12 ms·

Bitcoin Thieves Yet to Spend Stolen Hoard

34 points by ytNumbers 14y ago

hippich 14y ago
I experienced the same with funds stolen from my project http://betco.in/ http://betco.in/ - whoever stole bitcoins just sit on them right now. I do not know if it is because they are looking for a way to launder them (although it seems simple to me) or just waiting when bitcoins will cost $100+/$1000+/etc may be?
- rscale 14y ago
  Perhaps waiting out the statute of limitations in their jurisdiction?
  - rprasad 14y ago
    There is no SOL in most nations, as virtual goods are generally not considered property. Bitcoin is regarded as a virtual good in the U.S., so it is not possible to "steal" a bitcoin. (Note: this is a distinct concept from intellectual property -- do not confuse the issues.) In China, Korea, Singapore, and Japan, virtual goods are considered property to varying degrees. EDIT: reply to discountgenius since there was no reply link. One of the functions of government is to create laws protecting property. There aren't any laws in the U.S. that treat virtual goods such as bitcoin as property. In the U.S., at least, courts have proven extremely reluctant to extend property protections to virtual goods, i.e., MMO items, because the state of the law and underlying technology is still too much in flux. At best, virtual goods are treated as licenses. However, licenses are not property that can be stolen (and this has been litigated in non-virtual contexts). In Japan and Korea a few years ago, some courts ruled that in-game purchases were considered property for specific purposes. I do not know if their respective courts followed those cases.
    - discountgenius 14y ago
      Do you know of any precedent where Bitcoin (or another "virtual good") was specifically treated by the government in this way?
    - tzs 14y ago
      Even if taking the bitcoins is not itself a crime in their jurisdiction, they may have committed other crimes as part of the operation to take the bitcoins, such as unauthorized access to a computer.
- nancyhua 14y ago
  How do you launder bitcoins?
  - discountgenius 14y ago
    One method involves running a mining pool where you pay little bits of the "dirty" coins to hundreds of different miners and keep their "clean," freshly-minted coins for yourself. It's a relatively new protocol. There may be laundering methods that nobody's thought of yet.
    - nancyhua 14y ago
      People don't trace the dirty bits to the miners?
  - hippich 14y ago
    most obvious - transfer 'em to any mtgox-like account and withdraw a day later.
    - nancyhua 14y ago
      Withdrawal is anonymous?
      - hippich 14y ago
        I can't say how it is now, since I did not use it for a while, but it used to be anonymous funding and anounymous withdrawals within daily limits.
reubensutton 14y ago
I'm fairly certain that you keep the balance in a single wallet, so can send from a different address than the one that received the funds, so really, all this tells us is that they haven't been stupid and sent money out from the same wallet they sent it to.
- zby 14y ago
  It is not possible to send bitcoins from a different address that received them, it does not matter what addresses you control (i.e. have in your wallet) - from any address you can only send bitcoins that were previously sent there (with the only exception for mining new bitcoins).
  - reubensutton 14y ago
    I stand corrected. So, how can they ever be truly laundered? Because eventually someone is going to want to convert them to cash, and at that point, they're traceable right?
    - danielweber 14y ago
      Well, you can't "convert" Bitcoins to cash. You can trade them to someone who will give you dollars in return. And they generally keep real-world information for the people they transact with.
    - elliottcarlson 14y ago
      By sending smaller values to different addresses and continuing that route. It wouldn't clear the trail, but the more you dilute the trail the more annoying it would become to trace it back to that original theft. For example, if they had 1000 bitcoins, broke that up in to 4 pairs of 250, then broke that up in to 8 transactions of 125 and kept decreasing it then there would be so many transactions in the history of those coins. Additionally, there are laundering services out there for bitcoins (eg http://www.bitcoinlaundry.com/ http://www.bitcoinlaundry.com/, http://app.bitlaundry.com/ http://app.bitlaundry.com/) which will just cycle all the bitcoins with others - eventually it will be so mixed up with others you can cash out without worrying about being traced easily.
HyprMusic 14y ago
Excuse my ignorance, but he said he suspects they're sitting on the bitcoins because they were "hot". I thought that wouldn't matter with bitcoins due to their anonymous nature?
- feral 14y ago
  They aren't that inherently anonymous; the transaction flow can be traced to a limited extent. For example, if the thieves just did something naive, like transfer all those 'coins' to an address in a wallet they had previous used, or that was previously connected to an identity, it could reveal who they are. In that scenario, the person receiving the coins could be faced with the questions 'Why did you just receive all those stolen coins? If you arent the thief, then who gave them to you? Did you sell them something?' etc. I did some work on this before, showing it was possible to follow flows of stolen bitcoins at least some distance through the blockchain. The visualisation lower down this page is of a previous alleged theft, and is extracted from the blockchain: http://anonymity-in-bitcoin.blogspot.ie/2011/07/bitcoin-is-not-anonymous.html http://anonymity-in-bitcoin.blogspot.ie/2011/07/bitcoin-is-n...
- chiph 14y ago
  My understanding is that because of the distributed transaction nature of Bitcoin-the-protocol, the stolen coins will be "hot" forever. As soon as they're spent, they'll show up in the logs. The identity of the thieves may never be known, but the coins themselves are identifiable. I'm surprised someone hasn't started a hot-sheet for stolen coins, so that exchanges and individuals can check before accepting them.
