports, the amount of missing bitcoins is over 1,400.

Blockchain evidence that ties TradeFortress to Hashie.co-controlled addresses:

sent.

sent.
http://explorer.chain.com/transactions/7547d946f9f622692d845bec3c220cbf323ee3750dd21632fce90ec03ba431ed

Hi TradeFortress I would like to ask you something important.
When I examined this transaction, I've seen that You've used 3 different addresses to pay 20 BTC.
1: https://blockchain.info/address/1JNZgYxgsrUnwoCGZqSKGqpbUoxewyCxsn
2: https://blockchain.info/address/15bLpPJbAz1ahgFSLMBLCVuoM1y9QYHHuy
3: https://blockchain.info/address/1MDiAC7C91waTzTtkg8UpKqcPej58rn77h

Let's look at the 1st address closer. It got bitcoins from this address: https://blockchain.info/address/12QTQnVtCQpFfaKnXwG1cfDmzJeJbj18zA

And this addresses bitcoins come from "scammer (told it was hacked) hashie.co". "Which are hot wallets of the hashie.co"
Weren't those bitcoins stollen by hackers?

Can you explain this please?

Edit (addition):
Hashie.co scam was hacked in 24 December 2014; https://www.reddit.com/r/Bitcoin/comments/2qods9/hashieco_was_hacked_or_was_a_scam_all_along/
This address: 12QTQnVtCQpFfaKnXwG1cfDmzJeJbj18zA got bitcoins from hot wallet on the date of 2015-01-26 11:19:12  (Fee: 0.0001 BTC - Size: 26644 bytes)
https://blockchain.info/tx/085efd1c29b57d8b6f0cd063187c77f326777e84b8a6ddcb0915847b7917635e

Then it's used to send bitcoins to TradeFortress...
Isn't that interesting?

Very interesting indeed. Good find. Checks out. Haven't looked into the other addresses.

20 BTC from "TF" to "Quickseller" --> https://blockchain.info/tx/7547d946f9f622692d845bec3c220cbf323ee3750dd21632fce90ec03ba431ed
https://blockchain.info/address/1JNZgYxgsrUnwoCGZqSKGqpbUoxewyCxsn --> https://blockchain.info/address/12QTQnVtCQpFfaKnXwG1cfDmzJeJbj18zA --> https://blockchain.info/address/1CgD88HMPcBSQ3C5ykLEWFiCJpJ1jryBFg (HASHIE ADDRESS) / https://blockchain.info/address/1FGzuz2E6u1kh4h9DcjR4Z2rfJSoGfiiC3 (HASHIE ADDRESS)

http://justpaste.it/hashie

Being one address removed from the Hashie wallets means TradeFortress was either involved in the scam, or was directly paid with the proceeds (meaning he knows exactly who controlled those addresses).

Queen Elsa (Hashie rep) states she is TradeFortress:

I might not be checking this thread or support@hashie.co much in the future, but if you need to contact me for any reason feel free to email me at admin@glados.cc

Bye everyone!

-Queen Elsa

User admin@glados.cc -- webmaster for both hashie.co and coinchat.org -- ties TradeFortress to Hashie:

https://code.google.com/p/chromium/issues/detail?id=429395


https://code.google.com/p/chromium/issues/detail?id=306734

[1713880310]

1713880310

[1713880310]

1713880310

[1713880310]

1713880310

[1713880310]

1713880310

[1713880310]

1713880310

[vodaljepa]

About time this scammer is exposed and justice be brought

[Dr Charles]

very interesting post. Thanks for displaying the aggregation of this data to support a claim rather than just an accusation.

[poeEDgar]

About time this scammer is exposed and justice be brought

Unfortunately, I'm not sure we will see any justice (if justice is him being prosecuted or victims being repaid). Really, I just find it so damn curious. He is tied to prominent scams (Inputs.io, CoinLenders, now Hashie.co)... Yet, he fancies himself a scam buster (regularly warns of scam sites and even went on a negative-trust campaign against those advertising dicebitco.in).

Now he shills for Quickseller and blindly sends him 20BTC? Fucking weird.

[Deathwing]

Well, this just got pretty weird. I knew TF since CoinChat and he was really good, nice back then. I know that glados.cc belongs to him as I forgot my CoinChat password once and TF gave me this email address to send a mail to him and reset it later on.

Well, I feel bad...

[TheButterZone]

I recognize that nick!

Freenode events search: http://otc.evilbs.com/?unicodesnowman&&&&&

Freenode <nickserv>:
(notice) Information on unicodesnowman (account unicodesnowman):
(notice) Registered : Dec 01 20:48:46 2014 (41w 4d 0h ago)
(notice) Last addr  : ~unicodesn@wikipedia/unicodesnowman
(notice) Last seen  : now
(notice) Flags      : HideMail
(notice) *** End of Info ***

[siameze]

Well, this just got pretty weird. I knew TF since CoinChat and he was really good, nice back then. I know that glados.cc belongs to him as I forgot my CoinChat password once and TF gave me this email address to send a mail to him and reset it later on.

Well, I feel bad...

This address has been on the scam radar for a long time, ever since right before the inputs hack.

[Coinonomous]

Well, this just got pretty weird. I knew TF since CoinChat and he was really good, nice back then. I know that glados.cc belongs to him as I forgot my CoinChat password once and TF gave me this email address to send a mail to him and reset it later on.

Well, I feel bad...

This address has been on the scam radar for a long time, ever since right before the inputs hack.

