The focus of this analysis are two addresses. The first address is: https://blockchain.info/address/1AYtnRppWM7tWQaVLpm7TvcHKrjKxgCRvX

I will call this the 400k address or just 400k

The second address is: https://blockchain.info/address/1KLahQtqDNAXvrjNyfvgSBtAhwco5ZxLp4

I will call this the 432k address or just 432k

If the withdrawals of the 432k address are even briefly analysed it can be seen that it is broken into chunks of 50k which then go on to fund the proof transaction of 424k. There is no doubt therefore that the 432k address belongs to MT Gox.

The 400k address has two transactions on the 27th of January 2011, one for 250k and another for 150k. 85k, withdrawn from the 250k, ends up funding the 432k address. Around 50k from the 250k address, chunked of course, are still there.

There is more direct proof however that the 400k address belongs to Mt Gox: http://web.archive.org/web/20101007203437/http://mtgox.com/users/addFunds

The donation address specified on this website goes on to fund the 150k address deep into its chunking. Furthermore, it connects directly with many of the addresses moved.

On the 27th of January 2011, 150k was withdrawn from the 400k address. This 150k is divided into chunks of £5k, then 2k. This happened between the 1st and the 2nd of March 2011. The divided chunks never moved further. They stayed at the address they were sent in March 2011 until they were moved by only one withdrawal, part of them on 21st of December 2013 and part of them on the 5th-6th of February 2014 and remain there. All, that is, except for the last 5k which goes on to fund the 432k.

All of this 150k, albeit divided into smaller chunks, was moved, whether by the owner or the thief, just before the formal announcement by Mt Gox that withdrawals were halted.

It is possible that this 150k was retained by Jed McCaleb, the previous owner of Mt Gox, when he sold the company on or around March the 6th 2011. If that is the case then why did he move these ancient coins all at the same time?

There is evidence to suggest that these coins were not retained in ownership by Jed. There is one interesting address which comes up time and again: 1LXc28hWx1t8np5sCAb2EaNFqPwqJCuERD

The funding to this address comes mostly from the 150k, or is linked in this closed loop of addresses, which clearly can be seen from two or three 5k addresses. However, some of the addresses that immediately fund the 1LX are created after ownership of Mt Gox changed on March the 6th 2011. That does not preclude Jed himself creating these addresses at a later date than March the 2nd. It seems however more likely that Mt Gox owned these addresses as once ownership was changed then all the deposits would have had to be handed over to Mt Gox in order for Mt Gox to continue functioning as normal.

In any event, whether the thief moved them or Jed, this 150k – and there is more in addresses created on 28 February 2011 and moved on 21 December 2013 – belong to Mt Gox.



 I'm writing to you because i have near-proof that the stolen MtGox coins
    are being transfered to your exchange. I would appreciate any information
    you can supply about this matter but i understand that legal restrictions
    may apply. In either case this is crucial information to you and i hope you
    will take the required actions. The following will be a rundown of the
    proof (which can be expanded upon).

