8 ms·

In November of 2011 Mt. Gox demonstrated control of 500k BTC. I followed the 500,000 BTC for a bit beginning at https://blockchain.info/tx/b269bf1b82dae8a61f7f

In November of 2011 Mt. Gox demonstrated control of 500k BTC. I followed the 500,000 BTC for a bit beginning at https://blockchain.info/tx/b269bf1b82dae8a61f7f91dbf7a9d807e30963c1ae00ddd95a8faebea6d0a007 https://blockchain.info/tx/b269bf1b82dae8a61f7f91dbf7a9d807e.... The coins move around and small amounts are sent away, but the majority ends up back in Mt. Gox's main (hot) wallet. This repeats a few times until the majority is paid back to the main Mt.Gox address. Here is the transaction where it starts to get interesting: https://blockchain.info/tx/478ea915aa3a2e54503c43e1c5659722b42a784412423a05394c83a44affb805 https://blockchain.info/tx/478ea915aa3a2e54503c43e1c5659722b... What's left of the 500,000 (429.9k) is split into roughly half and sent to 2 new address. And then each of those address splits the coins in half and sends to two new address. The end result is that the 429k was split again and again until the funds are split into many addresses, each of which now contain less than 1,000 BTC each. I stopped following the transactions there. Why take 429k and split it into many addresses each containing less than 1,000 BTC each? I'd like to see someone trace all of these coins and see if they end up coming together somewhere or show a pattern.