  - feral 14y ago
    People have talked about 'marking' Bitcoins before. There are some issues with the idea. Some of them are subtle: The first thing to realize is that bitcoins do not exist as independent trackable entities, in the system. So there are no individually identifiable bitcoins that you can 'mark'. Instead, address balances exist. So, you might say, lets just mark the address balance as 'hot'. This has some merit. It violates what appears to be a design assumption of Bitcoin, which is that bitcoins are meant to be fungible; but it has some merit. If someone tries to pay you with a transfer from that address full of stolen coins, you can just say "Im not accepting that as valid payment. Take your business elsewhere." But, what happens when somebody - lets say an anonymous mixer - accepts, say, 100 stolen bitcoins, into an address that has 900 bitcoins already in it. Now, you have an address with 1000 bitcoins. 10% of these bitcoins are dirty - but which 10%? How do you deal with this scenario? What if someone tries pay you 100 coins from that address? Do you say that transfers from that address are only worth 90% of the value they had before? What if that address goes through a mixer again? You can keep track of percentage 'contamination' but its going to start making things complicated. If you accept dirty bitcoins, that weren't dirty when you got them (lets say you are a mixer and get a transfer before people realise there has been a theft), what happens? Also, who gets to say which bitcoins are dirty? A centralised authority? That sort of breaks the design goal of fungibility - if you have to ask a central authority whether this is a real bitcoin or not, why not also just have the centralised authority issue them in the first place, and dispense with all the complexity? I'm not sure whether a marking system would work; there certainly seem to be some reasons its tricky. I've seen discussions about this on the bitcoin forum; plenty of people there who have thought about this a lot.
nodata 14y ago
Isn't there a famous patch that makes Bitcoin transactions anonymous? How do we know they're not using that? Ref: https://bitcointalk.org/index.php?topic=24784.0 https://bitcointalk.org/index.php?topic=24784.0
- eli 14y ago
  that patch purports to make it "more anonymous," not actually anonymous
VMG 14y ago
So would any business that accepts Bitcoin be in legal trouble if it accepted these coins? An individual that accepts them?
- rprasad 14y ago
  No. Knowing receipt of stolen property is a crime. However, bitcoins are not considered property, nor can they be considered stolen, under current U.S. law.
  - politician 14y ago
    Do you if anyone is compiling a list of stolen addresses?
    - hippich 14y ago
      no, because funds might be easily transfered to another address. and after that you need to mark new address as "bad" again. and it become complicated when only part of funds transfered to another address. and it become even more complicated when funds transfered to "pool" address, of big exchanger like mtgox for example. and these funds end up in hands of honest users..
      - VMG 14y ago
        I doubt that creating a graph of "tainted" addresses would be very difficult.
        hippich 14y ago
        something like this? http://blockchain.info/taint/1dice7EYzJag7SxkdKXLr8Jn14WUb3Cf1 http://blockchain.info/taint/1dice7EYzJag7SxkdKXLr8Jn14WUb3C...
illuminate 14y ago
I would assume that the people behind whichever inside jobs are just waiting for things to "die down" and for their former customers to forget and move on with their lives before the thieves cash out.
carioca3 14y ago
Maybe they deleted their wallet in order to destroy the coins?
- napillo 14y ago
  I like your thinking. Perhaps they are interested in only driving up the cost of coins - taking a bunch out of circulation can certainly do that.
debacle 14y ago
Not necessarily true. They may have simply transferred ownership of the account the bitcoins were in to someone else outside of the bitcoin universe (e.g. on a USB drive).
jorgeortiz85 14y ago
This presents an interesting problem. Do individuals who accept payments in bitcoin have to verify that the bitcoins the accept haven't been stolen? If they fail to verify the provenance of their payment, are they at risk of forfeiting their money or, worse!, being criminally liable for possession of stolen property?
- ahi 14y ago
  How do you verify that the bitcoins have in fact been stolen?
  - jorgeortiz85 14y ago
    Exactly.
zupreme 14y ago
I've only been into bitcoin mining and trading for about a month now, so take this with a grain of salt, but: If were the criminal behind this heist and I wanted to whitewash these bit coins, I would first establish several new wallets, would divide the coins between them, then would programmatically transfer the coins back and forth between the accounts in random amounts at short but random intervals over the course of several months to increase the noise level. I would then (again programmatically) buy a different electronic currency (namecoins, etc.) with them to obscure the trail even more. Finally I could transfer them back into bitcoins, using several new wallets. At that point they could be cashed out or spent more or less freely. Again, I'm new to bit coins so I may not know all the dynamics involved, but what I have outlined seems logical based on what I know at this point.
- maxerickson 14y ago
  If I have it right, the self transactions wouldn't do much (because the transaction history of the bitcoin system is public). A few other comments mention that Mt. Gox is treating certain coins within some distance of certain accounts as tainted and freezing those transactions.
kevinpet 14y ago
Can someone explain if there is a technical reason the network can't collude to cancel these bitcoins? This seems a reasonable reaction to known theft.
- hippich 14y ago
  technically this can be added into protocol/rules. but then we get back to who decides what was stolen and what was not.

