View difference between Paste ID: gFgSazs0 and UXhXeZuG

 This has been updated with information from BigVern (Updates encapsulated in ***bv***) on 18 Sept 2017
 
           _____  _______    ______       _____
    * _____\    \_\      |  |      | _____\    \_  .
     /     /|     ||     /  /     /|/     /|     |
   ./     / /____/||\    \  \    |//     / /____/|   *
 . |     | |____|/ \ \    \ |    ||     | |____|/      .
   |     |  _____   \|     \|    ||     |  _____   *
   |\     \|\    \   |\         /||\     \|\    \    '
   | \_____\|    |   | \_______/ || \_____\|    | .
  '| |     /____/|    \ |     | / | |     /____/|      *
    \|_____|    ||2o16 \|_____|/   \|_____|    ||  .
    '      |____|/    .          *        |____|/
 
 The CryptoVigilanteCrew Presents.....
 
 While Paul Vernon being complicit in the funds stolen from Cryptsy is still in question... another question still remains unanswered... (until now)
 
 "Who made lucky7coin that Paul Vernon claims was responsible for hacking Cryptsy?"   ...lets find out!
 
 Well, we do know, after visiting lucky7coin's github repository, that it was indeed backdoored. A quick search of the malicious code on github, also brings up another coin, called torcoin.
 
 https://github.com/alerj78/lucky7coin/
 https://github.com/torcoindev/torcoin
 
 Well we know these coins were announced on bitcointalk. Let's see if what we can find out about these 2 users on bitcointalk...
 
 https://bitcointalk.org/index.php?action=profile;u=333668 (alerj78, owner of lucky7coin repository, initial uploader)
 https://bitcointalk.org/index.php?action=profile;u=352008 (torcoin)
 
 let's have a look at the bitcointalk user database entries for lucky7coin and torcoin:
 
 INSERT INTO `smf_members` VALUES (332957,'aler78',1400503000,0,0,'',1400631882,'aler78',0,0,'','','','','$5$rounds=7500$eZTQt3ihVEN45C13$5ugytyWO68zOr/yO3z8/evZ5ryHoceFlA97.QyV3Br2','johnaler@safe-mail.net','',0,'0001-01-01','','','','','','','',1,1,'','',0,'',1,0,0,'',1,1,0,2,'81.89.96.113','81.89.96.113','','',0,1,'',6844841,'','',4,833,'',0,NULL,1,2,0,0,94.99,'195.228.45.176');
 
 INSERT INTO `smf_members` VALUES (333668,'alerj78',1400633430,2,0,'',1405004034,'alerj78',4,1,'','','','','$5$rounds=7500$iKTbk1zMBf2MC2xe$L8Gs8DJxfE0hcYWvaGB.BPfVlPzvN3Al6HoDAec.n14','alerj78@safe-mail.net','',0,'0001-01-01','','','','','','','',1,1,'','',0,'',1,0,0,'',1,1,0,2,'77.247.181.162','77.247.181.162','','',0,1,'',7768339,'','',12,7134,'',0,NULL,1,2,2,0,0,'81.89.96.113');
 
 INSERT INTO `smf_members` VALUES (352008,'torcoin',1404479253,38,0,'',1407801091,'torcoin',97,3,'','','','','$5$rounds=7500$fpewoiyQ05ACAebp$.EMZ9UgNKut2UrlrXjtvQsach3LvbzTXhpJzIINzKk1','torcoin@hushmail.com','',0,'0001-01-01','','','','','','','',1,1,'','',0,'',1,0,0,'',1,1,0,2,'192.42.116.16','192.42.116.16','','',0,1,'',8303268,'','',5,77896,'',0,NULL,1,2,38,0,0,'81.89.96.113');
 
 
 let's see if any other users are registered on bitcointalk with that ip, 81.89.96.113 ...
 
 ***bv***
 
 Well, first lets find out what we can about that IP.
 
 81.89.96.113 is assigned to a dedicated server / colocation company in Germany.   It is likely a proxy.   This means that IP alone may not be enough to tie the users together.  We need something else to either show that the proxy was a private proxy not generally used by the public, or some kind of data tying the users together other than IP.
 
