Weexchange/Bitfunder User Deposit Addresses. Where are the coins "gone"?

[SebastianJu]

Since its interesting for this investigation... here a try to collect the dates involving everything with weexchange/bitfunder. Might give a hint to things that happened:

WeexChange Timeline:

* bitfunder closed for us-residents and verification needed 7/8.10.2013
* weexchange withdraw problems started. Bitcoin-d crashing. Result: Withdraws remain "processing" / "Could not connect to 2nd stage server" Error message. Withdraws occassionally worked but the error appeared more often. Started at 17.10.2013
* inputs.io got "hacked" 24.10.2013
* bitfunder closing 4.11.2013
* ukyo claims he still does manual withdraws from weexchange funds though its probably the last time 12.11.2013
* legal issue (Problem 2) started at the time manual withdraws stopped? 12.11.2013
* ukyo removed ability to send funds to bitfunder 16.11.2013
* weexchange claim portal opened on 17.12.2013

* neobee stepped in

[1714150787]

1714150787

[1714150787]

1714150787

[1714150787]

1714150787

[1714150787]

1714150787

[klabaki]

Given this assumption, one can get a list of most of WeExchange's addresses and transactions from only one single address.
The list isn't complete though, because transactions also have a change address which belongs to the sending wallet. The WeExchange wallet places this change address at an unusual output index, so I didn't include it in the list to avoid fan-out into other wallets.

I adapted to that issue about unusual output indexes.

So, finally, I could compile a list of WeExchange's addresses and transactions which is somewhat complete:

Addresses, Part 1: http://pastebin.com/yGEtnAAY
Addresses, Part 2: http://pastebin.com/JVSL6zjN

Transactions, 2011-10-17 to 2013-03-31: http://pastebin.com/QkFVY7fH
Transactions, 2013-03-31 to 2013-05-19: http://pastebin.com/1SE7YVTt
Transactions, 2013-05-19 to 2013-06-15: http://pastebin.com/T9TLKVtw
Transactions, 2013-06-15 to 2013-07-11: http://pastebin.com/rV3q46Lg
Transactions, 2013-07-11 to 2013-07-29: http://pastebin.com/eqWxDbCu
Transactions, 2013-07-29 to 2013-08-18: http://pastebin.com/sAnebk2a
Transactions, 2013-08-18 to 2013-09-12: http://pastebin.com/r2KkybqV
Transactions, 2013-09-12 to 2013-10-09: http://pastebin.com/SnGfhxXn
Transactions, 2013-10-09 to 2014-01-31: http://pastebin.com/P0tG2gJZ

The transactions' list comes with four columns:

• the timestamp of the block containing this transaction
• the transaction id itself
• the credit or debit that this transaction did to the set of addresses I found
• the sum of the previous column of all transactions up to this one

...it looks like this address received more than one big withdrawal from WeExchange:

19ENdxtYNwdsFbaEF2web7FywgQHdsNCGt

That's all that I could find out for now. Further investigation would concentrate on who owns these addresses, and where did the coins go next...

I kept my promise and analysed this wallet in the same way I analysed the WeExchange wallet. Here's the results:

Addresses: http://pastebin.com/57M05y8q

Transactions: http://pastebin.com/Vu7b1ib7

Although this wallet has way less addresses than the WeExchange wallet, it handled more bitcoins, for example:

Code:

