MtGox2014Leak.zip

[Aido]

Not sure if someone posted this but I've uploaded an xls version of Gox BTC balances at http://filebin.ca/1F3qa078QQSL or http://filebin.ca/1F3qa078QQSL/BTC_mtgox_balances.xls. No macros or any dodgy stuff.

[elebit]

That's why I wrote "isolated" (no shared folders, preferably on a separate physical machine, guest additions disabled, etc.).

No, that's just insane. There has been exploits to pretty much all virtualization systems, not just the guest drivers.

Sure, a separate physical machine with no network would do, but what could you possibly gain from running possible malware? Do you expect the software to burst into jackpot mode and magically withdraw all your goxcoins?

You don't run malware. Ever. You decompile it.

[elebit]

Not sure if someone posted this but I've uploaded an xls version of Gox BTC balances at [...]. No macros or any dodgy stuff.

Sure.

If there were no macros or "dodgy stuff" this would have been a csv or a txt, which are a magnitude smaller and possible to open securely.

People, don't be stupid here. Don't get carried away. There are at any time about a dozen well known ways to run code on your computer if you open anything with Excel, or Word, or Acrobat Reader. (Really. All the mentioned file formats can wrap everything from Flash to CLR components, which in turn contains even more vulnerabilities.)

[Nagle]

OK. There's a bunch of junk and some suspicious executables in that .zip file, but the files of interest are just two big text files.  Here's what they look like:
"mtgox_balances":

Code:

