Cryptsy Hack Resolution - 3rd dispatch posted

[Timelord2067]

How about posting a properly formatted version of your PGP public key and the signed message so we can import and verify?

[DarkVenu]

when they will reopen withdrawals for altcoin? release all hostages !

[aardvark15]

when they will reopen withdrawals for altcoin? release all hostages !

I don't think they have any money left to pay out withdrawals, so they won't be opening up any withdrawals.  The one thing I can't figure out is that, according to Cryptsy_Jim, there are still some people employed by cryptsy, so where are they getting money to pay them?

[Phildo]

when they will reopen withdrawals for altcoin? release all hostages !

I don't think they have any money left to pay out withdrawals, so they won't be opening up any withdrawals.  The one thing I can't figure out is that, according to Cryptsy_Jim, there are still some people employed by cryptsy, so where are they getting money to pay them?

From all the fees that they collected while allowing you to trade coins that were "stolen."

Oh, and also from the stolen coins.

[Gleb Gamow]

Also, IP address which linked to a bitcoin address or transaction usually is full nodes IP or miners, not yourself

That's the IP address of the node that relayed the transaction. However, the node is able to see the IP address of the sender. This is why it might only be feasible if one has control over a larger number of nodes.

Amazing how we learnt something gnu every day.

https://blockchain.info/tx/e68f52a38f58e71b951a08650e20aea3f62f7331a3f548e99181f6dbf1cc1d51

Received Time   2014-07-29 08:50:27
Included In Blocks   312987 ( 2014-07-29 08:54:46 + 4 minutes )
Confirmations   90122 Confirmations
Relayed by IP    5.9.24.81 (whois)

https://blockchain.info/tx/c7b46a79fd8887038bd3a8e884b04820038415a60e0b9d2c2f5bcff68a2687bf

Received Time   2014-07-29 12:54:47
Included In Blocks   313009 ( 2014-07-29 13:17:36 + 23 minutes )
Confirmations   90101 Confirmations
Relayed by IP    5.9.24.81 (whois)

4+ hours and 22 Blocks later, the same IP was used to process Cryptsy's stolen coins.

Find out who processed that node and have them relay the IP address of the sender and you'll have your killer holding a candle stick. BTW, the same task is much easier with altcoins.

I'm currently in talks with Paul Vernon to sign a contract to award me U$1.5M for the time I've put into this investigation, but it looks like he only wants to pay me U$770K, but I'm pretty sure I can get him to up it to U$900K worth of BTC given that there's a precedence.

[rayban84]

Fun fact the 1750 Bitcoin bounty I'm looking to receive for just the Bitcoin recovery is 618 more then 1132.

i just realised that im left with nothing for safe keeping the coins . seems like Paul dont think its worth his time to reply to my pms or emails . cryptcracker you may think you know who i am, but i %100 know who you are .

Again, we ask that you contact Paul by sending a note to reward@cryptsy.com and show proof the coins are in your control. Then he will talk to you. 
Too many have made the claims you are making.

Internet is full of trolls, making fun of people miseries. What a life.

[romeshomey]

Received Time   2014-07-29 12:54:47
Included In Blocks   313009 ( 2014-07-29 13:17:36 + 23 minutes )
Confirmations   90101 Confirmations
Relayed by IP    5.9.24.81 (whois)

I find that relay IP address associated with this poster running a dedicated server.

http://www.webhostingtalk.com/showthread.php?t=1383580&p=9154591#post9154591

[rayban84]

Also, IP address which linked to a bitcoin address or transaction usually is full nodes IP or miners, not yourself

That's the IP address of the node that relayed the transaction. However, the node is able to see the IP address of the sender. This is why it might only be feasible if one has control over a larger number of nodes.

