Thread by @lilleputt1

WHAT THE ACTUAL FUCK

So after starting to look into where the money was going from Eliza, I started to doubt that would lead anywhere...

I might have found something else though...

This might take some time to untangle

So let's start back-up with Eliza's wallet

Looking at it she made 0.15023756 BTC

One donation however sticks out

Hash: 9c46eeccbd35d178dba1394595c9b810e0d61aa0e9b28455fb41048c8b89f03a

We know this is a donation

Let's go look at the wallet

blockchain.com/explorer/addre…

This is weird

2 transactions, 1 in one and 1 out

Why would you make an account just to donate to Eliza? Why 0.14227771 BTC? That's a lot of money Roughly 3.3 K USD, as a donation? That's weird

Why is it split into two? Why is the input split into two?

blockchain.com/explorer/addre…

Let's go look shall we?

Where it came from? Same pattern 2 transactions, 1 in and 1 out... The money is again being split into two...

Again it looks like the sole purpose of this was to facilitate one transaction between two parties

blockchain.com/explorer/addre…

Again same pattern... 2 transactions, one in and one out

This is a bit different though it has multiple inputs on the transactions in...

blockchain.com/explorer/addre…

What are these? Why do they split up transactions?

Are these burner wallets? And if so why would you use a burner for a donation and why would you layer it 3 times when one would do?

makeuseof.com/what-are-crypt…

This is a very odd way of using wallets, I can get one burner wallet, that makes you security aware, but three? Even I'm not that paranoid...

I guess this is as good a time to talk about batching

coinguides.org/batching-bitco…

Batching is what they are using to split up the trades.
We know for a fact this happened with the initial donation to Eliza

It got split into two one part Eliza and another part to this address 3MfTgVA42qa1XnGMo3yf6iK9k2yzgFZd4E

More on that later

This is likely the same entity (Person or group) who uses all three wallets since
1. All three accounts are doing batching, this is very uncommon outside of payment processors and exchanges
2. Repeating pattern of one wallet, 2 transactions, one in and one out
Safe to assume

This is as far up the rabbit hole we are going for now

Let's do a deep dive and see where the forks leads us

Let's start from the top, that would be this one for those of you with bad memory
blockchain.com/explorer/addre…

We know 1BcASkCe1g6UWzW1Ya2oMKcjCAib9STDBo
will eventually lead us to Elizas and we are going down that fork... later

Let's take a short detour first

blockchain.com/explorer/addre…

Would you look at that...

Same pattern again 2 transactions, one in and one out

What's this though?

This is a bit odd...

If you look at the transaction going out... Batching

Is it possible to batch to batch into a single wallet?

Yes it is...

And what are the odds that you have all of it going into one wallet and not multiple like you normally would for a payment processor? Where are my statistically gifted brothers at?

Should we look?

blockchain.com/explorer/addre…

Pretty impressive almost 50M USD by today's exchange rate...

Now you get why I started this thread with WTF?

Quick break

Now what do we have here?

A treasure trove, that's what... Literally

Look at total sent and received, that's a lot of eggs

To be fair, this could be a payment processor

But why go through all that trouble just to hide that?
You wouldn't

At the rate this is going, the 3.3 K looks more like a payoff than a donation

From whom? We may never know. For what? Again we may never know

Kinda hard to believe that this started with Eliza being petty and go too far

If not for her banning people I would've never looked

Where to go from here?

1. Look at the trades in the wallet we left off with
2. Go back through the trade that lead us to the wallet we left off with
3. Follow the other forks in the main rabbit hole
4. Go back to the top layer we found and go further up to see if we

I'm boring, so I'm going to start with 1. and see where it goes

First of all this wallet has an insane amount of trades and an insane cash-flow as we saw yesterday

Here is what's a bit interesting though

Let's look at one given trade
blockchain.com/explorer/trans…

Look at the second "To" address...

Spot the difference?

