[GOX] Crime Scene Investigation, Case #MG744

[Armis]

Do you want to know where the Mt Gox money went?
Do you want to know who is responsible for the loss?
Do you want to help find the missing btc?

Given that the bitcoin block chain is a public ledger and that each and every transaction from the beginning of btc time to present is documented, I propose a CSI type forensic investigation of the block chain to account for all of the btc that went through Mt Gox from their first deposit to their last withdrawal.

Clearly this would be a massive undertaking because you are not just looking at 1 level of deposits and withdrawals, but you are looking for patterns, and anomalies on multiple levels.  Most of the transactions will be relatively easily to account for, many won't, but all btc can be accounted for.  

I think such an effort would give the btc community a major boost.







 

[ZeroBarrier]

And what is it that you want to do when you find the BTC? Beat the private keys out of anyone that has even a satoshi of them in their wallets? Who's can say those BTC have long been used/traded for good or services? Or even if they ended up in a cold storage wallet long ago?

I think you really need to think about what your suggesting; a witch-hunt plain and simple.

[texasaggie]

And what is it that you want to do when you find the BTC? Beat the private keys out of anyone that has even a satoshi of them in their wallets? Who's can say those BTC have long been used/traded for good or services? Or even if they ended up in a cold storage wallet long ago?

I think you really need to think about what your suggesting; a witch-hunt plain and simple.

I think we have our first suspect...

[Armis]

And what is it that you want to do when you find the BTC? Beat the private keys out of anyone that has even a satoshi of them in their wallets? Who's can say those BTC have long been used/traded for good or services? Or even if they ended up in a cold storage wallet long ago?

I think you really need to think about what your suggesting; a witch-hunt plain and simple.

I think we have our first suspect...

hahahahaaa

[Armis]

And what is it that you want to do when you find the BTC? Beat the private keys out of anyone that has even a satoshi of them in their wallets? Who's can say those BTC have long been used/traded for good or services? Or even if they ended up in a cold storage wallet long ago?

I think you really need to think about what your suggesting; a witch-hunt plain and simple.

What I'm suggesting is 100% sound

Let's examine your excuses individually:

1)  "And what is it that you want to do when you find the BTC?"
A)  return it to it's rightful owner, that's what you are supposed to do with stolen money.  Sure that's not news to you?

2) "Beat the private keys out of anyone that has even a satoshi of them in their wallets?"
A) I try not to operate like that any more

3)  "Who's can say those BTC have long been used/traded for good or services?"
A)  Oh, goodie, they were spent for "good or service", so now you have names, faces, addresses, email addresses, phone numbers, cities,  countries ... to add to all of the other electronic connections.  At that point anonymous becomes a less anonymous.

4)  "Or even if they ended up in a cold storage wallet long ago?"
A)  cold storage doesn't represent a dead end it represents a good idea of where it is, who has it and that it is still available.


Even if someone attempted to wash the dirty money it will show on the block chain. 

The whole cryptocurrency economy suffers when irresponsible behavior is rewarded with a blind eye.

[leopard2]

it may be simpler than that; the theft can have been

a) straightforward stealing from a wallet, not tied to a customer account, in which case there should be  a normal blockchain record of the transaction
b) malleability hacks - in this case the internal records may be compared to the blockchain records. In other words, the proper accounting that was not done in real time, could be done as part of an iterative forensic analysis using internal records and blockchain. Most accounts at Gox are probably OK and it should be possible to rule these out easily.

At least the total leakage from 2011 until now could somehow be determined if Gox has archived all their transactions...and 800K is a lot, even if BTC was worth a lot less back then, the volume was also a lot less...

And also, if someone stole that many coins, he will not have an easy time converting these, if exchanges do proper AML-KYC. Mixing such a large number of coins is hard. This mixer.io (or whatever its called) some people advertise, claims to have a queue of 2400, so mixing 800 000 coins is not realistic.

But first we need some forensic analysis to prove that these coins were stolen

I HOPE THEY WERE ONLY LOST ... that would be even good for the honest BTC owners  

[Jeronimus]

There was some irc chat long ago, where Karpeles sent around 424k BTC to a particular address as in to prove that the exchange holds enough funds.