 There are 4 IP's shown above and their current assignments:
 
 81.89.96.113 - German dedicated server / colocation facility  (Possible tor exit node or other type of proxy?)
 77.247.181.162 - torservers.net - hosted in Germany
 192.42.116.16 - Tor exit node - Netherlands
 195.228.45.176 - Dedicated server - Hungary - possible tor exit
 
 It is possible that all 4 of these nodes where tor exit nodes when they where used.  The bottom 3 IPs the most likely candidates for Tor exit nodes.
 
 Bitcointalk user creation timeline for these 4 users:
 
 aler78 - Mon, 19 May 2014 12:36:40 GMT
 alerj78 - Wed, 21 May 2014 00:50:30 GMT
 azeteki - Fri, 27 Jun 2014 21:30:02 GMT
 torcoin - Fri, 04 Jul 2014 13:07:33 GMT
 
 Let's query the Cryptsy DB for these IP's in login histories:
 
 81.89.96.113 - No Results
 77.247.181.162 - 422 different users (Definitely a tor node)
 192.42.116.16 - 145 different users (Definitely a tor node)
 195.228.45.176 - 46 different users (Definitely a tor node)
 
 Strange that 81.89.96.113 has no activity at all for logins. If this was a tor exit node, then it is unusual that we have no entries for it.
 
 azeteki, aler78, alerj78, and torcoin are not usernames found in the Cryptsy DB.
 
 However, there is an entry for a Dan Edgecumbe...
 UserID: 35144
 Username: Forbearance
 Email Domain: danedgecumbe.com
 Signup Date: 2013-12-01 05:53:02
 
 A quick look at his website shows us that he is in fact azeteki (author of bitcoind-ncurses).  Based on the skillset listed on his website, it would appear he would have the necessary skills to implement the malicious code into lucky7coin and torcoin.
 
 6 Logins for this user from IP 129.67.137.66 from 2013-12-01 to 2014-01-25. This was the only IP ever used to login.  This was NOT a tor node.  IP belongs to Oxford University.  No other users have used this IP.  This user did not log in after 2014-01-25.
 
 The password hash for this user is not used by any other users.
 
 How many Cryptsy users logged in from the 3 tor nodes above during the period 2014-05-18 to 2014-07-05 that also used safe-mail.net?
 
 Total of 7
 
 These are the 3 most suspicious of the bunch:
 
 | 260536 | joshsmith999 | kukka999@safe-mail.net    | Josh       | Smith     | 2014-06-05 12:34:13 |
 | 265246 | rv9z744      | tz79pr5@safe-mail.net     | Jeff       | Smith     | 2014-07-01 00:34:14 |
 | 265609 | xxcdrwxx     | xxcdrwxx@safe-mail.net    | az         | az        | 2014-07-02 07:01:41 |
 
 Check out the last one, first name "az" and last name "az"...  as in azeteki maybe?  This user made no deposits or trades.  They signed up from IP 77.247.181.162
 
 There is another IP in the bitcointalk database for azeteki - 62.210.74.186.   What do we know about this IP?
 - It's a tor exit node
 - 47 distinct Cryptsy users have logged in with this IP
 - None of the users use safe-mail
 - Nothing unusual stands out for the users created during the period 2014-05-18 to 2014-07-05
 
 Conclusion:
 
 It is unknown if the IP 81.89.96.113 was a Tor exit node.  If it was, then it would seem likely that it would be in the login database at least once.  In any case, azeteki lives in London, UK - and the IP is in Germany.  So this does appear to be some kind of proxy.  It is unknown if this is a shared proxy or a private proxy, but it was only used by these 4 bitcointalk users.
 
 We are unable to dispel the association between these 4 users based on that IP address.   If anything, the data has shown a stronger association.
 
 The user azeteki does have the skillset required to program the malicious code.
 
