LarryLiu (OP)
Newbie
Offline
Activity: 56
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 01, 2014, 05:13:02 AM Last edit: March 01, 2014, 08:23:38 PM by LarryLiu |
|
Traced 3 deposits last year to Gox and found the coins are all there, only 2-3 TX away from my external send address.
Source: 1EbuCc81dratEh8j1z6uokYQWXhF3iNGMr Final: 1KJVoXikYWsdztn2zqfmRnc8b32xWBXuWV Source: 13rK2ayxeLKpQyiJzVmwXYfBM2JmUvPGyf Final: 1HtZX7fUWiZckDx86yo1xqo3HJxXEoXJyV Source: 1KqZmLEtYCSM6VqzXUzWpPJ4wxmwT7KHVg Final: 131TsvJdYveQNBHMS2K3Sv4QVWL4VYYsJz
In each case above, the 1st TX was from my external address to Gox's account specific address generated for each deposit. The 2nd hop should be to a concentrating address or an address in the hot wallet. The 3rd hop supposed to be an address in the cold wallet or the thief's address, perhaps?
But the strange thing is the coins didn't get move further from there. What kind of thief wouldn't do that? Gox also seems to have conducted a major consolidation of their hot wallets on 12/31/2013 around 6:00 GMT. Perhaps a subsequent move to the cold storage went south but they failed to notice it before deleting those hot wallet keys?
I'm going to continue monitor those 3 final addresses to see if there is going to be any withdrawal from them in the future. It would be helpful if anyone can share more TX info from late Dec. so we can compare.
|
|
|
|
thelema93
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 01, 2014, 05:24:19 AM |
|
These are all the deposits i sent to that cunt Mark at Gox:
75 2014-01-21 01:04:00 deposit 1PkvLqjTUdqDdLYa7pP9W8J5UHZHsrmdRf 2.97
81 2014-01-22 01:03:00 deposit 17APreaf41aL3exUfhpRDkEpWK3Kj7mqCa 4
92 2014-01-22 03:50:01 deposit 16v6SxwrRadhHCY7rJwPq5S8Ejrsrifh8b 2
95 2014-01-27 04:13:00 deposit 1MFjfj4Y8wmpEtyX873ZveXZWVnJ6abwco 4.9495
99 2014-01-30 02:38:00 deposit 14E1f3KW4WTHWyKRbxjhq58DY3GU4NtJK8 5
109 2014-02-03 06:29:00 deposit 1CdiTM1BCifFB5KpW8L5t51PUL8NW7vW9E 5 THIS IS HERE AND IS STILL HERE!: 1NRUPGCqCX56DvVptV2dvNPS2UwZMsUXvA 5 BTC
|
|
|
|
LarryLiu (OP)
Newbie
Offline
Activity: 56
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 01, 2014, 06:02:37 AM |
|
These are all the deposits i sent to that cunt Mark at Gox: 75 2014-01-21 01:04:00 deposit 1PkvLqjTUdqDdLYa7pP9W8J5UHZHsrmdRf 2.97 81 2014-01-22 01:03:00 deposit 17APreaf41aL3exUfhpRDkEpWK3Kj7mqCa 4 92 2014-01-22 03:50:01 deposit 16v6SxwrRadhHCY7rJwPq5S8Ejrsrifh8b 2 95 2014-01-27 04:13:00 deposit 1MFjfj4Y8wmpEtyX873ZveXZWVnJ6abwco 4.9495 99 2014-01-30 02:38:00 deposit 14E1f3KW4WTHWyKRbxjhq58DY3GU4NtJK8 5 109 2014-02-03 06:29:00 deposit 1CdiTM1BCifFB5KpW8L5t51PUL8NW7vW9E 5 THIS IS HERE AND IS STILL HERE!: 1NRUPGCqCX56DvVptV2dvNPS2UwZMsUXvA 5 BTC
You have 1BTC at 1A5d9dn4SDnKGgRdVRyGZC56ptVjWV18Sv from 16v6SxwrRadhHCY7rJwPq5S8Ejrsrifh8b directly never touched. 4.9495 BTC at 1AvrC7rJVZgj8HHtRpyBWeURHzbDNmppcx from 1MFjfj4Y8wmpEtyX873ZveXZWVnJ6abwco along with some others. 5 BTC at 1NRUPGCqCX56DvVptV2dvNPS2UwZMsUXvA from 1CdiTM1BCifFB5KpW8L5t51PUL8NW7vW9E You can do a little more digging to find the other three transactions but almost half of your funds are there just 2 hops away.
