Try to track stolen bitcoins

[keychainX]

Stolen bitcoin ended in 1NDyJtNTjmwk5xPNhjgAMu4HDHigtobu1s  wallet ,  a BINANCE.COM wallet . They have a tweet in with they recognize this address belong to them.
The Police send them mail to reveal the entity behind the tranzaction and they don't respond after 2 months.
I realised the  stolen bitcoins from all the world can be exchanged at Binance without ptoblem.
Don't understant why Eu let them operate if they don't colaborate with autorities.

They have recently closed their EU headquarters in Jersey.

Still you should use twitter maybe, CZ is pretty active there.

Good luck

[HCP]

How many transactions before the coins ended up in Binance?

Unless it was 1, you've no real clue as to whether or not it was the actual thieves who sent the coins into Binance. They may have sent it to a gambling site... who then paid it out to another completely different user... or they may have put it into a mixer etc.

[o_e_l_e_o]

Unless it was 1, you've no real clue as to whether or not it was the actual thieves who sent the coins into Binance.

Looking at the blockchain records, it was one. OP sent coins to the 1MhAy... address which he states is the thief's wallet. From there, they went straight to (what is presumably) a Binance deposit address 1Cw2T... and then were swept along with a bunch of other addresses in to 1NDyJ..., which we know to be one of Binance's central wallets.

The 1Cw2T... address is still in use, still seeing regular deposits and still being regular swept to the 1NDyJ... address. Do Binance not generate a fresh address for each deposit?

Regardless, even if they have never completed KYC, Binance should still have an IP address and email address for this account, although whether they would be of any use (since easily spoofed) is unknown.

[bob123]

Do Binance not generate a fresh address for each deposit?

No.
Binance is made for the average user.
And the average user doesn't understand the concept of addresses in bitcoin.

We can be happy that they don't change the address after each deposit. Otherwise we probably would have hundreds of posts asking whether binance got hacked because there is now a different address shown.

[o_e_l_e_o]

-snip-

Do they at least provide an option to generate a new deposit address?

Honestly, it seems like almost every day I am astounded by some new piece of information revealing just how terrible centralized exchanges are, and every time I am amazed that people just accept these kind of behaviors. A few days ago I just learned that Coinbase "recommend" linking your wallet with your KYCed account and then making your wallet "public", thereby putting your details on some public database so that other people can search for you, like some kind of horrendous Facebook friends list.

And now you tell me that Binance give every customer a single deposit address. Given that these deposit addresses all sweep in to a known Binance wallet, then they are easily identified as Binance deposit addresses. So if anyone is able to identify a single deposit you've made to Binance, they can now identify every deposit you've ever made or will ever make to Binance, as well as link all the addresses in those transactions as belonging to you. As if KYC wasn't bad enough, by using Binance you now publicize huge amounts of your financial data.

Why do people accept this? This is horrendous.

[LoyceV]

Do they at least provide an option to generate a new deposit address?

No, but you can still withdraw up to 2 BTC/day on Binance, so you can create a new account each time. It's terrible for privacy, but they're not the only one: Bittrex provides only one deposit address too, and from what I've seen most online casino's are the same.

[GazetaBitcoin]

Yesterday , in Bucharest i meet 2 guys [...]

I accidentally noticed this thread. First of all, OP, I'm sorry for your loss. Do you have any updates? Did Police make any steps forward with the investigation?

Second of all: are you Romanian? I'm asking because your English is terrible, very hard to be understood by natives, not to mention non-English natives (see csmiami's post). If you are Romanian, maybe you should also start a similar thread in the Romanian board. Maybe some of the Romanian users are not visiting this board, but they can help you.

Besides all these, where did you find these guys? Are they forum users... LocalBitcoins users...? Can you share their usernames if so? I don't think you just bumped into them while walking on the street, therefore mentioning their origins may be useful.

I remember that last year I read a similar topic on the Romanian board. Someone was accusing a user offering crypto-fiat services for being a thief. At that moment, the user being accused came with proof that the accuser was just trying to ruin his business for no reason (if I remember well the proof was good), but seeing this topic I remembered also that topic - that's why I'm asking where you met those guys.