mysql> SELECT * FROM platform.User_Wallet WHERE platform.User_Wallet.Balance != 0 ORDER BY platform.User_Wallet.Balance DESC;
+--------------------------------------+--------------------------------------+------------+---------------+-------------+---------+---------+----------------------+------------------------+----------------+---------------------+
| User_Wallet__                        | User__                               | Currency__ | Balance       | Liabilities | Index   | Backend | Daily_Withdraw_Limit | Monthly_Withdraw_Limit | Disable_Limits | Stamp               |
+--------------------------------------+--------------------------------------+------------+---------------+-------------+---------+---------+----------------------+------------------------+----------------+---------------------+
| 5c05557d-8d1e-4e2a-9a24-21781413be32 | 711a4e9d-e183-4bec-a390-340918326538 | BTC        | 4454767562508 |           0 |  156624 | virtual |                    0 |                   NULL | N              | 2012-07-13 06:58:01 |
| a6acd802-bb4f-412b-be6d-b0bf3f2bb055 | 34fcda44-5832-48c3-8beb-60f1bd9fef37 | BTC        | 4376817697344 |           0 |   42208 | virtual |        2000000000000 |                   NULL | N              | 2014-02-25 03:53:01 |
| 221d365a-ce33-4619-a8fb-f79514940bb1 | c0b24126-f199-4cc6-83fc-c96f2bcb9381 | BTC        | 1998500000000 |           0 |       4 | virtual |                    0 |                   NULL | N              | 2012-08-11 10:30:00 |
| 2ae40a68-c862-4fd3-8ebc-a05a7e0fbfac | 92d047e9-9f2b-4dd0-9163-077db3e56dd0 | BTC        | 1150063956592 |           0 |     253 | virtual |                 NULL |                   NULL | N              | 2013-11-26 02:35:25 |
| 1ad3f250-17dc-4d3d-9aff-15f3ed40cec9 | ff84fc35-b22a-492d-b8f2-5fb79be170a7 | BTC        | 1100781000685 |           0 |    3941 | virtual |                 NULL |                   NULL | N              | 2014-02-20 22:30:51 |
| 166c11b8-f2b3-4302-a21d-c2c706994447 | 0afba433-817e-49d4-a72f-0576c660861b | BTC        |  981919410221 |           0 |    6752 | virtual |        1000000000000 |                   NULL | N              | 2014-02-24 18:41:47 |
| f070b09c-f046-4bf2-889d-cb9defcce7fd | 19b38844-b58b-4d1b-8ba1-af2e45b164f7 | BTC        |  875255455182 |           0 |   32579 | virtual |        1000000000000 |                   NULL | N              | 2014-02-24 03:13:22 |
| d4e3840c-938d-47a2-bb72-7678c3d8f7d2 | 945e5a15-4100-4199-91ea-d8d8bec7e07a | BTC        |  800000000000 |           0 |    3496 | virtual |                 NULL |                   NULL | N              | 2013-08-08 18:50:39 |
| 45548a69-11e5-4d31-bc0c-d8f0294eb4f1 | 4339257e-4b12-4412-9574-0785ccf613bb | BTC        |  605128552400 |           0 |    6966 | virtual |        1000000000000 |                   NULL | N              | 2014-02-22 08:18:31 |
| da39625a-d901-425c-9586-86bab7bf9880 | 0766852e-9187-4712-80f0-1fbb78813b07 | BTC        |  519991480916 |           0 |   16523 | virtual |         200000000000 |                   NULL | N              | 2014-02-25 00:49:35 |
| c10d31d6-81a5-4df1-9d2a-6524c4b3ad04 | f2d2f8ea-dd36-4d32-adb7-79448755d53c | BTC        |  500000000000 |           0 |     165 | virtual |                    0 |                   NULL | N              | 2014-01-21 03:22:40 |
| caebcd40-3f04-402e-84bd-13f019ca9847 | ccb564e6-f33a-40fc-b222-aa4d8bc88fa6 | BTC        |  422607868556 |           0 |     902 | virtual |          90000000000 |                   NULL | N              | 2014-02-22 17:11:30 |
| 33ec6422-fec5-458d-a25c-284790aedc99 | 0b1bb842-d189-48c2-899b-6b1893ba0db8 | BTC        |  396731866419 |           0 |    3870 | virtual |        1000000000000 |                   NULL | N              | 2014-02-24 18:56:05 |
| 30245646-10ee-481c-802e-fd8828efa43a | 40399e92-1249-4e80-be0d-30c59a995dff | BTC        |  388009278436 |           0 |    6831 | virtual |        1000000000000 |                   NULL | N              | 2014-02-21 21:43:43 |
| eee8ae06-fbc0-40eb-8ca3-d909acf096a3 | 679376ba-ffad-4fab-831c-b5c445cbb59e | BTC        |  370719697264 |           0 |    5747 | virtual |                 NULL |                   NULL | N              | 2014-02-07 14:01:24 |
| 64b2e05b-52da-4cfa-8fd8-890af1da5a10 | 944d5ea9-40c6-4dc1-92ef-45afbde02716 | BTC        |  360731800000 |           0 |     989 | virtual |                 NULL |                   NULL | N              | 2012-03-15 07:56:41 |
| 85452c04-0665-4979-bb8a-8886cc2f0a10 | 87c17550-bb6a-4ab1-b3a9-bcd8b72906f7 | BTC        |  356516619593 |           0 |    5077 | virtual |                 NULL |                   NULL | N              | 2014-02-25 01:13:16 |

"btc_xfer_report.csv":

Code:

