The hunt for Triswardhani (Lithium - XLTH)

[Gizfreak]

Yes, it's yet another ICO scam (why do people keep falling for this shit anyway).
The scammer disappeared with almost no traces left, right after the goal of 40 BTC was reached.

The pre ann thread was closed and the XLTH website was taken down.

If you can help in any way to hunt down this criminal, you're welcome to post here or contact me.
And please no accusations without hard facts. I am taking this one very serious.

Another thread that is being used for this purpose is this one by Jimmy Recard btw.

BTC address used during the ICO: 1J5RjgAHg8YPe6jF44vBJPF6Epwgf65PFY

[mvl]

Yes, it's yet another ICO scam (why do people keep falling for this shit anyway).
The scammer disappeared with almost no traces left, right after the goal of 40 BTC was reached.

The pre ann thread was closed and the XLTH website was taken down.

If you can help in any way to hunt down this criminal, you're welcome to post here or contact me.
And please no accusations without hard facts. I am taking this one very serious.

Another thread that is being used for this purpose is this one by Jimmy Recard btw.

Let's use this for the factual stuff, not for the wild accusations just based on gut feelings.

I think the hack into the devs own account at his ICO and XLTH-Wallet accounts is a good starting point.

https://s29.postimg.org/5e327cerb/image.png

There it is.
Google the email address crt.ferguson@gmail.com

You will see it belongs to bct user 'templar77'
You can find it in many threads on the forum, like this one: https://bitcointalk.org/index.php?topic=600322.msg6683579#msg6683579

Templar77 was involved in many controversial actions (Libertycoin):
https://bitcointalk.org/index.php?topic=760653.0

Invest for yourself. He is the guy behind Grumpycoin and Dogenex

This is his profile page: https://bitcointalk.org/index.php?action=profile;u=150444
This is also a nice find (Honorcoin) : https://bitcointalk.org/index.php?topic=639043.msg7218665#msg7218665

Certainly someone with a "history".

I leave it to you to dig up more information for now. Feel free to send me a PM.

Oh, one more thing, just to show how ultimately stupid this guy is: the "exchange source code" that he sent out to level3 investors, contained a database dump. In that database dump, his username and password for the XLTH ICO and Wallet site were stored (password in clear text). How stupid is that? That is where the screenshots came from.

Please, let's just post hints and allegations that you were able to verify up to a certain level of certainty. There are more scams and more scammers on the forum, but they are not necessarily pulled by the same scammer just because yout gut feeling tells you so.

[iqbal26]

Have rewards  haha just kiding

[fikihafana]

gizfreak check PM

[fikihafana]

Have rewards  haha just kiding

any bounty ? hahaha  kiding

[JimmyRecard]

loljosh, mintodev, templar77, Carlos RT Ferguson & nite69 are all confirmed alt accounts of the same user/team, if templar77 & CRT.Ferguson are linked to the addresses and username to the XLTH lithium dev Trishwardhani then you can be sure it is them.

Here is what I posted earlier in the other thread that is Fact:

Hi man, I want to join the project. I'm from Mexico. I'm Mid Level PHP dev, but I can also help with design, PR, advertising, and all that cool stuff. So  plz tell me if I can help with something.

So that's him. Apparently, he wanted to learn about creating an altcoin exchange but didn't get root access (https://bitcointalk.org/index.php?topic=320975.20) so he couldn't quite complete the one for lithium

Check this out:

https://bitcointalk.org/index.php?topic=595055.0

https://bitcointalk.org/index.php?topic=466908.0

Twitter Account: https://twitter.com/correosdelbosqu

Name: Josue Aguilar

Location: Panama

Facebook: https://www.facebook.com/josue.aguilar.165685

Name: Josue Aguilar

Location: Boston, New York

Occupation: Self-Employed Web Designer & Developer at Koby. https://www.facebook.com/pages/Koby/633701170023082?ref=br_rs (San Carlos, Panama, Panama)

Places Lived: Sweden 2001, Canada 2007, USA 2014


https://www.quora.com/How-do-I-read-and-then-catch-waves-when-surfing/answer/Josue-Aguilar-6 (Same account as Twitter)

https://bitcointalk.org/index.php?topic=600322.msg7027527#msg7027527

24hash.com was set up by the 2 scammers. they paid out some miners while they kept the bulk (it speculated around 3 million, but could be more). It was Templar77/Carlos RT Ferguson and loljosh the teen ager Canadian

The Email for Lithium was crt.ferguson@gmail.com remember now this guys name is Carlos RT Ferguson.... would you believe it the dumbass lol

