Public STATEMENT Regarding Bitcoinica account hack at MtGox

[Herodes]

We should start asking what Matthew has to loose in this case.

http://en.wikipedia.org/wiki/Anal_retentiveness

The term anal-retentive (also anally retentive), commonly abbreviated to anal,[1] is used conversationally to describe a person who pays such attention to detail that the obsession becomes an annoyance to others, potentially to the detriment of the anal-retentive person. The term derives from Freudian psychoanalysis.

[1713909642]

1713909642

[1713909642]

1713909642

[1713909642]

1713909642

[Blazr]

Relevant?

Session Time: Fri Jul 13 00:00:00 2012
[00:49] * phantomcircuit (~phantomci@c-67-188-9-35.hsd1.ca.comcast.net) has joined #intersango
[00:49] * ChanServ sets mode: +o phantomcircuit
[01:01] * phantomcircuit sets mode: -o phantomcircuit
[01:01] * phantomcircuit is now known as steve_bobs

Session Time: Fri Jul 13 00:00:00 2012
[00:49] * phantomcircuit (~phantomci@c-67-188-9-35.hsd1.ca.comcast.net) has joined #bitcoinconsultancy
[01:01] * phantomcircuit is now known as steve_bobs

Session Time: Fri Jul 13 00:00:00 2012
[00:49] * phantomcircuit (~phantomci@c-67-188-9-35.hsd1.ca.comcast.net) has joined #bitcoinica
[01:01] * phantomcircuit is now known as steve_bobs

I call fake on that chat-log. I can't find any evidence of that anywhere.

[cryptoanarchist]

Relevant?

Session Time: Fri Jul 13 00:00:00 2012
[00:49] * phantomcircuit (~phantomci@c-67-188-9-35.hsd1.ca.comcast.net) has joined #intersango
[00:49] * ChanServ sets mode: +o phantomcircuit
[01:01] * phantomcircuit sets mode: -o phantomcircuit
[01:01] * phantomcircuit is now known as steve_bobs

Session Time: Fri Jul 13 00:00:00 2012
[00:49] * phantomcircuit (~phantomci@c-67-188-9-35.hsd1.ca.comcast.net) has joined #bitcoinconsultancy
[01:01] * phantomcircuit is now known as steve_bobs

Session Time: Fri Jul 13 00:00:00 2012
[00:49] * phantomcircuit (~phantomci@c-67-188-9-35.hsd1.ca.comcast.net) has joined #bitcoinica
[01:01] * phantomcircuit is now known as steve_bobs

I call fake on that chat-log. I can't find any evidence of that anywhere.

<sarcasm>
You mean btcx isn't a reputable source?!?
</sarcasm>

[guruvan]

Relevant?

Session Time: Fri Jul 13 00:00:00 2012
[00:49] * phantomcircuit (~phantomci@c-67-188-9-35.hsd1.ca.comcast.net) has joined #intersango
[00:49] * ChanServ sets mode: +o phantomcircuit
[01:01] * phantomcircuit sets mode: -o phantomcircuit
[01:01] * phantomcircuit is now known as steve_bobs

Session Time: Fri Jul 13 00:00:00 2012
[00:49] * phantomcircuit (~phantomci@c-67-188-9-35.hsd1.ca.comcast.net) has joined #bitcoinconsultancy
[01:01] * phantomcircuit is now known as steve_bobs

Session Time: Fri Jul 13 00:00:00 2012
[00:49] * phantomcircuit (~phantomci@c-67-188-9-35.hsd1.ca.comcast.net) has joined #bitcoinica
[01:01] * phantomcircuit is now known as steve_bobs

? Wtf ? 
If this log is real, this guy's got some explaining to do

I just read through all of this and missed if there was a follow-up to this post?

The IP in question is an american one, which doesn't necessarily mean anything. But it seems from that log (if legit), that phantomcircuit is given op privilegies, which means he should be identified with NickServ? AFAIK, you can authenticate from any ip, so if phantomcircuit's e-mail was compromized earlier on (as was stated on this forum), then his IRC personality could be compromized as well, for all we know, his computer(s) may be backdoored.

Googling ~phantomci@c-67-188-9-35.hsd1.ca.comcast.net gives some results, but I'm not going to do anymore research, if anyone feels up to it, go ahead.

