Bitcoin Forum
December 15, 2017, 02:58:20 AM *
News: Latest stable version of Bitcoin Core: 0.15.1  [Torrent].
 
   Home   Help Search Donate Login Register  
Pages: [1] 2 »  All
  Print  
Author Topic: WoW I've found my coins!  (Read 1999 times)
LarryLiu
Jr. Member
*
Offline Offline

Activity: 42


View Profile
March 01, 2014, 05:13:02 AM
 #1

Traced 3 deposits last year to Gox and found the coins are all there, only 2-3 TX away from my external send address.

Source: 1EbuCc81dratEh8j1z6uokYQWXhF3iNGMr     Final: 1KJVoXikYWsdztn2zqfmRnc8b32xWBXuWV
Source: 13rK2ayxeLKpQyiJzVmwXYfBM2JmUvPGyf     Final: 1HtZX7fUWiZckDx86yo1xqo3HJxXEoXJyV
Source: 1KqZmLEtYCSM6VqzXUzWpPJ4wxmwT7KHVg     Final: 131TsvJdYveQNBHMS2K3Sv4QVWL4VYYsJz

In each case above, the 1st TX was from my external address to Gox's account specific address generated for each deposit. The 2nd hop should be to a concentrating address or an address in the hot wallet. The 3rd hop supposed to be an address in the cold wallet or the thief's address, perhaps?

But the strange thing is the coins didn't get move further from there. What kind of thief wouldn't do that?
Gox also seems to have conducted a major consolidation of their hot wallets on 12/31/2013 around 6:00 GMT. Perhaps a subsequent move to the cold storage went south but they failed to notice it before deleting those hot wallet keys?

I'm going to continue monitor those 3 final addresses to see if there is going to be any withdrawal from them in the future. It would be helpful if anyone can share more TX info from late Dec. so we can compare.
  


LL
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
thelema93
Full Member
***
Offline Offline

Activity: 238


View Profile
March 01, 2014, 05:24:19 AM
 #2

These are all the deposits i sent to that cunt Mark at Gox:


75   2014-01-21 01:04:00   deposit   1PkvLqjTUdqDdLYa7pP9W8J5UHZHsrmdRf   2.97   

81   2014-01-22 01:03:00   deposit   17APreaf41aL3exUfhpRDkEpWK3Kj7mqCa   4   

92   2014-01-22 03:50:01   deposit   16v6SxwrRadhHCY7rJwPq5S8Ejrsrifh8b   2   

95   2014-01-27 04:13:00   deposit   1MFjfj4Y8wmpEtyX873ZveXZWVnJ6abwco   4.9495   

99   2014-01-30 02:38:00   deposit   14E1f3KW4WTHWyKRbxjhq58DY3GU4NtJK8        5   



109   2014-02-03 06:29:00   deposit   1CdiTM1BCifFB5KpW8L5t51PUL8NW7vW9E        5   
THIS IS HERE AND IS STILL HERE!:
1NRUPGCqCX56DvVptV2dvNPS2UwZMsUXvA 5 BTC

LarryLiu
Jr. Member
*
Offline Offline

Activity: 42


View Profile
March 01, 2014, 06:02:37 AM
 #3

These are all the deposits i sent to that cunt Mark at Gox:
75   2014-01-21 01:04:00   deposit   1PkvLqjTUdqDdLYa7pP9W8J5UHZHsrmdRf   2.97   
81   2014-01-22 01:03:00   deposit   17APreaf41aL3exUfhpRDkEpWK3Kj7mqCa   4   
92   2014-01-22 03:50:01   deposit   16v6SxwrRadhHCY7rJwPq5S8Ejrsrifh8b   2   
95   2014-01-27 04:13:00   deposit   1MFjfj4Y8wmpEtyX873ZveXZWVnJ6abwco   4.9495   
99   2014-01-30 02:38:00   deposit   14E1f3KW4WTHWyKRbxjhq58DY3GU4NtJK8        5   
109   2014-02-03 06:29:00   deposit   1CdiTM1BCifFB5KpW8L5t51PUL8NW7vW9E        5   
THIS IS HERE AND IS STILL HERE!:
1NRUPGCqCX56DvVptV2dvNPS2UwZMsUXvA 5 BTC

