[GOX] Crime Scene Investigation, Case #MG744

[papamoi]

how can you be sure that it s gox adresses and not anyone s else?

[Finnminer]

The coins are directly linked to known Gox addresses. See reddit for more info.

The coins are split in about half and moved to new addresses immediately after they get 6 confirmations. They are down to around 10k per address now:
https://blockchain.info/address/12Fgt5jTUENHjYu4KtYaz9V7PMbno3ABan
One interesting thing I noticed is that the amounts are exactly what you'd expect if you used the splitBigOutputs() function from the leaked Gox source code to do the splitting:


Coincidence or Karpeles using his own code to move the coins?

[Loozik]

If anyone is from Japan, please check if MtGox reported the theft to the local police.

If yes, which addresses the stolen coins were sent.

If not, please report the theft based on MtGox's statements. Not sure about how it's done in Japan, but when you report a crime, police is bound by law to look for evidence of the crime (Gox employee interogation inclusive).

[lemier]

I was sure that there is no thief ! So these must be sended to Japan to show them what is going on

[Loozik]

I was sure that there is no thief ! So these must be sended to Japan to show them what is going on

Yes, someone should check if the crime of theft was reported by Gox to the police at all.

[V4Vendettas]

@ Finnminer nice post and yes coincidence indeed.

[Armis]

If anyone is from Japan, please check if MtGox reported the theft to the local police.

If yes, which addresses the stolen coins were sent.

If not, please report the theft based on MtGox's statements. Not sure about how it's done in Japan, but when you report a crime, police is bound by law to look for evidence of the crime (Gox employee interogation inclusive).

You have a point there, looking at the translated version of the reorganization plea I did a search for 'stolen' which hit twice, I could not determine if the language surrounding it was speculation about a crime taking place and a suggestion that a criminal investigation commence; or a formal complaint that they believe a crime took place with the formal request for the criminal investigation.  

So, I agree with you, someone with standing in japan should make the police and/or fed agency criminal complaint.  

[darkmule]

The coins are directly linked to known Gox addresses. See reddit for more info.

The coins are split in about half and moved to new addresses immediately after they get 6 confirmations. They are down to around 10k per address now:

This looks really bad.  Anyone with any standing in the bankruptcy should file something IMMEDIATELY before the contents of these addresses get sent through mixers to God knows where.

Because this looks like Gox/Magikarpeles is preparing to abscond.

(Alternately, it could actually have something to do with the bankruptcy authorities themselves, since the feds did something similar with Silk Road funds.  But it should be known why this money is moving around now of all times.)

[Finnminer]

The coins are now in several hundred new addresses with 300-2000 BTC each. If it's actually using the splitBigOutputs() function they should end up in 30k different addresses holding less than 10 BTC each.

[Predatorian]

The coins are now in several hundred new addresses with 300-2000 BTC each. If it's actually using the splitBigOutputs() function they should end up in 30k different addresses holding less than 10 BTC each.

This.

Yes probably u are right, it's really unfortunately for all people who lost btc in that way.

[Armis]

The coins are now in several hundred new addresses with 300-2000 BTC each. If it's actually using the splitBigOutputs() function they should end up in 30k different addresses holding less than 10 BTC each.

the more the coins are handled the more foot/finger prints are made visible and the more connections could be made

for example, in order to mix you must go to a mixer their computer records will show the coins going in by x isp at y timestamp

that mixer will either cooperate or be materially embroiled in a criminal investigation

now with that isp as the finger print you could look for other places where that isp has engaged other mixers, exchanges, etc ...

eventually the electronic finger prints and foot prints will lead to humans who will need to explain.  If the prints are MK, MG employees, and or relatives of either arrests would be.

[McKinley]

The coins are now in several hundred new addresses with 300-2000 BTC each. If it's actually using the splitBigOutputs() function they should end up in 30k different addresses holding less than 10 BTC each.

the more the coins are handled the more foot/finger prints are made visible and the more connections could be made

for example, in order to mix you must go to a mixer their computer records will show the coins going in by x isp at y timestamp

that mixer will either cooperate or be materially embroiled in a criminal investigation

now with that isp as the finger print you could look for other places where that isp has engaged other mixers, exchanges, etc ...

eventually the electronic finger prints and foot prints will lead to humans who will need to explain.  If the prints are MK, MG employees, and or relatives of either arrests would be.

