Please forgive my ignorance, but WTF ?

[bitlane]

So, in regards to the Bitcoinica ordeal....

The Facts:

Today, we have discovered a suspicious Bitcoin transaction that doesn't seem to be initiated by any one of the company owners. Some of them are not online at the moment so

this is not conclusive.

Suspicious transaction:

  {
        "account" : "",
        "address" : "182tGyiczhXSSCTciVujNRkkMw1zQxUVhp",
        "category" : "send",
        "amount" : -18547.66867623,
        "fee" : 0.00000000,
        "blockhash" : "00000000000003f6bfd3e2fcbf76091853b28be234b5473a67f89b9d5bee019c",
        "blockindex" : 1,
        "txid" : "7a22917744aa9ed740faf3068a2f895424ed816ed1a04012b47df7a493f056e8",
        "time" : 1336738723
    },

The IP address associated with the above address is 91.121.174.223 (according to blockchain.info)

So, just surfing around, I came across a few things that puzzle me:




So...The 'Receiver' of the 'SENT' bitcoins from Bitcoinica runs a pool on port80 ?

....and is generating blocks ? (as recently as June 1, 2012)






As I said, please forgive my ignorance, as I really do have no idea if any of this is even relevant, but I had to ask....

More links for your browsing pleasure maybe ?....

http://blockchain.info/tree/5416502

http://blockchain.info/ip-address/91.121.174.223

http://blockchain.info/tx-index/7504034/438fbc2bd1435a460743290ab8265a2e9a84589d55a40cb3e0c8f0d29f17a1b1

http://blockchain.info/tree/7504034

http://blockchain.info/address/1HBrT9Yjb4THfw7sFvAHtcU5q3vJrJMabq

http://blockchain.info/tx-index/7428041/4def4f169ce16d730558b48ced612f478dc6c849a9c2b398b281170c5fbccf55



I have no idea, as I said, if this is relevant, makes any sense....or is old news already.
I just figured a post couldn't hurt.
bitlane.

[casascius]

The main problem is that is not necessarily the IP that originated the transaction, just the first known to have relayed it.  Any node will relay a valid transaction. What blockchain.info records is the first node it heard a transaction from, and if the originator does not have his own connection to blockchain.info's servers (a very probable thing) blockchain.info simply can't know the offenders IP.

[vuce]

The IP address associated with the above address is 91.121.174.223 (according to blockchain.info)

This is just the IP of the one who relayed the transaction, as far as I know.

[Gabi]

The IP means nothing.
It's just the IP that relayed that transaction to blockchain.info. Not who created it (maybe yes maybe no, no way to know)

[bitlane]

AAhh..OK.

Sorry guys.

As I said, I have no idea how to even use blockchain.info to 'follow' TXs...LOL

[kokjo]

LOL, bitcoins can't be traced to a IP.

the ip in blockchain.info, is the ip that forwarded the transaction to blockchain.info, it is therefor not from the original sender of the bitcoins.

[Liberty Payout]

Felt like Sherlock for a sec, didn't you? 

[kokjo]

Felt like Sherlock for a sec, didn't you? 

he is a Internet detective, LOL.

[bitlane]

Felt like Sherlock for a sec, didn't you? 

No....lol

I just got lucky and started finding my own IP attached to a bunch of transactions that I have been involved in and didn't properly understand what it meant.....hehe

I suck at being a detective.

[Maged]

The reason why they post the IP is because it is extremely valuable when combined with statistical analysis to find out who sent a transaction. For a single transaction, it's worthless. For 40 transactions, not so much. The problem is finding enough transactions to make the IP useful. While we might never know the exact IP of a transaction, analyzing the IP of who relayed a transaction could tip off what country a transaction came from.

[dscotese]

There is probably a way - an expensive and time-consuming way - to track through the block-chain over the weeks/months/years after a theft has been recognized, and eventually identify the thief.  I doubt that 18,000 BC (about $90k, I guess) would cover it, but if the people we make fun of for sleuthing ignore our dispersions and keep at it, cooperate with each other, and get encouragement and help from us, that cost may go down.

So if and when we know who did it, what do we do then?  I kind of doubt that there's any state that would be willing to defend BitCoin (and I don't think I'd want them involved anyway).  That leaves vigilantes (which, for legal reasons, we can't condone) and tracking the criminal to pressure him/her until the thief pays back the stolen bitcoin.

