Quote from: piuk on February 12, 2012, 03:30:44 PM

Quote from: BkkCoins on February 11, 2012, 11:38:59 PM

This looks pretty nifty. I noticed on that BTCServ hack that the small part gets spent twice to merge into a 40 BTC address. It would be useful to know what addresses payments get combined with as that may give clues about wallet (like a "back-link" on an address). I have no idea how it could be fit in a diagram because it would get "hairy" fast.

My hypothesis is that the coins change hands at the 40 BTC merge as the ip addresses switch from Germany to U.S. Maybe you could hover over a node to show any new inputs. Also the "Purity" of the coins (i.e. how much they have been mixed with the other transactions) could be represented by the thickness of the line.

Quote from: BkkCoins on February 11, 2012, 11:42:45 PM

So, that means the hacker either is close topologically by default or has added manually BTCServ IP as a peer? If the hacker is manually relaying thru BTCServ that's a bit like rubbing salt in a wound! Or another interpretation is that it's still controlled by BTCServ, though obviously not provably.

Or maybe the attacker sent some change back to BTCServe for some reason. I guess no matter how good future tools like this get it will still be almost impossible to prove anything.

The 0.63 transaction was a legit withdrawal. I think its displayed because it was happend at the same block count. Also the 419 transaction has been relayed by an US ip, apparently Tor Network. The 0.63 transaction did go out from btcserv.net ip