You have 1BTC at 1A5d9dn4SDnKGgRdVRyGZC56ptVjWV18Sv  from 16v6SxwrRadhHCY7rJwPq5S8Ejrsrifh8b   directly never touched.
4.9495 BTC at 1AvrC7rJVZgj8HHtRpyBWeURHzbDNmppcx from 1MFjfj4Y8wmpEtyX873ZveXZWVnJ6abwco along with some others.
5 BTC at 1NRUPGCqCX56DvVptV2dvNPS2UwZMsUXvA from 1CdiTM1BCifFB5KpW8L5t51PUL8NW7vW9E

You can do a little more digging to find the other three transactions but almost half of your funds are there just 2 hops away.

LL
thelema93
Full Member
***
Offline Offline

Activity: 238


View Profile
March 01, 2014, 06:05:31 AM
 #4

These are all the deposits i sent to that cunt Mark at Gox:
75   2014-01-21 01:04:00   deposit   1PkvLqjTUdqDdLYa7pP9W8J5UHZHsrmdRf   2.97   
81   2014-01-22 01:03:00   deposit   17APreaf41aL3exUfhpRDkEpWK3Kj7mqCa   4   
92   2014-01-22 03:50:01   deposit   16v6SxwrRadhHCY7rJwPq5S8Ejrsrifh8b   2   
95   2014-01-27 04:13:00   deposit   1MFjfj4Y8wmpEtyX873ZveXZWVnJ6abwco   4.9495   
99   2014-01-30 02:38:00   deposit   14E1f3KW4WTHWyKRbxjhq58DY3GU4NtJK8        5   
109   2014-02-03 06:29:00   deposit   1CdiTM1BCifFB5KpW8L5t51PUL8NW7vW9E        5   
THIS IS HERE AND IS STILL HERE!:
1NRUPGCqCX56DvVptV2dvNPS2UwZMsUXvA 5 BTC

You have 1BTC at 1A5d9dn4SDnKGgRdVRyGZC56ptVjWV18Sv  from 16v6SxwrRadhHCY7rJwPq5S8Ejrsrifh8b   directly never touched.
4.9495 BTC at 1AvrC7rJVZgj8HHtRpyBWeURHzbDNmppcx from 1MFjfj4Y8wmpEtyX873ZveXZWVnJ6abwco along with some others.
5 BTC at 1NRUPGCqCX56DvVptV2dvNPS2UwZMsUXvA from 1CdiTM1BCifFB5KpW8L5t51PUL8NW7vW9E

You can do a little more digging to find the other three transactions but almost half of your funds are there just 2 hops away.

So what do I do about that?

I mean ALL these coins I sent from my localbitcoins account - so I even have a kind of proof there. I wish I could just show that to the Bitcoin Foundation or something and just send em back somehow.
LarryLiu
Jr. Member
*
Offline Offline

Activity: 42


View Profile
March 01, 2014, 06:20:47 AM
 #5

These are all the deposits i sent to that cunt Mark at Gox:
75   2014-01-21 01:04:00   deposit   1PkvLqjTUdqDdLYa7pP9W8J5UHZHsrmdRf   2.97   
81   2014-01-22 01:03:00   deposit   17APreaf41aL3exUfhpRDkEpWK3Kj7mqCa   4   
92   2014-01-22 03:50:01   deposit   16v6SxwrRadhHCY7rJwPq5S8Ejrsrifh8b   2   
95   2014-01-27 04:13:00   deposit   1MFjfj4Y8wmpEtyX873ZveXZWVnJ6abwco   4.9495   
99   2014-01-30 02:38:00   deposit   14E1f3KW4WTHWyKRbxjhq58DY3GU4NtJK8        5   
109   2014-02-03 06:29:00   deposit   1CdiTM1BCifFB5KpW8L5t51PUL8NW7vW9E        5   
THIS IS HERE AND IS STILL HERE!:
1NRUPGCqCX56DvVptV2dvNPS2UwZMsUXvA 5 BTC