Amazing how we learnt something gnu every day.

https://blockchain.info/tx/e68f52a38f58e71b951a08650e20aea3f62f7331a3f548e99181f6dbf1cc1d51

Received Time   2014-07-29 08:50:27
Included In Blocks   312987 ( 2014-07-29 08:54:46 + 4 minutes )
Confirmations   90122 Confirmations
Relayed by IP    5.9.24.81 (whois)

https://blockchain.info/tx/c7b46a79fd8887038bd3a8e884b04820038415a60e0b9d2c2f5bcff68a2687bf

Received Time   2014-07-29 12:54:47
Included In Blocks   313009 ( 2014-07-29 13:17:36 + 23 minutes )
Confirmations   90101 Confirmations
Relayed by IP    5.9.24.81 (whois)

4+ hours and 22 Blocks later, the same IP was used to process Cryptsy's stolen coins.

Find out who processed that node and have them relay the IP address of the sender and you'll have your killer holding a candle stick. BTW, the same task is much easier with altcoins.

I'm currently in talks with Paul Vernon to sign a contract to award me U$1.5M for the time I've put into this investigation, but it looks like he only wants to pay me U$770K, but I'm pretty sure I can get him to up it to U$900K worth of BTC given that there's a precedence.

How is it possible that the node who processed the transaction has still in its logs the IP address of the originator of the transaction?. It was 2 years ago. Maybe. I don't know if these transactions IPs are ever dumped to a log. You can try contacting the operator of that Bitcoin node. Who knows, maybe they have still the logs.

[rayban84]

Fun fact the 1750 Bitcoin bounty I'm looking to receive for just the Bitcoin recovery is 618 more then 1132.

i just realised that im left with nothing for safe keeping the coins . seems like Paul dont think its worth his time to reply to my pms or emails . cryptcracker you may think you know who i am, but i %100 know who you are .

Why don't you try doing a dust transaction between the theft addresses, so we all see that you are in control of the private keys?.

[romeshomey]

Not sure what relevance if any this has but this page was just updated February 2016.

The old nogleg.com (at 5.9.24.81) was hosted at Hetzner.

http://nogleg.com/

[romeshomey]

Fun fact the 1750 Bitcoin bounty I'm looking to receive for just the Bitcoin recovery is 618 more then 1132.

i just realised that im left with nothing for safe keeping the coins . seems like Paul dont think its worth his time to reply to my pms or emails . cryptcracker you may think you know who i am, but i %100 know who you are .

Why don't you try doing a dust transaction between the theft addresses, so we all see that you are in control of the private keys?.

I'd thought he'd already stated he wasn't in possession of the coins and that he was attempting to blackmail those who held the multi sig private keys into giving them to him.  Then again, its hard to follow where any of this is going.

[Xandrah]

Oh god this was the best read today. I think they have been snorting physical bitcoins crushed into a powder from ebay to come up with this insane story.

[romeshomey]

IP Location    Germany Germany Nuremberg Hetzner Online Ag
ASN    Germany AS24940 HETZNER-AS Hetzner Online GmbH (registered Jun 03, 2002)
Resolve Host    worker45.brandwire.tv
Whois Server    whois.ripe.net
IP Address    5.9.24.81
% Abuse contact for '5.9.24.64 - 5.9.24.95' is ''

inetnum:        5.9.24.64 - 5.9.24.95
netname:        HETZNER-RZ16
descr:          Hetzner Online AG
descr:          Datacenter 16
country:        DE
admin-c:        HOAC1-RIPE
tech-c:         HOAC1-RIPE
status:         ASSIGNED PA
remarks:        INFRA-AW
mnt-by:         HOS-GUN
mnt-lower:      HOS-GUN
mnt-routes:     HOS-GUN
created:        2012-06-12T08:41:54Z
last-modified:  2012-06-12T08:41:54Z
source:         RIPE