I don't know Zou Thong, but personally I would've never have sold my operations to any 'security expert' that's previously been inolved in cracking said operations and boasting on it in a public forum...

http://bitcoinstats.com/irc/bitcoin-dev/logs/2011/09/12/4
http://bitcoinstats.com/irc/bitcoin-dev/logs/2011/09/12/5

Did some research anyway:
41 days ago, the same identity was used by a user called phantomcircuit:
http://pastie.org/4096261

Aparently he's discussing the pay back process rather grumpily on that occasion.

Yes. He was quite pissed off at me in particular. I raised questions very early on after signing into this forum the first time - why the fuck do people trust this guy who has been known to hack competitors' sites?

phantomcircuit is one of the least trustworthy people I know in bitcoin. He is a calculating, deceitful, and dishonest person. Getting him to tell the truth is nearly impossible. I find it highly suspect that he left after the last hack. I found it highly suspect that the first hack happened not long after he had access to bitcoinica.

But, now ZT's bullshit story of the "friend" calls that motive into question. I have to wonder if there aren't MULTIPLE parties looting bitcoinica.

It has been my opinion since the hack, that the hack that closed bitcoinica was premeditated and intended to cover up the significant losses of customer funds due to "bad hedges" (or, more likely, looting already in progress)

What I am pretty damn sure of at this point: I have lost my $500 and position to an inside job.

[cheat_2_win]

Would have been nice to keep me in the loop at that point, then.

Zhou's explanation sounds convincing, but as previously said it is not up to us to judge, and legal action is most likely unavoidable at this point.


Either way, I believe many here would appreciate to know who they can turn themselves to to get things moving forward.

If you go to a judge after publicly humiliating Zhou Tong, I am pretty sure the judge will throw the case out. If you had wanted to go to law enforcement in the first place, you should have done that prior to posting any public statement in the first place.

[Vod]

If you go to a judge after publicly humiliating Zhou Tong, I am pretty sure the judge will throw the case out. If you had wanted to go to law enforcement in the first place, you should have done that prior to posting any public statement in the first place.

I doubt it.  Making a public statement about him (even a humiliating one) doesn't make Zhou Tong less guilty of theft, so he would still be punished.

[racerguy]

I'm not sure about Zhou being the hacker.  Anyone remember one of the earlier hacks when the hacker was in irc giving away free coins from the heist?  That particular hacker seemed to not really be in it for financial gain and more in it because he was some hardcore anarchist that had been upset by something bitcoinica or bitcoin consultancy had done that pissed him off, that being the case I wouldn't put it past that particular hacker to try and setup Zhou or someone else involved to make it look bad for them.  

Also Zhou's behavior kinda strikes me as an innocent man being setup, but none of us here know for sure so the lynch mob thing needs to calm down a bit.

[Coinoisseur]

They stated an email linked to him was connected to suspicious transactions, Zhou Tong himself acknowledges this. IMO, Zhou Tong has to be more worried that he publicly acknowledged previous association with a black market operator and is claiming they have hacked him. On top of that he is acting as an intermediary between this 'alleged' culprit and the affected parties in relaying his offer of a partial payback in exchange for not pursuing criminal investigations.

Would have been nice to keep me in the loop at that point, then.

Zhou's explanation sounds convincing, but as previously said it is not up to us to judge, and legal action is most likely unavoidable at this point.


Either way, I believe many here would appreciate to know who they can turn themselves to to get things moving forward.

If you go to a judge after publicly humiliating Zhou Tong, I am pretty sure the judge will throw the case out. If you had wanted to go to law enforcement in the first place, you should have done that prior to posting any public statement in the first place.

[Vod]

Anyone remember one of the earlier hacks when the hacker was in irc giving away free coins from the heist?  

Anyone remember Zhou giving away 5,000 btc to anyone who asked?  Appears to be his M.O.

Sorry, but the evidence against him is overwhelming.  At this point, he has no choice but to refund 100% of the money he stole, otherwise people are going to be coming to see him.  Hopefully he will learn a life lesson out of this - DON'T STEAL.

[BitBuster]

that being the case I wouldn't put it past that particular hacker to try and setup Zhou or someone else involved to make it look bad for them.

