1DkyBEKt5S2GDtv7aQw6rQepAvnsRyHoYM

[sadpandatech]

Would it help determine a standard of 'taint' from addresses not directly associated with pirate or sr if I were to publich a few active addresses of my own? I have a few that have had moderate use in the past few months but no sends/receives from any known pirate or sr connection. Would be curious to see if there is taint at all and how much if so.

[Spekulatius]

Would it help determine a standard of 'taint' from addresses not directly associated with pirate or sr if I were to publich a few active addresses of my own? I have a few that have had moderate use in the past few months but no sends/receives from any known pirate or sr connection. Would be curious to see if that taint at all.

In order for those standardized values to be of use, one would need to sample a sufficiently large number of addresses created after January 2012 (about 1 or 2 % of all addresses created after January 2012). Those sample address must be choosen truly randomly (related to SR, Pirate or not doesnt matter). In order to do so, you could e.g. shuffle them all randomly and choose the first 1 or 2%, write them all down  with a number attached to them and then let a random number generator choose 1 or 2% of them for you, etc.

[notme]

Would it help determine a standard of 'taint' from addresses not directly associated with pirate or sr if I were to publich a few active addresses of my own? I have a few that have had moderate use in the past few months but no sends/receives from any known pirate or sr connection. Would be curious to see if that taint at all.

In order for those standardized values to be of use, one would need to sample a sufficiently large number of addresses created after January 2012 (about 1 or 2 % of all addresses created after January 2012). Those sample address must be choosen truly randomly (related to SR, Pirate or not doesnt matter). In order to do so, you could e.g. shuffle them all randomly and choose the first 1 or 2%, write them all down  with a number attached to them and then let a random number generator choose 1 or 2% of them for you, etc.

Good point, even with my 10 random addresses there will not be enough data to provide a statistically accurate baseline.

[dooglus]

I meant the other way... how much is the pirate closure tainting say the receiving addresses of the last 10 transactions (or 10 random transactions since we are getting close to his weekly payout time)?

Feel free to use the block parser to gather you own stats and reach your own conclusions

Code:

$ ./parser taint file:PIRATE-SPENDS
fatal: file:PIRATE-SPENDS is not a valid TX hash
Aborted (core dumped)

It seems like github doesn't have your newest version.  I don't think it has the ability to load keys from a file for the 'taint' command in the version you published...

[dooglus]

Oops, you're right.
Apologies, I forgot about that part.
I'll try to clean the code and push sometimes today.

Great.

The first time I ran the taint script you just published, it ran for half an hour before I realised what was up.

I modified the 'cluster' routine so it would cluster the blockchain then prompt in a loop for the address to cluster, making it much faster if you want to cluster multiple addresses.  So it was just sat there prompting, but with the prompt redirected to the output file so I didn't see it.

Doh!

[Shadow383]

I meant the other way... how much is the pirate closure tainting say the receiving addresses of the last 10 transactions (or 10 random transactions since we are getting close to his weekly payout time)?

Feel free to use the block parser to gather you own stats and reach your own conclusions

Since you already have it up and working, what does your block parser say about these addresses that I traced coins to manually?

Has anyone on here tried tracking large payments made to/from BTCST? Ponzi or not I'd be interested to see where they go...

+1

Okay, a touch of digging:

Last week, BS&T paid out 26,000 BTC in interest.

i really wonder how anyone can know this.

the reason is, because when i ask for a withdrawal, it comes in exactly the same transaction as the interest payment.

so if someone is due to be paid 100 in interest, but they request a 400 btc withdrawal at the same time, everyone seems to assume they have (500 / 0.07) invested when in reality their balance is much lower.

I was just hinted at this post. This is not at all what is seen on the block chain and what users say.

Bitcoinmax withdrawal from BS&T matches very well with http://blockchain.info/address/19kEo3qmuUdAQb1Q7VZhRwahw5v3NSZCeW?filter=0

The 800 payment last Wednesday can be timed with withdrawal requests shown on the forum. I also was told by BS&T users that they could withdraw at any time, and Bitcoinmax offers withdrawals within 24h, explicitly allowing "withdrawals at any time"! How could the withdrawals be delayed until the next Monday with such promises?

