okay... so the major sell off happened @2am and cryptsy turned off trading around 4:30am (EST)... so, how at around 4am did garza know it was a hack and not just some holder dumping their position? The original sells were around 45k, 17k, 15k (in 15min blocks)... why did they jump to 'we're being hacked' and not think that someone just got fed up with it and dumped? I wonder who had access to the wallet.paycoin.com private keys. This sounds like josh making good on his "this is the end of paycoin" threat more than someone willing to hack a two-bit coin.
A couple weeks ago when the "hack" txids were released by TeamPaycoin, I traced XPY going from their wallets and doing the Homero Shuffle and some going in and out of GAW/Josh wallets, some staying in them, particularly "Santa's Wallet":
And that is not including the coins that came straight from the Pre-Mine and went to exchanges. I am rather busy today, but I traced back a couple of transactions from the Paycoin.com "hack", and I can say for sure that the
outputs are linked to some of the same wallets associated with GAW/Josh and the shuffling of XPY on a massive scale, and also some of the "stolen" coins go straight back to some of the largest addresses in the TeamPaycoin/Paycoin.com wallet. This evening I will try to put something together, but for now here is some of what I found in a quick trace of the "hack" transactions.
This is the first txid in the list.
https://chainz.cryptoid.info/xpy/tx.dws?fcbb640f4a65476bd1794b613658fc12a5428e23676e6032cbdc8207d02b9279.htmgoing forward it goes in and out of this wallet. This looks like bot action, and I will get to that other amount that went in and out after this...
https://chainz.cryptoid.info/xpy/address.dws?PDEYQFCKCG8HaptW5P6kHAu2Nk8JKmZW4U.htmfrom which this group of 222 leaves in this transaction and is combined with 249 XPY taken from Cryptsy.
https://chainz.cryptoid.info/xpy/tx.dws?466510.htmThat group then lands in this old and well used address:
https://chainz.cryptoid.info/xpy/address.dws?PJDDaTtn5T23x84Uik4brAgfXUfy2NygEE.htmThat address directly received (after the usual shuffle) coins directly taken from the Pre-mine. However, back to this group of "stolen" XPY, they get combined with some other "stolen" coins IN this address, and leave in this transaction:
https://chainz.cryptoid.info/xpy/tx.dws?471787.htmWhere 1,000 are deposited into Cryptsy, and have not moved, and the other ~800 are sitting in this wallet here:
https://chainz.cryptoid.info/xpy/address.dws?PB1mqKFEBjxsoCnbod6dh62vmLn8ob5Xm1.htmOK, so we know these "stolen" XPY went into and out of a wallet associated with the premine and with the paycoin shuffle that has been going on from day 1. Now, lets look at that group of 199 "stolen" coins, which are associated with this listed txid from the "hack".
https://chainz.cryptoid.info/xpy/tx.dws?466257.htm and bounce through the same shuffle address as the group of 222 traced before, this one:
https://chainz.cryptoid.info/xpy/address.dws?PDEYQFCKCG8HaptW5P6kHAu2Nk8JKmZW4U.htmFollowing the group of 199 XPY forward we leave in this tx:
https://chainz.cryptoid.info/xpy/tx.dws?467447.htmWhere they combine with other "stolen" coins, some bouncing through a Cryptsy account. They then land as a group of 621 XPY in this address:
https://chainz.cryptoid.info/xpy/address.dws?PSb9znGtdYkZqcTcNg1i8ycadiRHYCDNg6.htmThis address is back in the Paycoin.com wallet, and appears to be one used to distribute to individual users addresses, perhaps someone has more information on this address? It has received and sent over 116,000 XPY since 1-16-2015. Whatever it is, that group of 621 XPY then leaves this Paycoin.com address (because thieves always put the money they stole back in the same bank for a while, just to fuck with people- right?) in this tx:
https://chainz.cryptoid.info/xpy/tx.dws?467454.htm and lands in another Paycoin.com wallet (these "thieves" are real jokers
) here:
https://chainz.cryptoid.info/xpy/address.dws?PJCaAXtVDXgDoBoeuFoPqwM4bQCyWChToU.htmWhere it is mixed with a small amount of XPY, and then 155 XPY leaves in this tx, the rest remaining there until now.
https://chainz.cryptoid.info/xpy/tx.dws?481885.htmIt is combined with tiny amounts from other addresses (haven't traced)in that tx, and is now a 156.9 XPY group which goes to this address:
https://chainz.cryptoid.info/xpy/address.dws?PGWKtKvLfAFUxvmhzHkikXwPEc93tZz6eQ.htmWhich had another wayward group of 100 XPY go in and out. Havn;t followed those, but this group of 156.9 leaves in this tx yesterday:
https://chainz.cryptoid.info/xpy/tx.dws?482838.htm where it is split into two groups; 100 and 56. Here is the address where the group of 100 goes, and still remains:
https://chainz.cryptoid.info/xpy/address.dws?PWG5UaTcFyVZquZRDWJ8LdjJUXbUbJSQBD.htmI call this Santa's address, as it was created on 12-25-2014, and has received large amounts of XPY straight from the pre-mine, and has not seen any activity since 12-29 (no staking and non redeemed inputs, meaning it has not synched since then). It's current balance is 34,124.882546 XPY , ranked # 74 on the Rich List! Why did the "thieves" put the loot in this address? Who owns this? Why did they receive pre-mine? Why did the "stolen" XPY go here??? WTF?? These things all say inside job to me, I am sure
someone will disagree.
To finish this little bit of sleuthing, the other 56 XPY shaved off in that transaction from which the 100 came from shuffle through this address:
https://chainz.cryptoid.info/xpy/address.dws?PT5jJgfTHVjkgC5uRm5UUw92P56MzbYMHX.htmleaving in this tx:
https://chainz.cryptoid.info/xpy/tx.dws?484126.htm They are split into two groups, one of 49 which goes directly to the 34,124 XPY address above, and the other 7 shuffling through this addy:
https://chainz.cryptoid.info/xpy/address.dws?PQvaB9gNySbEQrYscq1k3wwhsX5co4QM2r.htmLeaving in this tx:
https://chainz.cryptoid.info/xpy/tx.dws?485232.htm where they are split into 2 groups (sound familiar yet?) , 5 going here
https://chainz.cryptoid.info/xpy/address.dws?PCucwVa23F7HZ7CXrYdBw7Ebn1rH29xutR.htmand 2 going to the same 34.124 XPY address above.
These are either the stupidest hackers on the planet (putting 1,000 XPY in Crypsty and not touching it? Sending 800XPY to an address and leaving it? , sending stolen XPY back to where it came from, while the Paycoin.com wallets were supposedly offline, no less? Sending XPY to GAW wallets? Sending XPY to a wallet that has not synched since 12-29?) or, it was an inside job. Or of course some combination of those two things maybe.
P.S.: Surprise Surprise. The day after I posted that bit about some of the "stolen" XPY from TeamPaycoin ending up in Santa's Wallet, which had not synched since 12/29, that wallet went active and since then has moved a massive amount out (All of it):
Taking a quick glance at the ~82,000 XPY group leaving, it goes into some Homero Shuffle addresses. In other words the last "hack"= Homero. I may spend some time and try to see what happened last night, but I know what I would bet on....