Long-time sig campaign farm ID'd via single wallet transaction

[nutildah]

A week or two ago I noticed the account illyiller had woken up as I was browsing the seclog looking for info about a scammer (unrelated to this story). That user name struck a bell, so I pulled up their account and decided maybe they were trying to get back into sig campaigning.

Out of curiosity, I looked into what campaigns they worked for. The blockchain suggests this person had made quite a bit of money sig campaigning in the past, way too much for the campaign I could associate them with.

Taking a closer inspection of a master address, to which feeder addresses sent BTC from several other addresses associated with sig campaigners, I managed to identify a ring of 9 alt accounts, all belonging to the same owner and all enrolled in sig campaigns at one time or another.

The kicker is that 3 of them have been in the same campaign together for over 3 years.

All of the addresses in this wallet are what I refer to as feeder addresses. There is 1 feeder address per sig campaigner, and it acts as a buffer between the sig campaigner address and the master address.

Here is the transaction between the feeder address wallet and the master address:

https://www.blockchain.com/btc/tx/2f068dddc4c24b8771bc0d46671e38d80b834198d9e99a7329d2d2a946c3fc19

So each pair of addresses (one sig campaign address, with outputs sent to a feeder address) corresponds to one account, which means all of these accounts partook in this transaction. Linked to each account name is the proof that account used that address:

Address	Account		wallet type	other
17k4EVPznuTQ7q7CujbFFvTqx97ff6CZZN			feeder	transaction ID
122h7dmX8vcdNnWjfbz1eevD8tfcJasBWV	figmentofmyass		campaign	part of ChipMixer campaign
1E5DeqedMWWLWCWXaV7xjU9KYjRb5TqaaG			feeder
1J4zoPgnaDDmnjhUxLf7Gh1z4EWq8bvrtB	illyiller		campaign	woke up 1/19/2021
1DZeFJs5og8iqc6axKuUcemvqKDswWd6ep			feeder
18QwLB8KEWnHjX8dvWUXCDK4HaWDaPp82s	illinest		campaign	inactive
1BxSjuLa5GAtMdeiyiQ6P1yBKp2mKnMmf4			feeder
1ugj76pwcXq2YmPVwxRccZmWrQmEsb2zp	squatter		campaign	part of ChipMixer campaign
1uAk6hDwoUuwBcRFJpxfeoXEJBUymRQVN			feeder
1GPLgkkLF3taAVhhGhVy7CfiX8DFkf4mZB	marky89		campaign	inactive
1Mp7gexEEbxzZKS5QUpv2FHwbXJpFWEDem			feeder
19wxJJobJ77deczvzoCpLGXDqb7FjcELCi	exstasie		campaign	part of ChipMixer campaign
1DYV1CUk9Vhk5wL8JZh1TL2Yoov9LbjpRY			feeder
1Np6kG52WjLQ9jaKbkMiUqfqruLyXS1JAD	MAbtc		campaign	inactive, 2012 registered
13z87VUi1fZhgpydei9KvxQVJ6NFDUNNuU			feeder
1GCcAoaMzA39jQai8asaB7dUTHuaDPnH7L	romani245		campaign	inactive
16JXYv4H1BpyseA66c4bqUDT7fWQvYRrPu			feeder
18jgXSJN7jyhPfvjeX52vRmBMeBpxQpJVW	manchester93		campaign	inactive
All go to
1Bp5t2AzEGkNSsFsAgCNn9zMy9QGsxB6Pu

It would appear all these account belong to the same person, seeing as how the addresses listed here have only ever been involved in signature campaign activity. For easy reference here are links to the accounts themselves (bolded are still active):

figmentofmyass
illyiller
illinest
squatter
marky89
exstasie
MAbtc
romani245
manchester93

Since the chances of all of these accounts pooling months worth of sig campaign funds together for any purpose whatsoever seems extraordinarily slim, it is safe to say that these are indeed alt accounts and one of the more clever and prosperous account farms to ever exist on the forum.

I'm of course open to other interpretations and am interested to hear what they might be before leaving a neutral* on all of the accounts.

Let's try to keep it civil, thanks.


*edit: in light of recent revelations I've decided to leave red tags instead of neutrals for this user; read further for more info.

