vdragon Erupter-Groupbuy-Scam : Task Force

[Xer0]

So, we got scammed and lost ~300 BTC. what now?

First, most important thing: reference
- reference thread: https://bitcointalk.org/index.php?topic=252180.0
- reference user: https://bitcointalk.org/index.php?action=profile;u=79855

Log:
[08 July 2013] user opens group buy and starts collecting funds
[19 July 2013] group buy closed, user says he will drive to yxt personally on 23.07
[2013-07-23 06:46:16] payment wallet gets cleared and funds going washed through a mixer
[23 July 2013, 8:08] he tells having his wallet not synced and moving his drive to next day
[23 July 2013, 11:01] last post, no communication after that point, not even a "heading out now"
[24 July 2013, 03:19:33] last seen online


There are some possibilities:
A: he is clean. still on the drive way or pausing in a motel without internet. and has a fucking reason pushing all our 300 btc through a mixer
B: was a legit member before and decided to do this scam shortly
C: scam was planned long before and so are all old posts fake and just part of a story (=we are screwed)

[1713855759]

1713855759

[1713855759]

1713855759

[1713855759]

1713855759

[1713855759]

1713855759

[1713855759]

1713855759

[Xer0]

ToDo:

- REPORT TO YOUR LOCAL POLICE

- Moderators: please provide all logged IPs and avaiable personal information of user "vdragon"

- fully archive the group buy thread, vdragon's all posts and you pm conversations with him
we could need copies from multiple users to be on the forensically safe side

- he joined some altcoin pools, tested some stuff. we need his ips from the operators

- he posted images of "his" rigs in the rig-image-section, especially interesting is this shot:
https://i.imgur.com/Kq6kuEq.jpg
there is a logo and text on the window - we need to find out what and where! (or if the images are just stolen)

- examine every single post he made and look for useful information, expecially personal information

[Xer0]

so far:

- archived gb thread and all his posts as .maff files, could not do screenshots though
- archived some images he posted in the post-your-mining-rig thread
- nomnomnom contacted possible real-life contact on hungarian bitcoin meetup
- albon found out the name asociated to a paypal account on his email address
- escrow.ms and green65 maybe found addresses related to his bitstamp account

[nottm28]

Sorry for your loss - interested party - watching

[qurashee]

For people based in the UK there is a site called actionfraud where you can report online fraud. I'm not sure btc scams are recognised as a form of electronic fraud but we can give it a go.

[escrow.ms]

Damn, I knew something is wrong.  Try to contact peoples who paid him cash and bank transfer.
You can get more details easily.

[qurashee]

Damn, I knew something is wrong.  Try to contact peoples who paid him cash and bank transfer.
You can get more details easily.

We did but it is a possibility that all these (four) people are the scammer himself pretending to be a customer. We'll see.

[Xer0]

Try to contact peoples who paid him cash and bank transfer. You can get more details easily.

"gapthemind" the only forum member who paid with SEPA - gived bank details, need to check these
the other two who "paid in cash" arent linked to any forum user and could be just some random names

[qurashee]

Btw If you look at the hotmail headers, it reports as encoding iso-8859-2 which is the encoding used in some languages including Hungarian. So there might be some truth that he is indeed from Hungary. Please do have a look and verify or not my finding

[nomnomnom]

Try to contact peoples who paid him cash and bank transfer. You can get more details easily.

"gapthemind" the only forum member who paid with SEPA - not answering any PMs - probably fake account
the other two who "paid in cash" arent linked to any forum user and could be just some random names

He just posted this in the original thread:

As i told a guy that have sent me a PM, i was at a work doing 2nd shift and i couldnt send him info he asked and i told him i will do it when i come home.
So here are his bank infos:
HU87 1040 2812 8050 5553 5750 6002
name is Zoltan Nagy, bank is K&H Budapest, Hungary.

Now, all of you calling me a scammer i have samething to say to you, FUCK OFF. I have a real job and a baby on the way and i have more important things in my life then this forum.

Edit:
Also, for reference, I contacted a Nemet Gyula on meetup:
http://www.meetup.com/BitcoinBudapest/members/50888732/

He is in the Groupbuy list as having ordered 2 Units and paid cash, will pickup localy.
Will let you know if I hear anything back.

And the Picture linked above with the logo and the text on the window, I am pretty
sure the text says "phone" in lowercase in an unusal font. Maybe some phonecompany logo?

[DannysCam]

i will offer a 1 bitcoin reward if i can get my 7.12 bitcoins back!

[nowywbitcoinowymswiecie]

i will offer a 1 bitcoin reward if i can get my 7.12 bitcoins back!

I will do the same - 1.5 BTC for my 8.9 BCT

[Moogle]

For people based in the UK there is a site called actionfraud where you can report online fraud. I'm not sure btc scams are recognised as a form of electronic fraud but we can give it a go.

Didn't know about this site. Cheers will give it a bash

[bobko]

i checked the IBAN and my bank accept it:
IBAN: HU87104028128050555357506002
SWIFT: OKHBHUHB
Bank name: K ES H BANK ZRT. 126 SZEGED, 5., KLAUZAL TER, SZEGED

When is here somebody from Hungary, please go to pollice and give notice of fraud.

[Bicknellski]

Hope you get your coins back everyone and this guys is brought to justice!

[monsters4r]

I'm "walking" through SZEGED with street view finding for that mysterious logo....

 

[escrow.ms]

And the Picture linked above with the logo and the text on the window, I am pretty
sure the text says "phone" in lowercase in an unusal font. Maybe some phonecompany logo?

True
https://i.imgur.com/m7Bef6m.jpg

[iiaurent]

when you miror the picture you see it's written " PHONE " on the windows
looks like a phone shop

[eneloop]

this could be the shop listed in his details.

did he sent a refund from this bank account? if not this could be anyone elses bank account and he speculated that most will pay in BTC. means: this could be a totaly stolen identity.

[Xer0]

I'm "walking" through SZEGED with street view finding for that mysterious logo....

 

good idea! thanks, keep us updated

i think it could be some internet cafe and the pics were shoot in a office or private room