neals 13y ago
Can anybody follow one of these "branches" until the very last known transaction on the blockchain? Would that clear anything up?
- drcode 13y ago
  Yeah, people have been trying all kinds of analysis on these addresses on r/bitcoin this week- So far the jury is out as to whether meaningful info can be gathered in this way.
- deweller 13y ago
  I haven't seen anyone do a comprehensive analysis yet. I assume someone is working on this. But maybe everyone else thinks that too. Here is a some background information at Let's Talk Bitcoin: http://letstalkbitcoin.com/the-ghost-in-the-machine-at-mtgox http://letstalkbitcoin.com/the-ghost-in-the-machine-at-mtgox
- Consultant32452 13y ago
  If you were going to steal bitcoins in this manner you'd run them through a number of tumblers. Tumblers are essentially the laundering facility for bitcoins. Lots of coins from various locations come in, put into a pool, and then get sent back out. There's no way to track coins you receive back to a particular transaction. Since 6% of all bitcoins are stolen, more than likely anyone holding bitcoins has a good chance of holding some stolen ones.
KiwiCoder 13y ago
I wonder, can this trace be automated?
- artursapek 13y ago
  It must be. Has anyone built a transaction tracer? Perhaps a visualizer using d3?
ihsw 13y ago
"Coming together" is a bit difficult to determine -- how do you identify a large group of recipient addresses as a single entity? How do you differentiate between a group of addresses belonging to a single owner, and a group of addresses belonging to multiple owners? We can construct a graph tree all destinations beginning from that one address, but what good would that be? Where do you make inferences to determine the identity of the recipients? How do you group them together? At some point your trail becomes so long and so disparate that any effort to continue following that trail would be a pointless endeavor. Sure the technology is there to follow the trail indefinitely, and (where available) you can easily check all recipient addresses from this "poisoned" tree against regular fiat exchange logs, but within the BTC ecosystem? It's an interesting intellectual challenge, but not useful.
- deweller 13y ago
  Here is an example of something you might find: Say you traced these coins to 50 different addresses. And then, for example, say that those addresses lay dormant for 3 months. And then 45 of those addresses send bitcoins somewhere on the same day. That would imply that the coins are under the control of a single owner. I agree it is difficult and beyond the scope of just writing a simple script.
  - kordless 13y ago
    I was thinking about dumping the Blockchain into Splunk. Investigating the best way to do that today.
    - joeld42 13y ago
      I don't know much about btc, but John Radcliffe has a nice command line blockchain parser/query tool: http://codesuppository.blogspot.com/2014/01/a-command-line-interface-for-blockchain.html http://codesuppository.blogspot.com/2014/01/a-command-line-i...
  - Carltonian 13y ago
    This seems like the best way to go about it. Use statistical analysis to find similarities between wallets involved in transactions stemming from the root. When you can give a qualitative "Here's where these coins are going", you can start to identify the culprit. Since there doesn't seem to be a legal framework to prosecute such theft anyway, I'd really just want to find them to congratulate them. Sorry to anybody who lost their coins :(
chevreuil 13y ago
I'm a bit new to bitcoins, but is it technically possible for the bitcoins community as a whole to make a blacklist of bitcoins addresses and "ban" the stolen bitcoins ? Such blacklist would daunt robbers and enforce public trust in bitcoins.
- the_watcher 13y ago
  Well, the supply of BTC is finite, so simply excluding stolen BTC's has some additional problems. May be better than not addressing it, but while BTC provides a mechanism for following them through the transaction chain, it's not that simple to ID what addresses contain "stolen" BTC. What if the thieves are able to launder them through unwitting proxies? For example, steal a bunch of BTC, sell them on another exchange immediately, and now, how do you blacklist those "stolen" bitcoins without screwing over an innocent bystander?
  - digikata 13y ago