    In the time Jed McCaleb owned MtGox there was a donation address listed in
    the left side:
    1EuMa4dhfCK8ikgQ4emB7geSBgWK2cEdBG
    This address send coins in 2011 around the time the exchange changed owner
    to Mark Karpeles
    1EuMa <https://blockchain.info/address/1EuMa4dhfCK8ikgQ4emB7geSBgWK2cEdBG>
     -> 1FBiC<https://blockchain.info/address/1FBiCxd41EgQ4u6PQVsAadDoot7FD9sx99>
     -> 1B4AW<https://blockchain.info/address/1B4AW7BwBYGUbcZhXwv6JK6bmR6UFdR7BK>
     -> 1Kq6s<https://blockchain.info/address/1Kq6sr5A9bM82u1vRTByjCvvixm5dxwQuV>
     -> 1K66U<https://blockchain.info/address/1K66ULWc44926qYwdNUX5hf9pazf7DAQeU>
     -> 1pdMA<https://blockchain.info/address/1pdMAQEyFNSgN4RU4BF1bMWHjFgumXcnj>
    These coins were split into blocks of 2-5k which were used as cold storage.
    The 1pdMA<https://blockchain.info/address/1pdMAQEyFNSgN4RU4BF1bMWHjFgumXcnj>
    coins
    (plus the rest) didn't move until 2013-12-21 and 2014-02-05 as part of a
    huge movement of old coins following the same pattern. These coins are
    mapped in two spreadsheets
    here<https://docs.google.com/spreadsheet/ccc?key=0Aj-Hzmrt4w_6dEFxWDRLcWhKSG9PSDFQMXdCNVlKbGc&usp=sharing#gid=0>
     and here<https://docs.google.com/spreadsheet/ccc?key=0Aj-Hzmrt4w_6dGpnaGlTeV9qN0dCRFdNVHpGS2RGYkE&usp=sharing#gid=0>
    totaling
    ~300k coins.
    Two of the MtGox cold storage addresses moved as shown:
    1PNNF <https://blockchain.info/address/1PNNFz5u2qy9xstrHmBR2Z5dERmad1Ku3j>
     -> 1JFXQ<https://blockchain.info/da/address/1JFXQhnX6V38inxoBy5jDm9KgjeKx6nFp7>
     -> 1DJoA<https://blockchain.info/da/address/1DJoAkM4fqFjPYZTLXtUGfoya8zCXZsH8W>
     -> 1PAzo<https://blockchain.info/da/address/1PAzoSbf2mjK41H9FRY9u9QjabtEu4ATbb>
    14MiN<https://blockchain.info/da/address/14MiNG1HCnXaRNGgH43o8Ry9c4VcyYxL2L>
     -> 1HsUP<https://blockchain.info/da/address/1HsUPjn15EQP1mSeiB9BFifgwQzvwGQaYb>
     -> 1KnPn<https://blockchain.info/da/address/1KnPnAvUv11ukCg6d5q4i4jXkJQ6X2UASF>
     -> 1PAzo<https://blockchain.info/da/address/1PAzoSbf2mjK41H9FRY9u9QjabtEu4ATbb>
    I know that 1PAzo<https://blockchain.info/da/address/1PAzoSbf2mjK41H9FRY9u9QjabtEu4ATbb>
    is
    an address owned by Bitstamp and i assume that
    1DJoA<https://blockchain.info/da/address/1DJoAkM4fqFjPYZTLXtUGfoya8zCXZsH8W>
     and 1KnPn<https://blockchain.info/da/address/1KnPnAvUv11ukCg6d5q4i4jXkJQ6X2UASF>
    also
    are Bitstamp addresses used to receive coins from customers. This shows
    that the MtGox cold storage coins moved directly from cold storage to an
    unknown address and then to a Bitstamp address. There are an estimate of
    13500 coins moved to Bitstamp as of this moment.

    I'm looking forward to hearing from you and i will appreciate any
    information you may give me. It is of my interest to find the owner of
    1JFXQ<https://blockchain.info/da/address/1JFXQhnX6V38inxoBy5jDm9KgjeKx6nFp7>
     and 1HsUP<https://blockchain.info/da/address/1HsUPjn15EQP1mSeiB9BFifgwQzvwGQaYb>

There's only one hoop. From Gox/Jed/Thief to unknown address then Bitstamp.

The first address to the second address was a movement of 150k - 300k coins on the 21st of December and the 6th of February. Therefore the movement from 1PNNF -> 1JFXQ and 14MiN -> 1HsUP was either by gox, Jed, or the theif. See: http://www.reddit.com/r/Bitcoin/comments/1za9sf/found_at_least_150k_btc_of_mt_goxs_stolen_coins/

So there is only one hoop, 1DJoA and 1KnPn. These may even be bitstamp addresses, but even if this person/persons or business is someone who has no connection whatever with the theif/gox/jed he can shed some light on how he came to possess these coins.

It is quite interesting though that both those addresses connect to bitstamp through only one hoop, and both sums were sent from this one intermediary address to bitstamp on the same day suggesting that the one hoop address may not be an innocent bystander.

Since 1PAzo is bitstamp and bitstamp use unique addresses to receive coins then 1DJoA is bitstamp aswell


There are only three options: Gox/Jed or the Thief.

Neither of those three should be selling these coins right now.

In regards to Gox or the theif it is obvious why they should not be selling them. In regards to Jed, those coins moved on the 6th of February, one day before gox stopped withdrawals. There is suspicion therefore that even if these are Jed's coins they might have been on mtgox before he moved them on the 6th. If that was the case he would have been given unfair advantage. The law therefore would nullify that transaction and distribute these coins equally amongst all creditors.

That might not be the case of course, if they are jed's coins at all rather than gox's or theif's, but it needs to be investigated before they can be sold.