New 400 BTC Bounty Pales Roger Ver's 37.6 BTC Bounty for Return of Stolen BTC

[Nicolas Dorier]

Tx matching your description.

time,height,txid,value
12/3/2012 6:27:49 PM +00:00,210776,781c1f5707383b56448487dcccdcd7da8d88395dd5e278ec3d7fcefd81145934,1131.89935045
12/4/2012 5:41:36 PM +00:00,210883,5fe3e3c8a2b69c0825c397c4506ba17d414fc84e6dd53f3e449d6656ab8d3733,1140.07914243
12/4/2012 8:53:06 PM +00:00,210899,aa531ee087dc39e81b8800934d2a2d72a88b3958717520e2a6c05c9852384964,1125.07914243
12/5/2012 1:04:55 AM +00:00,210923,efb029e5a20ee54fee1e698dd84c333513bd705dd5b6681077d0b1964a753c69,1135.928
12/7/2012 1:20:50 AM +00:00,211183,0d9d112eef95336173800552452d95d2debe168ff4bb0b53a7613211e3c81b51,1139.56541307
12/7/2012 1:20:50 AM +00:00,211183,dd28ea2487edb0b67e072eb947115c3efbc329df86b46c6ccedabb4d6b4eaebc,1131.86541307
12/7/2012 1:20:50 AM +00:00,211183,c7cc60b058056eb3ace620b84bd8eee8a4286e95196c131885ac657e1530364b,1126.66541307
12/7/2012 1:37:22 AM +00:00,211185,78f48b9fc40bb6780fc196ad0dc5abfa76ee580ec1d5ff4fcd1ea136553176bc,1132.73
12/9/2012 10:48:04 PM +00:00,211562,09ec0b7c17e3bfe03a14bcac2060629fc1476c5b043fe4f67bff11f145183797,1135.00
12/10/2012 2:04:49 AM +00:00,211586,efa55a22c34a07663bd5e4da735faebcef32923feed50d46ea3fa19727162e47,1129.4695
12/10/2012 4:33:12 PM +00:00,211670,55b18fcf52cb7f925fa0f06809dc0e5d43abe3c05c2c375976c228246c77b31f,1124.2801297
12/11/2012 6:24:25 AM +00:00,211747,69d80f660e443c1c15adcdfb01c38d692ba88a4ea826d8d4d62a445fecafe12d,1122.64
12/13/2012 5:03:47 AM +00:00,212021,2b857bae50c00f4cc2e3d44353017d0518118434d693f82a51fb6920c872f66b,1122.38169587
12/13/2012 8:16:03 AM +00:00,212038,02e1b6978acec288f1e6f2bbd6042d2abd8a16a618820307ce271bed11e2f990,1131.243
12/13/2012 8:16:03 AM +00:00,212038,5aebff69ae57238eee987eedf4fa2617ea6dd3d9faab0a8b93a3d133da8f44c9,1127.2425
12/14/2012 7:23:45 PM +00:00,212206,81c805eabdf367aa25b7502272141d67d1179a6c95df0bb1cfe0b1859a923a83,1140.17555838
12/17/2012 1:03:13 AM +00:00,212458,8ea7cfdab62d277d2356b3f5205da37bd6c6f5c4c73121b0866cf597f6848c29,1130.5875
12/18/2012 4:11:06 PM +00:00,212664,a563ba2551bcc969327a3188d41421532a8b6bd919df3821c9474439cc0331fa,1137.24273178
12/18/2012 4:38:17 PM +00:00,212667,701806ccaf8a9c4637f241224ba5827f91e0d589fd577331c3cc67f82968ea29,1137.13273178
12/18/2012 4:57:38 PM +00:00,212669,e9166711e80a132e90c0211d9d3b9ef95829202749fa56a2e422610be09c8142,1137.02273178
12/18/2012 7:13:40 PM +00:00,212683,87baf8865440253a16ff5c10eca6c67697f69648e365591e6d96ed1c5faf0461,1133.05273178
12/19/2012 7:01:46 AM +00:00,212751,96ccfd081d1a9eda691f203102e46424d94edec7ee1f247b890b26170081227f,1133.809
12/19/2012 4:14:10 PM +00:00,212805,70b5d44e20c665fe7e31bfc54acd6a0c00089fc673400510415cd7b83ad5464a,1132.95273178
12/19/2012 4:33:40 PM +00:00,212809,8142700396e12d4163073f3ec093fda999088c47ad3a2a3b1d8da42c3a595012,1132.85273178
12/19/2012 4:35:54 PM +00:00,212810,dc1e4d4489c685b680e910715d4c8fb793083b305501a4a29a2776195ff8f0a4,1132.75273178

[laurentmt]

Tx matching your description.