    Because transactions are recorded in a public blockchain, couldn't that be a big downside for anyone accepting bitcoin whether or not the coins appear on a blacklist/warning list. If a sending wallet address is associated with some contested activity (e.g. someone getting sued, or indited), I could imagine that those BTC could easily get swept up in the legal actions to unwind or resolve the activity. This vs accepting cash which is fungible, and would need some other evidence associating the buyers money with the contested activity. At least the resolution activity there would likely be stopped at one level from receiving the cash, but with BTC, you happen to be able to track that one specific coin right through multiple layers of transactions. I can see lawyers tracking all the way out to the current holder of a given BTC. edit: Upon a bit more side reading, I think the tracability of a given BTC is a bit overstated here.
    - the_watcher 13y ago
      That is assuming you can "blacklist" addresses before the transaction takes place. Or they could just create a new BTC address.
  - 13y ago
stef25 13y ago
Assuming those transactions you describe constitute "the theft", how on earth could Gox not have noticed their wallets being emptied?
- Carltonian 13y ago
  That's the 750k Bitcoin question.
jackgavigan 13y ago
> Why take 429k and split it into many addresses each containing less than 1,000 BTC each? Ever heard the adage "Don't put all your eggs in one basket"? It's possible that MtGox used to operate everything from a single, large wallet but decided to split it up into lots of smaller wallets, to avoid the risk of suffering a single, catastrophic compromise.
- rsiqueira 13y ago
  When following the splits-in-2 of this transaction, many accounts still have about 1000 BTC in their final balance according to blockchain. E.g: 1BoGw97oS9L2mU8HTQqpm7yxC72H4LCm6i (Final Balance: 1,000.35 BTC). The question is: who may be the owner of those large amounts of of about 1000 btc? If MtGox did all those splits in 2 smaller accounts, then MtGox could still be the owner?
  - deweller 13y ago
    Good find! How many of those did you trace? Can someone automate this trace? Or if not, can we start listing all the addresses and the transaction chains to get there? [Update] Here's a doc if anyone else wants to work on this manually: https://docs.google.com/spreadsheet/ccc?key=0AguUOoH79qm7dFlFQW9Ra09pdjVVVnpxRVNaM3B3TEE&usp=sharing https://docs.google.com/spreadsheet/ccc?key=0AguUOoH79qm7dFl... [Update] Forgot to make it editable. Now it is editable.
  - deweller 13y ago
    I can't trace these coins to 1BoGw97oS9L2mU8HTQqpm7yxC72H4LCm6i. Can you share how you did it?
    - rsiqueira 13y ago
      You showed that account 1M1ZkWpHfuQthji2AVsGDvpfY2PrcXQar6 had about 430000 BTC and split coins in 2 other accounts and so on. I followed one of the splits and its subsequents: 14qKyR7b86JVHn5mfm6Dm3G756BgxhMqMP received 203002 BTC. Then it sent 202658 BTC to 13JAudzPvKYyBtY9XpkhNW3YdDqBsi3c7Q. Then it sent 108570 BTC to 144rbLnQmwH8MbB5iirSqvaPgXB9NMdcdb. Then it sent 44505 BTC to 18pGH9G1FtpAkBt1zHTDuYXxPFMXqPG8PU. Then it sent 23525 BTC to 13kfZQxVC6qi5pDSw56Fi3boTU7qMar8Nf. Then it sent 23525 BTC to 14EKdT8ENWUY33Vyd7PN4TgLg6mnrwUt4T. Then it sent 9576 BTC to 7jj6RTpzayiHDeFfCR5ihnDFccK997UNT. Then it sent 5456 BTC to NRZTrVBQEcQ7EWgEdfUrs9xHjuwazdcuf. Then it sent 2878 BTC to 2kSAA9HY11xwDi2QvmtZN1TYWuRdZb7Gx. Then it sent 1241 BTC to 1GKUwZEzMoM92BVjVTNAwoSnUxeANhiawc. Then it sent 509 BTC to 16hpTHQDWRTDkhgHw2T3RDneJM74XJXDoD. Then it sent 473 BTC to 1KuNerYrrHiNR6bGgQesUiCyQt5u5qVBVQ. Then it sent 473 BTC to 1Mu3EwLg85J3sV8No3RKLvwZPu2XZqEE63. Then it sent 473 BTC to 1PgLdynDGFtsfpj6u442gokuLF1kZPCiRa. Then it sent 376 BTC to 12yUfwW8DmgkZmAcAYsMzGWGw7LCmiQzXa. Then it sent 375 BTC to 1CZHLDbrswW6ku8eHEDLLHC8Wr3RxowW3x. Then it sent 354 BTC to 15robQvbP2Q1rZ9kMADnuv9f6tFhwkzz5z. Then it sent 305 BTC to 1Jsdgh21hrbRuLuKeyvEGdkBauHiYXm7FN. Then it sent 286 BTC to 1Q64Rx1tVCNeucdUGLkGdo1asiPHhPjoNW. Then it sent 260 BTC to 1JWjfsk2tUAE83MtBjNEXP85ArxJuWoqg6. Then it sent 260 BTC to 1JS9EAFzrjeFrLiPaK57mXeAZLwqHdEbPa. Then it sent 256 BTC to 1421kfM6sbCXYsSZnvL6Dw1StXW2tbq4gZ. Then it sent 247 BTC to 12eq3PnDcHLT2xpHevZMmFuVHymULjdoaj. Then it sent 125 BTC to 12ZWoyaSwj53spGWGt9AtGCA28uLq58SCk. Then it sent 125 BTC to 1Kf6KQd2oQA3yGPQDw8teCZVK7wj6C7ms7. Then it sent 78 BTC to 1A3AsuYVsgdKNRDm7SGKkkHD9LQeuuipfe. Then it sent 49 BTC to 1bu6ZBmksM5sRVEZspDKaXb5zTxZRuhrW. Then it sent 49 BTC to 1J2HFUhF5xSnDXL3Zw3vCiEdv7eJi4EbM5. Then it sent 156 BTC to 1JT6L2sT9z3QNitk4a2xiDEuwq3dksPYsb. Then it sent 3730 BTC to 17C6oanWeXbehGZNL5fpUKsEQfMFya1pVD. Then it sent 1000 BTC to 1MoUfk2Bow7n9B6ksreCbcyDzXdRTFMpC9 (this seems important address, received more than 117500 BTC). Then it sent 998.99995 BTC to 1Ky8YXSXGensz2J8BYUprtLJvjcjNN3xbm. Then it sent 999.99 BTC to 12wjEVECppk1rPBTQXyZ6m8zn4h91AzzSf. Then it sent 1000 BTC to 1BoGw97oS9L2mU8HTQqpm7yxC72H4LCm6i, who still has 1000.35 BTC in its final balance.
