
A Bitcoin Address with 782,000 BTC Moved Through It - patio11
https://blockchain.info/address/1Drt3c8pSdrkyjuBiwVcSSixZwQtMZ3Tew
======
nakedrobot2
While I am still terribly sad that I didn't mine bitcoins with my workstation
3-4 years ago, I am glad I can stand at the sidelines and watch this _amazing_
drama unfold.

Incidentally, I never figured out how to pronounce "Mt.Gox" But now I know:
"Empty Gox" sounds about right :-)

~~~
dodyg
7 - 8 years ago I was envying all my friends who were buying properties that
keep going up and up ...

~~~
mcv
I bought my house 6 years ago. I bought some bitcoins this autumn.

~~~
kokey
It sounds like a winning investment strategy would be to go short on whatever
you are investing in.

~~~
bertil
That was the best back-handed compliment I’ve heard since the last episode of
Downtown Abbey. I'm sure csv hates you every tiny bit I love you right now. :)

~~~
mcv
I don't hate anyone. I love living in my house, and I was fully aware of the
risk when I bought my bitcoins. And I actually bought them just after the
collapse when China dropped out, so I bought them at EUR 470, and now they're
EUR 430 or thereabouts. The loss isn't huge. Yet. I'm not sure if I should cut
my losses at this point.

------
smtddr
So... for those that might not know how to read the blockchain.info site, this
isn't 782,000 BTC moved today.

That's the total amount the address has ever been exposed to, ever. As you
scroll down you'll see red arrows and green arrows, along with dates. Red =
withdraws from the address, and green = deposits into the address. You can see
the dates and note this is just an address that's been doing business(whatever
that is) for awhile now. You see the pagination at the bottom and can view
history for at least a year back.

In short, this isn't news. It's people who are angry looking for a target.
Don't let this be a repeat of SheepMarketPlace fiasco...
[http://www.theguardian.com/technology/2013/dec/09/recovering...](http://www.theguardian.com/technology/2013/dec/09/recovering-
stolen-bitcoin-sheep-marketplace-trading-digital-currency-money)

You can't catch bitcoin thieves this way. They need to make some other mistake
somewhere else outside of blockchain world.

~~~
weavie
What are the Public Note: sections in the blockchain about?

One of the transactions from this account traces down to this address
([https://blockchain.info/address/16cou7Ht6WjTzuFyDBnht9hmvXyt...](https://blockchain.info/address/16cou7Ht6WjTzuFyDBnht9hmvXytg6XdVT))
that contains 53,000 BTC. Transactions into this account have Public Notes
saying things like

\- Worth a shot. My sis really is dying man.
[https://www.facebook.com/MySisterHasCancer](https://www.facebook.com/MySisterHasCancer).
Debts around 310,000.00 now. I dont get it, its nothing to you..

\- I am from Russia. Help to buy a house. I need 100 BTC.
1MEmKEuJxXT71UgRCAhDpjDpYWSMSNcgKp I would be grateful :) Would century are
numbered ;)

\- I am a Chinese college students, I have a loving father, but I can not help
him, he needs to do heart bypass surgery, I can not help him, because the cost
of 100,000 or so needed, please help me, lifelong You pray Thank you!

Any ideas what that's all about?

~~~
smtddr
Just random people begging for money; trying their luck.

[https://blockchain.info/wallet/website-
faq](https://blockchain.info/wallet/website-faq)

Scroll to the very bottom.

------
r721
This address was mentioned in November in Washington Post article about
194,993 BTC transaction:

[Sarah Meiklejohn: ] "About half of the transactions sending bitcoins to this
12sENw address between August 29 and November 14 were from addresses we had
associated with Bitstamp. This could be true for a lot of reasons (a
heavyweight user withdrawing their bitcoins, for example), but there were a
few other weird things I saw that made me think otherwise.

For example, a lot of the bitcoins that flowed out of the 12sENw address went
to one of two other addresses: 1Drt3c8 and (especially recently) 1HBa5. The
former of these addresses we have tagged as Bitstamp, and the latter is often
within one hop of a known Bitstamp address (e.g., it has also sent a lot of
bitcoins to 1Drt3c8).

So, while a lot of things could explain many bitcoins being received from
Bitstamp, it seems like fewer of them could be explained by many bitcoins
flowing from Bitstamp and then back to Bitstamp in a small span of time which
is what leads me to think this is an internal shuffling of some kind.

Of course, I could also be completely wrong! For example, I should definitely
mention that, for the direct transaction of interest, I don't have any of the
input addresses tagged (i.e., they might or might not belong to Bitstamp), so
that my inferences are really just going on the past behavior of this small
handful of addresses."

[http://www.washingtonpost.com/blogs/the-
switch/wp/2013/11/23...](http://www.washingtonpost.com/blogs/the-
switch/wp/2013/11/23/heres-who-probably-did-that-massive-150000000-bitcoin-
transaction/)

So this address was tagged as "Bitstamp" in her database.

------
nikcub
I doubt this is the thief's wallet because it would mean that they somehow
managed to execute withdrawals of 3k and 5k bitcoin 7 and 5 days ago
respectively - MtGox has stopped all withdrawals for weeks/months now.

The number of transactions seems low as well, the malleability bug would have
involved thousands of smaller transactions.

It would also be insanely stupid for a sophisticated hacker to funnel their
loot through a single wallet. Someone who understands transaction malleability
enough to exploit it likely won't be making that mistake.

It isn't hard to pick out a number of bitcoin and then dive into the
blockchain and find a wallet that has a same/similar number of bitcoins.
Similar types of misidentification happen during the Silk Road and Sheep
Marketplace heists.