Me neither...

Isn't it weird to send money from account X to account X?

Is there any payment processors who does this?

This is very odd behavior to say the least

Lets look at the other wallets to see what's going on

So roughly 300 bucks sitting and waiting, looks like a dead end until we have some activity on this one

blockchain.com/explorer/addre…

Same thing as the last one, except this one has roughly 14k USD

Both only have one transaction, money sitting in the account
blockchain.com/explorer/addre…

Now we are getting some where!

This one has two transactions both in, one from the treasure trove account and one from a new account

The fact that the money is still sitting isn't this weird because the main transaction is relatively new

blockchain.com/explorer/addre…

Let's look at where the other transaction is coming from...

What are the odds?

Batching and what looks like a burner on the other side of the treasure trove...

blockchain.com/explorer/addre…

One layer up same pattern

What is this? Why would you do this if you're on the up and up?
blockchain.com/explorer/addre…

Same pattern repeating on next layer up

blockchain.com/explorer/addre…

Shit... This is going to take hours to go through and it's still active

I miss the burner accounts 😂🤣😂🤣

blockchain.com/explorer/addre…

Quick update:

Working on an angle to figure out what
bc1qw8wrek2m7nlqldll66ajnwr9mh64syvkt67zlu
could be

blockchain.com/explorer/addre…

Looking for any type of visual maping tool to track the transactions

In the mean while lets talk terminology

Moving forward I'm gonna be labeling the wallets as at least 3 different types

1. Burner wallets
2. Vault wallets
3. Router wallets

The reason for this is I need to keep track of how the wallets are being used, in terms of going back and looking at them

1: Burner wallets are the type of wallet that typically will be used for 1-2 transactions then not used again

These are wallets, once I'm done with is unlikely that I will revisit. The only exception (that I can think of RN) is if it still has funds sitting in them (Cold lead)

2. Vault wallets are wallets that have large sums of funds sitting in them. These are distinguished from point 3

The reason for that is these wallets hold more value for whoever is behind this than Router wallets

Example:
blockchain.com/explorer/addre…

3. Router wallets are somewhat a combination of point 1 & 2, in that they will handle multiple transactions, but funds won't be stored here
Why are they different? This wallet could be "deactivated" from the network without any loss of funds

Example
blockchain.com/explorer/addre…

All the loose ends...

Seeing as I don't have a mapping tool for tracking at current time and I'm working on an angle for the Vault wallet, we are stepping away from this for a bit to try and tie up some loose ends

First let me explain what we did up to this point in one tweet so you can kinda get the scope of how big this possibly is

We went from Eliza's wallet up to, more terminology, the top of the rabbit hole

We then went back down 1 passage way, through a bunch of burner wallets to find the vault.

Think of the vault as an intersection of transactions being done

We then went up from the vault through multiple burner wallets and found a router wallet

blockchain.com/explorer/addre…

This is were it gets complex... Every single burner wallet we went through split their transaction into 2 new wallets...

So in essence for each burner wallet I'm following, I'm creating two more leads

And we went through roughly 10

This is like fighting a hydra, for every head you chop off
2 more appears

Breakthrough!!

Finally found a tool I can use for visualizing what the possible network looks like!

Let's get graphical

cytoscape.org

Learning new stuff is fun

Below is a picture of the network map I'm working on

Some color codes:
Red: Burner Wallets
Green: Exit/unrelated
Purple: Possible entry wallet

Updated:

Lets talk about this one
32KwP-1WyL8

This is what I expect an exit account looks like

blockchain.com/explorer/addre…

Notice how this transaction has multiple input and outputs? This is more than likely someone taking money off the blockchain through a payment processor

Day 3

Let's start off by talking about something I did yesterday after "logging off"

I set up a Discord server to start monitoring some of the loose ends we have

Mainly:
blockchain.com/explorer/addre…

And this one:
blockchain.com/explorer/addre…

The reason for this is I wanna know if there is movement on this so I can do one of two things:

1. Continue following the trail
2. Exclude it from the rest of the network if it breaks pattern

Now some predictions:

Remember this one?
blockchain.com/explorer/trans…

It was the transaction the led us into the Vault Wallet
in the first place

My prediction is as follows: I will find similar, if not identical "cells" if I go look at the inputs on this trade

So that's what I'll be focusing on today

First some more terminology, because we know I love that...