I suppose this is already going on, but that the efforts are kept hidden from everyone in order to avoid alarming the thief who might then put extra effort into burying the trail.  I disagree with that reason.  I think any such efforts should be open, specifically because BitCoin users tend to be smart enough to "play chess" the way I like to play it - that is, honestly explaining my rationale to my opponent (if they want to hear it), under the assumption that, in the chess game this optimizes learning and engenders respect and friendship and, with the bitcoin thief sleuthing, the thief's efforts to thwart the pursuers' progress will backfire.  Especially since the openness of the process may not be complete (yes I know that's a bit duplicitous, but it seems justified).

So anyway, bitlane, I'm glad you looked into it and shared what you found. 

The thief is probably reading this and laughing at me.  That's why I've deployed my "Laugh-detector-inator" (apologies to Dr. Dufenschmirtz).  I recommend you give up now, whoever you are!

[bitlane]

So anyway, bitlane, I'm glad you looked into it and shared what you found. 

Sometimes it takes a 'simpler' mind to look at the situation, unattached - CALL ME RAINMAN

[Raoul Duke]

Well bitlane, I like you so I'll leave you some leads for you to follow...

You can see in this IRC log that BitcoinicaHacker used the usernames B1tcoinz and ageis on IRC http://ibot.rikers.org/20120521.html.gz

Looking for ageis on IRC logs I found some on #postfix IRC channel, which isn't much surprising, given that the dude used an exploited mailserver to pawn Bitcoinica and he's asking questions about, get ready, SASL and authentication stuff.
http://echelog.com/logs/browse/postfix/1321657200
http://echelog.com/logs/browse/postfix/1321743600

Also found an ageis on the IRC Bitcoin dev channel:
http://bitcoinstats.com/irc/bitcoin-dev/logs/2012/04/09/1
http://bitcoinstats.com/irc/bitcoin-dev/logs/2012/04/14/1
And the following that I found on #bitcoin-dev tells me that he's the same ageis on the #postfix

03:08    ageis kevin@ageispolis.net

Keep digging...
Every human makes mistakes and this dude is nothing else but human.

Now, if this helps to catch the guy, I want 10k BTC of reward lol

[ineededausername]

Well bitlane, I like you so I'll leave you some leads for you to follow...

You can see in this IRC log that BitcoinicaHacker used the usernames B1tcoinz and ageis on IRC http://ibot.rikers.org/20120521.html.gz

Looking for ageis on IRC logs I found some on #postfix IRC channel, which isn't much surprising, given that the dude used an exploited mailserver to pawn Bitcoinica and he's asking questions about, get ready, SASL and authentication stuff.
http://echelog.com/logs/browse/postfix/1321657200
http://echelog.com/logs/browse/postfix/1321743600

Also found an ageis on the IRC Bitcoin dev channel:
http://bitcoinstats.com/irc/bitcoin-dev/logs/2012/04/09/1
http://bitcoinstats.com/irc/bitcoin-dev/logs/2012/04/14/1
And the following that I found on #bitcoin-dev tells me that he's the same ageis on the #postfix

03:08    ageis kevin@ageispolis.net

Keep digging...
Every human makes mistakes and this dude is nothing else but human.

Now, if this helps to catch the guy, I want 10k BTC of reward lol

Most likely impersonated a reputable member to throw you off

[rjk]

Well bitlane, I like you so I'll leave you some leads for you to follow...

You can see in this IRC log that BitcoinicaHacker used the usernames B1tcoinz and ageis on IRC http://ibot.rikers.org/20120521.html.gz

Looking for ageis on IRC logs I found some on #postfix IRC channel, which isn't much surprising, given that the dude used an exploited mailserver to pawn Bitcoinica and he's asking questions about, get ready, SASL and authentication stuff.
http://echelog.com/logs/browse/postfix/1321657200
http://echelog.com/logs/browse/postfix/1321743600

Also found an ageis on the IRC Bitcoin dev channel:
http://bitcoinstats.com/irc/bitcoin-dev/logs/2012/04/09/1
http://bitcoinstats.com/irc/bitcoin-dev/logs/2012/04/14/1
And the following that I found on #bitcoin-dev tells me that he's the same ageis on the #postfix

03:08    ageis kevin@ageispolis.net

Keep digging...
Every human makes mistakes and this dude is nothing else but human.

