Yeah, I've seen them claiming that the captcha wasn't leaky, which well could be the case. Having looked at the config files and logs now, the Feds account see

Yeah, I've seen them claiming that the captcha wasn't leaky, which well could be the case. Having looked at the config files and logs now, the Feds account seems somewhat shaky. They were hitting the PHPMyAdmin page and authenticating, but didn't mention this, which is very iffy. It sounds more like the "typing in miscellaneous entries into the username, password, and CAPTCHA fields" wasn't exactly 'miscellaneous' so much as using some kind of a targeted exploit that they used to get the machine to leak enough to pwn it pretty well. Ulbricht was not nearly as skilled as he gets credit for, his machine had leaked the IP on the login screen in March and May, and his notes show he was scrambling to patch bugs, but if the Feds. had gotten PHP dumping $_SERVER or something just by fuzzing they would have mentioned it which makes their account suspicious. So that's in the air. On a separate note, there are two separate cases against Ulbricht, one in New York happening now, and the other Maryland (which is where the contract murder charges are). So he probably does need to be very cagey about any claim of ownership of the server given that this isn't the only trial he faces. As I understand it, while the claim wouldn't be admissible as evidence in the NY case, it could still be germane to the future case. It also means the "Fruit of the poisonous tree" issue could be mitigated even if the NY case is dismissed, given there's different evidence and claims presented in the MD case, and some of that evidence is not tied to the IP leak at all.