You're really too fast ! 

[Nicolas Dorier]

Tx matching your description.

You're really too fast ! 

Shameless plug, thanks NBitcoin ! https://github.com/NicolasDorier/NBitcoin 

[btchip]

Tx matching your description.

You're really too fast !  

Shameless plug, thanks NBitcoin ! https://github.com/NicolasDorier/NBitcoin  

Thanks, Phinnaeus, I guess you can start digging from those and see if you recognize something (or other amount / addresses from your split, depending how Instawallet worked for that).

Time to sign off here  

[laurentmt]

@Phinnaeus : another list here if it can help.
It's a list of txs sent in December 2012 or January 2013 with a txo between 1100 and 1200 btc (ordered by ascending amounts and then by dates)
EDIT : Here's the same list but ordered by dates first.

I've also looked for amounts > 1100 and directly sent to 1FrtkNXastDoMAaorowys27AKQERxgmZjY (cold wallet) but nothing seems to match your amount (Tx sent on 01/17/13 is a split of the cold wallet).
---------------------------
0b02ac8679f3fef2bf7b87da5c0cb20c1db1417ad7f8a3f047ff5dbc1b959c82 - 217859 - 2013-01-24 15:47:43 - 3000.00000000
5578ddc44d318b7196ec5859e2c6d299b521e2e77edc4e02af2440962669f7b2 - 216889 - 2013-01-17 10:19:23 - 1300.00000000
f6b21f88cc75556f0ac852d32e8e6422d9647c51345ad515b4ec505850c9e929 - 216634 - 2013-01-15 10:38:46 - 4500.00000000
483fd6d4d19839cf004da451d20e95a8b30d6ecef3e6461dda31b9618461da4e - 216634 - 2013-01-15 10:38:46 - 8500.00000000
72035bfa3e7ac5207f884766ef6adb0b5885e7721e3485b7e860b4735c04353d - 214776 - 2013-01-02 08:46:31 - 2900.00000000
5d8579d0c992188eec9c3057ccde4be7349c000946e44ad9e72857542372314c - 213676 - 2012-12-26 11:33:06 - 2500.00000000
c0ac09d534266892e6226c2d21b2cfc71ff2d5e49437a3aeba90e296673b709a - 211162 - 2012-12-06 21:17:08 - 2000.00000000
---------------------------
Now, we would need to do some taint tracing to check if we can link one of the tx identified with the cold wallet. I'm going to do some tests with some of the identified txs.

Shameless plug, thanks NBitcoin ! https://github.com/NicolasDorier/NBitcoin (https://github.com/NicolasDorier/NBitcoin)  Cool

Definitely the proof of a good job. Congrats ! But can you do it with less lines than this ?  

Code:

from minos.ledger.wrappers.ledgerdb_wrapper import LedgerDbWrapper
from minos.utils.dates import to_utcdate
from minos.bitcoin.helpers.bitcoin_helper_functions import convert_satoshis_to_btc

wrapper = LedgerDbWrapper("http://192.168.1.5:7474/")
request  = """MATCH (b:BLOCK)
                WHERE b.time > 1354316399 AND b.time < 1359673200 
                WITH b
                MATCH (b)-[:EMBEDS]->(tx:TRANSACTION)-[:HAS_FOR_OUTPUT]->(v)
                WHERE v.value > {amount_min} AND v.value < {amount_max}   
                RETURN tx.txid, b.height, b.time, v.value
                ORDER BY v.value, b.time"""
parameters = {"amount_min": 110000000000, "amount_max": 120000000000} 

results = wrapper._execute_cypher_query(request, parameters)
if len(results.data) == 0:
    print("nothing found")
else:
    for data in results.data:
        print("%s - %s - %s - %s" % (data.values[0], data.values[1], to_utcdate(data.values[2]), convert_satoshis_to_btc(data.values[3])))