What is a cell in this context?

A cell is a set of transactions that follow the burner wallet/batching technique

They will have one starting off point, for an instance this
blockchain.com/explorer/addre…

The purple one on this picture

They will also have an exit, the two green ones and possibly the two red ones on the left with money in them

Let's look at the transaction and I'm going to start with input number 1

blockchain.com/explorer/addre…

First transaction was back in July and last transaction leads back to the Vault...

blockchain.com/explorer/trans…

At first glance this looks totally normal

At first glance this looks like a trader account

It's mainly sending to one account, the vault

All except for one time...

Would you look at that batching between the Vault and one other account...

If the vault is indeed a market-maker this would be odd

Let's explain why

blockchain.com/explorer/trans…

So a market-maker is someone who will be buying a given commodity, stock or crypto

Then turns around and sells it at a later date

If you want to read more up on that here is a link for how it works

thebalancemoney.com/what-is-a-mark…

There is no reason I can see that a market maker would split a transaction into 2

This makes me curious

Let's go look

blockchain.com/explorer/addre…

Burner wallet, plus batching in and out...

I'm gonna make a bold statement here...

What we are looking at is a organization who are trying to hide where money is going

It doesn't stop there between April 8th last year and May 16th they refined their model

In addition to the 3 other type of wallets we have discussed we have a forth... So more terminology

4. Funnel wallet is a wallet that is nearly identical to the Router wallet. But in stead of splitting into multiple wallets like the router does, this funnels it into one

This would be that, the account we looked at that was only, apart from the first transaction (deviation), funneling money into one main account.

blockchain.com/explorer/addre…

In this instance the Vault

The pink one almost in the center of this pic

Let's talk more about that wallet

Every single transaction in is a single input (meaning only one sender...)

Don't believe me? Check it 👇👇👇
blockchain.com/explorer/addre…

Now I'll be starting chronologically, meaning oldest transaction to youngest

blockchain.com/explorer/trans…

Another possible vault
blockchain.com/explorer/addre…

As a matter of fact... Every single transaction in, apart from one, is coming from that wallet

blockchain.com/explorer/trans…

blockchain.com/explorer/trans…

blockchain.com/explorer/trans…

blockchain.com/explorer/trans…

Here is the crazy part...

This wallet shares at least one thing in common with the other vault wallet we found

blockchain.com/explorer/addre…

The common denominator? Looping transactions

blockchain.com/explorer/trans…

Look at the input on this and output nr 10...

Same number

Update to the map follows

Updated the scale on the arrows so it's easier to follow where the money comes from and where it goes

The wallet discussed above is the yellow one down in the left side corner

Time to get serious!

From here on out I will be using #FollowingTheMoney
and #CryptoNetwork to relate to this case

I urge you to do the same if you RT or comment on this post

Trimming my timeline

I will be devoting most of my time to this from here on out, that means I need to remove other distractions and I don't want a clogged timeline

#FollowingTheMoney #CryptoNetwork

I will not be using other hashtags that's related to what @FaranBalanced is doing, as this is tangentially related to it and I don't want to flood those hashtags with info that isn't directly related to that case

#FollowingTheMoney #CryptoNetwork

@FaranBalanced Working on a Discord server that will be made public for this. If you have any experience on running or moderating servers and want to help, comment below or DM me

#FollowingTheMoney #CryptoNetwork

@FaranBalanced Will also create a new thread on this to continue the work

@FaranBalanced @threadreaderapp unroll