Furthermore, look at the immediate large re-investment on Monday last week. Withdrawal?

One of the inputs to that address (presumably controlled by BTCST) is: http://blockchain.info/address/1PSf86KnLuzM7Ris5kDhTEZwooR3p2iyfV

Which is an output of some mining done by GPUMAX on their private pool:

The following address is managed by GPUMAX.

• 1PSf86KnLuzM7Ris5kDhTEZwooR3p2iyfV
  

Sorry it wasn't more interesting.

-pirate

If we trace some of those other inputs they end up here, which seems to be a mixer:
http://blockchain.info/address/1JEbx1x7k2ZukVFYBVidSA3fu2eCTLJ3b2
Which was since empties to here:
http://blockchain.info/address/1ELwS9w4B3vBPt7Mw5Her9GcBbzNMYqhy3
And a lot of those funds ended up here:
http://blockchain.info/address/16cou7Ht6WjTzuFyDBnht9hmvXytg6XdVT

There's also a 2500BTC payout from the "fee" address on the GPUMAX blocks which goes here:
http://blockchain.info/address/1PgxmSTp597CttDGkTAZRinPLDNFam2TTe

Which sent 10000BTC here:
http://blockchain.info/address/12PwokEjewCyxb3Jt19eAsaFXiQZf9T6rq
and 5000BTC here:
http://blockchain.info/address/13imTtV8ULYUwi9okX5bwtFFM2XQnzH7Yb
Which according to this transaction:
http://blockchain.info/tx-index/13212954/ca1c06bddca9723729b840d9a327b03a3920094bf3b01b79583312ee3a3adaf8

Links it to this vanity address here:
http://blockchain.info/address/1Pirate2EW1a89CgrF1KHR9Z5vcWurDxtK

So, noteable linked places with funds stored recently:
http://blockchain.info/address/1h3wA6JHSUrGzUpnVVS1f5iwDy7iHQxk9 (5000BTC)
http://blockchain.info/address/1Epc6YPR3gkNXpAxRRNGPPUyHJ4pdj7nUR (3000BTC)
http://blockchain.info/address/1FUaTPahUCvpCeoLvxBrmtxnq53squNFHF (3500BTC)
http://blockchain.info/address/16cou7Ht6WjTzuFyDBnht9hmvXytg6XdVT (54000BTC)

So whatever he's doing the mixing system is complex, but it's interesting that GPUMax blocks are easily traced into BTCST payouts.
What this needs is someone infinitely more knowledgeable than myself to see how interconnected these addresses really are...

[notme]

I meant the other way... how much is the pirate closure tainting say the receiving addresses of the last 10 transactions (or 10 random transactions since we are getting close to his weekly payout time)?

Feel free to use the block parser to gather you own stats and reach your own conclusions

I see, so you publish research without providing a baseline.  Good scienceing.

My, are we grumpy this morning ... could it be that your latest
SR shipment is late and your mood is starting to suffer  ?

This is not a scientific study. I'm just pulling some raw data out
of the chain and publishing the tools I used to do that. That's all.

If you find said data useless or irrelevant, you are hereby granted
my official permission to ignore it.

28% taint on one transaction could just be somebody cashing out from pirate and spending 28% of it on drugs, could it not?

Absolutely correct, but the fact that *many* of the TXs going into the
fat address have a strong pirate taint strongly increases the likelihood
that the two addresses are "related". And that is easy to check, I published
the taint of every TX coming into the fat address.

The 6% total taint is slightly more interesting, but again, we have no baseline for comparison.