[Nicolas Dorier]

I don't read the leveldb, NBitcoin use Sqlite as a nosql store

It is more along these lines

BlockStore store = new BlockStore("E:\\Bitcoin\\blocks", Network.Main);
var index = new IndexedBlockStore(new SQLiteNoSqlRepository("PlayIndex"), store);
var target = Money.Parse("1132");
var margin = Money.Parse("10");
var dest = Network.CreateFromBase58Data<BitcoinAddress>("1FrtkNXastDoMAaorowys27AKQERxgmZjY");
var en = new CultureInfo("en-US");

FileStream fs = File.Open("logs", FileMode.Create);
var writer = new StreamWriter(fs);
writer.WriteLine("time,height,txid,value");
foreach(var b in blocks)
{
   var block = index.Get(b.HashBlock);
   foreach(var tx in block.Transactions)
   {
      foreach(var txout in tx.Outputs)
      {
         var pa = new PayToPubkeyHashTemplate()
               .ExtractScriptPubKeyParameters(txout.ScriptPubKey);
         if(pa != null && pa == dest.ID)
         {
            if(target - margin < txout.Value && txout.Value < target + margin)
            {
               writer.WriteLine(b.Header.BlockTime.ToString(en) + "," + b.Height + "," + tx.GetHash() + "," + txout.Value.ToString());
            }
         }
      }
   }

}
writer.Flush();

I did not checked for the 1FrtkNXastDoMAaorowys27AKQERxgmZjY in my first dump. What does this address correspond to ?

[laurentmt]

I don't read the leveldb, NBitcoin use Sqlite as a nosql store

Well. I've used a trick. I've got a blockchain loaded in a neo4j db (which has a sql-like language called cypher).

I did not checked for the 1FrtkNXastDoMAaorowys27AKQERxgmZjY in my first dump. What does this address correspond to ?

It seems to be the cold wallet used by Instawallet but i didn't find anything which looked like a direct tx to this address with the given amount.
I'm going to check if I can use one of my previous dev to compute some tainting and find an indirect link but not sure of the result. Tainting is very ressource-consuming and requires something stronger than a laptop.

[Nicolas Dorier]

laurentmt, refactored because my previous code will make python programmers think C# is not nice... SQL Style
(Actually, I rarely use this LINQ syntax, it is just to show off  )

BlockStore store = new BlockStore("E:\\Bitcoin\\blocks", Network.Main);
IndexedBlockStore index = new IndexedBlockStore(new SQLiteNoSqlRepository("PlayIndex"), store);
Money target = Money.Parse("1132");
Money margin = Money.Parse("10");
BitcoinAddress dest = new BitcoinAddress("1FrtkNXastDoMAaorowys27AKQERxgmZjY", Network.Main);
var en = new CultureInfo("en-US");

FileStream fs = File.Open("logs", FileMode.Create);
var writer = new StreamWriter(fs);
writer.WriteLine("time,height,txid,value");

var lines = from header in blocks
         let block = index.Get(header.HashBlock)
         from tx in block.Transactions
         from txout in tx.Outputs
         where txout.ScriptPubKey.GetDestination() == dest.ID
         where target - margin < txout.Value && txout.Value < target + margin
         select new
         {
            Block = block,
            Height = header.Height,
            Transaction = tx,
            TxOut = txout
         };
foreach(var line in lines)
{
   writer.WriteLine(
      line.Block.Header.BlockTime.ToString(en) + "," +
      line.Height + "," +
      line.Transaction.GetHash() + "," +
      line.TxOut.Value.ToString());
}
writer.Flush();

I don't read the leveldb, NBitcoin use Sqlite as a nosql store

Well. I've used a trick. I've got a blockchain loaded in a neo4j db (which has a sql-like language called cypher).

I did not checked for the 1FrtkNXastDoMAaorowys27AKQERxgmZjY in my first dump. What does this address correspond to ?

It seems to be the cold wallet used by Instawallet but i didn't find anything which looked like a direct tx to this address with the given amount.

Maybe we can find a graph relationship... fun thing to do if bruno need it... (and willing to lend a small motivator bounty )

[laurentmt]

laurentmt, refactored because my previous code will make python programmers think C# is not nice... SQL Style
(Actually, I rarely use this LINQ syntax, it is just to show off  )

I've done some C# (with WPF) in the past and I can testify that it's a very nice language.