34 points by ytNumbers 14y ago

I experienced the same with funds stolen from my project http://betco.in/ http://betco.in/ - whoever stole bitcoins just sit on them right now. I do not know if it is because they are looking for a way to launder them (although it seems simple to me) or just waiting when bitcoins will cost $100+/$1000+/etc may be?

rscale 14y ago
Perhaps waiting out the statute of limitations in their jurisdiction?
- rprasad 14y ago
  There is no SOL in most nations, as virtual goods are generally not considered property. Bitcoin is regarded as a virtual good in the U.S., so it is not possible to "steal" a bitcoin. (Note: this is a distinct concept from intellectual property -- do not confuse the issues.) In China, Korea, Singapore, and Japan, virtual goods are considered property to varying degrees. EDIT: reply to discountgenius since there was no reply link. One of the functions of government is to create laws protecting property. There aren't any laws in the U.S. that treat virtual goods such as bitcoin as property. In the U.S., at least, courts have proven extremely reluctant to extend property protections to virtual goods, i.e., MMO items, because the state of the law and underlying technology is still too much in flux. At best, virtual goods are treated as licenses. However, licenses are not property that can be stolen (and this has been litigated in non-virtual contexts). In Japan and Korea a few years ago, some courts ruled that in-game purchases were considered property for specific purposes. I do not know if their respective courts followed those cases.
  - discountgenius 14y ago
    Do you know of any precedent where Bitcoin (or another "virtual good") was specifically treated by the government in this way?
  - tzs 14y ago
    Even if taking the bitcoins is not itself a crime in their jurisdiction, they may have committed other crimes as part of the operation to take the bitcoins, such as unauthorized access to a computer.
nancyhua 14y ago
How do you launder bitcoins?
- discountgenius 14y ago
  One method involves running a mining pool where you pay little bits of the "dirty" coins to hundreds of different miners and keep their "clean," freshly-minted coins for yourself. It's a relatively new protocol. There may be laundering methods that nobody's thought of yet.
  - nancyhua 14y ago
    People don't trace the dirty bits to the miners?
- hippich 14y ago
  most obvious - transfer 'em to any mtgox-like account and withdraw a day later.
  - nancyhua 14y ago
    Withdrawal is anonymous?
    - hippich 14y ago
      I can't say how it is now, since I did not use it for a while, but it used to be anonymous funding and anounymous withdrawals within daily limits.