mars 13y ago
that's common practice to anonymize bitcoins. google 'bitcoin tumbling service'.
- deweller 13y ago
  So do you think that these 429k bitcoins were all sent through a tumbler? Now that would be interesting information. Can we verify this? Obviously we can't trace the outputs, but can we look for patterns that suggest the use of tumblers/mixers?
  - mars 13y ago
    well, that's the whole purpose of a tumbling service. i mean you don't even know how long they will be stuck there. i didn't investigate this, but splitting those into small amounts and then tumbling these around seems like exactly this pattern. if you are interested on how this was done in the maybe now second biggest known btc heist check http://www.newstatesman.com/future-proof/2013/12/theres-£60m-bitcoin-heist-going-down-right-now-and-you-can-watch-real-time http://www.newstatesman.com/future-proof/2013/12/theres-£60m...
    - Uberphallus 13y ago
      To be honest, tumbling such large amount of BTC serves no purpose because you overflow the rest of the people tumbling.
- sbierwagen 13y ago
  Tumbling only works if you're a small fraction of the total. If you put $300 million into a tumbler that only has $1 million of other volume, then it's pretty easy to track you.
  - quandrum 13y ago
    Sure, but if you have access to $300 million and want to tumble $1 million, wouldn't it be hard to track you?
  - 13y ago
freefrancisco 13y ago
It would be interesting to put these transactions, or the whole blockchain, in a graph database like Neo4J. Dealing with it as a graph would make it easier to find the sinks for all the transactions that started from that wallet. It would also be interesting to look at deviations from the historical statistical distribution in the aggregate of these transactions as a function of time, that would show when a single actor moved a lot of bitcoins even if it is allocated among many addresses. I would bet that the thieves didn't bother to match their transactions with the background statistical distribution.
- Torn 13y ago
  Visualising it in something like KeyLines (http://keylines.com/ http://keylines.com/) would be awesome.
  - jsmeaton 13y ago
    Couldn't find a single download link or pricing/buy link.
    - psquid 13y ago
      It's under Pricing in the FAQ page (the gist: contact them via the contact link to discuss a price, because it's apparently too complicated to estimate), but yeah, the FAQ seems like rather an odd place to relegate such an important aspect to.
      - jsmeaton 13y ago
        Perhaps it's under the frequently asked questions because no one can find the bloody thing. Thanks for pointing it out though.
      - PeterisP 13y ago
        A quick translation: "pricing not on the front page, because contact us" -> "we have an enterprise sales model, which means that if you won't pay six figure prices, forget you ever saw this product". Not always literally true, but a good rule of thumb; you can't really sell $100-$1000 products that way, the cost/time of salespeople doesn't work out in that case.
negamax 13y ago
I followed until this far https://blockchain.info/zh-cn/address/1BWxHjJMmfxfu3w9ESDx91zZHKTo7CFQp1 https://blockchain.info/zh-cn/address/1BWxHjJMmfxfu3w9ESDx91... And it goes back to MtGox address. What? Following another chain and ended up here https://blockchain.info/zh-cn/address/1Cz3BkgQ9NJGq5gvPLs5YrmYn6CY2DoxZN https://blockchain.info/zh-cn/address/1Cz3BkgQ9NJGq5gvPLs5Yr... Same. Goes back to MtGox. Edit: Guys, the original address. The one which contains the MtGox coins. If you track any large transaction. > $30k, even the recent ones. They follow the same pattern. Split into two. And they all end up in pretty big wallets. As much as I want to call it a witch hunt, there seem to be some patterns (I may be biased as I do want this thing to end up in positive). There's still so much information missing.
gizmo686 13y ago
Thanks. Is there an API available for doing this type of analysis of the blockchain (or a program already built for this)?
gremlinsinc 13y ago
Yeah, and I'm sure this line of thinking, will eventually route out the person who stole all those bitcoins -- and I won't be surprised it it's The top execs of Mt. Gox - - who better to take the money and run? They KNEW that they couldn't possibly sell bitcoins at higher than market prices, and make a profit UNLESS they were running a Ponzi scheme.
andypag 13y ago
Could these be the coins? http://www.reddit.com/r/Bitcoin/comments/1z8bqb/jed_mccaleb_might_have_caused_the_spike_7th_of/ http://www.reddit.com/r/Bitcoin/comments/1z8bqb/jed_mccaleb_...