The address was this here

424k proof transaction:
https://blockchain.info/tx/3a1b9e330d32fef1ee42f8e86420d2be978bbe0dc5862f17da9027cf9e11f8c4 424k 06/23/2011

connected to this address are following addresses

50k 1P3S1grZYmcqYDuaEDVDYobJ5Fx85E9fE9 first input: 11/16/2011 05:59:08
40k 1cXNTyXj4xPGopfYZNY5xfSM1EPJJvBZV first input: 11/16/2011 05:59:08
40k 12HddUDLhRP2F8JjpKYeKaDxxt5wUvx5nq first input: 11/16/2011 05:38:46
40k 16Ls6azc76ixc9Ny7AB5ZPPq6oiEL9XwXy first input: 11/16/2011 05:38:46
30k 1MyGwFAJjVtB5rGJa32M6Yh46cGirUta1K first input: 11/16/2011 05:45:03

Unfortunately i fail to understand the blockchain.info chain of events completely, as there are some addresses which received less funds than they seemingly sent out.

you will notice that all of those addresses contain the bitcons still, AND all of those addresses have zero digits BEFORE the dot(sub the front digit of course). they are exactly 50000.whatever, 40000.whatever and so on...

if you head over to http://bitcoinrichlist.com/top100 you will be able to find similar addresses with 40k, 30k, 20k, 10k etc

one example being this

Nr 24, 25, 26 in the rich list are 40k with all digits in front of the dot are zero, AS WELL as one digit after the DOT.
There is one more 40k which has ALL digits in front of the dot zero, but not the digit AFTER the dot.
This would be this one

http://bitcoinrichlist.com/address/14j6jLececs66ZQ8ew6vTFNiEn2NupacWJ?charttype=balance


There is only 1 30k address which is already included in the list, showing this pattern, but there are two 20k addresses being at 45 and 46 in the rich list position, having all zeros after the "2" digit

http://bitcoinrichlist.com/address/15CVfJUC1LKn1GKZx6RM5UMbFfnTd8vTT4?charttype=balance
http://bitcoinrichlist.com/address/13ssxUjmQqemuiBfJSBsr7gFX7UWU7uXNK?charttype=balance

at 15k we have

http://bitcoinrichlist.com/address/1LDWDufjU5ATbozDZY3uChb7oPAbDaiB7K?charttype=balance
http://bitcoinrichlist.com/address/12WFth5HabiVrcj5waHtDP1b7gXSQPuDPz?charttype=balance
http://bitcoinrichlist.com/address/1Fd2RVn8Ha6K6qevPFgPLneJn8VNaLPGW2?charttype=balance

at 10k we have

http://bitcoinrichlist.com/address/1MeCzxxB8eDd17DaocFLQaQtH8seVjNM67?charttype=balance
http://bitcoinrichlist.com/address/1Gg9GGQWmRk1pp4vNkMqLaEiPVNdiNvz7E?charttype=balance
http://bitcoinrichlist.com/address/19PPeuu4jPjqtefSQ2FDgKmNJ88Z5wiuJt?charttype=balance
http://bitcoinrichlist.com/address/15jdxjFhXUsp2xuycmKnjw8yk1WsVon69c?charttype=balance
....

many more. The 10k addresses that follow this pattern are numerous going from 84-113 , meaning 30* 10k = 300k coins

194-235 5k deposits with same pattern  42*5k = 210k
 
So we would have

1x  50k
4x  40k (one of which does not follow the exact pattern as the other 3)
1x  30k
2x  20k
3x 15k
30x 10k
42x 5k

we get a total of 835k BTC.

Not all of those addresses are owned by MtGox for sure, in fact, maybe none of those are owned by Gox. It's highly speculative if those BTC are part of the lost 750k especially since i cannot understand the blockchain chain of events well enough to explain certain transactions from addresses that seem to have less in than they transact out.

[Armis]

it may be simpler than that; the theft can have been

a) straightforward stealing from a wallet, not tied to a customer account, in which case there should be  a normal blockchain record of the transaction
b) malleability hacks - in this case the internal records may be compared to the blockchain records. In other words, the proper accounting that was not done in real time, could be done as part of an iterative forensic analysis using internal records and blockchain. Most accounts at Gox are probably OK and it should be possible to rule these out easily.

At least the total leakage from 2011 until now could somehow be determined if Gox has archived all their transactions...and 800K is a lot, even if BTC was worth a lot less back then, the volume was also a lot less...