Some chat logs from back in the day of 2014, pankkake seems to be loljosh from deciphering the chat logs......
http://btcbase.org/log/2014-08-20

pankkake trying to extort money on Bitcointalk
https://bitcointalk.org/index.php?topic=344219.0

Weird talk on hackernews by pankkake with a user named josephagoss posting as well.... (Facepalm)
https://news.ycombinator.com/item?id=7087839

Their hackernews comments:

https://news.ycombinator.com/threads?id=josephagoss

https://news.ycombinator.com/threads?id=pankkake

Nite69 on bitcointalk was one of his alts as well but he lost the password or was using a throwaway email since that account hasn't logged in since September 2014

Thats about it for now, probably more to link up due to those chatlog names

[Gizfreak]

Have rewards  haha just kiding

any bounty ? hahaha  kiding

For me the bounty is called justice and that's without kidding 

[vlom]

i just searched for the e-mail address crt.ferguson@gmail.com. thats all.

http://website.informer.com/email/CRT.FERGUSON@GMAIL.COM



http://website.informer.com/coinnuke.com

Domain Name: COINNUKE.COM
Registry Domain ID: 1853542653_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.enom.com
Registrar URL: www.enom.com
Updated Date: 2014-04-05 16:14:58Z
Creation Date: 2014-04-05 23:14:00Z
Registrar Registration Expiration Date: 2015-04-05 23:14:00Z
Registrar: ENOM, INC.
Registrar IANA ID: 48
Registrar Abuse Contact Email: abuse@enom.com
Registrar Abuse Contact Phone: +1.4252744500
Domain Status: clientTransferProhibited
Registry Registrant ID:
Registrant Name: CARLOS TORRES
Registrant Organization:
Registrant Street: EDIMBURGO 4
Registrant City: MEXICO
Registrant State/Province: DISTRITO FEDERAL
Registrant Postal Code: 03100
Registrant Country: MX
Registrant Phone: +52.5512545826
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: CRT.FERGUSON@GMAIL.COM
Registry Admin ID:
Admin Name: BRYAN APPERSON
Admin Organization: BITRONIC TECHNOLOGIES
Admin Street: P.O. BOX 1614
Admin City: SOUTHOLD
Admin State/Province: NY
Admin Postal Code: 11971
Admin Country: US
Admin Phone: +1.6318735817
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email: ADMIN@BITRONICTECH.NET
Registry Tech ID:
Tech Name: BRYAN APPERSON
Tech Organization: BITRONIC TECHNOLOGIES
Tech Street: P.O. BOX 1614
Tech City: SOUTHOLD
Tech State/Province: NY
Tech Postal Code: 11971
Tech Country: US
Tech Phone: +1.6318735817
Tech Phone Ext:
Tech Fax:
Tech Fax Ext:
Tech Email: ADMIN@BITRONICTECH.NET
Name Server: NS1-MAYA.HOSTING-MEXICO.NET
Name Server: NS2-MAYA.HOSTING-MEXICO.NET
DNSSEC: unSigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
Last update of WHOIS database: 2014-04-05 16:14:58Z

[Gizfreak]

Reading Jimmy Recard's post, I come to the conclusion that there are maybe more connections going on, maybe even more people involved.
But for this thread i'll stick to Triswardhani and the Lithium Project and I think we are getting some good evidence together.

[vlom]

an other search

https://github.com/tardigrade1/exchange/blob/master/test.php

<?php
require("connect_db.php");
$address = 'B78ox737TTBnWfxwBDK5567AgqkK7HM8FP';
$email =  'crt.ferguson@gmail.com';
$transactions = array();
$query_btc = mysql_query("SELECT time,amount,confirmations FROM btc_deposits WHERE address='$address' AND operation='receive' ORDER  BY time ASC");
while( $row = mysql_fetch_assoc( $query_btc )){
    $transactions[] = $row; // Inside while loop
}
$query_mxn = mysql_query("SELECT time,amount,status FROM mxn_transactions WHERE user_email='$email' AND operation='deposito' ORDER BY time ASC");
while($row = mysql_fetch_assoc($query_mxn)){
    $transactions[] = $row; // Inside while loop
}
usort($transactions, function($item1, $item2) {
    $ts1 = strtotime($item1['time']);
    $ts2 = strtotime($item2['time']);
    return $ts2 - $ts1;
});
print_r($transactions);
?>

EDIT: This address belongs to which altcoin?
B78ox737TTBnWfxwBDK5567AgqkK7HM8FP

[MWesterweele]

Have rewards  haha just kiding

any bounty ? hahaha  kiding

For me the bounty is called justice and that's without kidding 

Not everybody's got a price. However, 40btc in times like this is very huge(my opininion), we should've been vigilant and careful in terms of investments but there is always a scammer who is very good in enticing investors. Justice, we really need this, a bounty is welcome, but justice to every one of us is priceless.