neals 13y ago

Can anybody follow one of these "branches" until the very last known transaction on the blockchain? Would that clear anything up?

drcode 13y ago
Yeah, people have been trying all kinds of analysis on these addresses on r/bitcoin this week- So far the jury is out as to whether meaningful info can be gathered in this way.
deweller 13y ago
I haven't seen anyone do a comprehensive analysis yet. I assume someone is working on this. But maybe everyone else thinks that too. Here is a some background information at Let's Talk Bitcoin: http://letstalkbitcoin.com/the-ghost-in-the-machine-at-mtgox http://letstalkbitcoin.com/the-ghost-in-the-machine-at-mtgox
Consultant32452 13y ago
If you were going to steal bitcoins in this manner you'd run them through a number of tumblers. Tumblers are essentially the laundering facility for bitcoins. Lots of coins from various locations come in, put into a pool, and then get sent back out. There's no way to track coins you receive back to a particular transaction. Since 6% of all bitcoins are stolen, more than likely anyone holding bitcoins has a good chance of holding some stolen ones.

KiwiCoder 13y ago

I wonder, can this trace be automated?

artursapek 13y ago
It must be. Has anyone built a transaction tracer? Perhaps a visualizer using d3?

ihsw 13y ago

"Coming together" is a bit difficult to determine -- how do you identify a large group of recipient addresses as a single entity? How do you differentiate between a group of addresses belonging to a single owner, and a group of addresses belonging to multiple owners? We can construct a graph tree all destinations beginning from that one address, but what good would that be? Where do you make inferences to determine the identity of the recipients? How do you group them together? At some point your trail becomes so long and so disparate that any effort to continue following that trail would be a pointless endeavor. Sure the technology is there to follow the trail indefinitely, and (where available) you can easily check all recipient addresses from this "poisoned" tree against regular fiat exchange logs, but within the BTC ecosystem? It's an interesting intellectual challenge, but not useful.

deweller 13y ago
Here is an example of something you might find: Say you traced these coins to 50 different addresses. And then, for example, say that those addresses lay dormant for 3 months. And then 45 of those addresses send bitcoins somewhere on the same day. That would imply that the coins are under the control of a single owner. I agree it is difficult and beyond the scope of just writing a simple script.
- kordless 13y ago
  I was thinking about dumping the Blockchain into Splunk. Investigating the best way to do that today.
  - joeld42 13y ago
    I don't know much about btc, but John Radcliffe has a nice command line blockchain parser/query tool: http://codesuppository.blogspot.com/2014/01/a-command-line-interface-for-blockchain.html http://codesuppository.blogspot.com/2014/01/a-command-line-i...
- Carltonian 13y ago
  This seems like the best way to go about it. Use statistical analysis to find similarities between wallets involved in transactions stemming from the root. When you can give a qualitative "Here's where these coins are going", you can start to identify the culprit. Since there doesn't seem to be a legal framework to prosecute such theft anyway, I'd really just want to find them to congratulate them. Sorry to anybody who lost their coins :(

chevreuil 13y ago

I'm a bit new to bitcoins, but is it technically possible for the bitcoins community as a whole to make a blacklist of bitcoins addresses and "ban" the stolen bitcoins ? Such blacklist would daunt robbers and enforce public trust in bitcoins.

