I was hacked (1170btc stolen) - 500btc max BOUNTY

[ReRunRod]

Send money? That $500,000 US he stole isn't enough?

OOPS, was in a hurry, the note went with the previous transaction, not the theif's, my post has been corrected, please delete your response to my error.

The dude lives in France. His IP points at least one of the addys over there.

https://blockchain.info/nl/inv/fec490fa9b022f280c41522d7d0fc5ebb46556f1b264dd0124e408c1b154b5b1

[1715120685]

1715120685

[1715120685]

1715120685

[1715120685]

1715120685

[1715120685]

1715120685

[1715120685]

1715120685

[Bit_Happy]

I'm not good at this type of hunt, but I hope the OP gets it all back.
That is a generous bounty let's see someone earn it by recovering all the stolen coins. 

dropbox was compromised (with plain txt for the pwd, I know I know..)

sorry, but ... it's a EPIC fail ... my lord.

I've never seen that one before, it is really cute and funny. 

[bitcoin_bagholder]

Send money? That $500,000 US he stole isn't enough?

OOPS, was in a hurry, the note went with the previous transaction, not the theif's, my post has been corrected, please delete your response to my error.

I made the same mistake last week. Started a thread about over 150K moved from an address with a cryptic note attached but the note was from the previous tx. The placement of these notes are misleading if one doesn't know better or doesn't dig deeper.

[Wulfcastle]

The coins have moved again, they are now here:

410 at https://blockchain.info/address/16j6RQrJc3cyGEqe6BtApXkoNZ4Yy5z5Wo
221 at https://blockchain.info/address/17eHmNKr6Cb1U4uBhcnfs3iwWKsZGtRLaV
539 at https://blockchain.info/address/14DZ3Yjb39sDTMwKd19Ly4PK15BKZfLXWZ

Plus some of my tag BTC was moved through here:

https://blockchain.info/address/19J9DgHUUXh4Kwq1bN2tXbbZpVywBeV1oG

to:

https://blockchain.info/address/1GRFNTyLwoyQnk7S3MFFAz5qPkdWp7YSoY

which is an interesting address with 5,095.70255455 BTC

Now this is getting interesting, 5000 BTC in one account, when klee only lost 1170 BTC, looks like this guy has hacked other people too. Also was it you who left the note there BurtW, when you say "your tag"?

[montreal]

i'm sure there are many very smart individuals who are highly motivated to find this person's identity for that kind of reward. share every lead and piece of evidence you can muster. good luck man

[Mikez]

Well, this suck big time. I hope klee gets the money back, even if there's not a fat chance. I wouldn't like to see the thief getting hurt, maybe just brought to justice.
Are we sure the btc isn't in some tumbler by now?

@Wulfcastle, but why would the thief amass all of the stolen btc in the same address? It would be that much easier to connect him to other events and hoard some more evidence. Maybe the address belongs to a mixing service?

[Harley997]

Dear HEADHUNTERS,

43% of any btc I will be able to get back IF you find the identity of the thief!

If the whole amount will be returned to me (1170BTC) that would be 500BTC.

https://blockchain.info/nl/address/1GwNLwoCQiobJzmURSAq54vH4BYjFkwaxr

FIND HIM!!!

http://blockr.io/issue/1

Make a report!

https://blockchain.info/nl/tx/800ee228491d8591fd9da880c6d88d4c901ed1697e0aa43c010d7b0eafd796da

IP ADDY on here. Lives in France.

https://blockchain.info/nl/ip-address/46.105.103.92

The IP address is just the IP address of the node that relayed the transaction first. When using multibit, your IP address can show up as being in several countries across the planet when you do not even leave your home. 

[darkota]

The hacker is the same guy who stole the funds from Silk Road. The address he sent some BTC too is the same address that over 5,000 BTC stolen from the Silk Road hack was sent to. He could be either

1) The guy who stole the original Silk Road's funds and the proposed Silk Road 2's Funds

2) One of the owners of SK who stole their own users funds and make it seem as if a hacker took them


http://www.deepdotweb.com/2014/02/20/here-is-the-stolen-silk-road-wallet/

Could be someone relatively "close" to Klee, an owner of Silk Road 2(defcoin for example), or the hacker who stole from Silk Road

[BurtW]

Are we sure the btc isn't in some tumbler by now?