Now, if this helps to catch the guy, I want 10k BTC of reward lol

Most likely impersonated a reputable member to throw you off

Yeah there needs to be some actual evidence. psy's stuff isn't evidence. And I'm sure rg can confirm that, since he's met him in person. I also have IRC logs that are pretty convincing.

[Raoul Duke]

Well bitlane, I like you so I'll leave you some leads for you to follow...

You can see in this IRC log that BitcoinicaHacker used the usernames B1tcoinz and ageis on IRC http://ibot.rikers.org/20120521.html.gz

Looking for ageis on IRC logs I found some on #postfix IRC channel, which isn't much surprising, given that the dude used an exploited mailserver to pawn Bitcoinica and he's asking questions about, get ready, SASL and authentication stuff.
http://echelog.com/logs/browse/postfix/1321657200
http://echelog.com/logs/browse/postfix/1321743600

Also found an ageis on the IRC Bitcoin dev channel:
http://bitcoinstats.com/irc/bitcoin-dev/logs/2012/04/09/1
http://bitcoinstats.com/irc/bitcoin-dev/logs/2012/04/14/1
And the following that I found on #bitcoin-dev tells me that he's the same ageis on the #postfix

03:08    ageis kevin@ageispolis.net

Keep digging...
Every human makes mistakes and this dude is nothing else but human.

Now, if this helps to catch the guy, I want 10k BTC of reward lol

Most likely impersonated a reputable member to throw you off

Did he? And he happened to impersonate it on some channel that isn't Bitcoin related, right?
And only him? Why not impersonate lot's of them, then?
Also, care to explain this
Name:    ageisp0lis
Posts:    11
Position:    Jr. Member
Date Registered:    October 22, 2011, 02:03:34 AM
Last Active:    May 21, 2012, 08:47:58 AM

Half hour after the usernames fuck up. Checking if somehow someone noticed it, maybe?

You guys can ignore it but the fact is: it's the only lead there is so far.

[FlashFire]

Wow, this is some shady stuff. I hope this gets solved. I love Bitcoinica.

[dscotese]

Everyone has the blockchain, and it seems like it would be pretty simple to write a program that would identify all the addresses to which the 18k BC have gone.  Of course, there are a crapload of these addresses, but that just increases the number of people who might get somewhere doing the following:

"Hey, my address is in that list because of a payment sent to me from XXXXX.  I can't find that person anywhere now, but the blockchain shows that the address they used to pay me had like 200BC in it.  Maybe that person, wherever he is, can help us find the thief."

Then maybe I'm that person, and I hear about this effort, so I check it out and say, basically, the same thing.

At some point the actual thief will feel that people are on his trail.

Is Bitcoinica offering any kind of compensation for the identification of the thief?  If they do, I think they ought to let him keep the reward if he turns himself in and returns whatever is leftover after the reward.

This thing about looking back through the blockchain really intrigues me.

I suppose that if I got a nice payment for something that wasn't so dear to me, I might not be willing to say "oh, yeah, I sold that to Mr.X" - but then I'd have no evidence that I'm not the thief.

Thieves have to spend slowly in order to avoid attracting the attention of the authorities, but in this case, the authority is a piece of code with 100% attention.  So should I start building code that will be able to identify all the addresses that currently hold BC that came from 182tGyiczhXSSCTciVujNRkkMw1zQxUVhp?  Or is there already that software?

[Stephen Gornick]

So should I start building code that will be able to identify all the addresses that currently hold BC that came from 182tGyiczhXSSCTciVujNRkkMw1zQxUVhp?  Or is there already that software?

Like this?
 - http://toolongdidntread.com
 - http://anonymity-in-bitcoin.blogspot.com/2011/07/bitcoin-is-not-anonymous.html

And here's a method that provides a visual traversal method if you want to do it manually:
 - http://blockchain.info/tree/5484758

Manual investigations or a flow analysis method will help reveal some identity where the use of bitcoin is typical.   But if basic precautions are employed, bitcoins can be used anonymously.  The thief knows to only spend anonymously, or ... like has been done already, to spend in ways where it doesn't matter like spending by donating to the bitcoin faucet, or giving away coins, "Robin Hood" style on IRC:
 - http://pastebin.com/3ukW7NpN
 - http://bitcointalk.org/index.php?topic=82581.0;all

 

[EhVedadoOAnonimato]

LOL, bitcoins can't be traced to a IP.

Don't be that sure. It's not that difficult to directly connect to all listening nodes.
That's the main reason I always put my bitcoin behind Tor.