|
|
|
|
thelema93
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 01, 2014, 06:05:31 AM |
|
These are all the deposits i sent to that cunt Mark at Gox: 75 2014-01-21 01:04:00 deposit 1PkvLqjTUdqDdLYa7pP9W8J5UHZHsrmdRf 2.97 81 2014-01-22 01:03:00 deposit 17APreaf41aL3exUfhpRDkEpWK3Kj7mqCa 4 92 2014-01-22 03:50:01 deposit 16v6SxwrRadhHCY7rJwPq5S8Ejrsrifh8b 2 95 2014-01-27 04:13:00 deposit 1MFjfj4Y8wmpEtyX873ZveXZWVnJ6abwco 4.9495 99 2014-01-30 02:38:00 deposit 14E1f3KW4WTHWyKRbxjhq58DY3GU4NtJK8 5 109 2014-02-03 06:29:00 deposit 1CdiTM1BCifFB5KpW8L5t51PUL8NW7vW9E 5 THIS IS HERE AND IS STILL HERE!: 1NRUPGCqCX56DvVptV2dvNPS2UwZMsUXvA 5 BTC
You have 1BTC at 1A5d9dn4SDnKGgRdVRyGZC56ptVjWV18Sv from 16v6SxwrRadhHCY7rJwPq5S8Ejrsrifh8b directly never touched. 4.9495 BTC at 1AvrC7rJVZgj8HHtRpyBWeURHzbDNmppcx from 1MFjfj4Y8wmpEtyX873ZveXZWVnJ6abwco along with some others. 5 BTC at 1NRUPGCqCX56DvVptV2dvNPS2UwZMsUXvA from 1CdiTM1BCifFB5KpW8L5t51PUL8NW7vW9E You can do a little more digging to find the other three transactions but almost half of your funds are there just 2 hops away. So what do I do about that? I mean ALL these coins I sent from my localbitcoins account - so I even have a kind of proof there. I wish I could just show that to the Bitcoin Foundation or something and just send em back somehow.
|
|
|
|
LarryLiu (OP)
Newbie
Offline
Activity: 56
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 01, 2014, 06:20:47 AM |
|
These are all the deposits i sent to that cunt Mark at Gox: 75 2014-01-21 01:04:00 deposit 1PkvLqjTUdqDdLYa7pP9W8J5UHZHsrmdRf 2.97 81 2014-01-22 01:03:00 deposit 17APreaf41aL3exUfhpRDkEpWK3Kj7mqCa 4 92 2014-01-22 03:50:01 deposit 16v6SxwrRadhHCY7rJwPq5S8Ejrsrifh8b 2 95 2014-01-27 04:13:00 deposit 1MFjfj4Y8wmpEtyX873ZveXZWVnJ6abwco 4.9495 99 2014-01-30 02:38:00 deposit 14E1f3KW4WTHWyKRbxjhq58DY3GU4NtJK8 5 109 2014-02-03 06:29:00 deposit 1CdiTM1BCifFB5KpW8L5t51PUL8NW7vW9E 5 THIS IS HERE AND IS STILL HERE!: 1NRUPGCqCX56DvVptV2dvNPS2UwZMsUXvA 5 BTC
You have 1BTC at 1A5d9dn4SDnKGgRdVRyGZC56ptVjWV18Sv from 16v6SxwrRadhHCY7rJwPq5S8Ejrsrifh8b directly never touched. 4.9495 BTC at 1AvrC7rJVZgj8HHtRpyBWeURHzbDNmppcx from 1MFjfj4Y8wmpEtyX873ZveXZWVnJ6abwco along with some others. 5 BTC at 1NRUPGCqCX56DvVptV2dvNPS2UwZMsUXvA from 1CdiTM1BCifFB5KpW8L5t51PUL8NW7vW9E You can do a little more digging to find the other three transactions but almost half of your funds are there just 2 hops away. So what do I do about that? I mean ALL these coins I sent from my localbitcoins account - so I even have a kind of proof there. I wish I could just show that to the Bitcoin Foundation or something and just send em back somehow. Bitcoin transactions are irreversible, there is no central authority could make that happen. Only the person who knows or holds the wallet's key can move those coins. What we've found only confirms that these coins probably haven't been stolen. If more people submit more info we may be able to get a better idea of what's been going on.
|
|
|
|
thelema93
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 01, 2014, 09:20:52 AM |
|
Well, yes. But how does that show they haven't been stolen? Someone could have stolen them and just left them in that wallet right?