Yes we know exactly where they are, see my previous posts.

@Wulfcastle, but why would the thief amass all of the stolen btc in the same address? It would be that much easier to connect him to other events and hoard some more evidence. Maybe the address belongs to a mixing service?

The hacker is the same guy who stole the funds from Silk Road. The address he sent some BTC too is the same address that over 5,000 BTC stolen from the Silk Road hack was sent to. He could be either

1) The guy who stole the original Silk Road's funds and the proposed Silk Road 2's Funds

2) One of the owners of SK who stole their own users funds and make it seem as if a hacker took them


http://www.deepdotweb.com/2014/02/20/here-is-the-stolen-silk-road-wallet/

Could be someone relatively "close" to Klee, an owner of Silk Road 2(defcoin for example), or the hacker who stole from Silk Road

the 5K BTC may be unrelated to this hacker.  He just donated some of my tag BTC and a small bit of the stolen BTC to that address, maybe to try to throw us off.  It is only interesting that he donated my tag BTC there.

0.00112233 + 0.00011122 from me, 0.0006 from klee

[Wulfcastle]

Well, this suck big time. I hope klee gets the money back, even if there's not a fat chance. I wouldn't like to see the thief getting hurt, maybe just brought to justice.
Are we sure the btc isn't in some tumbler by now?

@Wulfcastle, but why would the thief amass all of the stolen btc in the same address? It would be that much easier to connect him to other events and hoard some more evidence. Maybe the address belongs to a mixing service?

Well it could, but based on the posts above mine it seems like the hacker has already been connected to other events., looking at it now it could very well be a mixing service.

[darkota]

Are we sure the btc isn't in some tumbler by now?

Yes we know exactly where they are, see my previous posts.

@Wulfcastle, but why would the thief amass all of the stolen btc in the same address? It would be that much easier to connect him to other events and hoard some more evidence. Maybe the address belongs to a mixing service?

The hacker is the same guy who stole the funds from Silk Road. The address he sent some BTC too is the same address that over 5,000 BTC stolen from the Silk Road hack was sent to. He could be either

1) The guy who stole the original Silk Road's funds and the proposed Silk Road 2's Funds

2) One of the owners of SK who stole their own users funds and make it seem as if a hacker took them


http://www.deepdotweb.com/2014/02/20/here-is-the-stolen-silk-road-wallet/

Could be someone relatively "close" to Klee, an owner of Silk Road 2(defcoin for example), or the hacker who stole from Silk Road

the 5K BTC may be unrelated to this hacker.  He just donated some of my tag BTC and a small bit of the stolen BTC to that address, maybe to try to throw us off.  It is only interesting that he donated my tag BTC there.

0.00112233 + 0.00011122 from me, 0.0006 from klee

Oh, in that case, he might of sent it there to throw us off like you said.

[laurentmt]

http://blockr.io/issue/1
Make a report!
https://blockchain.info/nl/tx/800ee228491d8591fd9da880c6d88d4c901ed1697e0aa43c010d7b0eafd796da
IP ADDY on here. Lives in France.
https://blockchain.info/nl/ip-address/46.105.103.92

This data means that blockchain.info has received the transaction from a peer located in France and not that the transaction was initially sent by this peer.
I guess that someone stealing such an amount has used some protections like a VPN and/or TOR (or he is really stupid and deserves to be caught).

[The Avenger]

the 5K BTC may be unrelated to this hacker.  He just donated some of my tag BTC and a small bit of the stolen BTC to that address, maybe to try to throw us off.  It is only interesting that he donated my tag BTC there.

Which probably means the hacker is bitcoin savvy. So less likely to be someone who randomly stumbled on an easy to hack dropbox and more like someone who knew what they were doing?

[ThomasVeil]

Great idea. I gave it a shot: https://twitter.com/oxpal/status/487696772803096576
If more people ask, maybe he picks it up.

Everyone should retweet this or send a tweet to Roger Ver about it. ^^

Agreed.  Everyone tweet it and copy Roger.  Lets show them how this community supports itself.  And lets show the clueless public that Bitcoin is the first public ledger of account.  Therefore safe.

