Quote from: theymos on February 23, 2015, 07:43:59 PM

I think that marcotheminer should return the account now since it was probably hacked, but everyone should give yussuf89 negative feedback for being unable to stand behind his account's actions unless he pays 50-75% of the loan principle. (This is just my opinion -- I'm not going to try to enforce it.)

if you are confident the account is hacked then it would be best to post this. I am still looking for blockchain evidence of other alts however the account being likely hacked (instead of possibly) makes the situation more urgent.

Quote from: MadZ on February 22, 2015, 11:25:16 PM

Hacker/scammer took out the loan to this address: https://blockchain.info/address/1HQATDRExXexyCc2hHJ8F272evTgm21JZ4

A week ago that address made this transaction where the guy identifies his skype address: https://blockchain.info/tx/c998155f548d0a4ce3c1b311c76c89b4ce13a4489dcf6b5550cea74f73cd23a9

Skype: Nizamhekker

He uses it a lot, just google it and a bunch of hackforums results come up.

Here is one of his btctalk accounts: https://bitcointalk.org/index.php?topic=742872.msg8397265#msg8397265
https://bitcointalk.org/index.php?action=profile;u=164938

Here is another one: https://bitcointalk.org/index.php?topic=857347.msg10001956#msg10001956
https://bitcointalk.org/index.php?action=profile;u=380653

Take the BTC address (1DwQxpZGC5e7ZkR1xbagAmJcaHmU88v5aj) from nizamcc's post and you also find this account: https://bitcointalk.org/index.php?topic=764034.msg8610073#msg8610073
https://bitcointalk.org/index.php?action=profile;u=372665

Both nizamcc and YOLOMAN have fake positive trust from the same sock account: https://bitcointalk.org/index.php?action=trust;u=348988

Confident they are the same person. Anyway, let me know if you can find anymore of his accounts/info about him before I post a scam accusation.

Edit: my response

Quote from: Quickseller on February 23, 2015, 01:59:24 AM

I also find it interesting as to just how much whoever got the loan was gambling, there was ~19 pages worth of transactions to/from luckyb.it addresses when looking at blockchain.info. However only ~1.5 pages of those were from after the transaction of the loan. While scrolling through all the transactions, I noticed that he made a few very large bets, one for .25BTC, one for ~.31BTC, among others. ~~Additionally it looks like his bankroll started with 11 BTC.~~ Actually no, he spent that here, which was later spent here which was likely depositing it into either a casino or some other service/site that holds funds on behalf of others. It looks like his initial bankroll was 1.8 BTC (here, here, and here), he then gets a series of <.01 BTC transactions into that address, until he starts playing luckyb.it. He later send ~1.1 BTC to the address (here and here). He sent another ~3 BTC (here, and here).

I lost track of how much he sent to other addresses then luckyb.it address, however one of note is thiswhich sent ~3.1 BTC to some other address. I would say that he likely sent around between 1.5 and 2.5 BTC to other addresses in addition to the above transaction. This is strange because it implies that he was roughly 'even' with his gambling with that specific address.

It looks like this transaction sent .005 to an address tagged as 'lucky bit promo', I am not sure what it is, however a forum search comes up with nothing, and I am having trouble accessing my VPN via foreign country gateways so I can't access luckyb.it appearing to be outside of the US. It is probably a dead end, but it could lead somewhere. I know luckyb.it was running a contest where people could guess the time of the millionth bet if they sent funds to a luckyb.it address, however it is not that one.

The 11 BTC amount is interesting because it is very close to what moreia stole in his ponzi with williamj. There are a small number of people that have that much bitcoin. This was my gut feeling from the start and was somewhat confirmed by him saying that he clicked on a link from the PD chat that likely contained some kind of malware. Moreia has a history of spreading malware, and either him or someone else did a very similar thing on Coinichiwa to Neonecrox13 (convicted2008).

Quote from: Neonecrox13 on February 20, 2015, 03:42:07 PM

They just posted the link to it. I can't remember their name but they did again the next day after it happened while I was on there talking told RedsnOw to ban them, that link was the only thing I"ve ever downloaded and I got robbed. But yeah I installed a antivirus and did a system backup to a few days prior to this happening. I know u probably think I know them or something, but honestly before now I've never heard of them before. After I downloaded the antivirus I did have like 3 or 4 it said. I think I can still get to it shows the names and what they were in.

Quote from: Neonecrox13 on February 20, 2015, 04:13:15 PM

Ask Redsnow if they are anyway he can get the chat logs from Coinichiwa on Jan 23 and 24th. Im fairly sure it was that day that I downloaded it, but it could have been the day before I'm not sure. But I do know that the name of it was 999dice.exe. I know that don't help at all though. Also let me check and see if I can find anything on my computer from that date. I'm not sure I can though where I did a system back up. But I will look.

Quote from: Neonecrox13 on February 20, 2015, 04:46:18 PM

http://i.imgur.com/4cCSRR6.png

http://i.imgur.com/QCCP9Hz.png

http://i.imgur.com/L8HcWGP.png

The webaddress is www dropbox com s hbosomsnyicqxtf 999dice.exe?dl=0 <---maleware

Like I said though, it says Link not found at dropbox. They have took it off there I imagine.

I do agree that the person who got the loan is the same person as nizamcc and IceTurk, although the later doesn't really matter as he has negative trust already. The newbie account is probably also the same but that is less concrete. Assuming the newbie is an alt of them then YOLOMAN is also an alt of them, which is interesting because he gave marcotheminer positive trust for escrowing an account trade (he does not 'publicly' sell accounts, does not have an escrow thread, and I have long suspected that a good amount of his lending thread is him lending to his alts). It is even more interesting because YOLOMAN did not give any feedback to the person who actually sold the account. Even more interesting is that YOLOMAN had a debt to marcotheminer and "defaulted" here, his first post of his lending thread however lists the loan as being "repaid" with no mention of being late, the reuse of his address makes it very difficult to know for sure if the loan was actually repaid or not. Looking from the beginning of November back to the beginning of septemer, I didn't see any transactions sending .007 (the repayment amount) to 12hYBWiPqfwdveGzpbRdGxeqnoMcNvGNSq (marcotheminer's repayment address for all his loans). although there was one for .005 during that time.