Weexchange/Bitfunder User Deposit Addresses. Where are the coins "gone"?

[SebastianJu]

I found that in the thread https://bitcointalk.org/index.php?topic=348468 there were posted a lot of addresses though its not really the topic there. Because of that i will collect all deposit addresses in this thread and collect it in this first post once posted by the users. Some users sent me a pm with the address too because they want to stay anonymous. Maybe we find out what happened with the coins that "are gone".

Everyone feel free to investigate in the hope something interesting is found!

User JoseRolles created another tool to collect the addresses. They can be posted there anonymously too:

So I put together a quick site where we can collect all the addresses in one place...
http://www.jspmedia.net/weexadd/

You can add your address anonymously and quickly. Anyone can go there and view the addresses collected so far. It updates autonomously using Firebase.

List of weexchange user deposit addresses:

1P7tdTzWhpYoV87L4v4gZwhd6mAnT7fiD4
1JvJBF59uxkfMqqBxv5RoNCGS92wAnGewL
1LjXuWRfgY7G3akEspgZxVE5toAKcGMaPj
15GhbQJJJCgrWNz4XjPyBrDbHMgHxPcKi3
19UQiHUjy26ZDZfQr6S8fTNJzirbGb8nk4
1EPuWB8BbeLG4m8cSbqug3oRqb2GVXT19X
16UYZoVwVC4jHszXGGVsRx4Nsni5khx3Mz
1JvPAarhmVyfoWYDYuZ6NCp7YL3GPiB11n
18rTzHGa9iuGqkv6tcXTFVASZppiMWfsWz
1Kv2KNrDD77ZEjiXkYZ6EqCGkHmXWH7yG
1LN99wLNnNdqEh2ADyEvWVYViTtcrfHBvC
15EbbDJ2Po1RxXCx9oa2n1h1fXnKx5mM1y

Additional info to certain deposit addresses:

* 1P7tdTzWhpYoV87L4v4gZwhd6mAnT7fiD4

The address is empty now.

Even though i see letsdice.com appear there... i never used that website. I believe what happened is that this website is sending one satoshi to used addresses because blockchain.info is posting the name of the website then which means advertising for the domain name. So its pretty sure neither iam nor ukyo used the domain in connection with my deposit address.

Ok, when i see what happened with my last deposited bitcoins, around 158BTC, then they were sent to 1KMmWYbWHQjBZY14hXENGXeb5aMyoQynvg and a small part to 1BDtP3xdCQ1Zj1wJDxLPu8mf1uvuspQ3BU

I believe what happened was that ukyo paid out a withdraw request from a weexchange user. The small transaction was a withdraw to a user wallet and the big transactions target is a change address in the weexchange wallet.

Weexchange change addresses then are for example: The big BTC-part was sent then from 1KMmWYbWHQjBZY14hXENGXeb5aMyoQynvg is sent to 1BYrnppD62tj2cn1HD32iD6Bv2t9sTESYH, then to 12Nz2KmzVfnsrCK7HVYzw4LLYp4iQtqU4P, then to 115vYRHjw9uCnXoecs6VzigubMUhmMfcfE, then to 17pgZ4mCRsTwW6D5kHEg92eQM2V9JAUHBS, then to 1GtPbfmp75HvJ2N6r4uRtBozZa3bjJofvw, to 12VTYbiXoRiVKXNyNvrqtAgkAFZewFPAw1, to 1EZmoUo4YorRnNnnyDewHsdBREr6YnMnvm, to 17hPi868CsyvjWHtXjY7NnNbS6QTaDz4FN, to 1Q5JYuxQK5ZmjyAP1CJEJUPU8wUHXByvK3, to 1JxME3VtA9Q4quZHqQFwA6qKdSP1rtVviQ, to 1D2MKZtPs5xZC9cY4fch8msP838KnVgXK9

and and and...