And also, if someone stole that many coins, he will not have an easy time converting these, if exchanges do proper AML-KYC. Mixing such a large number of coins is hard. This mixer.io (or whatever its called) some people advertise, claims to have a queue of 2400, so mixing 800 000 coins is not realistic.

But first we need some forensic analysis to prove that these coins were stolen

I HOPE THEY WERE ONLY LOST ... that would be even good for the honest BTC owners  

I was expecting someone to bring up 'mixing' even with that the transactions can be tracked everything electronic leave a footprint, here's the thing about the mixers, if anyone is too lazy to figure it out they can just blame it on the owner of the mixer since they were the last ones on record to have the funds.   That would motivate the mixers to cooperate with the investigation.   

[Armis]

There was some irc chat long ago, where Karpeles sent around 424k BTC to a particular address as prove that the exchange holds enough funds.


The address was this here

424k proof transaction:
https://blockchain.info/tx/3a1b9e330d32fef1ee42f8e86420d2be978bbe0dc5862f17da9027cf9e11f8c4 424k 06/23/2011

connected to this address are following addresses

50k 1P3S1grZYmcqYDuaEDVDYobJ5Fx85E9fE9 first input: 11/16/2011 05:59:08
40k 1cXNTyXj4xPGopfYZNY5xfSM1EPJJvBZV first input: 11/16/2011 05:59:08
40k 12HddUDLhRP2F8JjpKYeKaDxxt5wUvx5nq first input: 11/16/2011 05:38:46
40k 16Ls6azc76ixc9Ny7AB5ZPPq6oiEL9XwXy first input: 11/16/2011 05:38:46
30k 1MyGwFAJjVtB5rGJa32M6Yh46cGirUta1K first input: 11/16/2011 05:45:03

Unfortunately i fail to understand the blockchain.info chain of events completely, as there are some addresses which received less funds than they seemingly sent out.

you will notice that all of those addresses contain the bitcons still, AND all of those addresses have zero digits BEFORE the dot(sub the front digit of course). they are exactly 50000.whatever, 40000.whatever and so on...

if you head over to http://bitcoinrichlist.com/top100 you will be able to find similar addresses with 40k, 30k, 20k, 10k etc

one example being this

Nr 24, 25, 26 in the rich list are 40k with all digits in front of the dot are zero, AS WELL as one digit after the DOT.
There is one more 40k which has ALL digits in front of the dot zero, but not the digit AFTER the dot.
This would be this one

http://bitcoinrichlist.com/address/14j6jLececs66ZQ8ew6vTFNiEn2NupacWJ?charttype=balance


There is only 1 30k address which is already included in the list, showing this pattern, but there are two 20k addresses being at 45 and 46 in the rich list position, having all zeros after the "2" digit

http://bitcoinrichlist.com/address/15CVfJUC1LKn1GKZx6RM5UMbFfnTd8vTT4?charttype=balance
http://bitcoinrichlist.com/address/13ssxUjmQqemuiBfJSBsr7gFX7UWU7uXNK?charttype=balance

at 15k we have

http://bitcoinrichlist.com/address/1LDWDufjU5ATbozDZY3uChb7oPAbDaiB7K?charttype=balance
http://bitcoinrichlist.com/address/12WFth5HabiVrcj5waHtDP1b7gXSQPuDPz?charttype=balance
http://bitcoinrichlist.com/address/1Fd2RVn8Ha6K6qevPFgPLneJn8VNaLPGW2?charttype=balance

at 10k we have

http://bitcoinrichlist.com/address/1MeCzxxB8eDd17DaocFLQaQtH8seVjNM67?charttype=balance
http://bitcoinrichlist.com/address/1Gg9GGQWmRk1pp4vNkMqLaEiPVNdiNvz7E?charttype=balance
http://bitcoinrichlist.com/address/19PPeuu4jPjqtefSQ2FDgKmNJ88Z5wiuJt?charttype=balance
http://bitcoinrichlist.com/address/15jdxjFhXUsp2xuycmKnjw8yk1WsVon69c?charttype=balance
....

many more. The 10k addresses that follow this pattern are numerous going from 84-113 , meaning 29* 10k = 290k coins

194-235 5k deposits with same pattern  
 
So we would have

1x  50k
4x  40k
1x  30k
2x  20k
29x 10k
41x 5k

we get a total of 775k BTC.