You have 1BTC at 1A5d9dn4SDnKGgRdVRyGZC56ptVjWV18Sv  from 16v6SxwrRadhHCY7rJwPq5S8Ejrsrifh8b   directly never touched.
4.9495 BTC at 1AvrC7rJVZgj8HHtRpyBWeURHzbDNmppcx from 1MFjfj4Y8wmpEtyX873ZveXZWVnJ6abwco along with some others.
5 BTC at 1NRUPGCqCX56DvVptV2dvNPS2UwZMsUXvA from 1CdiTM1BCifFB5KpW8L5t51PUL8NW7vW9E

You can do a little more digging to find the other three transactions but almost half of your funds are there just 2 hops away.

So what do I do about that?

I mean ALL these coins I sent from my localbitcoins account - so I even have a kind of proof there. I wish I could just show that to the Bitcoin Foundation or something and just send em back somehow.

Bitcoin transactions are irreversible, there is no central authority could make that happen. Only the person who knows or holds the wallet's key can move  those coins. What we've found only confirms that these coins probably haven't been stolen. If more people submit more info we may be able to get a better idea of what's been going on.

LL
thelema93
Full Member
***
Offline Offline

Activity: 238


View Profile
March 01, 2014, 09:20:52 AM
 #6

Well, yes. But how does that show they haven't been stolen?
Someone could have stolen them and just left them in that wallet right?
V4Vendettas
Sr. Member
****
Offline Offline

Activity: 294



View Profile
March 01, 2014, 09:41:34 AM
 #7

Nice work Smiley


Getting goxxed has made we want to become a Blockchain analist myself and today is going to be the day I start my learninz so I can also help with this Grin

alfabitcoin
Sr. Member
****
Offline Offline

Activity: 476


View Profile
March 01, 2014, 10:09:48 AM
 #8

Those coins can be reamaining of the 2000 what gox still has. Either way, no way of proving it.
breel
Full Member
***
Offline Offline

Activity: 127


View Profile
March 01, 2014, 01:16:16 PM
 #9

Hmmm, I've tried to do the same and followed this transaction:
https://blockchain.info/address/1NwuCH9szpshHZoKJ6AsCLUYFu39rN2jsj

but I eventually ended up in a tumbler (no proof, bug huge amount of BTC moving every few minutes for a few days in February...).
Of course, that might just have been my luck and that was some of the coins stolen from the malleability issue.
LarryLiu
Jr. Member
*
Offline Offline

Activity: 42


View Profile
March 01, 2014, 05:34:36 PM
 #10

Well, yes. But how does that show they haven't been stolen?
Someone could have stolen them and just left them in that wallet right?

Possible but not very plausible at all.

LL
LarryLiu
Jr. Member
*
Offline Offline

Activity: 42


View Profile
March 01, 2014, 05:37:43 PM
 #11

Those coins can be reamaining of the 2000 what gox still has. Either way, no way of proving it.

Why not? We can easily prove if we can ident more than 2000 coins.

LL
boumalo
Legendary
*
Offline Offline

Activity: 1232


View Profile
March 01, 2014, 07:36:44 PM
 #12

Wow this is very interesting

The problem is I don't think an competent agency will look into all that mtgox fiasco the way it should looked at, big governments have tens of thousands of agencies but they never have the one needed

What about crowd funding a professional team that will look into that?

analytics
Member
**
Offline Offline

Activity: 98


View Profile
March 01, 2014, 07:39:47 PM
 #13



See this thread too for tracing stolen coins...
https://bitcointalk.org/index.php?topic=494761.msg5451149#msg5451149
LarryLiu
Jr. Member
*
Offline Offline

Activity: 42


View Profile
March 01, 2014, 08:20:49 PM
 #14

See this thread too for tracing stolen coins...
https://bitcointalk.org/index.php?topic=494761.msg5451149#msg5451149

Thanks, will check out the other thread soon. One thing I do want to point out though, the coins that I tracked down are MY coins. The source addresses I posted are NOT guessed ones, they are where I sent them from.