Till there only 6 hours were gone. Every transactions was done like sending the big part to an address and a smaller part. A weexchange change address and a weexchange users address. The last transaction where i can say that its most probably my coin that was sent to a change address of weexchange is here: https://blockchain.info/de/address/1PfERfzUJEr4kxzBxtx49GcF4dM2vfGc52 from octobre the 27th. After that i cant say if it went to a weex user or a weex change address.

So the coins from my deposit were paid out to weexchange users most probably completely.

At least it does not look like the coins were sent to a single address that might be controlled by government. At least not till octobre 27th, 2013.

I hope we can find some interesting things from other users addresses.

Maybe someone has later deposits where ukyo didnt have the time to use the funds to pay withdraws from weexchange users with. So that it is in the timeframe of "manual withdraws" and the "incident".

Lets see if we find something! We should investigate this.

List of weexchange portal addresses the 6.1% were paid out from:

1L5eKEybeeFq9nZYvvokoKrCVGmudY5iwG

General Info:

Well - the only interesting thing I found with my 3.175% payout was that tracing it back it came from pool mining.
The 386 BTC payouts were done over and over again to a new address so it takes a while to follow it back but it was easy to see and follow.

I take it you weren't able to discern which pool it was? Speculation here; maybe it came from Graeme?

Yes, but I can't remember 100% which it was - I think it was BTCGuild
But it wasn't Ozcoin.

[1714172464]

1714172464

[1714172464]

1714172464

[MilkyLep]

Although not dealing with the deposit addys, I think the following two posts by kano are fairly relevant to the outcome of the situation considering they deal with coinds coming back out from WeEx.

Well - the only interesting thing I found with my 3.175% payout was that tracing it back it came from pool mining.
The 386 BTC payouts were done over and over again to a new address so it takes a while to follow it back but it was easy to see and follow.

I take it you weren't able to discern which pool it was? Speculation here; maybe it came from Graeme?

Yes, but I can't remember 100% which it was - I think it was BTCGuild
But it wasn't Ozcoin.

[equipoise]

Although not dealing with the deposit addys, I think the following two posts by kano are fairly relevant to the outcome of the situation considering they deal with coinds coming back out from WeEx.

Well - the only interesting thing I found with my 3.175% payout was that tracing it back it came from pool mining.
The 386 BTC payouts were done over and over again to a new address so it takes a while to follow it back but it was easy to see and follow.

I take it you weren't able to discern which pool it was? Speculation here; maybe it came from Graeme?

Yes, but I can't remember 100% which it was - I think it was BTCGuild
But it wasn't Ozcoin.

Tracing back each and every coin in existence came from mining.

[SebastianJu]

As far as i see my deposit address it looks like the coins i invested were used to pay out the withdraw of other users plus the rest sent to a change address. That way each withdraw a weexchange user got came from a deposit address of another weexchange user most probably. And the origins of these coins would be up to the weexchange user depositing.

So i dont know how important the info is since kano didnt post addresses. Just in case it becomes important i added it.

[JoseRolles]

So I put together a quick site where we can collect all the addresses in one place...
http://www.jspmedia.net/weexadd/

You can add your address anonymously and quickly. Anyone can go there and view the addresses collected so far. It updates autonomously using Firebase.

[Evolyn]

You can add my weex deposit address: 1Kv2KNrDD77ZEjiXkYZ6EqCGkHmXWH7yG

[JoseRolles]

So I put together a quick site where we can collect all the addresses in one place...
http://www.jspmedia.net/weexadd/

You can add your address anonymously and quickly. Anyone can go there and view the addresses collected so far. It updates autonomously using Firebase.

I also added the JSON Endpoints for those who want to GET the data lists to process them with their own script:
https://weexadd.firebaseio.com/add_deposit.json
https://weexadd.firebaseio.com/add_withdrawal_original.json
https://weexadd.firebaseio.com/add_withdrawal_portal.json

[mcleung]

Is it just me or is the weexchange clam page showing 0 balance now.
I don't mind being patient while Ukyo sorts out his things so I can recover my bitcoins, but it would be nice to know that he still has the logs of how much is owned to everyone.
Today I logged into the weexchange clam website, and it says Total 0, Available 0.
Also, the main weexchange site seems to not work anymore, as I can not login. (It just leaves you on the main page, no error message or anything.)