role:           Hetzner Online GmbH - Contact Role
address:        Hetzner Online GmbH
address:        Industriestrasse 25
address:        D-91710 Gunzenhausen
address:        Germany
phone:          +49 9831 505-0
fax-no:         +49 9831 505-3
e-mail:         
abuse-mailbox: 
remarks:        *************************************************
remarks:        * For spam/abuse/security issues please contact *
remarks:        * , not this address. *
remarks:        * The contents of your abuse email will be *
remarks:        * forwarded directly on to our client for *
remarks:        * handling. *
remarks:        *************************************************
remarks:
remarks:        *************************************************
remarks:        * Any questions on Peering please send to *
remarks:        *  *
remarks:        *************************************************
org:            ORG-HOA1-RIPE
admin-c:        MH375-RIPE
tech-c:         GM834-RIPE
tech-c:         SK2374-RIPE
tech-c:         TF2013-RIPE
tech-c:         MF1400-RIPE
tech-c:         SK8441-RIPE
nic-hdl:        HOAC1-RIPE
notify:         
mnt-by:         HOS-GUN
created:        2004-08-12T09:40:20Z
last-modified:  2015-08-06T09:39:14Z
source:         RIPE

route:          5.9.0.0/16
descr:          HETZNER-RZ-FKS-BLK5
origin:         AS24940
mnt-by:         HOS-GUN
created:        2012-04-26T10:30:12Z
last-modified:  2012-04-26T10:30:12Z
source:         RIPE

[rayban84]

Fun fact the 1750 Bitcoin bounty I'm looking to receive for just the Bitcoin recovery is 618 more then 1132.

i just realised that im left with nothing for safe keeping the coins . seems like Paul dont think its worth his time to reply to my pms or emails . cryptcracker you may think you know who i am, but i %100 know who you are .

Why don't you try doing a dust transaction between the theft addresses, so we all see that you are in control of the private keys?.

I'd thought he'd already stated he wasn't in possession of the coins and that he was attempting to blackmail those who held the multi sig private keys into giving them to him.  Then again, its hard to follow where any of this is going.

I was meaning the other user who was trying to troll Cryptsy (show off) in front of us: "Eternal Insolent". He/she is another hacker claiming to be with access to the coins.

[Bit_Happy]

...
I have talked to Big Vern directly on twitter...

You are flirting with multiple felony crimes, have you ever spent time in Federal prison?


Perhaps, you should re-consider your primary strategy?

[romeshomey]

Fun fact the 1750 Bitcoin bounty I'm looking to receive for just the Bitcoin recovery is 618 more then 1132.

i just realised that im left with nothing for safe keeping the coins . seems like Paul dont think its worth his time to reply to my pms or emails . cryptcracker you may think you know who i am, but i %100 know who you are .

Why don't you try doing a dust transaction between the theft addresses, so we all see that you are in control of the private keys?.

I'd thought he'd already stated he wasn't in possession of the coins and that he was attempting to blackmail those who held the multi sig private keys into giving them to him.  Then again, its hard to follow where any of this is going.

I was meaning the other user who was trying to troll Cryptsy (show off) in front of us: "Eternal Insolent". He/she is another hacker claiming to be with access to the coins.

Thanks.  I clearly missed that.

[spamsucks]

2nd dispatch news coming shortly. Paul and I have both communicated with Eternal Insolent and it looks like we'll have a resolution within 24 hours. Keep your fingers crossed, mates.

wait... isnt that you? Now I am confused...
or did you accidentally log in from the wrong account?

[romeshomey]

2nd dispatch news coming shortly. Paul and I have both communicated with Eternal Insolent and it looks like we'll have a resolution within 24 hours. Keep your fingers crossed, mates.

wait... isnt that you? Now I am confused...

HAHA

[spamsucks]

so Eternal Insolent is the same person as Cryptcracker... is that what I just saw?







And now that post was deleted... so what exactly just happened?


Never mind... I think we all know what just happened... unless I am reading this wrong (im not real smart)
Cryptcracker tried to post but was logged in as Eternal Insolent by mistake.

That means this whole thing has been a troll, not that I am surprised. We all know what that means.

[Gleb Gamow]

so Eternal Insolent is the same person as Cryptcracker... is that what I just saw?







And now that post was deleted... so what exactly just happened?


Never mind... I think we all know what just happened... unless I am reading this wrong (im not real smart)
Cryptcracker tried to post but was logged in as Eternal Insolent by mistake.

That means this whole thing has been a troll, not that I am surprised. We all know what that means.