[1714045953]

1714045953

[1714045953]

1714045953

[1714045953]

1714045953

[AB de Royse777]

Address	Account	Date	action	other
17k4EVPznuTQ7q7CujbFFvTqx97ff6CZZN		9/15/2017	part of wallet	transaction ID
122h7dmX8vcdNnWjfbz1eevD8tfcJasBWV	figmentofmyass		sent to	part of ChipMixer campaign

I am trying to understand the connection. Sorry I am very poor in it :-P

How do you get these two addresses connected to find that the address 17k4EVPznuTQ7q7CujbFFvTqx97ff6CZZN is connected with the user figmentofmyass? I am using it as an example to understand your table format?

[suchmoon]

I am trying to understand the connection. Sorry I am very poor in it :-P

How do you get these two addresses connected to find that the address 17k4EVPznuTQ7q7CujbFFvTqx97ff6CZZN is connected with the user figmentofmyass? I am using it as an example to understand your table format?

https://www.blockchain.com/btc/tx/9755344cee7c84ba37412e87dacdd037e2163e40bf0017fde35357ab0096cd89

figmentofmyass is sweeping coins from the 122h address into the 17k4 address, which is connected to all the other addresses in the table. Basically each pair of addresses for each user is linked that way.

Another interesting thing is the timing. Most of these sweeps happen around the same time, some in the same block, which seems to be too much of a coincidence for them to be unrelated. For example:

https://www.blockchain.com/btc/address/17k4EVPznuTQ7q7CujbFFvTqx97ff6CZZN
https://www.blockchain.com/btc/address/1Mp7gexEEbxzZKS5QUpv2FHwbXJpFWEDem
https://www.blockchain.com/btc/address/1BxSjuLa5GAtMdeiyiQ6P1yBKp2mKnMmf4

all have a set of incoming transactions at 2017-10-04 07:15 and another set within half hour on 2017-09-16.

[nutildah]

Address	Account	Date	action	other
17k4EVPznuTQ7q7CujbFFvTqx97ff6CZZN		9/15/2017	part of wallet	transaction ID
122h7dmX8vcdNnWjfbz1eevD8tfcJasBWV	figmentofmyass		sent to	part of ChipMixer campaign

I am trying to understand the connection. Sorry I am very poor in it :-P

How do you get these two addresses connected to find that the address 17k4EVPznuTQ7q7CujbFFvTqx97ff6CZZN is connected with the user figmentofmyass? I am using it as an example to understand your table format?

The address next to the account name is the address they used to enroll in a sig campaign.

The address above it received coins from the sig campaign address and sent coins to an address which also received coins from the 8 other sig campaign addresses. That's the simplest way I can explain it. If you take a look at this transaction, and then examine the inputs of all the addresses which funded the transaction, you'll see they all came from sig campaign payments:

https://www.blockchain.com/btc/tx/2f068dddc4c24b8771bc0d46671e38d80b834198d9e99a7329d2d2a946c3fc19

The table formatting didn't come out as well as in the preview, unfortunately.

[Quickseller]

It seems that timeloard believes one of the accounts is a farmed account connected to a different farm. IDK if the accounts are still “connected” to the same person as the connection is from several years ago. My guess is that all the accounts in the OP were likely available for sale at one point, if not actually sold.

[nutildah]

I can't find any evidence that the 3 active accounts have been traded since that particular transaction. From 2015-2017, they tended to post in the same subjects and have similar gaps in posting.

After the date of the transaction, their style continues to share some similarities although he does a good job of sticking to all lowercase for figmentofmyass. Also, little things like this (I have many examples) make me think they're still all owned by the same person. The only 2 search results on the forum for the phrase, "some from Column A and some from Column B":

Probably some from Column A and some from Column B.

I think it'll be some from Column A and some from Column B.

Here's the 3 results for "strong monetary properties":



Another good example is this one. This guy said, "as they say", so I wondered who does he mean by "they" because I've never heard the expression said that way before. It turns out it was himself.

as they say, the trend is your friend, until it ends.

The trend is your friend until it ends.

Again, those are the only 2 results for that phrase on Bitcointalk.

If that isn't satisfying enough, the cherry on the top is the merit transfers among the accounts. The merit system wasn't introduced until January 2018, which is after the transaction linking them together occurred.

