WoW I've found my coins!

[LarryLiu]

Traced 3 deposits last year to Gox and found the coins are all there, only 2-3 TX away from my external send address.

Source: 1EbuCc81dratEh8j1z6uokYQWXhF3iNGMr     Final: 1KJVoXikYWsdztn2zqfmRnc8b32xWBXuWV
Source: 13rK2ayxeLKpQyiJzVmwXYfBM2JmUvPGyf     Final: 1HtZX7fUWiZckDx86yo1xqo3HJxXEoXJyV
Source: 1KqZmLEtYCSM6VqzXUzWpPJ4wxmwT7KHVg     Final: 131TsvJdYveQNBHMS2K3Sv4QVWL4VYYsJz

In each case above, the 1st TX was from my external address to Gox's account specific address generated for each deposit. The 2nd hop should be to a concentrating address or an address in the hot wallet. The 3rd hop supposed to be an address in the cold wallet or the thief's address, perhaps?

But the strange thing is the coins didn't get move further from there. What kind of thief wouldn't do that?
Gox also seems to have conducted a major consolidation of their hot wallets on 12/31/2013 around 6:00 GMT. Perhaps a subsequent move to the cold storage went south but they failed to notice it before deleting those hot wallet keys?

I'm going to continue monitor those 3 final addresses to see if there is going to be any withdrawal from them in the future. It would be helpful if anyone can share more TX info from late Dec. so we can compare.
  

[thelema93]

These are all the deposits i sent to that cunt Mark at Gox:


75   2014-01-21 01:04:00   deposit   1PkvLqjTUdqDdLYa7pP9W8J5UHZHsrmdRf   2.97   

81   2014-01-22 01:03:00   deposit   17APreaf41aL3exUfhpRDkEpWK3Kj7mqCa   4   

92   2014-01-22 03:50:01   deposit   16v6SxwrRadhHCY7rJwPq5S8Ejrsrifh8b   2   

95   2014-01-27 04:13:00   deposit   1MFjfj4Y8wmpEtyX873ZveXZWVnJ6abwco   4.9495   

99   2014-01-30 02:38:00   deposit   14E1f3KW4WTHWyKRbxjhq58DY3GU4NtJK8        5   



109   2014-02-03 06:29:00   deposit   1CdiTM1BCifFB5KpW8L5t51PUL8NW7vW9E        5   
THIS IS HERE AND IS STILL HERE!:
1NRUPGCqCX56DvVptV2dvNPS2UwZMsUXvA 5 BTC

[LarryLiu]

These are all the deposits i sent to that cunt Mark at Gox:
75   2014-01-21 01:04:00   deposit   1PkvLqjTUdqDdLYa7pP9W8J5UHZHsrmdRf   2.97   
81   2014-01-22 01:03:00   deposit   17APreaf41aL3exUfhpRDkEpWK3Kj7mqCa   4   
92   2014-01-22 03:50:01   deposit   16v6SxwrRadhHCY7rJwPq5S8Ejrsrifh8b   2   
95   2014-01-27 04:13:00   deposit   1MFjfj4Y8wmpEtyX873ZveXZWVnJ6abwco   4.9495   
99   2014-01-30 02:38:00   deposit   14E1f3KW4WTHWyKRbxjhq58DY3GU4NtJK8        5   
109   2014-02-03 06:29:00   deposit   1CdiTM1BCifFB5KpW8L5t51PUL8NW7vW9E        5   
THIS IS HERE AND IS STILL HERE!:
1NRUPGCqCX56DvVptV2dvNPS2UwZMsUXvA 5 BTC

You have 1BTC at 1A5d9dn4SDnKGgRdVRyGZC56ptVjWV18Sv  from 16v6SxwrRadhHCY7rJwPq5S8Ejrsrifh8b   directly never touched.
4.9495 BTC at 1AvrC7rJVZgj8HHtRpyBWeURHzbDNmppcx from 1MFjfj4Y8wmpEtyX873ZveXZWVnJ6abwco along with some others.
5 BTC at 1NRUPGCqCX56DvVptV2dvNPS2UwZMsUXvA from 1CdiTM1BCifFB5KpW8L5t51PUL8NW7vW9E

You can do a little more digging to find the other three transactions but almost half of your funds are there just 2 hops away.

