Post
Topic
Board Reputation
Merits 494 from 67 users
Topic OP
Long-time sig campaign farm ID'd via single wallet transaction
by
nutildah
on 01/02/2021, 00:50:47 UTC
⭐ Merited by fillippone (55) ,El duderino_ (51) ,Welsh (50) ,Ratimov (36) ,ABCbits (26) ,DarkStar_ (25) ,LoyceV (24) ,1miau (20) ,suchmoon (19) ,ranochigo (15) ,vapourminer (15) ,cabalism13 (13) ,bitmover (12) ,hilariousetc (10) ,marlboroza (10) ,malevolent (9) ,DaveF (6) ,hugeblack (6) ,TheBeardedBaby (5) ,Bitinity (5) ,Daltonik (5) ,Best_Change (5) ,ibminer (5) ,NotATether (3) ,DdmrDdmr (3) ,Tytanowy Janusz (3) ,Xavofat (3) ,lovesmayfamilis (2) ,Dave1 (2) ,seek3r (2) ,Buchi-88 (2) ,o_e_l_e_o (2) ,Halab (2) ,crwth (2) ,mu_enrico (2)
A week or two ago I noticed the account illyiller had woken up as I was browsing the seclog looking for something unrelated. That user name struck a bell, so I pulled up their account and decided maybe they were trying to get back into sig campaigning.

Out of curiosity, I looked into what campaigns they worked for. The blockchain suggests this person had made quite a bit of money sig campaigning in the past, way too much for the campaign I could associate them with.

Taking a closer inspection of a master address, to which feeder addresses sent BTC from several other addresses associated with sig campaigners, I managed to identify a ring of 9 alt accounts, all belonging to the same owner and all enrolled in sig campaigns at one time or another.

The kicker is that 3 of them have been in the same campaign together for over 3 years.

All of the addresses in this wallet are what I refer to as feeder addresses. There is 1 feeder address per sig campaigner, and it acts as a buffer between the sig campaigner address and the master address.

Here is the transaction between the feeder address wallet and the master address:

https://www.blockchain.com/btc/tx/2f068dddc4c24b8771bc0d46671e38d80b834198d9e99a7329d2d2a946c3fc19

So each pair of addresses (one sig campaign address, with outputs sent to a feeder address) corresponds to one account, which means all of these accounts partook in this transaction. Linked to each account name is the proof that account used that address:

AddressAccountDateactionother
17k4EVPznuTQ7q7CujbFFvTqx97ff6CZZN9/15/2017part of wallettransaction ID
122h7dmX8vcdNnWjfbz1eevD8tfcJasBWVfigmentofmyasssent topart of ChipMixer campaign
1E5DeqedMWWLWCWXaV7xjU9KYjRb5TqaaGpart of wallet
1J4zoPgnaDDmnjhUxLf7Gh1z4EWq8bvrtBillyillersent towoke up 1/19/2021
1DZeFJs5og8iqc6axKuUcemvqKDswWd6eppart of wallet
18QwLB8KEWnHjX8dvWUXCDK4HaWDaPp82sillinestsent toinactive
1BxSjuLa5GAtMdeiyiQ6P1yBKp2mKnMmf4part of wallet
1ugj76pwcXq2YmPVwxRccZmWrQmEsb2zpsquattersent topart of ChipMixer campaign
1uAk6hDwoUuwBcRFJpxfeoXEJBUymRQVNpart of wallet
1GPLgkkLF3taAVhhGhVy7CfiX8DFkf4mZBmarky89sent toinactive
1Mp7gexEEbxzZKS5QUpv2FHwbXJpFWEDempart of wallet
19wxJJobJ77deczvzoCpLGXDqb7FjcELCiexstasiesent topart of ChipMixer campaign
1DYV1CUk9Vhk5wL8JZh1TL2Yoov9LbjpRYpart of wallet
1Np6kG52WjLQ9jaKbkMiUqfqruLyXS1JADMAbtcsent toinactive, 2012 registered
13z87VUi1fZhgpydei9KvxQVJ6NFDUNNuUpart of wallet
1GCcAoaMzA39jQai8asaB7dUTHuaDPnH7Lromani245sent toinactive
16JXYv4H1BpyseA66c4bqUDT7fWQvYRrPupart of wallet
18jgXSJN7jyhPfvjeX52vRmBMeBpxQpJVWmanchester93sent toinactive
All go to
1Bp5t2AzEGkNSsFsAgCNn9zMy9QGsxB6Pu

It would appear all these account belong to the same person, seeing as how the addresses listed here have only ever been involved in signature campaign activity. For easy reference here are links to the accounts themselves (bolded are still active):

figmentofmyass
illyiller
illinest
squatter
marky89
exstasie
MAbtc
romani245
manchester93

Since the chances of all of these accounts pooling months worth of sig campaign funds together for any purpose whatsoever seems extraordinarily slim, it is safe to say that these are indeed alt accounts and one of the more clever and prosperous account farms to ever exist on the forum.

I'm of course open to other interpretations and am interested to hear what they might be before leaving a neutral on all of the accounts.

Let's try to keep it civil, thanks.