2013-08-10_01:24:36 7e45d4ad00670fcfb51beffbf6ae54413dbf026988fd52a351f4ccce97478e8f      0.25421784  4380.57643731
2013-08-11_10:40:03 fcfd4e06e9a6b877d43a18da3fdd3aa8a2c4f4d2e7fbfdbad7c1b0979756bab2   5863.00000000 10243.57643731
2013-08-11_19:11:51 00ce11e4f9e1091317294b652b8d6c663607323654b1d64a4292bcb7143d86df   1000.00000000 11243.57643731
2013-08-11_20:30:06 2094d50b32791a778555835c62552e9e2f82fa4c75e159438c1c73eedc99d74a   4313.00000000 15556.57643731
2013-08-11_20:35:51 1e3198fd649c8d67d197bb754a344790c5d4c22fbdd45753f7d2afbb66f0dc6e   1100.00000000 16656.57643731
2013-08-11_21:26:33 d9e9356faa1f66ade70a2baa7f1f587ac23e54613953c760c254dd63d96f0372    913.00000000 17569.57643731
2013-08-11_23:30:07 699c39794a780ca6d26526b19ebb780d0e5a2f3ca4e0f51920290cf1070ddc51   -500.00000000 17069.57643731
2013-08-12_07:54:55 9202badc41c380e2e7e39ae184172931653484085e77172aaeb6790bd689bce5     -1.00000000 17068.57643731
2013-08-12_10:16:27 88704e47ea9efb730fbfd456f43f856fdd0dc063f0a132bd27fc99c49f4fec32 -12999.00000000  4069.57643731
2013-08-12_14:05:28 90cb96d95424c6cfd186ea6ad50ff3c9775d8c9d721d228af67019cbdb3814e2   1500.00000000  5569.57643731
2013-08-12_14:06:43 ab90fa83efd38abeeeeae7170d701edcdec8928f8a220d50dfa4f66fffc0d5ee      0.46932299  5570.04576030
2013-08-12_14:30:13 41d4ff6585eeb82075d6bf5b037c409f905073eb65fc16102bd5d4dcc6dae363   1000.00000000  6570.04576030
2013-08-12_15:04:11 ae2b08e28101877f167774c0d0aa32df1b4aae58a5ae11752e88467679299997    500.00000000  7070.04576030
2013-08-14_17:18:22 7014297f814c65e2a7f94e631a8bcee6a0e5f8e548b3d0228c7973f967d1ca34    104.86445000  7174.91021030
2013-08-14_19:27:22 facc0d324f4089b21ceaed2fe76f0f3e48de92ed2565d11e1c9812fea6ae1721    176.08838444  7350.99859474
2013-08-16_12:09:07 c2b53e82438dab737b1c961666457e50ce599d2752ff3eeb0b23112ca998c852      2.10844606  7353.10704080
2013-08-16_12:15:27 527c87999e31f905d5c080c3f7956308c0bc3e0a3c30126e3886451afe288f1b     -2.90000000  7350.20704080
2013-08-16_15:23:03 6067707fad6e8c3caad44bae41c0aaca585b78372fd6009338e7e3d2411dbc3d      0.21206826  7350.41910906
2013-08-18_23:17:43 f5035f5f5857a68df5957acc6436dcc220577b3438c487ff0d3016dc7d9259eb    -20.00000000  7330.41910906
2013-08-19_14:21:29 e2e33c7451832ee0114e8a4fd4e5abb88b4e0215a0f9af4bf03792beb4678892      0.38399153  7330.80310059
2013-08-19_17:55:56 b2889b6e0dea50082e3dd1783dca8fdcbd83957755c612332dc55c8da7c7443b  -7000.00000000   330.80310059
2013-08-21_13:10:56 a351524ae383e3454c32c4687069bbc6dca49917a4cf279c9641d5ff77db08ae     61.30095000   392.10405059

One of this transactions comes from WeExchange; quoting from the WeExchange wallet:

Code:

2013-08-11_10:10:39 4165bfe5ba036afdb29aa87bc4113da411d840a93b7a3ca6409d46f9695edfcd     5.00000000 11094.97351450
2013-08-11_10:40:03 fcfd4e06e9a6b877d43a18da3fdd3aa8a2c4f4d2e7fbfdbad7c1b0979756bab2 -5863.00000000  5231.97351450
2013-08-11_11:02:40 4c79aa8897bf165a33ac115aa86d08356bc5fd6ff75c45623c48e5517a2da6cb     0.10000000  5232.07351450

This means that on 11th of August 2013, more than half of WeExchange's funds were transferred into some other wallet, where they became intermixed with funds that probably did not origin from WeExchange.