What's more likely? Zhou was the victim of a stupendous setup by a person who we have no to reason or evidence to believe exists, thus absolving Zhou of blame, or that he creating this persona for that purpose? This is the classic behaviour of cheating juveniles.

Also Zhou's behavior kinda strikes me as an innocent man being setup, but none of us here know for sure so the lynch mob thing needs to calm down a bit.

No it doesn't. If you haven't the faculties to realise that you have been shafted, don't deny others their right to retaliate in kind.


BB.

[Vod]

What's more likely? Zhou was the victim of a stupendous setup by a person who we have no reason or evidence to believe exists, thus absolving Zhou of blame, or that he creating this persona for that purpose? This is the classic behavior of cheating juveniles.

Exactly.  "I'm holding it for a friend" is the oldest excuse in the book.

Zhou spent the 69 minutes typing up the long post, and now he is sitting back seeing what suckers believe it.

[repentance]

Would have been nice to keep me in the loop at that point, then.

Zhou's explanation sounds convincing, but as previously said it is not up to us to judge, and legal action is most likely unavoidable at this point.


Either way, I believe many here would appreciate to know who they can turn themselves to to get things moving forward.

If you go to a judge after publicly humiliating Zhou Tong, I am pretty sure the judge will throw the case out. If you had wanted to go to law enforcement in the first place, you should have done that prior to posting any public statement in the first place.

It would be public prosecutors taking the case to court based on the objective evidence gathered by law enforcement.  A judge isn't going to throw out criminal charges because someone said something on the internet.  It's not like anyone here would be likely to be sitting on the jury.

[Phinnaeus Gage]

I hope everyone can comment with more reasoning and less assumptions. I'm trying my best to calm down and attempt to get more information about the hacker, because he also used my email for a credit card fraud case. It's possible to discover something at that direction.

I have also listed a few people who know this secret email of mine. And I'm going to question them one by one tonight.

I'm definitely on the side of Bitcoinica customers and I believe that if the real hacker really had ties with me personally like what MagicalTux said, I may be able to recover majority of the amount back if the hacker can be warned. This issue is very serious and if I'm the hacker, I would definitely return the full amount back to reduce the criminal punishment.

The hacker seems to be a Chinese because he used Chinese punctuations in his English messages in the Aurumxchange ticket.

I will provide any information needed to the police once Bitcoinica files a police report.

The hacker has now been warned and has returned all the stolen funds in 5...4...3...

(I have no idea how I got two pages behind in such a short period of time, so if the above has for real happened already, forgive me)

He probably doesn't know that. I have received another email just now and it seems that the hacker isn't aware of this thread at all:

https://www.aurumxchange.com/help/ticket.php?track=Y72-1AN-3Y4H&Refresh=32888

http://www.youtube.com/watch?v=_pFbfXZSseU (following Maged's lead with this video in reply to the above)

Shit! I'm further behind. By the time I get caught up with this thread, Zhou Tong will be telling this to Zhou "Little Tommy" Tong III as a bedtime story.

~Bruno~

[Phinnaeus Gage]

I hope everyone can comment with more reasoning and less assumptions. I'm trying my best to calm down and attempt to get more information about the hacker, because he also used my email for a credit card fraud case. It's possible to discover something at that direction.

I have also listed a few people who know this secret email of mine. And I'm going to question them one by one tonight.

I'm definitely on the side of Bitcoinica customers and I believe that if the real hacker really had ties with me personally like what MagicalTux said, I may be able to recover majority of the amount back if the hacker can be warned. This issue is very serious and if I'm the hacker, I would definitely return the full amount back to reduce the criminal punishment.

The hacker seems to be a Chinese because he used Chinese punctuations in his English messages in the Aurumxchange ticket.

I will provide any information needed to the police once Bitcoinica files a police report.

The hacker has now been warned and has returned all the stolen funds in 5...4...3...

(I have no idea how I got two pages behind in such a short period of time, so if the above has for real happened already, forgive me)

He probably doesn't know that. I have received another email just now and it seems that the hacker isn't aware of this thread at all:

https://www.aurumxchange.com/help/ticket.php?track=Y72-1AN-3Y4H&Refresh=32888

just easy simple or the biggest fake ever!!