Is it just me or is it this way for everyone?

[WeexUser]

Is it just me or is the weexchange clam page showing 0 balance now.
I don't mind being patient while Ukyo sorts out his things so I can recover my bitcoins, but it would be nice to know that he still has the logs of how much is owned to everyone.
Today I logged into the weexchange clam website, and it says Total 0, Available 0.
Also, the main weexchange site seems to not work anymore, as I can not login. (It just leaves you on the main page, no error message or anything.)

Is it just me or is it this way for everyone?

It has happened 2-3 times before and will go back to normal when Ukyo has fixed it. It is allegedly a logging issue

[bittymitty]

Can anyone help to explain the following.

I deposited .3 BTC to the we-exchange address on the 18th Nov 2013.  This was well after all the issues started and during the issue when no-one could withdraw.

https://bitcointalk.org/index.php?topic=337523.msg3633503#msg3633503

https://blockchain.info/address/1LN99wLNnNdqEh2ADyEvWVYViTtcrfHBvC

The BTC was sent from here on the 17 DEC 2013 well before redemptions started to 17sQK5ZBmUoZuQpvCrmNZ8UgDNFbzUv2d2

after a quick google search of 17sQK5ZBmUoZuQpvCrmNZ8UgDNFbzUv2d2 I found the below post from a group buy with id40 showing the same address with a known billing address

https://bitcointalk.org/index.php?topic=187660.msg2377673#msg2377673

Why was my BTC sent to this address?

Who's address is this?

Can SebastianJu give us more info about this?

[SebastianJu]

Can anyone help to explain the following.

I deposited .3 BTC to the we-exchange address on the 18th Nov 2013.  This was well after all the issues started and during the issue when no-one could withdraw.

https://bitcointalk.org/index.php?topic=337523.msg3633503#msg3633503

https://blockchain.info/address/1LN99wLNnNdqEh2ADyEvWVYViTtcrfHBvC

The BTC was sent from here on the 17 DEC 2013 well before redemptions started to 17sQK5ZBmUoZuQpvCrmNZ8UgDNFbzUv2d2

after a quick google search of 17sQK5ZBmUoZuQpvCrmNZ8UgDNFbzUv2d2 I found the below post from a group buy with id40 showing the same address with a known billing address

https://bitcointalk.org/index.php?topic=187660.msg2377673#msg2377673

Why was my BTC sent to this address?

Who's address is this?

Can SebastianJu give us more info about this?

Yes, the address belongs to one of the users that took part in my groupbuy and he bought avalon chips with it in may. So i think it was a deposit to a user address that ukyo made manually. I will send the user a pm and ask him if he can confirm this.

[bittymitty]

Does this prove that Ukyo acted fraudulently?  He obviously had access to the wallet to make withdrawals and he used my funds to pay out another user?

[SebastianJu]

Does this prove that Ukyo acted fraudulently?  He obviously had access to the wallet to make withdrawals and he used my funds to pay out another user?

Not really because ukyo claimed some time that he can do withdraws manually. This stopped then though. So this withdraw might be from a time when the manual withdraws still were possible.

Of course you are in a special situation. The coins you deposited belonged to you and ukyo only had them in escrow. Its a shares wallet of course but normally those coins would be attached to you and werent owned be weexchange. So at a possible court case you might claim that he gave your coins to others to solve weexchange debts. Strictly spoken coins that were deposited and users bought shares with it wouldnt belong to them anymore. But coins that werent used to buy anything would still belong to someone.
Of course that only would help you as long as there is a chance to get the coins back.

[bittymitty]

Ok it looks like the 17th Dec was the day the claim portal opened

https://bitcointalk.org/index.php?topic=348468.msg4006582#msg4006582

I'm so happy my BTC was used to reimburse users.....

[SebastianJu]

The user got back to me and he confirmed that the payment were his 6% from the claim portal...