The transactions' list has been intentionally presented in a way that allows everyone with a web browser to examine it.
So, everyone feel free to skim it for suspicious activity and post your findings. I just did the start.

Donations for my continued efforts go to 1PaEvsKNTDxhz4kg8rL1samkbgF65P9NMF. Thanks!

[SebastianJu]

What do you think is that other address? Is it connected to a business, IPO or something?

[Kouye]

The 19ENd address (where half Weex coins went in august) exchanged a lot of coins with 17hCi8apMUkzzLLJgUwfXxRJuykuo5Lcur

7,000 here, for example:
https://blockchain.info/tx/b2889b6e0dea50082e3dd1783dca8fdcbd83957755c612332dc55c8da7c7443b

13,000 here:
https://blockchain.info/tx/88704e47ea9efb730fbfd456f43f856fdd0dc063f0a132bd27fc99c49f4fec32

Googling for this 17hCi8 address...
https://bitcointalk.org/index.php?topic=262052.msg3879697#msg3879697

[ffwong]

The 19ENd address (where half Weex coins went in august) exchanged a lot of coins with 17hCi8apMUkzzLLJgUwfXxRJuykuo5Lcur

7,000 here, for example:
https://blockchain.info/tx/b2889b6e0dea50082e3dd1783dca8fdcbd83957755c612332dc55c8da7c7443b

13,000 here:
https://blockchain.info/tx/88704e47ea9efb730fbfd456f43f856fdd0dc063f0a132bd27fc99c49f4fec32

Googling for this 17hCi8 address...
https://bitcointalk.org/index.php?topic=262052.msg3879697#msg3879697

Also here:  http://www.reddit.com/r/Bitcoin/comments/1uj7ow/asic_manufacturer_hashfast_faces_legal_action/

[klabaki]

What’s more, the company has reportedly antagonized customers further by failing to protect their email addresses in a mailout sent on 27th December. DeCastro admitted:

“Customer emails addresses were accidentally put in the ‘To’ field rather than the ‘Bcc’ field.”

“Only customers received these emails, no other customer-specific information was included. We took immediate and decisive corrective action to put measures in place to ensure that this will not happen again.”

This looks interesting; does anyone have a record of these email addresses?

I'd like to check whether this list includes Ukyo...

[Kouye]

What’s more, the company has reportedly antagonized customers further by failing to protect their email addresses in a mailout sent on 27th December. DeCastro admitted:

“Customer emails addresses were accidentally put in the ‘To’ field rather than the ‘Bcc’ field.”

“Only customers received these emails, no other customer-specific information was included. We took immediate and decisive corrective action to put measures in place to ensure that this will not happen again.”

This looks interesting; does anyone have a record of these email addresses?

I'd like to check whether this list includes Ukyo...

You might wanna shoot a PM to https://bitcointalk.org/index.php?action=profile;u=148670

As he suggested someone could compile the 5 lists that leaked:
https://bitcointalk.org/index.php?topic=262052.msg4177783#msg4177783


Even more peculiar, is that the 5863 sent from Weex to this 19ENd address was sent back explicitely to (supposedly) Hashfast.
If you look at the 13,000 tx, they output exactly 5863 as one of the inputs, and all other inputs are nice round numbers coming from the same address.
Why not just output the 13,000 one-shot?
This tx had to be handcrafted, right?

[DobZombie]

It it possible that the 13,000 was from a mining IPO?
Then used to pay for hashfast equipment?

[perezoso]

What are the e-mail addresses you are looking for?  I have a partial list of the leaked HF addresses and can cross-check for my portion.  In the thread cited above, you'll also see others who received other parts of the HF customer list.  Mine is of addresses beginning with GAR and ending in JER.

[klabaki]

Even more peculiar, is that the 5863 sent from Weex to this 19ENd address was sent back explicitely to (supposedly) Hashfast.
If you look at the 13,000 tx, they output exactly 5863 as one of the inputs, and all other inputs are nice round numbers coming from the same address.
Why not just output the 13,000 one-shot?
This tx had to be handcrafted, right?