[Gizfreak]

Have rewards  haha just kiding

any bounty ? hahaha  kiding

For me the bounty is called justice and that's without kidding 

Not everybody's got a price. However, 40btc in times like this is very huge(my opininion), we should've been vigilant and careful in terms of investments but there is always a scammer who is very good in enticing investors. Justice, we really need this, a bounty is welcome, but justice to every one of us is priceless.

Got nothing to add 

[JimmyRecard]

Reading Jimmy Recard's post, I come to the conclusion that there are maybe more connections going on, maybe even more people involved.
But for this thread i'll stick to Triswardhani and the Lithium Project and I think we are getting some good evidence together.

To find Triswardhani you have to go back to the linkings of templar77 which also connects to crt.ferguson@gmail.com AKA Carlos Torres AKA Carlos RT Ferguson which also goes back to all that I listed plus more, these are the big fish !

[Gizfreak]

Reading Jimmy Recard's post, I come to the conclusion that there are maybe more connections going on, maybe even more people involved.
But for this thread i'll stick to Triswardhani and the Lithium Project and I think we are getting some good evidence together.

To find Triswardhani you have to go back to the linkings of templar77 which also connects to crt.ferguson@gmail.com AKA Carlos Torres AKA Carlos RT Ferguson which also goes back to all that I listed plus more, these are the big fish !

But to catch a big fish you need a small fish as lure, right? And that's where I am concentrating on atm. One thing at a time

[JimmyRecard]

BTC address used during the ICO: 1J5RjgAHg8YPe6jF44vBJPF6Epwgf65PFY

Looking at that address on the blockchain I don't think that was the XLTH ICO Bitcoin Address, wasn't it hidden ?

[Gizfreak]

BTC address used during the ICO: 1J5RjgAHg8YPe6jF44vBJPF6Epwgf65PFY

Looking at that address on the blockchain I don't think that was the XLTH ICO Bitcoin Address, wasn't it hidden ?

I got that from my BTC wallet and btw following some txs back I came to this address.
It doesn't mean that it is also involved, but there was a tx.

https://blockchain.info/nl/address/13vHWR3iLsHeYwT42RnuKYNBoVPrKKZgRv

That's $1.270.251 

[iqbal26]

BTC address used during the ICO: 1J5RjgAHg8YPe6jF44vBJPF6Epwgf65PFY

Looking at that address on the blockchain I don't think that was the XLTH ICO Bitcoin Address, wasn't it hidden ?

I got that from my BTC wallet and btw following some txs back I came to this address.
It doesn't mean that it is also involved, but there was a tx.

https://blockchain.info/nl/address/13vHWR3iLsHeYwT42RnuKYNBoVPrKKZgRv

That's $1.270.251 

wow fantastico balance 

[JimmyRecard]

BTC address used during the ICO: 1J5RjgAHg8YPe6jF44vBJPF6Epwgf65PFY

Looking at that address on the blockchain I don't think that was the XLTH ICO Bitcoin Address, wasn't it hidden ?

I got that from my BTC wallet and btw following some txs back I came to this address.
It doesn't mean that it is also involved, but there was a tx.

https://blockchain.info/nl/address/13vHWR3iLsHeYwT42RnuKYNBoVPrKKZgRv

That's $1.270.251  

wow fantastico balance  

I googled this address 13vHWR3iLsHeYwT42RnuKYNBoVPrKKZgRv and it came up Poloniex

[ZajzajEr]

Hi,
Maybe some strange, but...

https://play.google.com/store/apps/details?id=com.crtf.btcmxnprice&hl=en-ca
Mercados Bitcoin Mexico
..
..
Offered By
Valhalla Labs

Developer
Email crt.ferguson@gmail.com

More apps form Valhalla Labs - all linked to above mail: crt.ferguson@gmail..
https://play.google.com/store/apps/developer?id=Valhalla%20Labs&hl=en-ca

 ..@#!  (over 0.31BTC lost as 200k of shitty XLTH..;>)

[Lauda]

Isn't this the same story as per thread here: https://bitcointalk.org/index.php?topic=1760477.0 ?
One should be closed so that we can keep the investigation consistent. For those concerned, DOX'es should probably not be posted here. In the case of that happening the thread should be moved into Investigations if I'm correct. Let me know if there are any alts of his, but please provide proof that can be easily followed by outside observers.