[thelema93]

These are all the deposits i sent to that cunt Mark at Gox:
75   2014-01-21 01:04:00   deposit   1PkvLqjTUdqDdLYa7pP9W8J5UHZHsrmdRf   2.97   
81   2014-01-22 01:03:00   deposit   17APreaf41aL3exUfhpRDkEpWK3Kj7mqCa   4   
92   2014-01-22 03:50:01   deposit   16v6SxwrRadhHCY7rJwPq5S8Ejrsrifh8b   2   
95   2014-01-27 04:13:00   deposit   1MFjfj4Y8wmpEtyX873ZveXZWVnJ6abwco   4.9495   
99   2014-01-30 02:38:00   deposit   14E1f3KW4WTHWyKRbxjhq58DY3GU4NtJK8        5   
109   2014-02-03 06:29:00   deposit   1CdiTM1BCifFB5KpW8L5t51PUL8NW7vW9E        5   
THIS IS HERE AND IS STILL HERE!:
1NRUPGCqCX56DvVptV2dvNPS2UwZMsUXvA 5 BTC

You have 1BTC at 1A5d9dn4SDnKGgRdVRyGZC56ptVjWV18Sv  from 16v6SxwrRadhHCY7rJwPq5S8Ejrsrifh8b   directly never touched.
4.9495 BTC at 1AvrC7rJVZgj8HHtRpyBWeURHzbDNmppcx from 1MFjfj4Y8wmpEtyX873ZveXZWVnJ6abwco along with some others.
5 BTC at 1NRUPGCqCX56DvVptV2dvNPS2UwZMsUXvA from 1CdiTM1BCifFB5KpW8L5t51PUL8NW7vW9E

You can do a little more digging to find the other three transactions but almost half of your funds are there just 2 hops away.

So what do I do about that?

I mean ALL these coins I sent from my localbitcoins account - so I even have a kind of proof there. I wish I could just show that to the Bitcoin Foundation or something and just send em back somehow.

[LarryLiu]

These are all the deposits i sent to that cunt Mark at Gox:
75   2014-01-21 01:04:00   deposit   1PkvLqjTUdqDdLYa7pP9W8J5UHZHsrmdRf   2.97   
81   2014-01-22 01:03:00   deposit   17APreaf41aL3exUfhpRDkEpWK3Kj7mqCa   4   
92   2014-01-22 03:50:01   deposit   16v6SxwrRadhHCY7rJwPq5S8Ejrsrifh8b   2   
95   2014-01-27 04:13:00   deposit   1MFjfj4Y8wmpEtyX873ZveXZWVnJ6abwco   4.9495   
99   2014-01-30 02:38:00   deposit   14E1f3KW4WTHWyKRbxjhq58DY3GU4NtJK8        5   
109   2014-02-03 06:29:00   deposit   1CdiTM1BCifFB5KpW8L5t51PUL8NW7vW9E        5   
THIS IS HERE AND IS STILL HERE!:
1NRUPGCqCX56DvVptV2dvNPS2UwZMsUXvA 5 BTC

You have 1BTC at 1A5d9dn4SDnKGgRdVRyGZC56ptVjWV18Sv  from 16v6SxwrRadhHCY7rJwPq5S8Ejrsrifh8b   directly never touched.
4.9495 BTC at 1AvrC7rJVZgj8HHtRpyBWeURHzbDNmppcx from 1MFjfj4Y8wmpEtyX873ZveXZWVnJ6abwco along with some others.
5 BTC at 1NRUPGCqCX56DvVptV2dvNPS2UwZMsUXvA from 1CdiTM1BCifFB5KpW8L5t51PUL8NW7vW9E

You can do a little more digging to find the other three transactions but almost half of your funds are there just 2 hops away.

So what do I do about that?

I mean ALL these coins I sent from my localbitcoins account - so I even have a kind of proof there. I wish I could just show that to the Bitcoin Foundation or something and just send em back somehow.

Bitcoin transactions are irreversible, there is no central authority could make that happen. Only the person who knows or holds the wallet's key can move  those coins. What we've found only confirms that these coins probably haven't been stolen. If more people submit more info we may be able to get a better idea of what's been going on.

[thelema93]

Well, yes. But how does that show they haven't been stolen?
Someone could have stolen them and just left them in that wallet right?

[V4Vendettas]

Nice work


Getting goxxed has made we want to become a Blockchain analist myself and today is going to be the day I start my learninz so I can also help with this

[alfabitcoin]

Those coins can be reamaining of the 2000 what gox still has. Either way, no way of proving it.