I also didn't see OP explaining csmiami's interesting observation (it also seems that nobody else noticed it):

You bought the 1.52033000BTC on the 10th of November at 10:00AM, and sent them to 12o7wnUF574txi3jGBxBM6cgPxc69xAFZW

From 12o7wnUF574txi3jGBxBM6cgPxc69xAFZW, the coins were sent to both 1HU46MCbGcZ3huKLGBPjtpHUP6bjaad6ep (your address) and 1MhAywXcTF78eWVttBsVawSUZyhc53DMkf. Same day, but at 10:25AM

You then sent the coins to 1MhAywXcTF78eWVttBsVawSUZyhc53DMkf, which is the scammers account and then they ran away. That happened at ALSO at 10:25AM.

So the problems with this timeline are the following:

-You sent money twice (?) to the thieves address
-Only 25 minutes happened between the operation in which you bought the coins and when you were robbed.

As I can see on the Blockchain, when OP bought the coins, se sent right in that transaction 10,000 satoshis to the thief (1Mha) and 1.52 BTC to himself, then, in the very sent minute, the 1.52 BTC were moved again, to the thief's address. Why did you do that OP? What was the point to send the thief 10,000 satoshis?

[bob123]

Honestly, it seems like almost every day I am astounded by some new piece of information revealing just how terrible centralized exchanges are, and every time I am amazed that people just accept these kind of behaviors.

I guess it is mostly because they don't really care about the decentralized or privacy aspects of bitcoin.
All they care about is buying them and selling them later for a profit margin of X %.

I wouldn't even be surprised if the majority of people buying coins on binance/coinbase, don't even withdraw them but keep them laying there to avoid paying a fee reducing their margin.

[BrewMaster]

I wouldn't even be surprised if the majority of people buying coins on binance/coinbase, don't even withdraw them but keep them laying there to avoid paying a fee reducing their margin.

evidence suggests that this is true. majority of those who go to exchanges for trading are only there for profit and never withdraw their coins. i mentioned this in another topic talking about rich lists and that the number of addresses with more BTC has grown more.
of course in case of Binance it is because the altcoin traders don't or can't run the altcoin wallets on their computers.

[o_e_l_e_o]

Why did you do that OP? What was the point to send the thief 10,000 satoshis?

I assume that OP didn't actually purchase the bitcoin 25 minutes before the transaction with the thief like Csmiami suggests. More likely is the bitcoin were already on his Binance account and had been for some time, he simply withdrew them to his own wallet shortly before meeting up with the thief. And the first transaction for 10,000 satoshi was presumably a "test" transaction, to ensure the addresses were correct and there was no concern regarding clipboard malware, fake QR codes, or whatever. Once they saw those 10,000 sats show up unconfirmed in the thief's wallet, he then made the rest of the transaction.

[Csmiami]

----

As I seem to recall some details vaguely from this thread, I've re-read all the info provided by OP in the first posts. The whole thing was fishy from the start, and basically, some unkown people contacted OP for him to buy them some Bitcoin. OP wire transfered some money to Binance, then withdrew to his blockchain.com addy and from there, he sent the money to the scammers. All of this happened in a couple of hours.

The part of sending money to the scammers addy would make sense as a test, but both were made on the same minute, and AFAIK blocks aren't mined that fast yet

[GazetaBitcoin]

Why did you do that OP? What was the point to send the thief 10,000 satoshis?

the first transaction for 10,000 satoshi was presumably a "test" transaction, to ensure the addresses were correct and there was no concern regarding clipboard malware, fake QR codes, or whatever. Once they saw those 10,000 sats show up unconfirmed in the thief's wallet, he then made the rest of the transaction.

I thought also about that, but I came to the conclusion that nowhere in the world this could be the reason.

The part of sending money to the scammers addy would make sense as a test, but both were made on the same minute, and AFAIK blocks aren't mined that fast yet

Furthermore, I think that not even the txID itself can be seen on Blockchain within seconds. Remember that both transactions of 10,000 sats and 1.52 BTC were made at 10:25. As far as I know, the wallet gives you the txID right after the transaction was made, but in some cases the respective transaction isn't shown on the block explorers before some seconds pass (maybe even up to a minute). Besides that, they would also spend seconds in order to access a block explorer, insert the txID in order to search for it; maybe also refresh the page for a few times until they could see the transaction there (although not confirmed -- which implies no test could be done up to this point). All these seconds would make the second transaction to be created at least 1 minute later, but no, the second one was made within the very same minute, at 10.25.