~~~
amacneil
I don't think they are suggesting it's the thief's wallet - it's presumably
the Gox hot storage wallet.

------
yuvadam
It never had more than a few thousand BTC (except for a few peaks) at any
point in time. [1]

[1] -
[https://blockchain.info/charts/balance?address=1Drt3c8pSdrky...](https://blockchain.info/charts/balance?address=1Drt3c8pSdrkyjuBiwVcSSixZwQtMZ3Tew)

~~~
ok_craig
Do you think this means that it is less likely, or more likely to be related
to the thefts?

According to Gox, the theft was happening over a long period of time, not one
lump sum. Transfers to this address began in April of 2012, which is
consistent with the story.

~~~
shawabawa3
If this address does belong to the thief, why would they steal all the
bitcoins with a single address? Surely using different addresses would make it
less suspicious

~~~
ok_craig
I don't necessarily believe that this address was related to the theft, only
pointing out that the expectation of one transaction containing all the stolen
bitcoin is not correct. Yes, using different addresses would be less
suspicious.

------
sorenbs
How traceable are bitcoins? Would it be possible to track when someone tried
to offload the stolen bitcoins on one of the major exchanges by tracing back
to this address or some Gox logs?

Given the value of the stolen coins are in the range of 0.5B USD it's not
unreasonable to suspect that some government capacity would investigate this.

If the stolen coins can indeed be detected - how would they go about
extracting the value? Seems like a large scale, risky money laundry effort
would be needed.

~~~
icebraining
You can trace all transactions forever, they're all public in the Bitcoin
ledger (blockchain). But since Bitcoins are fungible, if you transfer them to
an address that holds BTC from many people, you can "mix" them and make it
harder to tell to where did your amount go:
[https://en.bitcoin.it/wiki/Mixing_service](https://en.bitcoin.it/wiki/Mixing_service)

~~~
kordless
Keep in mind older transactions are pruned from the tree on most nodes. While
you may see where a Bitcoin originated, not all intermediate addresses will be
shown forever in some version of the Blockchain. That's not to say that
someone somewhere doesn't have the full blockchain, so you should keep in mind
that it depends on what blockchain you are viewing at the time of
investigation.

~~~
stcredzero
If I were the NSA, I'd be keeping track of the full blockchain.

~~~
kordless
Based on current observations, I would assume they are and have for some time.

------
perlgeek
So, what about it? Does it belong to some BTC exchange? Or is it all stolen,
or something?

I'm pretty sure there are lots of company and governmental bank accounts with
lots of money moving through them...

~~~
mseidl
MtGox has about 700k+ BTC

~~~
perlgeek
Wasn't it said they lost 700k BTC? Also just comparing balances doesn't seem
like a very strong indicator of identity to me.

~~~
AUmrysh
Couldn't someone with a known withdrawal from mtgox use the address the money
came from to trace up the blockchain? I don't know if gox used multiple
wallets, but if not it should be pretty obvious where the money came from and
went.

------
mburst
I think in another 5-10 years bitcoin will finally be realized as one of the
great scams of our time

~~~
ebbv
The biggest scam of BitCoin is never even mentioned; that the creator reserved
for himself vast numbers of them.

~~~
czzarr
How dare he take profits for his work! How dare Zuckerberg keep 56% of
Facebook for himself. Jesus the things we read on HN these days.

~~~
acjohnson55
Well, now that you mention it, I think it is totally fair to take a critical
view of the way we allocate the rewards for a successful enterprise. There's
no natural law at play here. We live in a system that deliberately rewards
founders and financiers over the other pieces of the puzzle.

------
adam12
This whole situation reminds me of Michael Bolton's virus in Office Space.