So this superhacker is able to break into his computer yet he is this dumb now?  the hacker is smart enough to steal all this money but not smart enough to not even bother framing people as it leaves more evidence?  Come on.... or maybe steal a lot of bitcoins and make it seem like you are being framed.  It is like Basic Instinct, write a book of a crime before it occurs then it becomes the person's alibi.

It's an excellent Discipline when pulled off flawlessly.

[racerguy]

I'm not sure about Zhou being the hacker.  Anyone remember one of the earlier hacks when the hacker was in irc giving away free coins from the heist?  That particular hacker seemed to not really be in it for financial gain and more in it because he was some hardcore anarchist that had been upset by something bitcoinica or bitcoin consultancy had done that pissed him off, that being the case I wouldn't put it past that particular hacker to try and setup Zhou or someone else involved to make it look bad for them.  

Also Zhou's behavior kinda strikes me as an innocent man being setup, but none of us here know for sure so the lynch mob thing needs to calm down a bit.

Yeah screw that he probably did it.

[sadpandatech]

I hope everyone can comment with more reasoning and less assumptions. I'm trying my best to calm down and attempt to get more information about the hacker, because he also used my email for a credit card fraud case. It's possible to discover something at that direction.

I have also listed a few people who know this secret email of mine. And I'm going to question them one by one tonight.

I'm definitely on the side of Bitcoinica customers and I believe that if the real hacker really had ties with me personally like what MagicalTux said, I may be able to recover majority of the amount back if the hacker can be warned. This issue is very serious and if I'm the hacker, I would definitely return the full amount back to reduce the criminal punishment.

The hacker seems to be a Chinese because he used Chinese punctuations in his English messages in the Aurumxchange ticket.

I will provide any information needed to the police once Bitcoinica files a police report.

The hacker has now been warned and has returned all the stolen funds in 5...4...3...

(I have no idea how I got two pages behind in such a short period of time, so if the above has for real happened already, forgive me)

He probably doesn't know that. I have received another email just now and it seems that the hacker isn't aware of this thread at all:

https://www.aurumxchange.com/help/ticket.php?track=Y72-1AN-3Y4H&Refresh=32888

just easy simple or the biggest fake ever!!

So this superhacker is able to break into his computer yet he is this dumb now?  the hacker is smart enough to steal all this money but not smart enough to not even bother framing people as it leaves more evidence?  Come on.... or maybe steal a lot of bitcoins and make it seem like you are being framed.  It is like Basic Instinct, write a book of a crime before it occurs then it becomes the person's alibi.

It's an excellent [img=http://www.amazon.com/Discipline-Novel-Paco-Ahlgren/dp/0979084202/ref=sr_1_1?s=books&ie=UTF8&qid=1343324282&sr=1-1]http://Discipline[/img] when pulled off flawlessly.

[makomk]

Relevant?

Session Time: Fri Jul 13 00:00:00 2012
[00:49] * phantomcircuit (~phantomci@c-67-188-9-35.hsd1.ca.comcast.net) has joined #intersango
[00:49] * ChanServ sets mode: +o phantomcircuit
[01:01] * phantomcircuit sets mode: -o phantomcircuit
[01:01] * phantomcircuit is now known as steve_bobs

Session Time: Fri Jul 13 00:00:00 2012
[00:49] * phantomcircuit (~phantomci@c-67-188-9-35.hsd1.ca.comcast.net) has joined #bitcoinconsultancy
[01:01] * phantomcircuit is now known as steve_bobs

Session Time: Fri Jul 13 00:00:00 2012
[00:49] * phantomcircuit (~phantomci@c-67-188-9-35.hsd1.ca.comcast.net) has joined #bitcoinica
[01:01] * phantomcircuit is now known as steve_bobs

I call fake on that chat-log. I can't find any evidence of that anywhere.

It's not fake. I found essentially the same thing in my chat logs for #bitcoin-dev; sadly the public logs don't seem to contain nickname changes. I'm not sure what it means though...

[dopamine]

Ok can I have my bitcoins now?

[ErebusBat]

It's not fake. I found essentially the same thing in my chat logs for #bitcoin-dev; sadly the public logs don't seem to contain nickname changes. I'm not sure what it means though...