You already have everything setup, it would take me an hour to get started.  If the problem is picking the addresses, here's 10 I pulled pseudorandomly from various recentish transactions:
17qq5A3XKfrxpJRSC5LH6APjvTDb9hTmma
19NmcoeHo2qwEFjQdUrbGuk34SU2fgfDeg
14hYbtGjTButtsYhCwsJpGBD9TMdMY6DKt
1MW2LCfz7bvFZJG88QTeC3a1cUHLSbS2ty
16VsQigp45paX9cwt8Ees6hAPbMpNSUjj
1dice8EMZmqKvrGE4Qc9bUFf9PX3xaYDp
1QGyQGd9WprNZ4ud75jUVE4gcjEWxwUv1L
12oiay6fiaFhHU2sPeCad18Myr5nHJzgGa
1KJTGpNzYsFibLmq9WaTGAXQbhRFUgnG3z
1VayNert3x1KzbpzMGt2qdqrAThiRovi8

I'll see what I can put together in terms of a baseline.

I've never made a purchase from SR, thanks.

Thank you for taking a look at creating a baseline.

[notme]

I've never made a purchase from SR, thanks.

That's too bad, I hear the products found there can
in particular help developing one's sense of humor.

So, if I take drugs I might find you funny?

[molecular]

Result: most of transactions spending to the FAT address exhibit a very strong
taint from the closure (from 1% to 28%).

Pirate likes to smoke lots of weed?

[finkleshnorts]

Result: most of transactions spending to the FAT address exhibit a very strong
taint from the closure (from 1% to 28%).

Pirate likes to smoke lots of weed?

Texans don't smoke weed.

[Spekulatius]

Result: most of transactions spending to the FAT address exhibit a very strong
taint from the closure (from 1% to 28%).

Pirate likes to smoke lots of weed?

Texans don't smoke weed.

Maybe we mistake this address with the armory then?

[molecular]

Result: most of transactions spending to the FAT address exhibit a very strong
taint from the closure (from 1% to 28%).

Pirate likes to smoke lots of weed?

Texans don't smoke weed.

Maybe we mistake this address with the armory then?

lol, good one! I bet he's armed to the teeth by now

[dooglus]

   - addr 12oiay6fiaFhHU2sPeCad18Myr5nHJzgGa (last line)  has a closure size of
      about 200K addresses ... and taints the fat address like crazy (86%) . Very much
      looks like some sort of feeble attempt at laundering.

That large closure is MtGox.  My MtGox deposit address is in the same closure.

[nrd525]

Pirate's taint will be far higher than other people simply because he controls more bitcoins.

[Shadow383]

There's been some movement on some of the big addresses I pointed out here:
https://bitcointalk.org/index.php?topic=94675.msg1065019#msg1065019

One of them I suspect is just a passthrough as it makes a lot of small payments, but there's large amounts still moving in and out of the bigger ones too.

[Spekulatius]

I have a thought



Dread Pirate Roberts is SR's admin dude...



Pirateat40 is the same guy  SR brings in tons of profit, enough to pay the interest he's offering.....

I had the exact same idea. It would explain the odd correlation of the FAT address to both entities (pointed out by taint analysis):
https://bitcointalk.org/index.php?topic=94675.100

Also the fact, that pirate claimed on IRC to have moved the market on the 17th of July "for the first time" (line No 729.) in which 70k BTC were sold, just before that (some minutes/hours before) 70k were withdrawn from that address, for the first time.

Now the similar names of both heads of the operation.

Things add up, he can now effectively mix bitcoins used for buying drugs with those invested into his BS&T or his GPUMAX operation.

Where do the 7% per week come from to pay off his lenders? --> Profits of GPUMAX, Silk Road and The Armory

[dooglus]

his Gigamining operation.

GPUMAX.  Gigamining is something else.

[Spekulatius]

his Gigamining operation.

GPUMAX.  Gigamining is something else.

Thx, got that corrected

[nimda]

Oh boy.
Dread Pirate Roberts
pirateat40

coins sent to silk road go to the fat address
the fat address has a strong pirate taint

there was a withdrawal from that address when pirateat40 (unauthenticated) said he moved the market

proprietary mixing scheme

Here we go

[Spekulatius]

Oh boy.
Dread Pirate Roberts
pirateat40

coins sent to silk road go to the fat address
the fat address has a strong pirate taint

there was a withdrawal from that address when pirateat40 (unauthenticated) said he moved the market

proprietary mixing scheme

Here we go

Does that mean his ponzi wont default any time soon then? lol