Wallet,Entry,Date,Operation,Amount
00001bd2-cdb1-4707-b125-97dfdc46d3f4,682b3d0a-67d7-4b62-8ed4-4e1d39d54a69,"2011-07-27 11:11:00",deposit,0.05
00001bd2-cdb1-4707-b125-97dfdc46d3f4,e441aa74-372f-488d-8342-e2e845041e88,"2011-08-09 11:14:07",deposit,0.85
00001bd2-cdb1-4707-b125-97dfdc46d3f4,e1173927-a09b-4dc0-a085-138e0e21558d,"2011-09-23 11:29:47",withdraw,-1.40154
00005afe-8eac-418b-945b-6016166ccb13,a97682c8-dfc2-4d6e-9bdc-66aa1dda355b,"2013-04-12 14:25:21",deposit,100
00005afe-8eac-418b-945b-6016166ccb13,ce10fe19-0551-41e7-9160-d9241e67281a,"2013-04-08 19:23:33",withdraw,-8
00005afe-8eac-418b-945b-6016166ccb13,db9d0a3c-4a94-4710-9fcd-f98aa7dbd968,"2013-04-08 20:57:16",withdraw,-20
00005afe-8eac-418b-945b-6016166ccb13,1a812ba4-578f-42d7-a19d-8982fcc7fe72,"2013-04-16 20:42:28",withdraw,-0.1
00005afe-8eac-418b-945b-6016166ccb13,701f5de7-b527-4f50-9fb2-a6430d912ea9,"2013-04-17 19:36:14",withdraw,-99.9
00005afe-8eac-418b-945b-6016166ccb13,aaa584a1-5e22-4fab-9862-5713041c47b2,"2013-04-19 13:49:43",withdraw,-55
00005afe-8eac-418b-945b-6016166ccb13,34ff41b3-b021-4331-b834-e08be410490a,"2013-04-20 20:19:00",withdraw,-1
00005afe-8eac-418b-945b-6016166ccb13,10138f9f-ec2b-4ca1-a7c3-d36f56bae3df,"2013-05-19 09:01:31",withdraw,-0.5
00005afe-8eac-418b-945b-6016166ccb13,9731a1f6-5e66-4a76-8a53-10257411d0ba,"2013-08-08 21:23:40",withdraw,-80.06210892

What these mean, when they were created, whether they're even real, and whether they check with the blockchain remains to be analyzed. But that's what's in there.

Looking up some of those addresses at "blockchain.info" returns no find. Try it yourself. This may be totally bogus data.

[phelix]

[...]
Looking up some of those addresses at "blockchain.info" returns no find. Try it yourself. This may be totally bogus data.

What addresses? There are no Bitcoin addresses only Gox internal codes.

The data is at least partially legit, probably everything is legit (besides the .exe wallet stealer).

One could look for large withdrawals before the btc withdrawals halt...  Another thing would be to check for larger withdrawals by known accounts that are rumored to have known more than the average coinhead (e.g. Bitcoin foundation board members).

[BCB]

you have to remember that if this data is real it does not include data from Beginning of Mt Gox nor dos it include any data from from the last three months of trading.

Lots of missing and dirty data.

[phelix]

you have to remember that if this data is real it does not include data from Beginning of Mt Gox nor dos it include any data from from the last three months of trading.

Lots of missing and dirty data.

Certainly but still interesting bits. All BTC withdrawals are included from 2011-04 until the end. Though it seems not possible to link these to userIDs which might make it difficult to search for certain users withdrawals.

[BCB]

you have to remember that if this data is real it does not include data from Beginning of Mt Gox nor dos it include any data from from the last three months of trading.

Lots of missing and dirty data.

Certainly but still interesting bits. All BTC withdrawals are included from 2011-04 until the end. Though it seems not possible to link these to userIDs which might make it difficult to search for certain users withdrawals.

I've not had the time to dig in deep enough to determine any correlation between the data sets.

I'd be most interested if btc w/d could be tied to blockchain transactions by timestamp + value.  matching timestamp will be tricky.

[T.Stuart]

you have to remember that if this data is real it does not include data from Beginning of Mt Gox nor dos it include any data from from the last three months of trading.

Lots of missing and dirty data.

No trading data for the last three months? Good for those on the inside who profited during the last weeks...

[rbillig]

For info, I checked my wallet from a special website and it shows the value of the day before the final closure.
For me, this file is real.

[rbillig]

https://euvps.rolisoft.net/mtgox/

[Anddos]

http://thehackernews.com/2014/03/mtgox-hacker-tricks-people-to-install.html

[Mahn]

What these mean, when they were created, whether they're even real, and whether they check with the blockchain remains to be analyzed. But that's what's in there.

They are real. Both the balances and transaction history match as reported by many MtGox users who checked their own data, myself included. There's zero doubt about this.