~~~
hackerboos
Yeah or Richard Pryor in Superman III

------
o_nate
If I was going to steal 782,000 BTC over a period of two years why would I
steal them all from the same address? Doesn't pass the sniff test.

~~~
beedogs
The hacker really only needs to be slightly smarter than whoever wrote that
bad PHP in the first place. It's not implausible really that they'd send it
through the same address.

------
dave1010uk
To save you doing the math, that many bitcoins is about $375 million at
today's prices - not that the market is deep enough to be able to sell it for
anywhere near that price.

~~~
negamax
It really surprises me that Bitstamp has absorbed 100k+ in last 24 hours at
current price range.

------
struct
Seems that quite a lot of the volume on that address[1] is about 40% of the
volume of the of the stuff going through MT Gox[2]. Might be a coincidence.

[1] [https://blockchain.info/charts/received-per-
day?timespan=180...](https://blockchain.info/charts/received-per-
day?timespan=180days&showDataPoints=false&daysAverageString=1&show_header=true&scale=0&address=1Drt3c8pSdrkyjuBiwVcSSixZwQtMZ3Tew)

[2]
[http://bitcoincharts.com/charts/bitstampUSD#rg180ztgSzm1g10z...](http://bitcoincharts.com/charts/bitstampUSD#rg180ztgSzm1g10zm2g25zv)

------
kiba
Context would be nice.

~~~
harrigan
The alleged Mt. Gox insolvency document claims that they lost about 744,408
BTC due to malleability-related theft which went unnoticed for several years.
This is an address that just happens to have had 782,558 BTC flow through it
over the last two years.

Of course, if the Mt. Gox document is a fake, the author could easily have
chosen an amount that corresponded to an address that had such a number of
Bitcoins flow through it.

It's difficult to know what's going on here.

------
vxNsr
Well I don't know if this matters but it checks out against benford's law, or
at least kinda...
[http://i.imgur.com/nL9lO6r.png](http://i.imgur.com/nL9lO6r.png)

for comparison here is a dataset that doesn't checkout against benford's law
(it's the city of Chicago's employee Salaries)

[IMG][http://i.imgur.com/SxAY1d2.png](http://i.imgur.com/SxAY1d2.png) (don't
get too alarmed though, it fails because they've used estimations for hourly
employees)

------
mdemare
It is possible for the exchanges and miners to get together and change the
protocol, to mark the stolen bitcoins as invalid? The thief is probably going
to dump the stolen bitcoins on the market - not exactly a good thing for the
bitcoin price or the long term viability of bitcoin itself.

Especially since it will take quite some time to dump all thsoe bitcoins - the
market isn't all that liquid.

~~~
cLeEOGPw
Nobody can say for sure the bitcoins in that address are stolen.

But it would be very possible to reject bitcoins from certain addresses, and
the protocol don't need to be changed. All it would take is make a client to
reject to include transactions to/from blacklisted addresses into blockchain.
And for everyone to update clients. That still would be vulnerable to 51%
attack, but it is very real possibility.

------
fidotron
Get the pitchforks and the torches! Looks like we've got ourselves a witch-
hunt.

~~~
DannyBee
Don't worry, the internet is pretty good at these. I mean, Reddit did a great
job with the ... oh, that's right.

------
fu86
I hope, his USB-stick doesn't get corrupted or unreadable ...

------
jcfrei
I'm sure you could find several addresses with a transaction amount in those
heights. Exchanges don't operate from a single address - so any theft could
only be traced back to several addresses.

------
lettergram
Same time MtGox Disappeared

~~~
icebraining
No, it's not, the 780k were not from a recent transaction, they're the
cumulative sum of all transactions in the last two years on that address.

~~~
dredmorbius
Many of those transactions were recent. Though the account dates to April,
2012, the volume of TX seems to have accelerated through 2013 and 2014.

~~~
dredmorbius
More (only because I'm learning this as I go): the balance shows the flow of
funds in and out of that account. I've traced a bunch to various endpoints and
through intermediaries:

[https://blockchain.info/charts/balance?timespan=all&showData...](https://blockchain.info/charts/balance?timespan=all&showDataPoints=false&daysAverageString=1&show_header=true&scale=0&address=1Drt3c8pSdrkyjuBiwVcSSixZwQtMZ3Tew)

[http://www.reddit.com/r/Bitcoin/comments/1yvdcd/heres_a_summ...](http://www.reddit.com/r/Bitcoin/comments/1yvdcd/heres_a_summary_of_what_has_happened_over_the/cfocqz3)

------
antidaily
That was me.

