How to find "Tom Williams" ...

[ctoon6]

was the entire site really behind tor? if that is the case, i wish you guys the best of luck to find him, otherwise if it wasn't just get the federal bureau of investigation or some other entity that cover cyber crime. they can force the hosting company to reveal the identity of the person/s.  an incident this large is almost certain to get caught. and when he/she is caught, you might be lucky and get all your coins back assuming the logs were still in tact/obtainable, or at least be ordered to pay back the BC.

[1714108794]

1714108794

[1714108794]

1714108794

[1714108794]

1714108794

[wumpus]

was the entire site really behind tor? if that is the case, i wish you guys the best of luck to find him,

It had a tor hidden service, but was also reachable through normal https... otherwise we wouldn't even know the IP address and hoster.

[ctoon6]

was the entire site really behind tor? if that is the case, i wish you guys the best of luck to find him,

It had a tor hidden service, but was also reachable through normal https... otherwise we wouldn't even know the IP address and hoster.

then what is the problem. the FBI should be able to get his name and such np. unless he used fake details for registration.

[Chick]

was the entire site really behind tor? if that is the case, i wish you guys the best of luck to find him,

It had a tor hidden service, but was also reachable through normal https... otherwise we wouldn't even know the IP address and hoster.

then what is the problem. the FBI should be able to get his name and such np. unless he used fake details for registration.

That won't work if he was born with a fake name.

[repentance]

was the entire site really behind tor? if that is the case, i wish you guys the best of luck to find him, otherwise if it wasn't just get the federal bureau of investigation or some other entity that cover cyber crime. they can force the hosting company to reveal the identity of the person/s.  an incident this large is almost certain to get caught. and when he/she is caught, you might be lucky and get all your coins back assuming the logs were still in tact/obtainable, or at least be ordered to pay back the BC.

It's going to be hard to get any authorities to take this seriously unless the coins are actually moved.  Right now the evidence of wrong-doing is limited to a website being down, something which I doubt is an offence in any First World nation.

Given that Mybitcoin went for maximum anonymity when creating the LLC and registering the domain, I'd be surprised if the hosting company has any details about the actual owner.  It's most likely that was arranged through their company agents as well, which means law enforcement would hit a dead end unless they're willing to devote a huge amount of resources to sifting through the hosting company's records to try to determine where the unknown owner logged in from. 

[julz]

I still consider it a reasonably likely scenario that the site was run by a privacy-advocate/cryptographer  - who has simply died.

[ctoon6]

I still consider it a reasonably likely scenario that the site was run by a privacy-advocate/cryptographer  - who has simply died.

should we start trying to crack the private keys then?

[repentance]

I still consider it a reasonably likely scenario that the site was run by a privacy-advocate/cryptographer  - who has simply died.

According to the "from the desk of Tom Williams" statement in June, two technicians have access to the server.

All disk keys are held off-site and were never generated anywhere near the internet. All server passwords are unique per server and per user, of course. Only two technicians have access to the secure servers. This access is over a VPN and we only use secured workstations running Linux and BSD to access them.

https://bitcointalk.org/index.php?topic=22221.msg279396#msg279396

You'd think that by now one of them would have realised that there's something wrong and that if something dramatic has happened to "Tom" they'd be trying to find a way to communicate with the users of the service.

[julz]

was the entire site really behind tor? if that is the case, i wish you guys the best of luck to find him,

It had a tor hidden service, but was also reachable through normal https... otherwise we wouldn't even know the IP address and hoster.

"normal https" is interesting..

Does anyone have any information about the issuer of the certificate that was used?  Presumably if it was self-signed it would have been giving browser warnings.. so did the site actually have a commercial https certificate issued for 'www.mybitcoin.com'?  

[julz]

I still consider it a reasonably likely scenario that the site was run by a privacy-advocate/cryptographer  - who has simply died.

According to the "from the desk of Tom Williams" statement in June, two technicians have access to the server.

All disk keys are held off-site and were never generated anywhere near the internet. All server passwords are unique per server and per user, of course. Only two technicians have access to the secure servers. This access is over a VPN and we only use secured workstations running Linux and BSD to access them.

https://bitcointalk.org/index.php?topic=22221.msg279396#msg279396

You'd think that by now one of them would have realised that there's something wrong and that if something dramatic has happened to "Tom" they'd be trying to find a way to communicate with the users of the service.

If the other 'technician' was the dead person's spouse ..   then maybe the whole thing just isn't of interest right now. The other technician might need physical access to fix it - and may not even be in the same country.

[julz]

It seems that www.mybitcoin.com was using a CACert

http://bitcointalk.org/?topic=1043

cacert.org may have more information on record about who the certificate was issued to.

[joepie91]

There's also another Bitcoin...  TOR server in the same IP range

http://torstatus.blutmagie.de/

BitcoinForFreedom   
     4
63 d   
83.149.112.137 [83.149.112.137]         
9191   None   

 BitcoinIsAWESOME   
     2
63 d   
83.149.112.133 [83.149.112.133]         
9999   None   

They also have the same uptime (!) so are probably owned by the same person. The other host has port 80 open but it always replies with "400 Bad Request".

At least the port 9999 that is open on the server is indeed TOR. Obviously, there is no way to scan whether it offers any hidden services, but it's interesting.