[falko0815]

Does this prove that Ukyo acted fraudulently?  He obviously had access to the wallet to make withdrawals and he used my funds to pay out another user?

Not really because ukyo claimed some time that he can do withdraws manually. This stopped then though. So this withdraw might be from a time when the manual withdraws still were possible.

Of course you are in a special situation. The coins you deposited belonged to you and ukyo only had them in escrow. Its a shares wallet of course but normally those coins would be attached to you and werent owned be weexchange. So at a possible court case you might claim that he gave your coins to others to solve weexchange debts. Strictly spoken coins that were deposited and users bought shares with it wouldnt belong to them anymore. But coins that werent used to buy anything would still belong to someone.
Of course that only would help you as long as there is a chance to get the coins back.

I think ukyo has never done one single withdraw manually. Ukyo has lied as he said he does withdraws manually.
I tell You what Uyko did:
He lost 94% of our Coins. Afterwards he transfered the rest of the coins to the claim portal to withdraw weex users 6% of their coins.

[klabaki]

1P7tdTzWhpYoV87L4v4gZwhd6mAnT7fiD4

Thanks. That was my entry point.

Technologies like CoinJoin aren't yet implemented in standard Bitcoin clients.
Therefore, one can safely assume that all transactions signed by WeExchange's addresses are signed exclusively by WeExchange's addresses.

Given this assumption, one can get a list of most of WeExchange's addresses and transactions from only one single address.
The list isn't complete though, because transactions also have a change address which belongs to the sending wallet. The WeExchange wallet places this change address at an unusual output index, so I didn't include it in the list to avoid fan-out into other wallets.

Using the above quoted address as entry point, one will get these addresses:

http://pastebin.com/LZJPeiRM

...and these transactions:

http://pastebin.com/As66ecst
http://pastebin.com/XgsTaiaL

Now, let's sum up the total amount on all of these addresses over time:

http://postimg.org/image/wvq6x2rsl/

...zooming into early October 2013:

http://postimg.org/image/n693ky4m5/

Firstly, I was surprised seeing the first transactions as early as October 2011 - I didn't know that WeExchange existed at that time.
Secondly, I expected the biggest drop to be in mid-November 2013. However, it was early October 2013.

I filtered the list of transactions to find the big one from 3rd of October:

8a77d88fcc9ef418ec97cb2c332efd1378f21aa90188d3000a8c2e4e89f467cb

...it looks like this address received more than one big withdrawal from WeExchange:

19ENdxtYNwdsFbaEF2web7FywgQHdsNCGt

Other addresses receiving big withdrawals from WeExchange include:

115KrBsBGXvW3saUtmY6seXpXysvgd44BS
1D8zFb9jJvmdxwNmuS1TBGh1sfcqUMyRzf

That's all that I could find out for now. Further investigation would concentrate on who owns these addresses, and where did the coins go next...

Donations for my efforts go to 1PaEvsKNTDxhz4kg8rL1samkbgF65P9NMF. Thanks!

[WeexUser]

I think ukyo has never done one single withdraw manually. Ukyo has lied as he said he does withdraws manually.

In the period where Ukyo claimed to do manual withdrawals, some people reported that their stuck withdrawals went through.

[SebastianJu]

I think ukyo has never done one single withdraw manually. Ukyo has lied as he said he does withdraws manually.
I tell You what Uyko did:
He lost 94% of our Coins. Afterwards he transfered the rest of the coins to the claim portal to withdraw weex users 6% of their coins.

I remember users that were paid at the time he claimed he does manual withdraws. Though he never claimed that he stopped it. That became only clear because no one received coins anymore.

Im relatively sure that nearly all coins were gone at some point and the remaining 300BTC he paid out might be deposits from users. Though of course you cant be sure about that.


Thanks for the investigation klabaki... i donated a bit to your address. I dont have a big clue about how these investigations are done so thanks for it.

[pascal257]

There are enormous chunks of bitcoin moving around if you follow the transactions from that address.

Maybe we can try and find a link between these addresses and those used by the claim portal.