the_watcher 13y ago
Well, the supply of BTC is finite, so simply excluding stolen BTC's has some additional problems. May be better than not addressing it, but while BTC provides a mechanism for following them through the transaction chain, it's not that simple to ID what addresses contain "stolen" BTC. What if the thieves are able to launder them through unwitting proxies? For example, steal a bunch of BTC, sell them on another exchange immediately, and now, how do you blacklist those "stolen" bitcoins without screwing over an innocent bystander?
- digikata 13y ago
  Because transactions are recorded in a public blockchain, couldn't that be a big downside for anyone accepting bitcoin whether or not the coins appear on a blacklist/warning list. If a sending wallet address is associated with some contested activity (e.g. someone getting sued, or indited), I could imagine that those BTC could easily get swept up in the legal actions to unwind or resolve the activity. This vs accepting cash which is fungible, and would need some other evidence associating the buyers money with the contested activity. At least the resolution activity there would likely be stopped at one level from receiving the cash, but with BTC, you happen to be able to track that one specific coin right through multiple layers of transactions. I can see lawyers tracking all the way out to the current holder of a given BTC. edit: Upon a bit more side reading, I think the tracability of a given BTC is a bit overstated here.
  - the_watcher 13y ago
    That is assuming you can "blacklist" addresses before the transaction takes place. Or they could just create a new BTC address.
- 13y ago

stef25 13y ago

Assuming those transactions you describe constitute "the theft", how on earth could Gox not have noticed their wallets being emptied?

Carltonian 13y ago
That's the 750k Bitcoin question.

jackgavigan 13y ago

> Why take 429k and split it into many addresses each containing less than 1,000 BTC each? Ever heard the adage "Don't put all your eggs in one basket"? It's possible that MtGox used to operate everything from a single, large wallet but decided to split it up into lots of smaller wallets, to avoid the risk of suffering a single, catastrophic compromise.