Of course, not all of those addresses are owned by MtGox so we are getting closer to the 750k in this highly speculative theory.

In fact, none of those addresses could have anything to do with MtGox, as i do not understand the blockchain well enough, but i find it quite a coincidence that they add up so well.

I think you have shown how evidence can be used to shape a case, however to be fair to all parties the forensics really must start at the beginning and go where it leads, my guess it many interesting things will be found.


Based on what you found Mt Cox will have to account for those transactions -- they may all be legit, all illegit, or some mixture the point is we know where they came from and MG must make an accounting.  Whatever he can't account for must be assumed that he has control over.

[Jeronimus]

I think you have shown how evidence can be used to shape a case, however to be fair to all parties the forensics really must start at the beginning and go where it leads, my guess it many interesting things will be found.


Based on what you found Mt Cox will have to account for those transactions -- they may all be legit, all illegit, or some mixture the point is we know where they came from and MG must make an accounting.  Whatever he can't account for must be assumed that he has control over.

I think the main point is, if those addresses could in any way be linked to MtGox, then the coins cannot be stolen.

No thief would be dumb enough to sell all coins in one big chunk to a single entity that is also so  incredibly stupid to keep the coins as one single chunk in one address stored.

If the above addresses are in any way linked to gox, then the coins are retrievable.

[thelema93]

Would it help to make a directory of every Btcoin address that has been used to send coins to Gox?

I have a few addresses they gave me.

Is it possible to follow the path like that?

[Armis]

I think you have shown how evidence can be used to shape a case, however to be fair to all parties the forensics really must start at the beginning and go where it leads, my guess it many interesting things will be found.


Based on what you found Mt Cox will have to account for those transactions -- they may all be legit, all illegit, or some mixture the point is we know where they came from and MG must make an accounting.  Whatever he can't account for must be assumed that he has control over.

I think the main point is, if those addresses could in any way be linked to MtGox, then the coins cannot be stolen.

No thief would be dumb enough to sell all coins in one big chunk to a single entity that is also so  incredibly stupid to keep the coins as one single chunk in one address stored.

If the above addresses are in any way linked to gox, then the coins are retrievable.

You mentioned "one single chunk" you uncovered and delineated several big chunks.  

I suspect the road to finding what happened to be long and hard, but it it's short and smooth, that better for everyone.  

[Armis]

Would it help to make a directory of every Btcoin address that has been used to send coins to Gox?

I have a few addresses they gave me.

Is it possible to follow the path like that?

Mt Gox was the first exchange, I'm told it started in 2009, at that time on the block chain there should be very few entries as compared to now, so although you can work backwards from now that out again, you can also pretty much start at the beginning. 

My guess is many people, over time, will give their mt gox address to help connect the dots

Given that MG was the first and the biggest exchange a lot of major activity pointing to any single direction will probably be them. 

[thelema93]

So who stole $300,000,0000 USD worth of Bitcoins and got away with it?

PRIME SUSPECTS:

All Mt. Gox staff:

Mark Karpeles
Gay Butchery Gonzales
+ the rest

ROUND EM UP, LIE DETECTOR THEM

[Armis]

So who stole $300,000,0000 USD worth of Bitcoins and got away with it?

PRIME SUSPECTS:

All Mt. Gox staff:

Mark Karpeles
Gay Butchery Gonzales
+ the rest

ROUND EM UP, LIE DETECTOR THEM

you might be right, but what if you are wrong?

the block chain can help you find the truth, the block chain has the answer

[alfabitcoin]

Would it help to make a directory of every Btcoin address that has been used to send coins to Gox?

I have a few addresses they gave me.

Is it possible to follow the path like that?

Mt Gox was the first exchange, I'm told it started in 2009, at that time on the block chain there should be very few entries as compared to now, so although you can work backwards from now that out again, you can also pretty much start at the beginning.  

My guess is many people, over time, will give their mt gox address to help connect the dots

Given that MG was the first and the biggest exchange a lot of major activity pointing to any single direction will probably be them.  

It was estublished as trading magic cards at 2009. but as a bitcoin exchange mtgox started at 2011. When mark bought it from caleb.