reubensutton 14y ago

I'm fairly certain that you keep the balance in a single wallet, so can send from a different address than the one that received the funds, so really, all this tells us is that they haven't been stupid and sent money out from the same wallet they sent it to.

zby 14y ago
It is not possible to send bitcoins from a different address that received them, it does not matter what addresses you control (i.e. have in your wallet) - from any address you can only send bitcoins that were previously sent there (with the only exception for mining new bitcoins).
- reubensutton 14y ago
  I stand corrected. So, how can they ever be truly laundered? Because eventually someone is going to want to convert them to cash, and at that point, they're traceable right?
  - danielweber 14y ago
    Well, you can't "convert" Bitcoins to cash. You can trade them to someone who will give you dollars in return. And they generally keep real-world information for the people they transact with.
  - elliottcarlson 14y ago
    By sending smaller values to different addresses and continuing that route. It wouldn't clear the trail, but the more you dilute the trail the more annoying it would become to trace it back to that original theft. For example, if they had 1000 bitcoins, broke that up in to 4 pairs of 250, then broke that up in to 8 transactions of 125 and kept decreasing it then there would be so many transactions in the history of those coins. Additionally, there are laundering services out there for bitcoins (eg http://www.bitcoinlaundry.com/ http://www.bitcoinlaundry.com/, http://app.bitlaundry.com/ http://app.bitlaundry.com/) which will just cycle all the bitcoins with others - eventually it will be so mixed up with others you can cash out without worrying about being traced easily.

HyprMusic 14y ago

Excuse my ignorance, but he said he suspects they're sitting on the bitcoins because they were "hot". I thought that wouldn't matter with bitcoins due to their anonymous nature?

feral 14y ago
They aren't that inherently anonymous; the transaction flow can be traced to a limited extent. For example, if the thieves just did something naive, like transfer all those 'coins' to an address in a wallet they had previous used, or that was previously connected to an identity, it could reveal who they are. In that scenario, the person receiving the coins could be faced with the questions 'Why did you just receive all those stolen coins? If you arent the thief, then who gave them to you? Did you sell them something?' etc. I did some work on this before, showing it was possible to follow flows of stolen bitcoins at least some distance through the blockchain. The visualisation lower down this page is of a previous alleged theft, and is extracted from the blockchain: http://anonymity-in-bitcoin.blogspot.ie/2011/07/bitcoin-is-not-anonymous.html http://anonymity-in-bitcoin.blogspot.ie/2011/07/bitcoin-is-n...
chiph 14y ago
My understanding is that because of the distributed transaction nature of Bitcoin-the-protocol, the stolen coins will be "hot" forever. As soon as they're spent, they'll show up in the logs. The identity of the thieves may never be known, but the coins themselves are identifiable. I'm surprised someone hasn't started a hot-sheet for stolen coins, so that exchanges and individuals can check before accepting them.
- feral 14y ago
  People have talked about 'marking' Bitcoins before. There are some issues with the idea. Some of them are subtle: The first thing to realize is that bitcoins do not exist as independent trackable entities, in the system. So there are no individually identifiable bitcoins that you can 'mark'. Instead, address balances exist. So, you might say, lets just mark the address balance as 'hot'. This has some merit. It violates what appears to be a design assumption of Bitcoin, which is that bitcoins are meant to be fungible; but it has some merit. If someone tries to pay you with a transfer from that address full of stolen coins, you can just say "Im not accepting that as valid payment. Take your business elsewhere." But, what happens when somebody - lets say an anonymous mixer - accepts, say, 100 stolen bitcoins, into an address that has 900 bitcoins already in it. Now, you have an address with 1000 bitcoins. 10% of these bitcoins are dirty - but which 10%? How do you deal with this scenario? What if someone tries pay you 100 coins from that address? Do you say that transfers from that address are only worth 90% of the value they had before? What if that address goes through a mixer again? You can keep track of percentage 'contamination' but its going to start making things complicated. If you accept dirty bitcoins, that weren't dirty when you got them (lets say you are a mixer and get a transfer before people realise there has been a theft), what happens? Also, who gets to say which bitcoins are dirty? A centralised authority? That sort of breaks the design goal of fungibility - if you have to ask a central authority whether this is a real bitcoin or not, why not also just have the centralised authority issue them in the first place, and dispense with all the complexity? I'm not sure whether a marking system would work; there certainly seem to be some reasons its tricky. I've seen discussions about this on the bitcoin forum; plenty of people there who have thought about this a lot.