 ***bv***
 
 
 INSERT INTO `smf_members` VALUES
 (349019,'azeteki',1403904602,93,0,'',1423992881,'azeteki',6,0,'','','','','$5$rounds=7500$Lvy9Z5P+kZdiatAf$ySFjx5daAKnruGXMsc5ONKOKvbTZixr7tSeK9mo8Df/','azeteki@safe-mail.net','Amphibian',0,'0001-01-01','GitHub page','https://azeteki.github.io','Panama','','','','',1,0,'','[url=https://github.com/azeteki/bitcoind-ncurses]bitcoind-ncurses[/url] - [url=https://azeteki.github.io/charts]network charts[/url] - [url=https://azeteki.github.io]azeteki.github.io[/url] - [url=https://pgp.mit.edu/pks/lookup?op=vindex&search=0xE2BD14EC2C7D458F]PGP[/url]',0,'',1,0,0,'',0,0,0,2,'62.210.74.186','62.210.74.186','','',0,1,'',10465724,'11','',19,96372,'cfc9',0,NULL,1,2,93,0,0,'81.89.96.113');
 
 
 azeteki uses the same ip/proxy. also safe-mail.net.. interesting. the name azeteki comes from the latin name of a species of frog.
 
 so who is https://bitcointalk.org/index.php?action=profile;u=349019 (azeteki) ?
 
 https://github.com/azeteki/  (account is now deleted? but you can google it and see it was the author of bitcoind-ncurses.)
 https://www.reddit.com/user/Atelopus_zeteki
 https://pgp.mit.edu/pks/lookup?op=vindex&search=0xE2BD14EC2C7D458F
 https://pgp.mit.edu/pks/lookup?op=vindex&search=0x47DA40099E00994C
 
 17:57.32	*** join/#debian Amphibian (~azeteki@gateway/tor-sasl/amphibian)
 18:17.29	*** part/#debian Amphibian (~azeteki@gateway/tor-sasl/amphibian)
 
 bitcointalk profile shows:
 
 Gender:	Male
 Age:	N/A
 Location:	London, UK
 Local Time:	June 18, 2016, 04:04:49 AM
 
 Website:	esoteric nonsense
 Bitcoin address:	1FrogqMmKWtp1AQSyHNbPUm53NnoGBHaBo <- 1frog
 
 well, what can we get from esotericnonsense.com?
 
 daniele@esotericnonsense.com
 Origin country United Kingdom
 Primary IP Address 86.146.198.227
 
 https://esotericnonsense.com/contact.html
 
 pub   rsa4096/0x47DA40099E00994C 2016-04-04 [SC] [expires: 2021-04-03]
       Key fingerprint = E82F BFB5 0174 9C46 B440  29B7 47DA 4009 9E00 994C
 uid                   [ultimate] Daniel Edgecumbe <daniele@esotericnonsense.com>
 sub   rsa4096/0x0D2CCF290CD80BAD 2016-04-04 [E] [expires: 2021-04-03]
 
 well, it looks like azeteki's repo has moved here:
 https://github.com/esotericnonsense which belongs to a Daniel Edgecumbe. Coincidence? of course not.
 
 https://github.com/esotericnonsense/project-euler this page actually shows that azeteki is Daniel Edgecumbe's username on project euler.
 
 So, Daniel Edgecumbe created the backdoored lucky7coin, as well as torcoin. Cryptsy had lucky7coin installed on their exchange, we know that. Did Daniel Edgecumbe steal the 13k BTC from Cryptsy?
 He certainly could have using his backdoor, however, we do not know yet, but we are working on finding that out.
 
 Any proper authority can subpoena the database from bitcointalk, and other various sites he is registered on, and verify these claims. To all those who lost funds on Cryptsy, it sucks, we know,
 but maybe this information can help, and maybe one day the coins can be recovered. Maybe they won't, but we can get some sort of closure. Let this be a reminder, that if you hurt/attempt to hurt the crypto community,
 people will come looking for you, and they might just find you.
 
 donate to the CVC: 1CVCggdNNC9bbpVyxQtqbxWQcEgmj9JtGG
 
 There's no masking from us now
 We pop Tor nodes around the globe
 Track and hunt you down! -Dual Core