[breel]

Hmmm, I've tried to do the same and followed this transaction:
https://blockchain.info/address/1NwuCH9szpshHZoKJ6AsCLUYFu39rN2jsj

but I eventually ended up in a tumbler (no proof, bug huge amount of BTC moving every few minutes for a few days in February...).
Of course, that might just have been my luck and that was some of the coins stolen from the malleability issue.

[LarryLiu]

Well, yes. But how does that show they haven't been stolen?
Someone could have stolen them and just left them in that wallet right?

Possible but not very plausible at all.

[LarryLiu]

Those coins can be reamaining of the 2000 what gox still has. Either way, no way of proving it.

Why not? We can easily prove if we can ident more than 2000 coins.

[boumalo]

Wow this is very interesting

The problem is I don't think an competent agency will look into all that mtgox fiasco the way it should looked at, big governments have tens of thousands of agencies but they never have the one needed

What about crowd funding a professional team that will look into that?

[analytics]

See this thread too for tracing stolen coins...
https://bitcointalk.org/index.php?topic=494761.msg5451149#msg5451149

[LarryLiu]

See this thread too for tracing stolen coins...
https://bitcointalk.org/index.php?topic=494761.msg5451149#msg5451149

Thanks, will check out the other thread soon. One thing I do want to point out though, the coins that I tracked down are MY coins. The source addresses I posted are NOT guessed ones, they are where I sent them from.

[Zooey]

Nice work


Getting goxxed has made we want to become a Blockchain analist myself and today is going to be the day I start my learninz so I can also help with this

Well said.

[sl317]

Hmmm, I've tried to do the same and followed this transaction:
https://blockchain.info/address/1NwuCH9szpshHZoKJ6AsCLUYFu39rN2jsj

but I eventually ended up in a tumbler (no proof, bug huge amount of BTC moving every few minutes for a few days in February...).
Of course, that might just have been my luck and that was some of the coins stolen from the malleability issue.

Wow its my adress on your link https://blockchain.info/address/1NwuCH9szpshHZoKJ6AsCLUYFu39rN2jsj (185.....bpo), but my 100 btc so far lost by Mt.Gox
https://bitcointalk.org/index.php?topic=324918.msg4869935#msg4869935
http://img-fotki.yandex.ru/get/9808/23942984.0/0_7a2b4_c90daff_XL.jpg

[LarryLiu]

Hmmm, I've tried to do the same and followed this transaction:
https://blockchain.info/address/1NwuCH9szpshHZoKJ6AsCLUYFu39rN2jsj

but I eventually ended up in a tumbler (no proof, bug huge amount of BTC moving every few minutes for a few days in February...).
Of course, that might just have been my luck and that was some of the coins stolen from the malleability issue.

Your link points to an address not a transaction. Was that an external address or the addresse generated by Gox on their BTC Deposit page?

[LarryLiu]

Hmmm, I've tried to do the same and followed this transaction:
https://blockchain.info/address/1NwuCH9szpshHZoKJ6AsCLUYFu39rN2jsj

but I eventually ended up in a tumbler (no proof, bug huge amount of BTC moving every few minutes for a few days in February...).
Of course, that might just have been my luck and that was some of the coins stolen from the malleability issue.

Wow its my adress on your link https://blockchain.info/address/1NwuCH9szpshHZoKJ6AsCLUYFu39rN2jsj (185.....bpo), but my 100 btc so far lost by Mt.Gox
https://bitcointalk.org/index.php?topic=324918.msg4869935#msg4869935
http://img-fotki.yandex.ru/get/9808/23942984.0/0_7a2b4_c90daff_XL.jpg

It seems Breel's 7 BTC deposit was used to fund your 100 BTC withdrawal.

[HairyMaclairy]

Whatever the source of the issue which should expect to see recent deposits funding recent withdrawals consistent with the operation of a fractional reserve.

[analytics]

Based on my own transactions, this looks like it is a BitcoinBuilder BTC  Address  
1JiixnNK52kMtxMRuC26YMsyCxoBZzkinw

You can see how many transactions happened each day.   It would be hard to refute this isn't bitcoin builder due to the transaction volumes and apparent 2% fee harvesting.  You might be able to get at a lot of GOX addresses through the linking.


edit: not likely to be useful.  I traced some of my bitcoinbuilder to gox account withdrawals and those don;t show up of course on the blockchain as they were processed internal to gox only.