So considering all these, I'm not sure if it was a test or something else. In order for the test to succeed, they would have needed at least a few minutes, for the transaction to receive confirmations and to appear in the thief's wallet -- in case the transaction was processed in the very next block (which is also not necessary to happen); therefore, if it was a test, then the second transaction (the 1.52 BTC one) should have been made after several minutes and, in any case, not within the very same minute as the "test" one...

That's why I'm asking OP -- something doesn't tie up here...

[o_e_l_e_o]

The part of sending money to the scammers addy would make sense as a test, but both were made on the same minute, and AFAIK blocks aren't mined that fast yet

In order for the test to succeed, they would have needed at least a few minutes, for the transaction to receive confirmations and to appear in the thief's wallet

Not at all. No confirmations were needed and only a couple of seconds were needed to confirm the test transaction. Also, no block explorers were required.

If the thief opens his wallet and gives OP an address, and OP sends 10,000 sats to that address, the thief's wallet will show the incoming transaction within two or three seconds. You can test this yourself when you pay for something using a payment processor, which detects your transaction seconds after you hit send. You can even test this yourself by opening two Electrum wallets and sending coins between them. As soon as the transaction is broadcast, it is relayed across the network within a few seconds. Seeing the transaction show up in the thief's wallet, even with zero confirmations, is enough to confirm the address is correct. OP can simply click on the same address, click "max" or "send all", and click broadcast. The whole thing could be done in 10 seconds.

[GazetaBitcoin]

If the thief opens his wallet and gives OP an address, and OP sends 10,000 sats to that address, the thief's wallet will show the incoming transaction within two or three seconds. You can test this yourself when you pay for something using a payment processor, which detects your transaction seconds after you hit send. You can even test this yourself by opening two Electrum wallets and sending coins between them. As soon as the transaction is broadcast, it is relayed across the network within a few seconds.

Uhm... maybe this is the case with Electrum and / or some other wallets... But this doesn't happen with all the wallets. I can confirm you that Bitcoin Wallet for Android and Jaxx don't list a transaction with 0 confirmations. And, most likely, other wallets do the same.

This transaction, as example: https://blockchair.com/bitcoin/transaction/abb0a820a43e92ff9e3a1f9e6967f2c59e76b5cd1909d44c06af813e75251913

Was sent to my address from Bitcoin Wallet for Android 4 days ago and it still has 0 confirmations. And it still doesn't appear in my wallet. If you wish, I can also upload a screenshot from my wallet...

[o_e_l_e_o]

OP said the thief was using Jaxx wallet:

they put the receiver phone on the table ..their phone ...was a iphone with a jaxx live wallet

You say Jaxx doesn't show up unconfirmed transaction, but my (admittedly several years ago) experience with Jaxx is that it does. Certainly, their support pages suggest that unconfirmed transactions are displayed as "pending transactions": https://support.decentral.ca/hc/en-us/articles/360048583473-Pending-Transaction

[GazetaBitcoin]

my (admittedly several years ago) experience with Jaxx is that it does. Certainly, their support pages suggest that unconfirmed transactions are displayed as "pending transactions": https://support.decentral.ca/hc/en-us/articles/360048583473-Pending-Transaction

Uhm... Maybe Jaxx changed. Or behaves weird sometimes.

There are two aspects here: the one about showing unconfirmed transactions and the one about pending transactions.

So, about showing unconfirmed transactions, I confirm that it doesn't show them. Last week I was expecting to receive some BTC and I could see the transaction on Blockchain (with 0 confirmations), but not in Jaxx. I saw it after it received a confirmation. And this happened with 2 transactions. There is no "pending" transaction shown when you expect to receive funds inside the wallet.

The "pending" transactions are those which you send from Jaxx, but they don't have confirmations or have few confirmations. For this kind of transactions there is indeed a "pending" status, which lasts until the transaction receives 1-3 confirmations. This is also the weird part: so I saw a transaction which switched from "pending" to "completed" while having just 1 confirmation, but I also saw transactions which still appeared in "pending" after 2 or 3 confirmations. Even more weird is the fact that a transaction with 3 confirmation, which appeared as "pending", switched to "completed" without receiving another confirmation.

Also about the sent transactions which appear as "pending" starting with 0 confirmations: they are shown in Jaxx at several seconds (maybe even 30-60 seconds) after being shown on Blockchain. It seems the wallet acts with some lag.

