MyBitcoin has started spending our stolen coins

[piotr_n]

The odd thing is the coins are not being sent in the way a normal Bitcoin client would send them, the address balances are being nibbled at and combined with other small payments from other address to new addresses, like here: http://blockexplorer.com/address/12ViYXgordxUkmPhN5PAU9vJRHwc8jftfQ. The coins are sitting in that new address. Now the question is, is that a MtGox address or still the BitThiefs? If MagicalTux is willing to lock accounts because coins were long before used to scam him of MMORPG money, he should at least be willing to find, flag, lock, and IP log coins sent directly from mybitcoin users' addresses to the exchange, disclose that those are MtGox addresses if requested, and respond to subpoenas to the identity of the thief (for private action or to be handed over to the prosecution arm of juristictional law enforcement).

Along with the magical re-appearance of "Tom Williams" at the same time, we know it's the site owner, and I have a feeling they are being transferred to the exchange for quick sell, huge sells happening right after these transfers

Nice research!
I don't even think the service owners should be disclosing their customer data in such case - even if we prove that this money come from the stolen mybitcoin deposits.
Stealing some suckers money is bad, but there are also other important principles, which I prefer.
Like: I don't want any bitcoin service to disclose any of my data to any other entity - ever. I'm not an evil person, but still if they could that - I'd appreciate it

Which doesn't mean that I don't want the guy who stole my money to by miserable - what else can I feel?
But that's fine - it's only some pity money; don't let your dogs eat him - that could look much worse

[1715321324]

1715321324

[1715321324]

1715321324

[1715321324]

1715321324

[1715321324]

1715321324

[1715321324]

1715321324

[Maged]

They weren't sent to MtGox. If they were, they would have moved already. I have no idea about that weird consolidation, though. Luckily, it was done so poorly that we can now trace a very large amount of funds. With a script, you could trace each input, as well as the change, to find all spends out of what is known to be mybitcoin from the input and change information. It'd be cool to get a final number, too.

[westkybitcoins]

The odd thing is the coins are not being sent in the way a normal Bitcoin client would send them, the address balances are being nibbled at and combined with other small payments from other address to new addresses, like here: http://blockexplorer.com/address/12ViYXgordxUkmPhN5PAU9vJRHwc8jftfQ. The coins are sitting in that new address. Now the question is, is that a MtGox address or still the BitThiefs? If MagicalTux is willing to lock accounts because coins were long before used to scam him of MMORPG money, he should at least be willing to find, flag, lock, and IP log coins sent directly from mybitcoin users' addresses to the exchange, disclose that those are MtGox addresses if requested, and respond to subpoenas to the identity of the thief (for private action or to be handed over to the prosecution arm of juristictional law enforcement).

If Mt. Gox is forced to reveal info due to governmental demand, well, that's that.

But I personally would rather them NOT just step into a policing role in this matter. I already have my concerns with using their service... for them to do that would just cinch it.

If individuals discover the output of the funds themselves, then good for them, hopefully they can resolve their losses in a peaceful manner.

[paraipan]

......................

If Mt. Gox is forced to reveal info due to governmental demand, well, that's that.

But I personally would rather them NOT just step into a policing role in this matter. I already have my concerns with using their service... for them to do that would just cinch it.

If individuals discover the output of the funds themselves, then good for them, hopefully they can resolve their losses in a peaceful manner.

will see about how peaceful they are when find out where that guy is, will be like next Osama

[Maged]

Damn, someone REALLY needs to run a script on this. I barely scratched the first connected transaction, and I've already found over 500 BTC in 21 addresses.

[gnar1ta$]

Where are you getting the addresses from? And how much did that phony release say they "lost"?

[Maged]

Where are you getting the addresses from? And how much did that phony release say they "lost"?

From the non-change of the inputs to the change of the transaction from the OP's first address.

Sunday, August 7th, 2011

                MYBITCOIN ASSETS AND LIABILITIES DISCLOSURE

        Liabilities (Bitcoin)      Assets (Bitcoin)   Percentage
 -----------------------------------------------------------------------------
          154,406.34272079      75,666.76066691         49%

With a script (since I won't do it by hand), we could do some accounting on those numbers. Additionally, we'd be able to gather up a large number of the addresses and start tracking them. Thanks to his stupidity, we might eventually be able to track good 'ole Tom down.

[BitcoinPorn]

Thanks to his stupidity, we might eventually be able to track good 'ole Tom down.

I am trying to follow this, but to simplify it, a Bitcoin business of some kind would have to be involved to confirm the identity of a person who is trying to spend the Bitcoin?    Is this where Mt Gox comes in?   I figured a person would be smart enough to spend the coin on goods and services rather than try and exchange it out for cash in front of everyone's face.  Or it is done little by little daily or something. 

Someone call Bruce or the Bitcoin Police?  Or were they doing more damage than good for this cause? 

[Maged]

I just realized why we are seeing that consolidation...

It is true that we could disclose all of the Bitcoin payment addresses we manage and let everyone look them up and track the lineage of the coins. This is also troublesome due to the way that we defragment small payments to keep the processing engine speedy.

Someone, somewhere, restarted the MyBitcoin engine without realizing the implications. Thanks to that process, just about the entire MyBitcoin inventory is clearly visible to us.

Thanks to his stupidity, we might eventually be able to track good 'ole Tom down.