|
|
|
|
V4Vendettas
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 01, 2014, 09:41:34 AM |
|
Nice work ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif) Getting goxxed has made we want to become a Blockchain analist myself and today is going to be the day I start my learninz so I can also help with this
|
|
|
|
alfabitcoin
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 01, 2014, 10:09:48 AM |
|
Those coins can be reamaining of the 2000 what gox still has. Either way, no way of proving it.
|
|
|
|
breel
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 01, 2014, 01:16:16 PM |
|
Hmmm, I've tried to do the same and followed this transaction: https://blockchain.info/address/1NwuCH9szpshHZoKJ6AsCLUYFu39rN2jsjbut I eventually ended up in a tumbler (no proof, bug huge amount of BTC moving every few minutes for a few days in February...). Of course, that might just have been my luck and that was some of the coins stolen from the malleability issue.
|
|
|
|
LarryLiu (OP)
Newbie
Offline
Activity: 56
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 01, 2014, 05:34:36 PM |
|
Well, yes. But how does that show they haven't been stolen? Someone could have stolen them and just left them in that wallet right?
Possible but not very plausible at all.
|
|
|
|
LarryLiu (OP)
Newbie
Offline
Activity: 56
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 01, 2014, 05:37:43 PM |
|
Those coins can be reamaining of the 2000 what gox still has. Either way, no way of proving it.
Why not? We can easily prove if we can ident more than 2000 coins.
|
|
|
|
boumalo
Legendary
Offline
Activity: 1918
Merit: 1018
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 01, 2014, 07:36:44 PM |
|
Wow this is very interesting
The problem is I don't think an competent agency will look into all that mtgox fiasco the way it should looked at, big governments have tens of thousands of agencies but they never have the one needed
What about crowd funding a professional team that will look into that?
|
|
|
|
analytics
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 98
Merit: 10
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 01, 2014, 07:39:47 PM |
|
|
|
|
|
LarryLiu (OP)
Newbie
Offline
Activity: 56
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 01, 2014, 08:20:49 PM |
|
Thanks, will check out the other thread soon. One thing I do want to point out though, the coins that I tracked down are MY coins. The source addresses I posted are NOT guessed ones, they are where I sent them from.
|
|
|
|
Zooey
Sr. Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif) ![*](https://bitcointalk.org/Themes/custom1/images/star.gif) ![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 241
Merit: 250
Time you enjoy wasting is not wasted time.
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 01, 2014, 08:32:05 PM |
|
Nice work ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif) Getting goxxed has made we want to become a Blockchain analist myself and today is going to be the day I start my learninz so I can also help with this Well said.
|
|
|
|
|
LarryLiu (OP)
Newbie
Offline
Activity: 56
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 01, 2014, 08:51:56 PM |
|
Hmmm, I've tried to do the same and followed this transaction: https://blockchain.info/address/1NwuCH9szpshHZoKJ6AsCLUYFu39rN2jsjbut I eventually ended up in a tumbler (no proof, bug huge amount of BTC moving every few minutes for a few days in February...). Of course, that might just have been my luck and that was some of the coins stolen from the malleability issue. Your link points to an address not a transaction. Was that an external address or the addresse generated by Gox on their BTC Deposit page?
|
|
|
|
LarryLiu (OP)
Newbie
Offline
Activity: 56
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 01, 2014, 08:58:58 PM |
|
It seems Breel's 7 BTC deposit was used to fund your 100 BTC withdrawal.
|
|
|
|
HairyMaclairy
Legendary
Offline
Activity: 1414
Merit: 2174
Degenerate bull hatter & Bitcoin monotheist
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 01, 2014, 10:00:40 PM |
|
Whatever the source of the issue which should expect to see recent deposits funding recent withdrawals consistent with the operation of a fractional reserve.
|
|
|
|
analytics
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 98
Merit: 10
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 01, 2014, 10:10:59 PM Last edit: March 01, 2014, 10:29:55 PM by analytics |
|
Based on my own transactions, this looks like it is a BitcoinBuilder BTC Address 1JiixnNK52kMtxMRuC26YMsyCxoBZzkinw
You can see how many transactions happened each day. It would be hard to refute this isn't bitcoin builder due to the transaction volumes and apparent 2% fee harvesting. You might be able to get at a lot of GOX addresses through the linking.
edit: not likely to be useful. I traced some of my bitcoinbuilder to gox account withdrawals and those don;t show up of course on the blockchain as they were processed internal to gox only.
|
|
|
|
|