[Armis]

http://www.hackingdaily.com/2014/02/mtgox-speculations.html

An IRC log posted on Pastebin on June 23rd 2011 there is an insight to some of the 'missing coins'. Here is an important snippet from the logs;

<go1dfish> MagicalTux: 432109.87654321 is that pattern random, or was it chosen deliberately?
<go1dfish> by patern I mean the fact that it looks like a countdown
<sharkasgo> probably deliberate so it would be easy to search for
<MagicalTux> go1dfish: it's deliberate
<MagicalTux> want me to do it again?
<go1dfish> MagicalTux: yes, if you could send like a tiny amount to an address someone throws out
<go1dfish> that would do a huge amount to restore confidence
<MagicalTux> I broke out the 432109.87654321 already
<MagicalTux> but I'll make a new one
<UberCookies> I wonder if I've reclaimed my account correctly...
<xelister> do .424242
<MagicalTux> xelister: 424242.42424242 ?
<xelister> yeap
<go1dfish> just need to see a transaction happen from an account with a huge balance with an amount listed here to an address listed here
<MagicalTux> connecting the offline storage and decrypting on a firewalled system~
<go1dfish> 1AbTRVrRYGri1sZvqHBadnXaCHkuXJtV5N
<MagicalTux> I'll make the transaction and push it manually
<notallhere> this would completely restore a lot of peoples faith
<go1dfish> MagicalTux: post an address and I'll send you an amount
<Ooofo> MagicalTux, to get the "free month of trading" thing, will that be automatically done based on rolled back trades or do we have to apply somehow?
<MagicalTux> Ooofo: it'll be automatic
<Ooofo> awesome
<MagicalTux> I got all the data of all the affected users here
<MagicalTux> go1dfish: no, not practical
<go1dfish> ok
<MagicalTux> go1dfish: I'll send 424242.42424242 bitcoins from a bunch of 50kBTC addresses (and maybe on 42kBTC) to one
<MagicalTux> well, two actually
<MagicalTux> one will get the 424k, the other one will get the change
<go1dfish> ok, yeah all transactions get split that way as I understand it
<MagicalTux> ready guys? Don't come after me claiming we have no coins after that
<MagicalTux> hopefully I'll be able to work without getting too much disturbed after that~
<go1dfish> yeah, ready
<nanotube> MagicalTux: wasn't your last tx 432K btc? lost 8k?
<geist_> no
<geist_> thats just the amount someone suggested
<geist_> (the 424242)
<nanotube> ah
<MagicalTux> 42 is the answer
<go1dfish> to everything
<sixEch0> 42 is my password!
<noagendamarket> lol
<nanotube> hehe ic
<go1dfish> 42 is the solution to every block to
<mabus> wait what's going on, is he proving he has our bitcoins still?
<go1dfish> shit I just ruined the economy
<mabus> what does this help
<geist_> theres a lot of people crying wolf saying gox doesnt have their btc anymore
<wumpus> don't send them to the bitcoin eater please
<go1dfish> mabus: tux is shuffling large numbers of bitcoins to show they are still under his control
<MagicalTux> anyway, going to send to 1eHhgW6vquBY... the 424242.42424242 btc


We can see from the above log the community were questioning Mark about the amount of Gox claim to have held in 2011 and wanted proof he owned a large amount. We can see that he agreed to send 424242.42424242 to an address beginning with 1eHhgW6vquBY. Funny enough, we've located said transaction and confirmed it happened. It can be seen in the following.

https://blockchain.info/tx/3a1b9e330d32fef1ee42f8e86420d2be978bbe0dc5862f17da9027cf9e11f8c4

The above transaction shows that Gox, at least at one point in time, had a large sum of Bitcoins.

Digging further into the transactions we can see that a few weeks later the large amount of Bitcoins are broken into a smaller amount and placed into two address as seen below;

https://blockchain.info/tx/7a2a6f66e87ed4e72d85ba7a82eda1572605c3330c461e171f58d7ff2763ac63


We can only assume as this point that this address also belongs to Gox.

A short time after this, a transaction occurred which broke the large amount of Bitcoins into wallets, each containing 50,000. We don't know the exact reasoning for this but we can presume they were possibly being moved into cold storage separately.