FWIW This is what I found on my own personal logs (which I know to be untampered [unless the hax0r got my machine too])

Code:

$ grep steve_bobs *                                                                                                                
#bitcoin_20120712.log:[23:02:21] *** phantomcircuit is now known as steve_bobs
#bitcoin_20120713.log:[13:23:52] <steve_bobs> still aren't
#bitcoin_20120713.log:[13:24:33] <steve_bobs> they're a bank in europe
#bitcoin_20120713.log:[13:24:42] <steve_bobs> in the us they're a payment processor or something
#bitcoin_20120713.log:[13:25:01] <steve_bobs> iz, you sure that's what actually happened? seemed to have been something different from that
#bitcoin_20120713.log:[13:25:53] <steve_bobs> innocent, dialcoin
#bitcoin_20120713.log:[13:26:12] <steve_bobs> iz, yeah that's not what that says
#bitcoin_20120713.log:[13:26:47] <steve_bobs> pretty sure
#bitcoin_20120713.log:[13:26:50] <steve_bobs> that's an api key
#bitcoin_20120713.log:[13:26:53] <steve_bobs> not a password
#bitcoin_20120713.log:[13:43:48] <steve_bobs> helo, it's actually impossible
#bitcoin_20120713.log:[13:44:19] <steve_bobs> the risk to the insurer would be so high that they would never accept the contract
#bitcoin_20120713.log:[13:44:21] <kiba> steve_bobs: why would it be impossible? you know something that I don't?
#bitcoin_20120713.log:[13:45:11] <steve_bobs> if your premiums would be more than about 5% annually of the maximum liability of the insurance typically they will simply deny your application
#bitcoin_20120713.log:[14:38:21] <steve_bobs> ;;bc,blocks
#bitcoin_20120713.log:[18:39:59] <steve_bobs> HORRAY CHEAP OLIVE OIL
#bitcoin_20120714.log:[14:34:41] *** Quits: steve_bobs (~phantomci@c-67-188-9-35.hsd1.ca.comcast.net) (Remote host closed the connection)
#bitcoin-otc_20120712.log:[23:02:21] *** phantomcircuit is now known as steve_bobs
#bitcoin-otc_20120714.log:[14:34:41] *** Quits: steve_bobs (~phantomci@c-67-188-9-35.hsd1.ca.comcast.net) (Remote host closed the connection)

So it would appear that not only did *someone* use the ident of phantomci, they did more than just a /nick on it.
I don't log -dev, #bitconica, or #intersango so there absence above means nothing.

EDIT: I have posted the output of $ grep phantomcircuit * | grep -E "(Joins|Quits)" to http://pastebin.com/7BtrXWjv for anyone who is interested.  The above IP (67-188-9-35) does indeed appear there quite a bit.  Seems very unlikely that more than one person closely related would use the same odd handle.

[Phinnaeus Gage]

About him attending college in Australia. Is there any proof of that besides him stating such.

The phone number in the AurumXchange transaction which Zhou says is his is a landline in the state of Victoria.  It would certainly be possible to ring it and find out the relationship of the person answering to Zhou.

This proves very little in these days of VoIP. It's relatively simple to have any phone number ring anywhere on the planet that's got Internet connectivity.

As I said, +61 3 9015 7926 is mine and the number is posted on NameTerrific.

And not only do I want a blowjob, but I want not one, but two fingers stuck up my ass.

Domain name: zhoutong.com

Registrant Contact:
Zhou Tong
Tong Zhou ()

Fax:
PO Box 465
Carlton South, VIC 3053
AU

Administrative Contact:
Zhou Tong
Tong Zhou (domain@zhoutong.com)
+61.390157926
Fax:
PO Box 465
Carlton South, VIC 3053
AU

Technical Contact:
Zhou Tong
Tong Zhou (domain@zhoutong.com)
+61.390157926
Fax:
PO Box 465
Carlton South, VIC 3053
AU

Status: Locked

Name Servers:
node-1.us.terrificdns.com
node-2.us.terrificdns.com
node-3.us.terrificdns.com

Creation date: 16 May 2004 03:26:00
Expiration date: 16 May 2015 03:26:00

Take a careful look at this page: http://web.archive.org/web/20040802063515/http://zhoutong.com/   WoW! oh, WoW!

Somebody tell me why (and/or how) a 9-year-old Asian kid has a domain set up using an Australian address. And please do it quick, for I feel that ZT's answer may be, "I bought that domain a year (or so) ago."

~Bruno~