rsiqueira 13y ago
When following the splits-in-2 of this transaction, many accounts still have about 1000 BTC in their final balance according to blockchain. E.g: 1BoGw97oS9L2mU8HTQqpm7yxC72H4LCm6i (Final Balance: 1,000.35 BTC). The question is: who may be the owner of those large amounts of of about 1000 btc? If MtGox did all those splits in 2 smaller accounts, then MtGox could still be the owner?
- deweller 13y ago
  Good find! How many of those did you trace? Can someone automate this trace? Or if not, can we start listing all the addresses and the transaction chains to get there? [Update] Here's a doc if anyone else wants to work on this manually: https://docs.google.com/spreadsheet/ccc?key=0AguUOoH79qm7dFlFQW9Ra09pdjVVVnpxRVNaM3B3TEE&usp=sharing https://docs.google.com/spreadsheet/ccc?key=0AguUOoH79qm7dFl... [Update] Forgot to make it editable. Now it is editable.
- deweller 13y ago
  I can't trace these coins to 1BoGw97oS9L2mU8HTQqpm7yxC72H4LCm6i. Can you share how you did it?
  - rsiqueira 13y ago
    You showed that account 1M1ZkWpHfuQthji2AVsGDvpfY2PrcXQar6 had about 430000 BTC and split coins in 2 other accounts and so on. I followed one of the splits and its subsequents: 14qKyR7b86JVHn5mfm6Dm3G756BgxhMqMP received 203002 BTC. Then it sent 202658 BTC to 13JAudzPvKYyBtY9XpkhNW3YdDqBsi3c7Q. Then it sent 108570 BTC to 144rbLnQmwH8MbB5iirSqvaPgXB9NMdcdb. Then it sent 44505 BTC to 18pGH9G1FtpAkBt1zHTDuYXxPFMXqPG8PU. Then it sent 23525 BTC to 13kfZQxVC6qi5pDSw56Fi3boTU7qMar8Nf. Then it sent 23525 BTC to 14EKdT8ENWUY33Vyd7PN4TgLg6mnrwUt4T. Then it sent 9576 BTC to 7jj6RTpzayiHDeFfCR5ihnDFccK997UNT. Then it sent 5456 BTC to NRZTrVBQEcQ7EWgEdfUrs9xHjuwazdcuf. Then it sent 2878 BTC to 2kSAA9HY11xwDi2QvmtZN1TYWuRdZb7Gx. Then it sent 1241 BTC to 1GKUwZEzMoM92BVjVTNAwoSnUxeANhiawc. Then it sent 509 BTC to 16hpTHQDWRTDkhgHw2T3RDneJM74XJXDoD. Then it sent 473 BTC to 1KuNerYrrHiNR6bGgQesUiCyQt5u5qVBVQ. Then it sent 473 BTC to 1Mu3EwLg85J3sV8No3RKLvwZPu2XZqEE63. Then it sent 473 BTC to 1PgLdynDGFtsfpj6u442gokuLF1kZPCiRa. Then it sent 376 BTC to 12yUfwW8DmgkZmAcAYsMzGWGw7LCmiQzXa. Then it sent 375 BTC to 1CZHLDbrswW6ku8eHEDLLHC8Wr3RxowW3x. Then it sent 354 BTC to 15robQvbP2Q1rZ9kMADnuv9f6tFhwkzz5z. Then it sent 305 BTC to 1Jsdgh21hrbRuLuKeyvEGdkBauHiYXm7FN. Then it sent 286 BTC to 1Q64Rx1tVCNeucdUGLkGdo1asiPHhPjoNW. Then it sent 260 BTC to 1JWjfsk2tUAE83MtBjNEXP85ArxJuWoqg6. Then it sent 260 BTC to 1JS9EAFzrjeFrLiPaK57mXeAZLwqHdEbPa. Then it sent 256 BTC to 1421kfM6sbCXYsSZnvL6Dw1StXW2tbq4gZ. Then it sent 247 BTC to 12eq3PnDcHLT2xpHevZMmFuVHymULjdoaj. Then it sent 125 BTC to 12ZWoyaSwj53spGWGt9AtGCA28uLq58SCk. Then it sent 125 BTC to 1Kf6KQd2oQA3yGPQDw8teCZVK7wj6C7ms7. Then it sent 78 BTC to 1A3AsuYVsgdKNRDm7SGKkkHD9LQeuuipfe. Then it sent 49 BTC to 1bu6ZBmksM5sRVEZspDKaXb5zTxZRuhrW. Then it sent 49 BTC to 1J2HFUhF5xSnDXL3Zw3vCiEdv7eJi4EbM5. Then it sent 156 BTC to 1JT6L2sT9z3QNitk4a2xiDEuwq3dksPYsb. Then it sent 3730 BTC to 17C6oanWeXbehGZNL5fpUKsEQfMFya1pVD. Then it sent 1000 BTC to 1MoUfk2Bow7n9B6ksreCbcyDzXdRTFMpC9 (this seems important address, received more than 117500 BTC). Then it sent 998.99995 BTC to 1Ky8YXSXGensz2J8BYUprtLJvjcjNN3xbm. Then it sent 999.99 BTC to 12wjEVECppk1rPBTQXyZ6m8zn4h91AzzSf. Then it sent 1000 BTC to 1BoGw97oS9L2mU8HTQqpm7yxC72H4LCm6i, who still has 1000.35 BTC in its final balance.

mars 13y ago

that's common practice to anonymize bitcoins. google 'bitcoin tumbling service'.

