klee's hacked 1170 btc, Part II

[The Avenger]

Wrong. No mixing has taken place on the major balances:

Then please explain what was the post from the mixing service was referring to then?

Hacker mixed BurtW's tags, that was all.

You are a very bitcoin/nxt/scripting savvy person, you should know that.

[CIYAM]

Hacker mixed BurtW's tags, that was all.

You are a very bitcoin/nxt/scripting savvy person, you should know that.

I didn't look into this situation in much depth at all but had noticed the mixing service itself making a statement (which I thought referred to a lot more than just some tags).

So the hacker has only mixed a small % of the coins? Is that the 4.62 BTC that had been sent?

The 36 days still seems rather fishy to me though.

[SirChiko]

Hacker mixed BurtW's tags, that was all.

You are a very bitcoin/nxt/scripting savvy person, you should know that.

I didn't look into this situation in much depth at all but had noticed the mixing service itself making a statement (which I thought referred to a lot more than just some tags).

So the hacker has only mixed a small % of the coins?

The 36 days still seems rather fishy to me though.

It's more like 36 days to move to another state not to mix the coins 

[CIYAM]

It's more like 36 days to move to another state not to mix the coins  

Or another country (yes - my sentiments exactly).

[SirChiko]

It's more like 36 days to move to another state not to mix the coins  

Or another country (yes - my sentiments exactly).

Yep or probably that.

Obviously, the hacker was starting to feel the heat of being scrutinized so much and worried that the mixing funds might get frozen somehow.  I really think that klee should man up like Roger Ver and leave no quarter for the scum.  Taking a token from him only condones that the behavior pays off.  It is time to turn up the heat now and not kowtow.  You have another bit in the puzzle in that the email service (albeit anonymous) might have an IP to go with the hacker. Every lead counts.

My vote is fry him, he is already nervous, don't let him sleep well at night.  Remember mister hacker, not everyone is silly enough to tip you off by posting in a forum.

That's nice but klee already claimed that he has fammily and that the hacker had full control of his computer (emails included etc) and i don't wonder that klee is worried about his family even thought it was maybe just some skinny 19 years old kid. 

[The Avenger]

The 36 days still seems rather fishy to me though.

It's more like 36 days to move to another state not to mix the coins  

Some people have discussed it could be log files are generally deleted after 28 days.

The hacker knows his information has been exposed somewhere, so he is trying to end it now with this poor offer.

Although klee is worried about his personal info being exposed by the hacker, the hacker is probably some fat old computer slob who wouldn't survived a week in prison and knows it. It makes no sense for a victim to back down to a coward who is cornered. But that is the publicly available story we are discussing in this thread 

[SirChiko]

The 36 days still seems rather fishy to me though.

It's more like 36 days to move to another state not to mix the coins  

Some people have discussed it could be log files are generally deleted after 28 days.

The hacker knows his information has been exposed somewhere, so he is trying to end it now with this poor offer.

Although klee is worried about his personal info being exposed by the hacker, the hacker is probably some fat old computer slob who wouldn't survived a week in prison and knows it. It makes no sense for a victim to back down to a coward who is cornered. But that is the publicly available story we are discussing in this thread 

That may be true also, have you ever seen bodybuilded dude with huge gang as a hacker? His phisycal condition is probably really really poor and judging by that ammount of time he wants between these transactions he clearly left some traces in dropbox, someone should make the dropbox developers give us the IP. 

[Light]

That may be true also, have you ever seen bodybuilded dude with huge gang as a hacker? His phisycal condition is probably really really poor and judging by that ammount of time he wants between these transactions he clearly left some traces in dropbox, someone should make the dropbox developers give us the IP. 

No offense, but I fail to see what his physical abilities have to do with his hacking abilities (if it is even a he). Not trying to be a big downer, but to be brutally honest if you were to go via the criminal justice system your case would probably collapse if you didn't have much more information than his IP to prove that he did it. From what I've read (and learnt), judges don't really believe that an IP equates to a specific person (as piracy cases will show you). How would you even prove he stole it, although unlikely, he could claim that it was transferred by klee to him for some unbeknownst reason? And how would you know you had the right guy, unless you managed to get a warrant for police to raid his equipment?

Or would you just take the more dangerous and possibly convenient route and hire someone to scare him/worse? And even worse, what happens if you get the wrong guy?

[QuarantinedMoon]

I wonder whether this thread will affect whether the scammer sends back the funds to klee... he at least could use it as another delaying excuse and isn't particularly helpful to him. I don't think there is a lot to be discussed here, but the fact that he is even offering any kind of repaid funds suggests he might be a bit worried about being found out... if I was klee I'd pursue him further as the scammer's tracks may not be untrackable.

[Cablez]

The problem is time is working against klee.  Every day that passes means less residue remains to locating this person.

[SirChiko]

That may be true also, have you ever seen bodybuilded dude with huge gang as a hacker? His phisycal condition is probably really really poor and judging by that ammount of time he wants between these transactions he clearly left some traces in dropbox, someone should make the dropbox developers give us the IP. 

No offense, but I fail to see what his physical abilities have to do with his hacking abilities (if it is even a he). Not trying to be a big downer, but to be brutally honest if you were to go via the criminal justice system your case would probably collapse if you didn't have much more information than his IP to prove that he did it. From what I've read (and learnt), judges don't really believe that an IP equates to a specific person (as piracy cases will show you). How would you even prove he stole it, although unlikely, he could claim that it was transferred by klee to him for some unbeknownst reason? And how would you know you had the right guy, unless you managed to get a warrant for police to raid his equipment?

Or would you just take the more dangerous and possibly convenient route and hire someone to scare him/worse? And even worse, what happens if you get the wrong guy?