All of the above occur on Jaxx on both BTC and ETH.


Excepting all these, I also noticed that the number of confirmations appears slower on Jaxx after the transaction receives confirmations and these are shown on Blockchain. The delay here is up to 2-3 minutes. Jaxx shows also the number of confirmations of a transaction. And I was checking (many times) the transactions on Blockchain and I could see that one (let's say) had 2 confirmations. Jaxx was showing it has only 1. When the transaction received a third confirmation on Blockchain, Jaxx was showing it has 2 etc.

Last, but not least, another weird thing about Jaxx is that it doesn't allow you to send another transaction until it sees a previous one completed. This lattest part is also weird, as sometimes it considers a transaction as being completed after 1 confirmation, sometimes after two, sometimes after three... So excepting the fact that it doesn't have a fixed number determining when a transaction is completed, it also doesn't allow you to send another transaction before the completion of the previous one (and it's only up to Jaxx's "mood" when a transaction switched from pending to completed).

In comparison, Bitcoin Wallet for Android allows you to send another transaction, although the previous one is not confirmed yet (it allows you although the previous one has 0 confirmations).


Back on topic, I confirm again that Jaxx doesn't show incoming transactions with "pending status". It only shows outgoing ones with this status, but not immediately after they are broadcast. They (outgoing transactions with 0 confirmations) are shown as pending after several seconds.

And Bitcoin Wallet for Android behaves the same: it doesn't show an incoming transaction with 0 confirmations. (I still can't see in my wallet that transaction I previously mentioned, which was sent to me on January 30th - https://blockchair.com/bitcoin/transaction/abb0a820a43e92ff9e3a1f9e6967f2c59e76b5cd1909d44c06af813e75251913 - and which still has 0 confirmations (I hope miners will process it though prior BTC soars to $1M )).

[Nofearboy]

I'm romanian / Sorry for my english . I used a translator now.
I had to sell an Antminer s9 on olx (like ebay) and they called me to ask me if it is for sell and after that he asked me if i want to sell bitcoin becouse his bank account is bloked.
Yes, I made a small transaction before the main transaction to make sure it appears in their wallet. They used jaxx live wallet on an Iphone. I could enter the application without password on their phone but I could not withdraw to perform operations.the app asked for password . They said he would go outside to talk on the phone and leave the phone on the table and rest assured that the money was there. I realized and caught one and called the police.
I bought from binance by SEPA bank transfer and it took 2 or 3 days until the money arrived. As soon as I transferred the money from Binance to blockain.info (my wallet) I called them to meet.
You say the wallet before main binance wallet can be also a binance wallet ?

A month ago I went to the police to identify from a paper with several pictures of some people but he was not in the pictures. Until now, they could not force the person I brought to say (disclose) the other's identity. the other made the transactions. The one caught by me was just his bodyguard

[Nofearboy]

If the police can identified the other, they could find transactions in his accounts or something. the investigation would go much better. I have his picture but what can I do with it.

[GazetaBitcoin]

I'm romanian / Sorry for my english . I used a translator now.

OP, try to start a topic in the Romanian board. You may have more chances there. Your English is terrible and I doubt anyone truly understands everything you want to say. Eventually I can update this topic later, using a proper English, once I manage to understand what you will say in Romanian.

Besides, please read the earlier posts...like this post of mine:

Besides all these, where did you find these guys? Are they forum users... LocalBitcoins users...? Can you share their usernames if so? I don't think you just bumped into them while walking on the street, therefore mentioning their origins may be useful.

I remember that last year I read a similar topic on the Romanian board. Someone was accusing a user offering crypto-fiat services for being a thief. At that moment, the user being accused came with proof that the accuser was just trying to ruin his business for no reason (if I remember well the proof was good), but seeing this topic I remembered also that topic - that's why I'm asking where you met those guys.

What are their names? Phone numbers? At what bar did you go? Maybe that bar had security cameras...

They said he would go outside to talk on the phone and leave the phone on the table and rest assured that the money was there

So you have their phone, yes? Did you look into the phone? Check for contacts, text messages, crypto wallets, anything?

[Nofearboy]

They used rechargeable SIM cards. Here you can buy this cards without ID . The police have that phone, images from bar etc...
I opened this topic thinking that I could identify something, I thought I could identify the exchange they used.
I will close the topic and thank you for the answers.