AND, whatever "mixer" it would be - it would have to have an at least about equal amount of BTC at the time of mixing to be able to cover any tracks... If 200K + 1K per day go in and 201K go mixed out, this is quite traceable, too.

[itsunderstood]

@ Finnminer nice post and yes coincidence indeed.

This.  Nice sleuthing Finnminer.

[T.Stuart]

The coins are now in several hundred new addresses with 300-2000 BTC each. If it's actually using the splitBigOutputs() function they should end up in 30k different addresses holding less than 10 BTC each.

This.

Yes probably u are right, it's really unfortunately for all people who lost btc in that way.

Understand, though, that if it stops at 30k addresses with 10BTC in each this could be interpreted as a positive sign, as it would mirror what looks like Gox's hot wallet loading procedure.

If it keeps going then I suppose we keep watching, with a sinking feeling. 

[itsunderstood]

Understand, though, that if it stops at 30k addresses with 10BTC in each this could be interpreted as a positive sign, as it would mirror what looks like Gox's hot wallet loading procedure.

If it keeps going then I suppose we keep watching, with a sinking feeling. 

Fingerprint-capture every moment of the blockchain now, robotically.  There are many smart people out there and they will follow the coins like in the Pirates(tm) movies, they will never stop analyzing the blockchain.

Also, indeed, if the Goxxies spent their energy hack SHA-256, they would probably have it done long before the BTC blockchain reaches event horizon.  I think the collegiate-papered-cryptohackkids have a new method now, and they have gotten SHA-256 from 24 rounds to 55 rounds or something, that's a doubling in 3 years?  So, indeed the investors have a technical bottled genie now.  I would say bots will subsume and own the BTC blockchain soon, and this future, is being seeded now, with 10% of the coins being "ghostcoins", essentially lost forever?

What future does it portend?  Well, as Yoda would say: "Always in motion is the future."

But at that point in the Jedi tale, Yoda has already massively lied to the kid anyway, LOL.

Anyway, I will hold BTC and other crypto long.  That is my disclaimer.

[shunt1]

"Understand, though, that if it stops at 30k addresses with 10BTC in each this could be interpreted as a positive sign, as it would mirror what looks like Gox's hot wallet loading procedure."

I fully agree and that is why I am so excited about this new development.  We can only hope...

[Finnminer]

Seems like it's mostly finished already. Some branches went all the way down to addresses with less than 30 BTC, while others stopped at over 2000 BTC. Can't really think of any reasonable logic behind it. Mark does seem to like random functions though, so maybe it just randomized how far each branch was divided.

Some branches like this are still going if someone wants to follow the money:
https://blockchain.info/address/1ASkFuM3ZNU7TPqHNuDTpJch22o5FRPXxS

[Armis]

Why are we not talking about the fact that the huge transaction is made up of goxcoins?

the input for the 50k is 1 address away from the 550k address that karpeles used.


=====

update:
relevant thread http://www.reddit.com/r/Bitcoin/comments/1zsw1k/while_the_press_is_focused_on_satoshi_180000/

=====




from reddit:
"More importantly, the ฿50,000 output here is zero transactions away from the ฿550,000 proof of reserves that Tux signed back in 2011: https://blockchain.info/address/1P3S1grZYmcqYDuaEDVDYobJ5Fx85E9fE9

That ฿550k transaction was made by Karpeles. The ฿50k output has been sitting there untouched since 2011."

more:

"the 424,242.42 transaction made by karpeles is only 3 transactions away from the address of this transaction (!!!) https://blockchain.info/address/1eHhgW6vquBYhwMPhQ668HPjxTtpvZGPC

these very well may be goxcoins..

source: http://www.reddit.com/r/Bitcoin/comments/1zsjnu/i_believe_karpeles_not_satoshi_caused_the_days/"


wut

[Armis]

Someon on Reddit made a binary tree of the coins. It's a beautiful thing, I take no credit,I just stole it.

[T.Stuart]

Someon on Reddit made a binary tree of the coins. It's a beautiful thing, I take no credit,I just stole it.

Looks like those coins are partying away in there, oblivious to all the distress they're causing.