LL
Zooey
Sr. Member
****
Offline Offline

Activity: 241


Time you enjoy wasting is not wasted time.


View Profile
March 01, 2014, 08:32:05 PM
 #15

Nice work Smiley


Getting goxxed has made we want to become a Blockchain analist myself and today is going to be the day I start my learninz so I can also help with this Grin


Well said.

✘ www.NOTFORSALECAMPAIGN.org ✘
Human trafficking enslaves 30 million people: Join the movement to re-abolish slavery. | A 05:49s Vimeo |
sl317
Newbie
*
Offline Offline

Activity: 14


View Profile
March 01, 2014, 08:36:01 PM
 #16

Hmmm, I've tried to do the same and followed this transaction:
https://blockchain.info/address/1NwuCH9szpshHZoKJ6AsCLUYFu39rN2jsj

but I eventually ended up in a tumbler (no proof, bug huge amount of BTC moving every few minutes for a few days in February...).
Of course, that might just have been my luck and that was some of the coins stolen from the malleability issue.
Smiley

Wow its my adress on your link https://blockchain.info/address/1NwuCH9szpshHZoKJ6AsCLUYFu39rN2jsj (185.....bpo), but my 100 btc so far lost by Mt.Gox
https://bitcointalk.org/index.php?topic=324918.msg4869935#msg4869935
http://img-fotki.yandex.ru/get/9808/23942984.0/0_7a2b4_c90daff_XL.jpg
LarryLiu
Jr. Member
*
Offline Offline

Activity: 42


View Profile
March 01, 2014, 08:51:56 PM
 #17

Hmmm, I've tried to do the same and followed this transaction:
https://blockchain.info/address/1NwuCH9szpshHZoKJ6AsCLUYFu39rN2jsj

but I eventually ended up in a tumbler (no proof, bug huge amount of BTC moving every few minutes for a few days in February...).
Of course, that might just have been my luck and that was some of the coins stolen from the malleability issue.

Your link points to an address not a transaction. Was that an external address or the addresse generated by Gox on their BTC Deposit page?

LL
LarryLiu
Jr. Member
*
Offline Offline

Activity: 42


View Profile
March 01, 2014, 08:58:58 PM
 #18

Hmmm, I've tried to do the same and followed this transaction:
https://blockchain.info/address/1NwuCH9szpshHZoKJ6AsCLUYFu39rN2jsj

but I eventually ended up in a tumbler (no proof, bug huge amount of BTC moving every few minutes for a few days in February...).
Of course, that might just have been my luck and that was some of the coins stolen from the malleability issue.
Smiley

Wow its my adress on your link https://blockchain.info/address/1NwuCH9szpshHZoKJ6AsCLUYFu39rN2jsj (185.....bpo), but my 100 btc so far lost by Mt.Gox
https://bitcointalk.org/index.php?topic=324918.msg4869935#msg4869935


It seems Breel's 7 BTC deposit was used to fund your 100 BTC withdrawal.

LL
HairyMaclairy
Sr. Member
****
Online Online

Activity: 308


View Profile
March 01, 2014, 10:00:40 PM
 #19

Whatever the source of the issue which should expect to see recent deposits funding recent withdrawals consistent with the operation of a fractional reserve.
analytics
Member
**
Offline Offline

Activity: 98


View Profile
March 01, 2014, 10:10:59 PM
 #20

Based on my own transactions, this looks like it is a BitcoinBuilder BTC  Address  
1JiixnNK52kMtxMRuC26YMsyCxoBZzkinw

You can see how many transactions happened each day.   It would be hard to refute this isn't bitcoin builder due to the transaction volumes and apparent 2% fee harvesting.  You might be able to get at a lot of GOX addresses through the linking.


edit: not likely to be useful.  I traced some of my bitcoinbuilder to gox account withdrawals and those don;t show up of course on the blockchain as they were processed internal to gox only.   

 
 
Pages: [1] 2 »  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!