I am trying to follow this, but to simplify it, a Bitcoin business of some kind would have to be involved to confirm the identity of a person who is trying to spend the Bitcoin?    Is this where Mt Gox comes in?   I figured a person would be smart enough to spend the coin on goods and services rather than try and exchange it out for cash in front of everyone's face.  Or it is done little by little daily or something. 

Someone call Bruce or the Bitcoin Police?  Or were they doing more damage than good for this cause? 

You pretty much have it down. We likely won't be able to find much, but he might slip up. He just needs to slip up once.

[gnar1ta$]

Would the list of addresses that sent my payout help? I dug into an old wallet and found the transaction.  I had more there than I thought.

Actually it looks like they are all empty, but I'm fairly certain this is the wallet address 1CQJMVXcvUNfu9TiZuz9UDEZUtvbiGPWBi  no activity from Aug 8 2011 until Jan 7 2012

[Maged]

Actually it looks like they are all empty, but I'm fairly certain this is the wallet address 1CQJMVXcvUNfu9TiZuz9UDEZUtvbiGPWBi  no activity from Aug 8 2011 until Jan 7 2012

We have a match! If anything, this shows how completely we could script the accounting. That address is used in the same transaction as 1Fv74A11EWzekD5g1oWEdKkBvm6sAvJEuN in these transactions:
http://blockexplorer.com/tx/3b9c6d77b0015f25093b4233fe06a116bd19e157e1442f99f0010dbe28c34093
http://blockexplorer.com/tx/c1590040871443e884d9c14e7cc6a4fed57bc942ec68eaab67e3dfee9cdd9b6b

[gnar1ta$]

Maybe it would be possible to identify more addresses based on activity.  OP's addresses show no activity from Jul/Aug 11 to Jan 12 and mine was the same.  How many other addresses would coincidentally have the same activity? Aug 8 for the latest inactivity, and Jan 7 for the earliest new activity.

[deepceleron]

They weren't sent to MtGox. If they were, they would have moved already. I have no idea about that weird consolidation, though. Luckily, it was done so poorly that we can now trace a very large amount of funds. With a script, you could trace each input, as well as the change, to find all spends out of what is known to be mybitcoin from the input and change information. It'd be cool to get a final number, too.

Not necessarily. Coins seem to be swept out of MtGox deposit addresses after 1-4 days, although it was faster months ago.

[rjk]

Has anyone gotten Bitten to work, or does it do what it does well?

Bitten is a graphical blockchain explorer and wallet merger. You're smart, you'll figure it out.

[deepceleron]

Has anyone gotten Bitten to work?

You're smart - you figure it out!

There sure are funny comments on the commits: "something works", "miscellanous processed meat", "bunch o work".

Looks like the kind of comments I use, I just looked through some of my pre-public code for my comment goofs: "'term for crapping on cache server" (add query to url to bypass stale cache), "I could take a URL from the command line, but fuck you" (framework for future command-line options), "fill array with crap for debug" (preloading array on instantiation)...

[rjk]

Has anyone gotten Bitten to work?

You're smart - you figure it out!

But I'm not smart, and I haven't figured it out.

[Transisto]

Would bitlaundry be effective at anonymizing these BTC ?

http://app.bitlaundry.com/about

The owner should be contacted not to accept these BTC.

[mb300sd]

Would bitlaundry be effective at anonymizing these BTC ?

http://app.bitlaundry.com/about

The owner should be contacted not to accept these BTC.

I don't think bitlaundry was ever very widely used. Silk Road would probably be the most effective laundering method, and I doubt you'd be able to get them to reject the coins.

[realnowhereman]

In case it's of use to anyone; I looked at a few (incomplete) notes I had and found some information:

From a mybitcoin withdrawal to an address I controlled, the following must be under the control of mybitcoin:

• 1gvbrPhzqq2LAx1VqGwU9ieeMY9ATH1jK
• 1K47fYMcWnPQSEezEiQfhHQhxZzvJUniyE
• 17gXCG8q8Vs5cCxR4nHaj7Fg47TmuWGzLz
• 16kLncD6PHbJaFURf5cbvK2ySxudXCryfV
• 1MgrcvVZXno3h2NLfqPTXRyeHHfU5otA4R
• 1FJg5v7xxw9P8XCH7TJGGhysuRVbycXtxB
• 1JzTpamrSGM5kiyDUqmBpUSaB51Amhr9UA
• 19NuD3VsicyCUCQ7VTZxhCxnFTFz21ffuc
• 16Chb9iUhH2mtqrrGAVu8XohLPTLGqmosA
• 1C384ycmwGRPNf1muyiaZbmNfGnA1Bn4pP

From a deposits I made to mybitcoin, these addresses must have been under mybitcoin's control:

• 1ANqs2jiTrR9SokCBmxqkaeCCvrPddHeXR
• 1Jcjh6t5qiiykbveCtcxSvZZ9XKrAmAWeu
• 1MYKeZkH8NJNx5d3xvcS6U1FEqaNfg14hX

Annoyingly, I had a few more withdrawals, but I didn't keep notes.

Hope the above is of some use though.

[BitcoinPorn]

I've always been a bit confused about how exactly MyBitcoin did its marketing...

Bruce Wagner was head marketer http://buttcoin.org/has-bruce-wagner-pulled-off-the-financial-biggest-scam-on-the-bitcoin-community