I'm pointing on that that klee accepted his defeat as he is worried about his fammily, he claimed that in another thread wich i'm currently not sure about wich one it was.

[BurtW]

The BTC has already been through a mixer

Wrong. No mixing has taken place on the major balances:

https://blockchain.info/address/1PkzdYBpcLvf5kKUanbp7dpGEjt9AvNVmN
https://blockchain.info/address/1EyJWr7qwJazi8F4q3uEXDJLRhSHkqfaGd
https://blockchain.info/address/1HZMa4M9ZXmcLEvALVop8Ks1dJFApMdKEU

The coins are being split into smaller and smaller amounts, but are still totally traceable to the original stolen balance.

The way the mixer works is this:

1) You put the coins you want mixed into the system.
2) After just a few confirmations and subtracting out the 0.5% fee the mixing system sends you new mixed coins that it already has in reserve.
3) At that point the thief was done, they had their stolen coins back from the mixer within a few confirmations.

4) After the transaction is complete the mixing service goes to work on the coins that the customer sent to them.  The coins are chewed up over many hours/days and spun with other coins they have in reserve getting them ready to send out to other customers.

So, you can see that the addresses you are looking at have nothing to do with the thief's new coins they got from the mixing service.

Your statement:

Wrong. No mixing has taken place on the major balances

is incorrect.  It would more acurate to say:  The original coins are being processed.  The thief is long gone.

[cech4204a]

Thats a sick amount.. But the guy should be trackable don't you think so?

The BTC has already been through a mixer (as was noted by the mixer service in Klee's topic) and supposedly all records that could have traced the mixing have already been deleted (so there is no way that they can trace the hacker without at least losing their credibility as a mixing service).

I do think that the stuff about having 36 days to return the 462 BTC amount doesn't look very legit (i.e. the hacker gains 1 month to "disappear to another country").

I believe that hacker is not from the same country as the victim, therefore, hacker doesen't need a month for that reason. Maybe hacker is just playing a game with the guy to have better sleep, when he will stop bounty after him.

[SirChiko]

The BTC has already been through a mixer

Wrong. No mixing has taken place on the major balances:

https://blockchain.info/address/1PkzdYBpcLvf5kKUanbp7dpGEjt9AvNVmN
https://blockchain.info/address/1EyJWr7qwJazi8F4q3uEXDJLRhSHkqfaGd
https://blockchain.info/address/1HZMa4M9ZXmcLEvALVop8Ks1dJFApMdKEU

The coins are being split into smaller and smaller amounts, but are still totally traceable to the original stolen balance.

The way the mixer works is this:

1) You put the coins you want mixed into the system.
2) After just a few confirmations and subtracting out the 0.5% fee the mixing system sends you new mixed coins that it already has in reserve.
3) At that point the thief was done, they had their stolen coins back from the mixer within a few confirmations.

4) After the transaction is complete the mixing service goes to work on the coins that the customer sent to them.  The coins are chewed up over many hours/days and spun with other coins they have in reserve getting them ready to send out to other customers.

So, you can see that the addresses you are looking at have nothing to do with the thief's new coins they got from the mixing service.

Your statement:

Wrong. No mixing has taken place on the major balances

is incorrect.  It would more acurate to say.  The original coins are being processed.  The thief is long gone.

But then there is no point of thief returning the coins, only if he knows that he exposed his real IP, or left any other traces somewhere along the way. 

[BurtW]

But then there is no point of thief returning the coins, only if he knows that he exposed his real IP, or left any other traces somewhere along the way.  

True, but that is a totally different issue.

[Hazir]

Why doesn't he go to FBI with this? I am sure they have the resources to deal with that. Did not they catch some traders from Silk Road?

[Dread Pirate Roberts]

hacker step .
1 . infected pc of victims
2 . monitoring activity full
3 . check all keylogging
4 . crack all item of victims
5 . take all . and leave

maybe him get infected . he must know what he do in internet

[The Avenger]

Your statement:

Wrong. No mixing has taken place on the major balances

is incorrect.  It would more acurate to say:  The original coins are being processed.  The thief is long gone.

Are you saying bitmixer had 1170BTC in reserve, paid them out instantly to the hacker and bitmixer are now in the process of mixing the stolen 1170, which is the splitting we are seeing on the blockchain?

Okay, I looked at the bitmixer FAQ.

We have a large Bitcoin reserve in our mixer (currently 2236.72 BTC)

Massively risky transaction for bitmixer to carry out if the FBI got involved and force them to hand over control of those coins.

Basically now bitmixer.io are fully responsible for the theft and are in possession of the stolen funds, right? They've basically accepted a suitcase full of marked banknotes and exchanged them for a suitcase full of unmarked banknotes. And fully admitted to it in the old thread:

Hello. I've been asked about explanation.
Yes, the hacker used our service. Yes, he already got new coins. Please read more how our service works: https://bitmixer.io/how.html
Can we tell you forward addresses where new coins have been transferred to? No. We really don't know. We completely delete all order's data after 12 hours. I'm sorry that someone lost their bitcoins. I understand this is a crime. But if our service can't protect criminal, it will not be able to protect you too.
Regards,

https://bitcointalk.org/index.php?topic=686275.msg7816359#msg7816359

So bitminer.io done it. Inform the Oslo police. Please bitminer.io, return funds to klee and bounty to me if you don't want to spend the rest of your life in prison. Thanks

[x8008]

Bitmixer is just as responsible for this, may justice be served and I hope it does!

[CIYAM]

Bitmixer is just as responsible for this, may justice be served and I hope it does!

It isn't up to bitmixer or others to "be the police" (how can they even be sure there was any theft?).

Bitcoin has given us some amazing freedom but at a much higher cost of "personal responsibility" for looking after our private property.