Who stole the bitcoins?

Question

Introduction

You want to give bitcoins to a person you have met. Part of the deal is to give the bitcoins in the most untraceable way. So you have decided to send an email to him with the address (you already have sent the private key). The email you sent to him is shown here below:

Email 1:

I have already sent the private key to you in another email.

To get the bitcoin address, please take a look at the attachments,

Regards,

*****

The attachment lead to this image:

Email 2:

It looked as if everything went smooth, until you got an email back from the person you sent the email to. The email he sent is shown below:

Hi,

It seems that the wallet you sent me is empty,

Regards,

*****

The task

It seems that the bitcoin wallet was already emptied by someone else. Your task is to find out who has stolen the bitcoins.

Tips

Tip 1:

It was not the person you have sent the email to.

Tip 2 (important}:

The name of the person who stole the bitcoin is in this list.

Well, decrypting that QR code gives me 'NGnc7', which is probably the extent of my usefulness. — , May 31 '16 at 11:25
When I scanned the QR code and googled it, the first result was this puzzle with part of the solution shown in the preview. How ironic. — morxa, May 31 '16 at 17:35
@fabriced I generated the names with this website (done multiple times to get 250 names). After that, I made an 05AB1E script (which can be found here) to generate the addresses. — Adnan, May 31 '16 at 17:58
Who stole the Bitcoins from the Bitcoin wallet? Adnan stole the Bitcoins from the Bitcoin wallet! Who me? Yes you! Wasn't me... Then who?! — corsiKa, May 31 '16 at 23:12
Hmm. Cannot the address be derived from the private key already? — Thilo, Jun 01 '16 at 05:07
@Thilo It seems that that is actually possible. I didn't know that until now :p. — Adnan, Jun 01 '16 at 09:07
@Adnan Your pastebin says "Note that none of the above addresses or names do not represent real bitcoin addresses or names of people." - That's a double negative, can lead to confusion — undo, Jun 02 '16 at 09:18
The QR code step doesn't seem to be accurate anymore. I'm not sure how else to say this without spoiling anything.. — MrDuk, Jun 03 '16 at 15:03
@MrDuk How is not accurate? I tested it with my QR scanner and got the right code. — Adnan, Jun 05 '16 at 19:50
@MrDuk It's a Stack Imgur address, not a regular Imgur address. The regular seems to expire after some time... — Adnan, Jun 06 '16 at 15:00
Sending bitcoin by transferring the wallet is not secure, the sender can sweep it before the receiver or send the same wallet to multiple people, unconfirmed transactions can also be reversed or double-spent, always use the block chain and wait for at least 6 confirmations. — k-l, Aug 29 '16 at 12:42

score 39 · Accepted Answer · edited Apr 13 '17 at 12:50

39

Solution:

Bee Holzman

Explanation:

When the QR code is decrypted, we are given NGnc7. As @LeppyR64 figured out, this is an Imgur address, which leads us to this image:

Open this image with a text editor and you will find the bitcoin address at the end (see here for an image):

1GJ2CBCjBjqa7F9XscorRTfoUXAA2G4FHV.

Running a blockchain search for this address gives us :

One transaction: -0.02 BTC to the address 14j3zgcJoDGPzfUNEUzMAPHB57E4xVBSoL.

And that address belongs to...

Bee Holzman.

_{Most of this is from @LeppyR64's partial answer, I just finished off.}

edited Apr 13 '17 at 12:50

Community

1

answered May 31 '16 at 11:49

1

Thanks for updating your answer to include all the information after getting the check. Good work! – LeppyR64 May 31 '16 at 12:05
1

lol I got this one on imgur http://imgur.com/a/ngNC7 – Yar Jun 06 '16 at 19:16

score 33 · Answer 2 · edited Apr 13 '17 at 12:50

Partial - No time to finish it now

As was mentioned by Beastly Gerbil the QR-Code decodes to:

NGnc7 - This is an imgur address

This points to a new image:

With this image:

Edit it with notepad and you'll find at the end of file the text
"The address is 1GJ2CBCjBjqa7F9XscorRTfoUXAA2G4FHV"

Next Step:

This is a bitcoin address of the empty wallet. So now I don't know how to find the transactions and don't have time to research it now. Hopefully someone can continue or I will come back later.

Beastly Gerbil · Answer 3 · 2016-09-02T19:30:58.670

8

Using a QR Scanner, I get the text

NGnc7

I imagine that in the list of suspects the line of letters and numbers will have the first two capitals N and G, the two lowercase letters after that n and c and the first number after that 7

Alternatively it could be something to do with the initials

EDIT: The others realized it was an imgur adress, which lead to Bee Holzman. Guess I was wrong

edited Sep 02 '16 at 19:30

answered May 31 '16 at 11:33

Beastly Gerbil

58,036
8
166
314

2

NGnc7 is correct. Your suspicion is wrong. (I'm already on the next step) ;) – LeppyR64 May 31 '16 at 11:39
@LeppyR64, well done you, I have no idea what to do now! – Beastly Gerbil May 31 '16 at 11:40
No initials either haha :p – Wu33o May 31 '16 at 11:45
I can find nc7 in one of the addresses... – May 31 '16 at 11:46
1

@GeorgeGibson Check my answer. – LeppyR64 May 31 '16 at 11:47
@LeppyR64 Solved! – May 31 '16 at 12:04

score 8 · Answer 4 · answered May 31 '16 at 11:51

8

Continuing on @LeppyR64's answer:

When we check the transactions on the bitcoin wallet with the address we obtained, we see a transaction to address: 14j3zgcJoDGPzfUNEUzMAPHB57E4xVBSoL

Which belongs to:

Bee Holzman

answered May 31 '16 at 11:51

Wu33o

6,860
1
32
56

Who stole the bitcoins?

Introduction

The task

Tips

4 Answers4

Linked