Re: Weexchange/Bitfunder User Deposit Addresses. Where are the coins "gone"?

Quote from: klabaki on February 06, 2014, 12:08:50 PM

Given this assumption, one can get a list of most of WeExchange's addresses and transactions from only one single address.
The list isn't complete though, because transactions also have a change address which belongs to the sending wallet. The WeExchange wallet places this change address at an unusual output index, so I didn't include it in the list to avoid fan-out into other wallets.

I adapted to that issue about unusual output indexes.

So, finally, I could compile a list of WeExchange's addresses and transactions which is somewhat complete:

Addresses, Part 1: http://pastebin.com/yGEtnAAY
Addresses, Part 2: http://pastebin.com/JVSL6zjN

Transactions, 2011-10-17 to 2013-03-31: http://pastebin.com/QkFVY7fH
Transactions, 2013-03-31 to 2013-05-19: http://pastebin.com/1SE7YVTt
Transactions, 2013-05-19 to 2013-06-15: http://pastebin.com/T9TLKVtw
Transactions, 2013-06-15 to 2013-07-11: http://pastebin.com/rV3q46Lg
Transactions, 2013-07-11 to 2013-07-29: http://pastebin.com/eqWxDbCu
Transactions, 2013-07-29 to 2013-08-18: http://pastebin.com/sAnebk2a
Transactions, 2013-08-18 to 2013-09-12: http://pastebin.com/r2KkybqV
Transactions, 2013-09-12 to 2013-10-09: http://pastebin.com/SnGfhxXn
Transactions, 2013-10-09 to 2014-01-31: http://pastebin.com/P0tG2gJZ

The transactions' list comes with four columns:

the timestamp of the block containing this transaction
the transaction id itself
the credit or debit that this transaction did to the set of addresses I found
the sum of the previous column of all transactions up to this one

Quote from: klabaki on February 06, 2014, 12:08:50 PM

...it looks like this address received more than one big withdrawal from WeExchange:

19ENdxtYNwdsFbaEF2web7FywgQHdsNCGt

That's all that I could find out for now. Further investigation would concentrate on who owns these addresses, and where did the coins go next...

I kept my promise and analysed this wallet in the same way I analysed the WeExchange wallet. Here's the results:

Addresses: http://pastebin.com/57M05y8q

Transactions: http://pastebin.com/Vu7b1ib7

Although this wallet has way less addresses than the WeExchange wallet, it handled more bitcoins, for example:

Code:

2013-08-10_01:24:36 7e45d4ad00670fcfb51beffbf6ae54413dbf026988fd52a351f4ccce97478e8f 0.25421784 4380.57643731
2013-08-11_10:40:03 fcfd4e06e9a6b877d43a18da3fdd3aa8a2c4f4d2e7fbfdbad7c1b0979756bab2 5863.00000000 10243.57643731
2013-08-11_19:11:51 00ce11e4f9e1091317294b652b8d6c663607323654b1d64a4292bcb7143d86df 1000.00000000 11243.57643731
2013-08-11_20:30:06 2094d50b32791a778555835c62552e9e2f82fa4c75e159438c1c73eedc99d74a 4313.00000000 15556.57643731
2013-08-11_20:35:51 1e3198fd649c8d67d197bb754a344790c5d4c22fbdd45753f7d2afbb66f0dc6e 1100.00000000 16656.57643731
2013-08-11_21:26:33 d9e9356faa1f66ade70a2baa7f1f587ac23e54613953c760c254dd63d96f0372 913.00000000 17569.57643731
2013-08-11_23:30:07 699c39794a780ca6d26526b19ebb780d0e5a2f3ca4e0f51920290cf1070ddc51 -500.00000000 17069.57643731
2013-08-12_07:54:55 9202badc41c380e2e7e39ae184172931653484085e77172aaeb6790bd689bce5 -1.00000000 17068.57643731
2013-08-12_10:16:27 88704e47ea9efb730fbfd456f43f856fdd0dc063f0a132bd27fc99c49f4fec32 -12999.00000000 4069.57643731
2013-08-12_14:05:28 90cb96d95424c6cfd186ea6ad50ff3c9775d8c9d721d228af67019cbdb3814e2 1500.00000000 5569.57643731
2013-08-12_14:06:43 ab90fa83efd38abeeeeae7170d701edcdec8928f8a220d50dfa4f66fffc0d5ee 0.46932299 5570.04576030
2013-08-12_14:30:13 41d4ff6585eeb82075d6bf5b037c409f905073eb65fc16102bd5d4dcc6dae363 1000.00000000 6570.04576030
2013-08-12_15:04:11 ae2b08e28101877f167774c0d0aa32df1b4aae58a5ae11752e88467679299997 500.00000000 7070.04576030
2013-08-14_17:18:22 7014297f814c65e2a7f94e631a8bcee6a0e5f8e548b3d0228c7973f967d1ca34 104.86445000 7174.91021030
2013-08-14_19:27:22 facc0d324f4089b21ceaed2fe76f0f3e48de92ed2565d11e1c9812fea6ae1721 176.08838444 7350.99859474
2013-08-16_12:09:07 c2b53e82438dab737b1c961666457e50ce599d2752ff3eeb0b23112ca998c852 2.10844606 7353.10704080
2013-08-16_12:15:27 527c87999e31f905d5c080c3f7956308c0bc3e0a3c30126e3886451afe288f1b -2.90000000 7350.20704080
2013-08-16_15:23:03 6067707fad6e8c3caad44bae41c0aaca585b78372fd6009338e7e3d2411dbc3d 0.21206826 7350.41910906
2013-08-18_23:17:43 f5035f5f5857a68df5957acc6436dcc220577b3438c487ff0d3016dc7d9259eb -20.00000000 7330.41910906
2013-08-19_14:21:29 e2e33c7451832ee0114e8a4fd4e5abb88b4e0215a0f9af4bf03792beb4678892 0.38399153 7330.80310059
2013-08-19_17:55:56 b2889b6e0dea50082e3dd1783dca8fdcbd83957755c612332dc55c8da7c7443b -7000.00000000 330.80310059
2013-08-21_13:10:56 a351524ae383e3454c32c4687069bbc6dca49917a4cf279c9641d5ff77db08ae 61.30095000 392.10405059

One of this transactions comes from WeExchange; quoting from the WeExchange wallet:

Code:

2013-08-11_10:10:39 4165bfe5ba036afdb29aa87bc4113da411d840a93b7a3ca6409d46f9695edfcd 5.00000000 11094.97351450
2013-08-11_10:40:03 fcfd4e06e9a6b877d43a18da3fdd3aa8a2c4f4d2e7fbfdbad7c1b0979756bab2 -5863.00000000 5231.97351450
2013-08-11_11:02:40 4c79aa8897bf165a33ac115aa86d08356bc5fd6ff75c45623c48e5517a2da6cb 0.10000000 5232.07351450

This means that on 11th of August 2013, more than half of WeExchange's funds were transferred into some other wallet, where they became intermixed with funds that probably did not origin from WeExchange.

The transactions' list has been intentionally presented in a way that allows everyone with a web browser to examine it.
So, everyone feel free to skim it for suspicious activity and post your findings. I just did the start.

Donations for my continued efforts go to 1PaEvsKNTDxhz4kg8rL1samkbgF65P9NMF. Thanks!