Maybe we can find a graph relationship... fun thing to do if bruno need it... (and willing to lend a small motivator bounty )

Yep. I'm going to try that. Keep you in touch.

[EDIT] Time to sleep. I've launched a search for a graph relationship between candidate txs and the cold wallet. I'm not sure if it makes sense to look for this relationship but we'll see the results. If I can, I'll try another search corresponding to the split.

A couple/three days later I split the three accounts up into 1,000, 132, and x.xxx...

[Phinnaeus Gage]

I have Windows 8 now, but the old laptop was Vista, if that's what you're asking. The address was scanned via QR-code either from InstaWallet's page, where it was created, or from blockchain.info, even though there was nothing in it at the time.

Sorry, not clear on that. I'm asking what was the software/website used by the guy that did the transfer to your first address in that restaurant.

Also why are you mentioning blockchain.info ? Was your first address hosted by instawallet or blockchain.info ? (supposing they had a wallet at that time, I don't remember)

I have no idea as to what software/website the other guy was using.

I only mentioned blockchain.info because there's a QR-Code associated with each wallet, and the transfer was done via that QR-C or one on InstaWallet if it was available with the newly created bitcoin wallet.

[Phinnaeus Gage]

laurentmt, refactored because my previous code will make python programmers think C# is not nice... SQL Style
(Actually, I rarely use this LINQ syntax, it is just to show off  )

BlockStore store = new BlockStore("E:\\Bitcoin\\blocks", Network.Main);
IndexedBlockStore index = new IndexedBlockStore(new SQLiteNoSqlRepository("PlayIndex"), store);
Money target = Money.Parse("1132");
Money margin = Money.Parse("10");
BitcoinAddress dest = new BitcoinAddress("1FrtkNXastDoMAaorowys27AKQERxgmZjY", Network.Main);
var en = new CultureInfo("en-US");

FileStream fs = File.Open("logs", FileMode.Create);
var writer = new StreamWriter(fs);
writer.WriteLine("time,height,txid,value");

var lines = from header in blocks
         let block = index.Get(header.HashBlock)
         from tx in block.Transactions
         from txout in tx.Outputs
         where txout.ScriptPubKey.GetDestination() == dest.ID
         where target - margin < txout.Value && txout.Value < target + margin
         select new
         {
            Block = block,
            Height = header.Height,
            Transaction = tx,
            TxOut = txout
         };
foreach(var line in lines)
{
   writer.WriteLine(
      line.Block.Header.BlockTime.ToString(en) + "," +
      line.Height + "," +
      line.Transaction.GetHash() + "," +
      line.TxOut.Value.ToString());
}
writer.Flush();

I don't read the leveldb, NBitcoin use Sqlite as a nosql store

Well. I've used a trick. I've got a blockchain loaded in a neo4j db (which has a sql-like language called cypher).

I did not checked for the 1FrtkNXastDoMAaorowys27AKQERxgmZjY in my first dump. What does this address correspond to ?

It seems to be the cold wallet used by Instawallet but i didn't find anything which looked like a direct tx to this address with the given amount.

Maybe we can find a graph relationship... fun thing to do if bruno need it... (and willing to lend a small motivator bounty )

All depends how small. I don't want to be giving away the farm.  You all know that I'm on record in stating that I'm willing to dole out 400 BTC once I'm returned the entire 1,132 BTC, thus anything you want between 1 and 400 BTC is on the table, not a satoshi more or less.

Thanks, guys. You seem to have done more in hours what davout claims to have taken him a couple days, and he's running an exchange. That's a scary thought.

Meanwhile, I'm still waiting for davout to the independent auditor outta his ass.

~Bruno Kucinskas

[jc01480]

Clearly there was no independent auditor with any credibility to support the claim or there would be independent verification by that auditor, one with the pertinent qualifications and references to support such a claim.  This is sufficiently established.  The misleading information concerning a validation by an independent auditor contributes to criminal intent by a party to the incident.

[Phinnaeus Gage]

Clearly there was no independent auditor with any credibility to support the claim or there would be independent verification by that auditor, one with the pertinent qualifications and references to support such a claim.  This is sufficiently established.  The misleading information concerning a validation by an independent auditor contributes to criminal intent by a party to the incident.