Somehow I don't really believe a scammer would close (firewall) port 80 and 443 but not nuke the entire server, as it's evidence...

They may just both be VPSes that happen to be on the same host machine.

[wumpus]

They may just both be VPSes that happen to be on the same host machine.

For any hosting provider I've been with, every VPS had one or two IPs of itself. They never shared one IP between multiple VPSes.

It could be that both IPs belong to one VPS or physical server, it could be two different servers, it doesn't really matter. I do suspect they belong to the same person.

[joepie91]

They may just both be VPSes that happen to be on the same host machine.

For any hosting provider I've been with, every VPS had one or two IPs of itself. They never shared one IP between multiple VPSes.

It could be that both IPs belong to one VPS or physical server, it could be two different servers, it doesn't really matter. I do suspect they belong to the same person.

Of course, every VPS will have its own IP (if it doesn't, I suggest you start looking for a different provider). However, these IPs were not identical, they were just in the same range. Almost every VPS provider will have the different VMs on one machine, all in the same range (at least for IPv4 addresses), to keep it easier to oversee what VM is hosted on what physical server.

Considering Leaseweb is fairly popular for somewhat more questionable content (including TOR nodes) it is not unlikely there are simply two unrelated TOR nodes on the same physical server, purely by accident. Not to mention that, as far as I am aware, Blutmagie is a fairly well-known TOR node.

[JeffK]

I'd bet good money you guys are looking at lost funds due to a death here, especially if the bitcoins haven't been moving from the MyBitcoin wallets.

[ctoon6]

I'd bet good money you guys are looking at lost funds due to a death here, especially if the bitcoins haven't been moving from the MyBitcoin wallets.

probably looking for someone to buy them not in an exchange.

[EhVedadoOAnonimato]

PrivacyShark is a company older than bitcoin, who had once created a profile in this forum to answer some criticisms.

I still suspect that this whole problem isn't a scam, but rather that Tom Williams suffered some serious accident or even passed away, and there's currently nobody capable of maintaining the site.
If at least this could be verified, those with money in MyBitcoin could make a bounty to pay for one more month of hostage in leaseweb - if they haven't deleted all the account's data - just in the hope of bringing the MyBitcoin system alive once more and allow everybody to withdraw. But if the claim once done by Tom Williams that most of the coins are on cold storage is true, and if he hadn't told the password to these coins to anybody of his trust, then it's game over.

[julz]

PrivacyShark is a company older than bitcoin, who had once created a profile in this forum to answer some criticisms.

I still suspect that this whole problem isn't a scam, but rather that Tom Williams suffered some serious accident or even passed away, and there's currently nobody capable of maintaining the site.
If at least this could be verified, those with money in MyBitcoin could make a bounty to pay for one more month of hostage in leaseweb - if they haven't deleted all the account's data - just in the hope of bringing the MyBitcoin system alive once more and allow everybody to withdraw. But if the claim once done by Tom Williams that most of the coins are on cold storage is true, and if he hadn't told the password to these coins to anybody of his trust, then it's game over.

This fits my impression of the whole thing.
Given that back when mybitcoin was set up - It was far from obvious that speculation would drive such high values, it seems unlikely that this sophisticated privacy arrangement was put in place with the intent to defraud from the outset.  It's far more likely someone who is 'into' cryptography and privacy in the geek/political sense.

I suspect now that the leaseweb server was probably little more than a front-end.. and the real server was somewhere inside the i2p network.

I'm sorry to bring Len Sassaman's name into this again without evidence - but the fact is that he was
a) into cryptography and was a privacy advocate (knew of/used i2p tor etc)
b) at least knew of and has commented on bitcoins (hence having his ascii image imortalized as a tribute in the blockchain - very cool)
c) died at approximately the right time. (3rd july) -  perhaps mybitcoin was running on autopilot til something went catastrophically wrong on about the 29th.

Now it's a big planet with big interwebs - so one shouldn't read much into coincidences (unless you want a career as a conspiracy nut)..  but It'd be great for someone who knew Len to make some gentle enquiries amongst his friends to either rule this out, or see what they can find.

[wumpus]

Considering Leaseweb is fairly popular for somewhat more questionable content (including TOR nodes) it is not unlikely there are simply two unrelated TOR nodes on the same physical server

Yeah, right... they are both called Bitcoin*something*, have the same uptime, and the servers have quite a lot of similar properties. Sure there's a small chance they are unrelated, but I wouldn't bet on it.

, purely by accident. Not to mention that, as far as I am aware, Blutmagie is a fairly well-known TOR node.

The Blutmagie site has a list of TOR nodes (which I linked to). It is completely unrelated to their own TOR node.

I'm sorry to bring Len Sassaman's name into this again without evidence - but the fact is that he was

This name pops up quite a lot. Now is he Satoshi or the mybitcoin owner? Or both?

[EhVedadoOAnonimato]

perhaps mybitcoin was running on autopilot til something went catastrophically wrong on about the 29th.

Yes, people have been trying to contact MyBitcoin admin for a while now, since weeks before the outage, with no success. "Something went catastrophically" could just be failure to pay for hosting, and having your server shut down.

This really seems the most likely explanation.