To/From merit transfers (just some examples, not all of them)
1/26/2018 10:18:54 PM   manchester93 (Summary)   MAbtc (Summary)   1
2/8/2018 3:00:00 AM       manchester93 (Summary)   exstasie (Summary)   2

2/11/2018 9:00:25 AM   romani245 (Summary)   squatter (Summary)   1   
2/11/2018 9:06:56 AM   romani245 (Summary)   exstasie (Summary)   1
2/11/2018 9:22:06 AM   romani245 (Summary)   figmentofmyass (Summary)   1

2/11/2018 9:54:39 AM   manchester93 (Summary)   romani245 (Summary)   2
2/11/2018 9:59:48 AM   manchester93 (Summary)   squatter (Summary)   2
8/27/2018 1:40:32 AM   manchester93 (Summary)   illyiller (Summary)   1

5/22/2019 6:48:46 AM   illinest (Summary)   illyiller (Summary)   2   

10/18/2019 3:55:01 AM   figmentofmyass (Summary)   marky89 (Summary)   1

10/26/2019 4:10:37 AM   marky89 (Summary)   exstasie (Summary)   3

1/13/2020 9:01:42 AM   illinest (Summary)   figmentofmyass (Summary)   1

1/14/2020 7:16:25 PM   MAbtc (Summary)   exstasie (Summary)   3
1/14/2020 7:46:39 PM   MAbtc (Summary)   exstasie (Summary)   10   

2/8/2020 4:36:37 AM   squatter (Summary)   figmentofmyass (Summary)   1

3/30/2020 11:37:40 PM   exstasie (Summary)   figmentofmyass (Summary)   1

Given the fact they were exchanging merits as recently as 3/30/2020, I would say its likely they are all still owned by the same person, especially as there's no reason to suspect any of the accounts have changed hands.

Also, exstasie is in DT2 right now and figmentofmyass is on DT1 with -3 inclusions.

[Kittygalore]

This is a big bust of an account, @figmentofmyass and @exstasie is a prominent users in this forum and they are even holding a DT position that puts flags on users who does unsavory things, this isn't the biggest account farm that I have seen being busted but this is definitely an elaborate one involving a lot of addresses to trickle down to a single one is a pretty crazy. It is kind of pretty ironic that they project their self as righteous users to other people, I do not want to pass on a judgment as I am just an onlooker at this soon to be whirlpool of chaos, the accused hasn't explained their side yet so there might be a lot to uncover, with this evidence piled up against the accused, I would be betting that this is a real account farm.

[btcltcdigger]

Oh damn, looks like you caught a marlin this time.
3 freaking CM accounts, man. That's gonna sting and hurt him at the same time.

[dkbit98]

...

It is always nice to show some visual graph style connection with all posted addresses and merit abuse is just a nice cherry on top.
Interesting thing is that some of this accounts have been tagged as farmers since 2017 but they are still in same campaign... what's up with that  

More examination will probably reveal other addresses connected with 1BRevo address shown on the left side.

Code:

1BRevoHgfXeoqR5WhgxG754NukPdssxxBK
1HYS3m1YbdFHC27ZSzR1SD1s6oAYjYe1rh
12Jtg2ARpNEA1Q9HdfMpuk9PZgj4KMEScD
1QF6GW9tNx7MFXkD2eAr7FsN9oXhnHYHvp
1KjHbeCHrc3hs7rxD5Zw6koDMLDFFxuWDs
1Pfrk4NL6FycDnxph4KrcZib7w7E8YRJLN

https://blockpath.com/

[nutildah]

https://blockpath.com/

Thanks for this, that's a good tool I'll probably use in the future.

What's sad is this guy has been entering his alts together in contests for a long time, too... Not very cool.

He entered all 9 accounts in a giveaway held by El Duderino:

edit: list of everyone

...
3764    manchester93
...
4248    illyiller
...
4590    figmentofmyass
...
5090    squatter
...
5240    romani245
...
5340    exstasie
...
5560    MAbtc
...
5650    illinest
...
6000    marky89

Even worse is figmentofmyass has been helping to organize online poker tournaments for Bitcointalk users. I took a look and sure enough, he plays in tournaments with himself:

running list of SwC poker handles:

Code:

figmentofmyass = FOMA777
rhomelmabini = K1R1T0
Betwrong = Betwrong
Steamtyme = Steamtyme
CoinEraser = CoinEraser
manchester93 = NEpats93
Improved = Obaming
Murat = hardtime

This just crossed into scumbag territory.

Which is too bad because he's quite an intelligent guy. Hope he didn't think he'd get away with it forever.

[dkbit98]

Which is too bad because he's quite an intelligent guy.