That's exactly what I'm been trying say, albeit I did such with 5k-10k words, but I like your version better.

[Phinnaeus Gage]

I'm in the process of digging up as many references as possible connect

http://www.yasni.info/ext.php?url=http%3A%2F%2Fmobilepayment.typepad.com%2Fpaiement_mobile%2F2010%2F06%2Fj7-pour-sinscrire-et-participer-%25C3%25A0-mobile-payment-2010.html&name=Pierre+Noizat&showads=1&lc=en-us&lg=en&rg=fr&rip=us

J-7 pour s'inscrire et participer à Mobile Payment 2010

The event Mobile Payment opens in 7 days (June 9 and 10) at the Porte de Versailles. It is still possible to register or participate. You can view the agenda here: http://www.mobilepaymentexpo.com/lang-fr/agenda.html

If you are interested in some free invitations (very limited number of places) and pass -50% do not hesitate to contact me.

Confirmed speakers for the moment:

André-Jacques Selezneff, HBCC partners
Andrew Green, Orange
Arvind Ashta, Burgundy School of Business
Bruno Boussuge, BNP Paribas
Christian Chabrerie, Mobinear
Christophe Nivelet, Giesecke & Devrient
Christophe Romei, Services Mobiles
David Marcus, Zong
Didier Geiben, GM consultants
Didier Marissal, TribalNets
Dominique Baron, Horus
Dominique Descolas, Veolia Transport
Eric Legale, Issy Media
Franck Lefevre, Digital Airways
François Flouriot, GM consultants
François Lecomte, Forum des Services Mobiles Sans Contact
François Lemaire, GEMALTO
Frédéric Baud, BarCampBank
Frédéric Boy, Widmee
Gérard Peliks, EADS
Hiroshi Tamano, NTT DoCoMo
James Patmore BOKU
Jean Luc Dubois, Crédit Mutuel Arkéa
Jean Marc Levy Dreyfus, PayTapp
Jean Philippe Bétoin, Cassis
Jean-Sébastien Sennesal, Atos Worldline
Jérémie Leroyer, AirTag
Karine Jouannigot, Comptoirs du Multimedia
Laetitia Gazel-Anthoine, Connecthings
Lionel Brahami, Famoco
Marinos Xynarianos, ETHNODATA / National Bank of Greece
Michel Poignant, Paymotech
Nicolas d'Hueppe, Cellfish
Nicolas Ullmo, LOGICA
Olivier Locufier, MobileGov
Olivier Marx PDG,Altics
Olivier Thiriet, Atos Worldline
Olivier Tilloy, BPCE
Pascal Burg, Edgar Dunn
Patrice Hertzog, AEPM
Philippe Lerouge, PayByPhone
Philippe Marxgut, PMX conseil
Philippe Pénide, Absolu Telecom
Pierre Noizat, Cityzi
Rambert Namy, Sofrecom
Remi Provendier, SFR
Samee Zafar, Edgar Dunn
Sébastien Burlet, LemonWay
Sylvain Fourny, Atos Worldline
Thierry Chopard, Paypal
Toon Coppens, Touchatag Alcatel Lucent
Yves Eonnet, Tagattitude

Yes, it's 2010, but it was a small conference with an elite crowd, with Sébastien and Pierre developing a relationship since they're in the same industry.

Here's another workshop Sébastien and Pierre attendant.

http://insiden.blogspot.com/2010/06/tomorrow-mobile-payment-2010-paris.html

State of the art of Mobile banking

animé par Karine Jouannigot, Comptoirs du Multimedia, avec Jean Luc Dubois, Arkéa Services, Jean Claude Vignaud, TribalNets, Sébastien Burlet, LemonWay, Sylvain Fourny, Atos Worldline, Olivier Tilloy, BPCE, Marinos Xynarianos, ETHNODATA / National Bank of Greece, Bruno Boussuge, BNP Paribas

Le Paiement Mobile, opportunité pour les villes

Mobile Payment, an opportunity for cities
animé par Karine Jouannigot, Comptoirs du Multimedi, avec Eric Legale, Issy Media, Franck Lefevre, Digital Airways, Philippe Lerouge, PayByPhone, Pierre Noizat, Cityzi, Willy Breda, Ministère de l'environnement

[laurentmt]

They were purchased anonymously at a restaurant halfway between Sandwich, IL, and Chicago, in Naperville, IL, about the second week of December, 2012. Taxing my memory, the total was 1,132 + x(single digit).xxx... and immediately put in a freshly created InstaWallet bitcoin wallet.

