Thread by @tayvano_

Dude they got bitcoin fog

wired.com/story/bitcoin-…

I think we all know by now that anyone who knew about btc before 2013 is a villainous kingpin in the irs's eyes.

Feels to all the real kingpins out there who had to work hard irl for that title. 😂

Thanks Amy for the actual docs so I can stop thinking about clickbait headlines and the feelings of real kingpins. 😅

https://twitter.com/ahcastor/status/1387216776790872065?s=19

Numbers. I do very much appreciate they are using the btc value *at time of transaction.* (That's why it's both 1.2m BTC and $336M USD. 1.2m BTC=$336M at time of tx)

On the internet no one knows youre an IRS-CI SA operating in an online undercover capacity

....or do they? 😈

Alright so how they tracked him down.

1. Get email addresses from publicly available bitcoin talk. Confirm email but and get nothing new from subpoenas to twitter and microsoft (hotmail).

2. Get new fake email + fake name + payment details (liberty reserve) from subpoena to host of domain.

Use Liberty Reserve data from previous investigation to link back to Aurum Xchange account.

Subpoena Aurum (?) to determine received from Mt Gox 3?

***Note: I dont know what data IRC-CI has on hand from Mt. Gox? Or Aurum?

I do know they have a fuckton of Liberty Reserve stuff. Attached: *unrelated* other case that does a better job of showing how IRC-CI uses on-hand Liberty Reserve info.

3. So now they have the Liberty Reserve acccount and know LR account received from this random Aurum Xchange account they somehow figure out that Aurum account received from Mt Gox Acct 3.

Then Mt. Gox 2.
Then self-hosted (onchain) addy.
Then Mt Gox 1.

3b. They mention three new email addys and his name here.

in reality they would have the:
Name
Email
Sometimes an irl addresses
BTC addys in and out

from:
Liberty Reserve
Aurum
Mt Gox 3
Mt Gox 2
Mt Gox 1

That's a lot of (fake) info to sift thru to determine whats real.

3c. Oh and don't forget IP addresses, telephone numbers, other exchanges that sent and received from mt gox 1, 2, 3, aurum, liberty reserve, and the data from those exchange.....

!!!

They buried this little detail in that mass above but I'm pretty sure that IRS-CI now has BTC-E records on hand.

This data allows them to fill in the gaps. You know. Gaps that allow them to up their budget by $̶1̶B̶ $4.2B

cc @EileenOrmsby @lamoustache @mmviii_2008

Here's how they talk about how they got the various bits of information from WhoIs, Highhosting, Liberty Reserve, Mt Gox, BTC-E, Google:

Publicly available
Records from…reveal
…'s records show
records from…
records from…
…pursuant to a lawfully authorized search warrant

🤔

I mean so far theres no blockchain shit.

They started with the host to link thru to a bunch of data obtained from previous investigations/arrests/seizures/other US alphabet agencies seizures/French prosecutors and a search warrant to get a pile of real and fake information....

...and then stumbled upon a fucking goldmine in the Google Drive. Up until this point the only difference between real and fake is the real name crops up more. But now they are all definitively linked and you HAVE A 10 YEAR OLD DOC IN YOUR GOOGLE DRIVE TALKING BOUT IT CMON.

Finally some actual fucking blockchain shit.

Their narrative: if you look at the earliest Bitcoin Fog TX's you see they also link to the Mt Gox account we connected separately

Reality: From Mt. Gox data we found these txs that are to Bitcoin Fog before it was public

This really annoys me.

10/13/11:
2 BTC from Mt Gox 1 -> cluster 12NSB5
0.41 BTC->1KWMex
1.57 BTC->1NeWNP

"12NSB5 looks like a mixer"

"investigators traced the outflow of the balance of
1.57 BTC from wallet 1NeWNP to BITCOIN FOG."

Hide behind perceived complexity more bro.

1NeWNP = 1NeWNPH7sxkCoHjvvKwWqLLFjRjLLJJiMP

12NsB5 = 12NSB5HE8VUjK44cQPJgtLUgj6YXLeUyU4

1KWMex = ????? (It's *not* 1KwmEXW5hMKAcVV5r34xc2ZWyFq9CodqKF which receives/sends 1.00000001 BTC on 10/01/2014)

> The transaction pattern within cluster 12NSB5 is consistent with mixing/tumbling transactions,
including those seen from BITCOIN FOG.

I mean....I guess I see it if I close my eyes really tightly? 😝

I'm going to work out and process this before I keep on. The overarching narrative is totally bland: the US alphabet soup has all the power and data, on hand or via subpoena. Duh.

The question for me is why this arrest *now*???

*All* this is from 2011-2013…
…
…
…
It's 2021.

Continued here:

https://twitter.com/tayvano_/status/1387396127117373441?s=19