Well, it doesn't look like a standard bitcoind installation. It could be handcrafted, or some other non-standard wallet.

What we don't know yet, is whether this is already part of BitPay's infrastructure, or a private wallet (e.g. a group buy).
I'm currently trying to gather information about these and other intermediate wallets.

[klabaki]

What are the e-mail addresses you are looking for?  I have a partial list of the leaked HF addresses and can cross-check for my portion.  In the thread cited above, you'll also see others who received other parts of the HF customer list.  Mine is of addresses beginning with GAR and ending in JER.

Hmm... someone compiled a folder with lots of dox of Ukyo. I don't have it bookmarked, though. Maybe we're lucky and the address starts with "jon" or "jmontroll", that would be easy to find. But GAR to JER isn't the hot one probably.

Thanks for your quick response!

[Kouye]

What are the e-mail addresses you are looking for?  I have a partial list of the leaked HF addresses and can cross-check for my portion.  In the thread cited above, you'll also see others who received other parts of the HF customer list.  Mine is of addresses beginning with GAR and ending in JER.

Cheers for the reply perezoso
Maybe try your luck with dhenson, then?

I now have the email addresses of customers from csi...@gmail.com through jer...@com-products.nl

If you have a different list (outside of this range), please forward it to me via PM.  
I will construct a properly addressed email and warn all of the customers about their leaked email and to be on the lookout for possible phishing attempts.

Digging more, I found out that at least one of the outputs ending up in 19ENd address belongs to
https://bitcointalk.org/index.php?action=profile;u=4532
https://bitcointalk.org/index.php?topic=226179.msg2380742#msg2380742

And apparently, Transisto was also into hashfast at that time...

Disclaimer, I'm a share holder.

IMO, Having a few large investors is always a good thing in the sense that those are willing to go to greater length, spend lot more and can sometime provide the missing expertise to make sure things get done.

Hashfast initial prices are public, do your own maths. With the price drop of bitcoin IceDrill's share equivalent is now much better, with hosting included !

Hashrate/$ is about 1/4 that of BFL @ ~1/10 the power consumption. (These devices will be mining cost effectively for much longer)

On top of that IceDrill/HashFast will be saving a lot of money by not having to deal with shipping and customer service.

I've researched the track record of ever actor involved and I have a hard time seeing how this could fail.

So I doubt the 19ENd address is a bitpay one, but maybe we can ask Transisto if he'd agree to share details about this transaction?
https://blockchain.info/tx/2094d50b32791a778555835c62552e9e2f82fa4c75e159438c1c73eedc99d74a

EDIT: I sent a PM to Transisto.

[SebastianJu]

Those are really high amounts. Amounts one would normally think an IPO collected them. It might well be that an IPO at bitfunder was successful and someone took the bitcoins out to order the hardware. Though the question is... when ukyo now really would need to have 6000BTC in the weexchange wallet... how can this be. Are these big withdraws maybe legit and the loss of bitcoins was happening through many small transactions?

A theory... that was found as wrong now... was that ukyo misconfigured the wallet. So that change bitcoins didnt went to a new change address but instead went to user deposit addresses from other users. That way it was a deposit to weexchange and the user had more money. In fact the wallet then had lost bitcoins. And a user had more bitcoins he could withdraw that he didnt deposit.

Unfortunately it turned out the theory wasnt correct but its a unique idea so i wanted to post it so maybe someone gets an idea for new investigations. Maybe faulty stats so that ukyo didnt see that coins in fact are vanishing.

Only as a sidenote...

[KS]

A theory... that was found as wrong now... was that ukyo misconfigured the wallet. So that change bitcoins didnt went to a new change address but instead went to user deposit addresses from other users. That way it was a deposit to weexchange and the user had more money. In fact the wallet then had lost bitcoins. And a user had more bitcoins he could withdraw that he didnt deposit.

That sounds like a complicated way to fail.