He has to be intelligent for writing so much posts everyday in same campaign with 3 accounts and from bitcoin he earned this is probably his full time job, and playing poker with himself figmentofmyass vs manchester93 it's a winwin situation for him until he lose it all

[tyKiwanuka]

(...), and playing poker with himself figmentofmyass vs manchester93 it's a winwin situation for him until he lose it all

I did the spreadsheet for the SwC poker series and tbf he never joined with the NEpats93 account there. And it was organized by efialtis, while the currently running Poker Series at Betnomi, where he plays/played as well, is organized by Yahoo.

Just for clarification, not for defending or judging

[TheBeardedBaby]

Someone merit the OP from me please, he deserves a special place in the ChipMixer campaign, I hope DarkStar_ will consider this finding and really make you part of it, you deserve it more than most of the other applicants.
Keep busting those scammers man!!

No surprise that your username were one of the most searchable words lately.

EDIT: Thank you, Now I can merit him too

ANOTHER EDIT and offtopic: You people are insane, Thanks for the merit injection to Suchmoon and  cabalism13 but that's way tooo much.

[LoyceV]

I'd like to verify the evidence on ChipMixer campaign participants:

figmentofmyass

122h7dmX8vcdNnWjfbz1eevD8tfcJasBWV

This address sends to 17k4EVPznuTQ7q7CujbFFvTqx97ff6CZZN which sends to 1Bp5t2AzEGkNSsFsAgCNn9zMy9QGsxB6Pu.

squatter
No direct post available, and I don't have it in my own archives either. Address 1ugj76pwcXq2YmPVwxRccZmWrQmEsb2zp is quoted by user notaek, in a post last edited February 09, 2018.
This address sends to 1BxSjuLa5GAtMdeiyiQ6P1yBKp2mKnMmf4 which sends to 1Bp5t2AzEGkNSsFsAgCNn9zMy9QGsxB6Pu.

exstasie
No direct post available, but address 19wxJJobJ77deczvzoCpLGXDqb7FjcELCi is quoted by DarkStar_ so I have no doubt there.
This address sends to 1Mp7gexEEbxzZKS5QUpv2FHwbXJpFWEDem which sends to 1Bp5t2AzEGkNSsFsAgCNn9zMy9QGsxB6Pu.

Just checking these connections was a lot of work already. I'm impressed you found all this! Advertising a mixer and getting caught on blockchain evidence is quite ironic.

[cabalism13]

Pretty interesting, didn't  know this will happen to Chipmixer as well... It seems DS will need to see this.

...

I almost forgot who you are and thought you were a Source LoL.

[Dave1]

figmentofmyass joined Chipmixer campaign Week 20

exstasie - Week 25

Squatter - Week 31

Current week is 194

So this 3 accounts have been milking Chipmixer for more than 3 years.

[cabalism13]

figmentofmyass joined Chipmixer campaign Week 20
exstasie - Week 25
Squatter - Week 31
Current week is 194
So this 3 accounts have been milking Chipmixer for more than 3 years.

He should be a millionaire now, even if he leaves the campaign I think that would be alright, just think of it on how much he gathered. Especially if those accounts  were able to comple 50 posts a week LoL and not to mention (if, maybe) he's on a country  were BTC holds a Big Value of Money

[lovesmayfamilis]

It will be very interesting to hear what these 3 accounts have to say or one for all. Will there be excuses and stories about friends and family?
Any lie always pops up, and although three years have passed, these accounts have been exposed.
I applaud Nutildah, your investigations always explode with a lot of emotions. But I also "admire" this cheater, who for three years held a role in three or more faces.
Perhaps the manager will draw the right conclusions, and it will be fair if Nutildah can take an honest place in the ChipMixer subscription.

[AB de Royse777]

It was puzzling to me when I looked at the addresses, even after he was putting all these I was still confused to connect the reference and had to ask a question LOL
I have already done my merit rain so you got your share :-P

No surprise that your username were one of the most searchable words lately.

The username reminds me Nutella. Do the search engine consider that?

[yahoo62278]

(...), and playing poker with himself figmentofmyass vs manchester93 it's a winwin situation for him until he lose it all

I did the spreadsheet for the SwC poker series and tbf he never joined with the NEpats93 account there. And it was organized by efialtis, while the currently running Poker Series at Betnomi, where he plays/played as well, is organized by Yahoo.

Just for clarification, not for defending or judging

As far as I know, figmentofmyass has not been multi accounting the poker tourney. He has barely played any of the games.

How the heck do users even post with that many accounts? They have to be posting in the same threads and answering each other. I barely post on my 1 account, couldn't imagine the hell it would be to try making quotas weekly on 10+ accounts.