What I find most interesting about those upstream addresses, is that if you follow them back to the piles of BTC in one or the other, the seemingly random outputs start to look almost EXACTLY like the scripts running the now almost defunct scrypt.cc (ponzi) site's hotwallet - Looks just about the same - laundering bitcoin's over and over, much of it landing in Eobot wallets.  In fact, now that I look at both sites' "hot-wallet" addresses, I am pretty sure they were/are both being run by the same criminals. I think someone mentioned that TF had moved onto Scrypt.cc, but I can't recall who or in what thread now .... I would post the addresses and some example tx's for both, but I'm short on time, but I'm sure someone else can double-check.

Good post/thread, thanks!

[MUFC]

Well, this just got pretty weird. I knew TF since CoinChat and he was really good, nice back then. I know that glados.cc belongs to him as I forgot my CoinChat password once and TF gave me this email address to send a mail to him and reset it later on.

Well, I feel bad...

The person that owns the tradef account now could be a different person to the person who committed the scams. In fact it could have changed hands several times as has been aledged. It is weird that he got involved in this and seemingly sent quickseller coins but he's probably just trolling and enjoying the drama and confusion.

[DeftPlunk]

For those that are new to TradeFortress, his scams go way back
November 18, 2012
"Scammer Trade Fortress"
https://bitcointalk.org/index.php?topic=126588
May 17, 2013
"TradeFortress is a scammer."
https://bitcointalk.org/index.php?topic=207841
January 10, 2014
"TradeFortress - Full Verifiable Dox - Scammer"
https://bitcointalk.org/index.php?topic=327178
... and a ton other threads.

Over the years, there has been a TradeFortress on #bitcoin-otc. This TradeFortress registered and authenticates by signing messages with this bitcoin address:
1xw6QFuj3jvQ1spfT9H5kqitaByeJjSRB
https://bitcoin-otc.com/viewgpg.php?nick=TradeFortress
https://blockchain.info/address/1xw6QFuj3jvQ1spfT9H5kqitaByeJjSRB

This address received bitcoin from the 1GLadosEkeAsLReqS3yQ51E1R3wVtbJCDF address that is commonly seen used for change or mixing in TradeFortress' transactions, including the transaction with Quickseller referenced in the original post of this thread.

#bitcoin-otc ratings, including a few scam accusations:
https://bitcoin-otc.com/viewratingdetail.php?nick=TradeFortress

On to unicodesnowman, who lurks around #bitcoin-otc often and occasionally tries to sell massive amounts of bitcoin in the Sydney area.
http://bitcoinstats.com/irc/bitcoin-otc/logs/2015/01/16#l1421382797.0

2015-01-16 04:33   unicodesnowman   selling 1k btc, sydney.
2015-01-16 04:33   Michail1   price?
2015-01-16 04:33   unicodesnowman   Michail1, bitstamp w/ slippage -2%
2015-01-16 04:34   Michail1   too much for me. thanks.
2015-01-16 04:37   therealNano   sydney aus?
2015-01-16 04:38   unicodesnowman   therealNano, yes.

unicodesnowman is unregistered in the gribble/bitcoin-otc web of trust. Occasionally he talks about Chromium, loosely linking him to the admin@glados.cc of those Chromium issue chats.

Anyhow, all of these smoking guns won't actually do anything. If you were scammed by this guy and want something to happen, call the feds: http://www.ic3.gov/complaint/default.aspx http://www.afp.gov.au/contact

[zifford]

Damn I never knew all this. i figured we didn't know nothin about Queen Elsa that bitch. Is there any action against TradeFortress? Who is he?

[Coinonomous]

Damn I never knew all this. i figured we didn't know nothin about Queen Elsa that bitch. Is there any action against TradeFortress? Who is he?

Can you just try reading the post right before yours, I believe it's all right there.

[figmentofmyass]

Damn I never knew all this. i figured we didn't know nothin about Queen Elsa that bitch. Is there any action against TradeFortress? Who is he?

Can you just try reading the post right before yours, I believe it's all right there.

to be fair, there wasn't any mention of "any action against TradeFortress".....

just this:

Anyhow, all of these smoking guns won't actually do anything. If you were scammed by this guy and want something to happen, call the feds: http://www.ic3.gov/complaint/default.aspx http://www.afp.gov.au/contact

i mean, i would assume there are no actions pending against him. but do we know this for sure?

[blockchaintoken]

The Hashie contact during the fake hack was admin@glados.cc which is linked to Tradefortress.
http://btcbase.org/log/2015-09-18 (search unicodesnowman and Tradefortress)

gladoscc on Twitter is named Danny, as he posted a letter in 2019 from an airline voucher. He resides in Australia.

#uninicodesnowman is linked to admin@glados.cc on GitHub https://github.com/wikimedia/integration-config/blob/master/zuul/layout.yaml

unicodesnowman is linked to Danny, who resides in Sydney, Australia using the moniker in his youth when he won two Google code-in completions in 2012 and 2015. https://opensource.googleblog.com/2015/06/google-code-in-2014-wrap-up-with_11.html?m=1

The news article on one of his previous scams puts him at the same age, in Sydney, and using the moniker Tradefortress. https://www.theage.com.au/technology/australian-bitcoin-bank-hacked-1m-stolen-20131108-hv2iv.html


The un-named, 2 letter surnamed, individual is currently working in Sydney and investing his “hard earned” money in venture capital.

It walks, and quacks like a duck. However, there’s always the 1% chance I am wrong.