Thanks for helping everyone! It worked: Retweeted by RogerVer.
Wish some more of the news sites would have picked it up. Maybe this helps.


I'm skeptical about the Dropbox route. One would have to figure out where the wallets are. Then where the password file is - and even in plain text which word the password is. Sounds still tricky - let alone to get in first. Keylogger is way more occamish.

[PilotofBTC]

Great idea. I gave it a shot: https://twitter.com/oxpal/status/487696772803096576
If more people ask, maybe he picks it up.

Everyone should retweet this or send a tweet to Roger Ver about it. ^^

Agreed.  Everyone tweet it and copy Roger.  Lets show them how this community supports itself.  And lets show the clueless public that Bitcoin is the first public ledger of account.  Therefore safe.

Thanks for helping everyone! It worked: Retweeted by RogerVer.
Wish some more of the news sites would have picked it up. Maybe this helps.


I'm skeptical about the Dropbox route. One would have to figure out where the wallets are. Then where the password file is - and even in plain text which word the password is. Sounds still tricky - let alone to get in first. Keylogger is way more occamish.

You don't type in your BTC private key (yes you do your NXT password), so how would a keylogger have got it? I do think the hacker got hold of this text file somehow.

[SirChiko]

Dear HEADHUNTERS,

43% of any btc I will be able to get back IF you find the identity of the thief!

If the whole amount will be returned to me (1170BTC) that would be 500BTC.

https://blockchain.info/nl/address/1GwNLwoCQiobJzmURSAq54vH4BYjFkwaxr

FIND HIM!!!

I feel sorry for you but it was your mistake, you had to protect that big sum of money better.
Also i've seen that nxt community is helping you so good luck!

[smoothie]

Great idea. I gave it a shot: https://twitter.com/oxpal/status/487696772803096576
If more people ask, maybe he picks it up.

Everyone should retweet this or send a tweet to Roger Ver about it. ^^

Agreed.  Everyone tweet it and copy Roger.  Lets show them how this community supports itself.  And lets show the clueless public that Bitcoin is the first public ledger of account.  Therefore safe.

Thanks for helping everyone! It worked: Retweeted by RogerVer.
Wish some more of the news sites would have picked it up. Maybe this helps.


I'm skeptical about the Dropbox route. One would have to figure out where the wallets are. Then where the password file is - and even in plain text which word the password is. Sounds still tricky - let alone to get in first. Keylogger is way more occamish.

Good lord Roger is everywhere....awesome!

[ThomasVeil]

the 5K BTC may be unrelated to this hacker.  He just donated some of my tag BTC and a small bit of the stolen BTC to that address, maybe to try to throw us off.  It is only interesting that he donated my tag BTC there.

Which probably means the hacker is bitcoin savvy. So less likely to be someone who randomly stumbled on an easy to hack dropbox and more like someone who knew what they were doing?

But not NXT savvy. He did several beginner mistakes.

I'm skeptical about the Dropbox route. One would have to figure out where the wallets are. Then where the password file is - and even in plain text which word the password is. Sounds still tricky - let alone to get in first. Keylogger is way more occamish.

You don't type in your BTC private key (yes you do your NXT password), so how would a keylogger have got it? I do think the hacker got hold of this text file somehow.

If Klee opened his BTC account, he had to use the wallet file. And that's where the hacker could grab it.
The thing with the dropbox is that I imagine it's not straightforward to figure out which file is a password text.

[WootKung]

UPDATE:

I HAVE FOUND THE HACKER, HIS IN THE BACK OF MY SUV. WE'RE DRIVING HIM TO THE JAIL NOW, WE'RE OFFERING HIM A QUICK CIGARETTE FIRST THO BRAH

#DOGTHEBOUNTYHUNTER


CAN WE HAZ BOUNTY OP?

[PilotofBTC]

UPDATE:

I HAVE FOUND THE HACKER, HIS IN THE BACK OF MY SUV. WE'RE DRIVING HIM TO THE JAIL NOW, WE'RE OFFERING HIM A QUICK CIGARETTE FIRST THO BRAH

#DOGTHEBOUNTYHUNTER


CAN WE HAZ BOUNTY OP?

Um, no. He said the bounty was a percentage of returned BTC, not capture of the hacker.