deweller 13y ago
So do you think that these 429k bitcoins were all sent through a tumbler? Now that would be interesting information. Can we verify this? Obviously we can't trace the outputs, but can we look for patterns that suggest the use of tumblers/mixers?
- mars 13y ago
  well, that's the whole purpose of a tumbling service. i mean you don't even know how long they will be stuck there. i didn't investigate this, but splitting those into small amounts and then tumbling these around seems like exactly this pattern. if you are interested on how this was done in the maybe now second biggest known btc heist check http://www.newstatesman.com/future-proof/2013/12/theres-£60m-bitcoin-heist-going-down-right-now-and-you-can-watch-real-time http://www.newstatesman.com/future-proof/2013/12/theres-£60m...
  - Uberphallus 13y ago
    To be honest, tumbling such large amount of BTC serves no purpose because you overflow the rest of the people tumbling.
sbierwagen 13y ago
Tumbling only works if you're a small fraction of the total. If you put $300 million into a tumbler that only has $1 million of other volume, then it's pretty easy to track you.
- quandrum 13y ago
  Sure, but if you have access to $300 million and want to tumble $1 million, wouldn't it be hard to track you?
- 13y ago

freefrancisco 13y ago

It would be interesting to put these transactions, or the whole blockchain, in a graph database like Neo4J. Dealing with it as a graph would make it easier to find the sinks for all the transactions that started from that wallet. It would also be interesting to look at deviations from the historical statistical distribution in the aggregate of these transactions as a function of time, that would show when a single actor moved a lot of bitcoins even if it is allocated among many addresses. I would bet that the thieves didn't bother to match their transactions with the background statistical distribution.

Torn 13y ago
Visualising it in something like KeyLines (http://keylines.com/ http://keylines.com/) would be awesome.
- jsmeaton 13y ago
  Couldn't find a single download link or pricing/buy link.
  - psquid 13y ago
    It's under Pricing in the FAQ page (the gist: contact them via the contact link to discuss a price, because it's apparently too complicated to estimate), but yeah, the FAQ seems like rather an odd place to relegate such an important aspect to.
    - jsmeaton 13y ago
      Perhaps it's under the frequently asked questions because no one can find the bloody thing. Thanks for pointing it out though.
    - PeterisP 13y ago
      A quick translation: "pricing not on the front page, because contact us" -> "we have an enterprise sales model, which means that if you won't pay six figure prices, forget you ever saw this product". Not always literally true, but a good rule of thumb; you can't really sell $100-$1000 products that way, the cost/time of salespeople doesn't work out in that case.

negamax 13y ago

I followed until this far https://blockchain.info/zh-cn/address/1BWxHjJMmfxfu3w9ESDx91zZHKTo7CFQp1 https://blockchain.info/zh-cn/address/1BWxHjJMmfxfu3w9ESDx91... And it goes back to MtGox address. What? Following another chain and ended up here https://blockchain.info/zh-cn/address/1Cz3BkgQ9NJGq5gvPLs5YrmYn6CY2DoxZN https://blockchain.info/zh-cn/address/1Cz3BkgQ9NJGq5gvPLs5Yr... Same. Goes back to MtGox. Edit: Guys, the original address. The one which contains the MtGox coins. If you track any large transaction. > $30k, even the recent ones. They follow the same pattern. Split into two. And they all end up in pretty big wallets. As much as I want to call it a witch hunt, there seem to be some patterns (I may be biased as I do want this thing to end up in positive). There's still so much information missing.

gizmo686 13y ago

Thanks. Is there an API available for doing this type of analysis of the blockchain (or a program already built for this)?

gremlinsinc 13y ago

Yeah, and I'm sure this line of thinking, will eventually route out the person who stole all those bitcoins -- and I won't be surprised it it's The top execs of Mt. Gox - - who better to take the money and run? They KNEW that they couldn't possibly sell bitcoins at higher than market prices, and make a profit UNLESS they were running a Ponzi scheme.

andypag 13y ago

Could these be the coins? http://www.reddit.com/r/Bitcoin/comments/1z8bqb/jed_mccaleb_might_have_caused_the_spike_7th_of/ http://www.reddit.com/r/Bitcoin/comments/1z8bqb/jed_mccaleb_...