2 months after this, a transaction occurs from within the addresses that still are connected to Gox which transfer batches of 50,000 into a larger sum of 500,000 apart from 1 address which still contained 50,000 which can be seen below;

https://blockchain.info/tx/29a3efd3ef04f9153d47a990bd7b048a4b2d213daaa5fb8ed670fb85f13bdbcf


If we follow the 500,000 Bitcoin wallet, we can see that they make a large transaction of nearly all of the coins are made and sent to a wallet publicly belonging to Gox on the Blockchain as seen below. This can only prove our theory that Gox had been in control of the coins the whole time.

https://blockchain.info/tx/b269bf1b82dae8a61f7f91dbf7a9d807e30963c1ae00ddd95a8faebea6d0a007


The 50,000 address we mentioned earlier then split the coins into a batch of 40,000 and a batch of 10,000. This wallet also was under the control of Gox and the 40,000 Bitcoin address still remains there, untouched, since 2011.

https://blockchain.info/address/1cXNTyXj4xPGopfYZNY5xfSM1EPJJvBZV


When the wallets had combined to sent the 500,000 + 50,000, there was a wallet which wasn't included and this wallet, to this day, still has 50,000 Bitcoins in the wallet which are unspent.


https://blockchain.info/address/1P3S1grZYmcqYDuaEDVDYobJ5Fx85E9fE9


We can see that all of the mentioned addresses clearly belong to Gox and after slightly digging through them we can see they have 90,000 Bitcoins which have been there since 2011. I'm sure if we dug further and investigated more we would be able to find much more Bitcoins.

This raises the question, who is lying?

In the Gox leaked crisis plan, it stated they had 2,000 Bitcoins to their name. This means either the document was false, Mark or an employee had lied in the document in an attempt to hide the funds or the firm have lost the private keys for the wallets rendering them nothing more than eye candy.

We are not claiming they didn't lose some coins legitimately to the malleability bug but there is no way that 500,000 coins could have been stolen. Even the planets worst auditor wouldn't have missed such a large amount of Bitcoins disappearing from the companies reserve.

Could this be an attempt to walk away with stashed Bitcoins or has the company been running on lies after finding out their wallets were missing funds and/or they lost the private keys.

[T.Stuart]

-snip-

I think the work you have been doing is invaluable and I would hope (but have no confidence!) that the Bitcoin Foundation has already put expertise into this to provide to investigators.

I strongly advise you to work with the other members of the community who have been putting so much effort into this and gather the information into a report, to send to the Japanese officials in charge of administering Mt Gox.

[Armis]

-snip-

I think the work you have been doing is invaluable and I would hope (but have no confidence!) that the Bitcoin Foundation has already put expertise into this to provide to investigators.

I strongly advise you to work with the other members of the community who have been putting so much effort into this and gather the information into a report, to send to the Japanese officials in charge of administering Mt Gox.

Yes, multiple efforts need to be mounted from many different directions for many different reasons. 

- the main reason is to make the Mt Gox users whole so that no one looses,
- but also to show the world that the cryptocurrency system in general and the bitcoin system specifically works, that it can protect itself and can be self governed
When a department store's security department finds a thief they turn them over to police, who in turn turn them over to prosecutors, who in turn turn them over to prisons.

This is an opportunity for btc to be taken seriously on a totally different level

[T.Stuart]

Have you looked at this analysis?

Devon Weller • 2 days ago

"I followed the 500,000 BTC for a bit beginning at https://blockchain.info/tx/b26....

The coins go through a sequence of events, where the majority is sent to a fresh address and a small bit is sent away from Mt.Gox. This repeats a few times until the majority is paid back to the main Mt.Gox address.

This happens several times, until this transaction:

https://blockchain.info/tx/478...

Here is where it starts to get interesting.

What's left of the 500,000 (429.9k) is split into roughly half and sent to 2 new address. And then each of those address splits the coins in half and sends to two new address.

The end result is that the 429k was split again to many address which each now contain less than 1,000 BTC each. I stopped following the transactions there.

Why take 429k and split it into many addresses each containing less than 1,000 BTC each?

I'd like to see someone trace all of these coins and see if they end up coming together somewhere."

End
-----------------------------------------------------------------------------------------------------

Wow My amateur 10 mins on blockchain might have been on the right track. Maybe tomorrow I should actually learn about this stuff then start following this.