nodata 14y ago

Isn't there a famous patch that makes Bitcoin transactions anonymous? How do we know they're not using that? Ref: https://bitcointalk.org/index.php?topic=24784.0 https://bitcointalk.org/index.php?topic=24784.0

eli 14y ago
that patch purports to make it "more anonymous," not actually anonymous

VMG 14y ago

So would any business that accepts Bitcoin be in legal trouble if it accepted these coins? An individual that accepts them?

rprasad 14y ago
No. Knowing receipt of stolen property is a crime. However, bitcoins are not considered property, nor can they be considered stolen, under current U.S. law.
- politician 14y ago
  Do you if anyone is compiling a list of stolen addresses?
  - hippich 14y ago
    no, because funds might be easily transfered to another address. and after that you need to mark new address as "bad" again. and it become complicated when only part of funds transfered to another address. and it become even more complicated when funds transfered to "pool" address, of big exchanger like mtgox for example. and these funds end up in hands of honest users..
    - VMG 14y ago
      I doubt that creating a graph of "tainted" addresses would be very difficult.
      - hippich 14y ago
        something like this? http://blockchain.info/taint/1dice7EYzJag7SxkdKXLr8Jn14WUb3Cf1 http://blockchain.info/taint/1dice7EYzJag7SxkdKXLr8Jn14WUb3C...

illuminate 14y ago

I would assume that the people behind whichever inside jobs are just waiting for things to "die down" and for their former customers to forget and move on with their lives before the thieves cash out.

carioca3 14y ago

Maybe they deleted their wallet in order to destroy the coins?

napillo 14y ago
I like your thinking. Perhaps they are interested in only driving up the cost of coins - taking a bunch out of circulation can certainly do that.

debacle 14y ago

Not necessarily true. They may have simply transferred ownership of the account the bitcoins were in to someone else outside of the bitcoin universe (e.g. on a USB drive).

jorgeortiz85 14y ago

This presents an interesting problem. Do individuals who accept payments in bitcoin have to verify that the bitcoins the accept haven't been stolen? If they fail to verify the provenance of their payment, are they at risk of forfeiting their money or, worse!, being criminally liable for possession of stolen property?

ahi 14y ago
How do you verify that the bitcoins have in fact been stolen?
- jorgeortiz85 14y ago
  Exactly.

zupreme 14y ago

I've only been into bitcoin mining and trading for about a month now, so take this with a grain of salt, but: If were the criminal behind this heist and I wanted to whitewash these bit coins, I would first establish several new wallets, would divide the coins between them, then would programmatically transfer the coins back and forth between the accounts in random amounts at short but random intervals over the course of several months to increase the noise level. I would then (again programmatically) buy a different electronic currency (namecoins, etc.) with them to obscure the trail even more. Finally I could transfer them back into bitcoins, using several new wallets. At that point they could be cashed out or spent more or less freely. Again, I'm new to bit coins so I may not know all the dynamics involved, but what I have outlined seems logical based on what I know at this point.

maxerickson 14y ago
If I have it right, the self transactions wouldn't do much (because the transaction history of the bitcoin system is public). A few other comments mention that Mt. Gox is treating certain coins within some distance of certain accounts as tainted and freezing those transactions.

kevinpet 14y ago

Can someone explain if there is a technical reason the network can't collude to cancel these bitcoins? This seems a reasonable reaction to known theft.

hippich 14y ago
technically this can be added into protocol/rules. but then we get back to who decides what was stolen and what was not.