[kano]

...
So at a possible court case you might claim that he gave your coins to others to solve weexchange debts. Strictly spoken coins that were deposited and users bought shares with it wouldnt belong to them anymore. But coins that werent used to buy anything would still belong to someone.
Of course that only would help you as long as there is a chance to get the coins back.

Heh - I didn't think of this one at all.
My BTC in Weex was deposited BTC.
(I never put $ into Weex, only BTC)
What happened for me was someone said they'd buy BTC from me.
So I decided to do that (with my wallet) and then withdraw the remaining BTC back out of Weex that I had deposited.
Hmm ... very interesting.

[kano]

As far as i see my deposit address it looks like the coins i invested were used to pay out the withdraw of other users plus the rest sent to a change address. That way each withdraw a weexchange user got came from a deposit address of another weexchange user most probably. And the origins of these coins would be up to the weexchange user depositing.

So i dont know how important the info is since kano didnt post addresses. Just in case it becomes important i added it.

OK when I looked for it a 2nd time I didn't find it ... coz I'd used a cold address
So I looked again today and tracked it down.
Look at this transaction.
It's part of the 6.175% payout chain.
https://blockchain.info/address/19N74rC3sFyanYGfgezkv4mWG9juYvSxYj
(No it's not my payout)
But anyway, it's quite simple to follow that one, since it is simply a line of payments until the source ran low, one payment per txn, and the change going to the next payment - following it back by clicking on the address that is the input address on the left that supplied the coins.
It slowly counts back up, one transaction at a time.
... until you hit this address:
https://blockchain.info/address/151uDvok7xx26Q8xoAoJVBPoT6VKmKsHS6

Now there is a direct pool source filling up 151uDvok... on that page:

https://blockchain.info/address/17Rog6H3NDd2sttHiHozcMGf1bDBnjK8jy is a pool payout address

The pool is: Eligius

If you look further down 151uDvok... (in the past) going back to July

https://blockchain.info/address/1BKjTzLiq1EoS9Q55rebw1wzWS7sSiSapk

Is Eleuthria

[SebastianJu]

Maybe we should collect another list of addresses from the weexchange withdraw portal. All addresses were the coins came from that were paid out as 6.1%.

[klabaki]

Maybe we should collect another list of addresses from the weexchange withdraw portal. All addresses were the coins came from that were paid out as 6.1%.

All of WeExchange's addresses and transactions should already be included in the lists that are linked in this post:

https://bitcointalk.org/index.php?topic=437154.msg5033659#msg5033659

If you know about an address or a transactions that belongs to WeExchange, but doesn't appear in the lists, then you should report it immediately.

[kano]

Maybe we should collect another list of addresses from the weexchange withdraw portal. All addresses were the coins came from that were paid out as 6.1%.

All of WeExchange's addresses and transactions should already be included in the lists that are linked in this post:

https://bitcointalk.org/index.php?topic=437154.msg5033659#msg5033659

If you know about an address or a transactions that belongs to WeExchange, but doesn't appear in the lists, then you should report it immediately.

As SebastianJu said, he was referring to the addresses for the 6.175% payouts that I know of at least one that is not in your lists Mine.
Look at my post above, every address that is not a continuation of the chain I pointed out, is extremely likely to be a 6.175% payout address.
... and that's just one payout chain.
Total was supposedly 386BTC ... that chain started with exactly 28BTC

This one ... follow it back and forth:
https://blockchain.info/address/19N74rC3sFyanYGfgezkv4mWG9juYvSxYj

Edit: hmm but my transaction is in one of the lists (Just not my address)

[klabaki]

All of WeExchange's addresses and transactions should already be included in the lists that are linked in this post:

https://bitcointalk.org/index.php?topic=437154.msg5033659#msg5033659

https://blockchain.info/address/19N74rC3sFyanYGfgezkv4mWG9juYvSxYj

Edit: hmm but my transaction is in one of the lists (Just not my address)

Open the addresses' list, part 1, and look at line 4864.

I guess you just missed it?