Do you remember if you did it with a single or several transactions ? It you did it with several tx, I fear the results sent by Nicolas and I won't match your case.

A couple/three days later I split the three accounts up into 1,000, 132, and x.xxx... wallets, always using InstaWallet while in my possession. Hope that helps with your plans.

Same question: Do you remember if you did the split in a single or several transactions ?

[btchip]

Thanks, guys. You seem to have done more in hours what davout claims to have taken him a couple days, and he's running an exchange. That's a scary thought.

we're not doing the same thing - we're trying to look for addresses that could match your original deposit given the information you provided while davout was recursively looking for all addresses generated by Instawallet. Hopefully both approaches will meet at some point, and even better there'll be a way to verify that you actually were the owner of the address (still blurry there, but at least you'll get a starting point)

I also hold the secret hope that a graph oriented database will be faster than a recursive loop, but that's out of the scope of your current issues  

It would help if you could somehow recognize your original address from the list of addresses posted above, but that might not be very realistic.

Meanwhile, I'm still waiting for davout to the independent auditor outta his ass.

what are you going to do with this information once you get it ?

[btchip]

I'm in the process of digging up as many references as possible connect

you're wasting time here. The payment / banking / mobile / security / smartcard industry is small and you'll end up with the whole set in no time 

They were purchased anonymously at a restaurant halfway between Sandwich, IL, and Chicago, in Naperville, IL, about the second week of December, 2012. Taxing my memory, the total was 1,132 + x(single digit).xxx... and immediately put in a freshly created InstaWallet bitcoin wallet.

Do you remember if you did it with a single or several transactions ? It you did it with several tx, I fear the results sent by Nicolas and I won't match your case.

I also assumed one. It doesn't really make sense to do several transactions for a single purchase.

A couple/three days later I split the three accounts up into 1,000, 132, and x.xxx... wallets, always using InstaWallet while in my possession. Hope that helps with your plans.

Same question: Do you remember if you did the split in a single or several transactions ?

this might or might not lead to something according to how Instawallet managed internal transfers.

also it would help to know when collections to the cold storage were done to limit the scope

[Phinnaeus Gage]

They were purchased anonymously at a restaurant halfway between Sandwich, IL, and Chicago, in Naperville, IL, about the second week of December, 2012. Taxing my memory, the total was 1,132 + x(single digit).xxx... and immediately put in a freshly created InstaWallet bitcoin wallet.

Do you remember if you did it with a single or several transactions ? It you did it with several tx, I fear the results sent by Nicolas and I won't match your case.

A couple/three days later I split the three accounts up into 1,000, 132, and x.xxx... wallets, always using InstaWallet while in my possession. Hope that helps with your plans.

Same question: Do you remember if you did the split in a single or several transactions ?

I believe it was just one, but taxing my memory that one stemmed from several wallets combined, taking him a tad while to configure whatever he was doing to accomplish the task. I had no reason to believe that whatever he was doing, something nefarious was afoot.

In re. that last question: For some reason I'm having trouble recalling the exact steps or how many, but I want to say it was done all at the same time frame, but another part of me is thinking I waited to one of the first ones was confirmed before preceding further the same day or next.

Hell, a couple hours ago I tried to put a gallon of milk in the microwave thinking it was the refrigerator, but chalked that up to having shit on my mind, oppose to... now what the fuck is that word that describes people who forget shit? 

[btchip]

Another genuinely naive question, of course you have no way to contact the guy to see if he had logs of his own ?

[laurentmt]

I believe it was just one, but taxing my memory that one stemmed from several wallets combined, taking him a tad while to configure whatever he was doing to accomplish the task. I had no reason to believe that whatever he was doing, something nefarious was afoot.

No worry. I understand that it's hard to remember something done in 2012.
It's just that the more information we get, the more we'll have a chance to retrieve one of these transactions.
In my first search, I've looked for 1 transaction with 1 output value between 1100 and 1200 btc and I think Nicolas did something similar.
But if it was done with several tx, this search won't give us the right tx and we'll need to search in another way.