Silk Road forums

Discussion => Security => Topic started by: Megatherium on June 23, 2013, 11:25 pm

Title: So... do we have our first DEA honeypot?
Post by: Megatherium on June 23, 2013, 11:25 pm
Just read it and thought I would drop it here:

http://letstalkbitcoin.com/post/53700133097/users-bitcoins-seized-by-dea

Don't know if DPR on anyone else with sufficient access wants to investigate. Could be a bit time consuming, could also be easy as fuck because those cunts have a different definition of OpSec.

Do your homework, kids.
Title: Re: So... do we have our first DEA honeypot?
Post by: astor on June 24, 2013, 02:25 am
I see nothing in that article that indicates it was related to SR. Transactions on the market are not in the block chain, so if it had any relation to SR at all, ie if the DEA met the guy through SR, it would be an out of escrow transaction.
Title: Re: So... do we have our first DEA honeypot?
Post by: hoobydoobydoo on June 24, 2013, 02:45 am
Yah the article is lacking in details.

However, similarly to how Mt.Gox's Dwolla account was just suspended after they traced a deposit through the blockchain, I would guess it is possible for LEO/DEA to deposit funds into SR trace them through the blockchain, even through SR's mixer, and then go after anyone who ends up with those coins.

Of course in order to determine who ends up with them they would have to eventually hit a BTC address which is known to be associated with a financial institution they could subpoena to learn how withdrew into cash.

How likely is all of this I have no idea but it does not seem impossible.
Title: Re: So... do we have our first DEA honeypot?
Post by: enpiping on June 24, 2013, 02:52 am
I see nothing in that article that indicates it was related to SR. Transactions on the market are not in the block chain, so if it had any relation to SR at all, ie if the DEA met the guy through SR, it would be an out of escrow transaction.
I'm pretty much a newbie--can you explain how the transactions are not in the block chain? Is this because of how the coins are "tumbled"? Thanks!
Title: Re: So... do we have our first DEA honeypot?
Post by: hoobydoobydoo on June 24, 2013, 03:10 am
I see nothing in that article that indicates it was related to SR. Transactions on the market are not in the block chain, so if it had any relation to SR at all, ie if the DEA met the guy through SR, it would be an out of escrow transaction.
I'm pretty much a newbie--can you explain how the transactions are not in the block chain? Is this because of how the coins are "tumbled"? Thanks!

After coins are deposited into SR they are just held in the mixer.  If you send coins to another user on SR this does not show up on the blockchain.  However, once coins are withdrawn they obviously appear on the blockchain once again.  They will just show up as coming from one of the mixer addresses.  However, if you trace the transactions one by one for a transaction leaving SR you can still discover some BTC addresses that sourced the coins to SR to begin with.  This is just the nature of the blockchain.  It always leads back to somewhere.
Title: Re: So... do we have our first DEA honeypot?
Post by: hypnotick on June 24, 2013, 03:39 am
I think this was an SR vendor. Look at the nick name, "Casey Jones". He is indeed a vendor, but apparently in stealth mode. Here's his vendor page.

http://silkroadvb5piz3r.onion/index.php/silkroad/user/1c0fdae424
Title: Re: So... do we have our first DEA honeypot?
Post by: trc on June 24, 2013, 03:48 am
A recent news update suggest the vendor has hijacked a train well using sing copious amounts of cocaine.
Title: Re: So... do we have our first DEA honeypot?
Post by: eddiethegun on June 24, 2013, 03:57 am
I think this was an SR vendor. Look at the nick name, "Casey Jones". He is indeed a vendor, but apparently in stealth mode. Here's his vendor page.

http://silkroadvb5piz3r.onion/index.php/silkroad/user/1c0fdae424

Good catch hypnotick. When I saw the 'alias' I immediately thought that that was a vendor name. How many street dealers have funds in bitcoin?

I think we have our first confirmed DEA bust of a silk road vendor.
Title: Re: So... do we have our first DEA honeypot?
Post by: SelfSovereignty on June 24, 2013, 03:58 am
I see nothing in that article that indicates it was related to SR. Transactions on the market are not in the block chain, so if it had any relation to SR at all, ie if the DEA met the guy through SR, it would be an out of escrow transaction.
I'm pretty much a newbie--can you explain how the transactions are not in the block chain? Is this because of how the coins are "tumbled"? Thanks!

When you deposit to your account, once the coins are received by the bitcoin address associated with your account, they're transferred right back out to one or more other bitcoin addresses.  That's the SR tumbler.

So what you're left with is your account balance not being actual bitcoins or USD, but just the SR ledger vouching that you have such-and-such an amount of currency.  Buy something, and the ledger subtracts from you and adds to the vendor.  No coins necessary (until you go to withdraw, of course).
Title: Re: So... do we have our first DEA honeypot?
Post by: P2P on June 24, 2013, 04:17 am
I wasn't able to fully follow this article. Can someone well-versed in btc jargon please explain this occurence in laymen's terms?
Title: Re: So... do we have our first DEA honeypot?
Post by: oldtoby on June 24, 2013, 04:59 am
Huh. So they are in fact tracing people through the blockchain.

Good to know. I mean, this is why there have been laundry sites, why SR uses a mixer, but it's helpful to know that these precautions are needed. Too easy to get lazy and buy into blase comfort offered by dubious strangers.
Title: Re: So... do we have our first DEA honeypot?
Post by: eddiethegun on June 24, 2013, 05:06 am
That's not just you P2P, it's a pretty poorly written article. The crux is that a DEA public notice of seized property this month mentions that they seized a bitcoin address from a suspect, containing 11 BTC. There are no specifics given, other than it was for conspiracy to distribute a controlled substance, and that his AKA is "Casey Jones" who is also a SR vendor selling suboxone and methylone. What does it mean to "seize" a BTC account? They mention one address, so it's speculated that they physically seized the suspects computer with the wallet.dat file locally stored. The rest of the article is a half-assed blockchain analysis that comes to no conclusion. (I can't criticize too much -- blockchain analysis is beyond my ability as well) and an appeal for help from someone who actually knows how to do blockchain analysis.
Title: Re: So... do we have our first DEA honeypot?
Post by: hoobydoobydoo on June 24, 2013, 05:09 am
I wasn't able to fully follow this article. Can someone well-versed in btc jargon please explain this occurence in laymen's terms?

Bottom line is we don't know precisely what happened right now due to sparse details in the article.  At the moment it is just a story involving someone who supposedly vended on silk road - potentially the Casey Jones vendor already pointed out - and who got caught in some unknown manner by the DEA.

It could be that he sent a package with his fingerprints/DNA on it, or some other manner which was traceable to him via USPS or whatever.  Or potentially the investigation used other methods involving tracing BTC transactions which would be a lot more ominous for SR users.

Until more information is learned it is all speculation.
Title: Re: So... do we have our first DEA honeypot?
Post by: DealerOfDrugs on June 24, 2013, 05:26 am
This Casey Jones requested a sample from me a 15 days ago. The crazy thing is, he messaged me from his vendor account, and willingly gave me his entire personal address, not a drop address. I myself warned Casey at the time to be careful because anyone at anytime could blackmail him, and he pretty much dismissed the idea and said "no problem, I might start a alternate buyer account to start buying. I'm not worried about it"
Title: Re: So... do we have our first DEA honeypot?
Post by: astor on June 24, 2013, 05:29 am
That's not just you P2P, it's a pretty poorly written article. The crux is that a DEA public notice of seized property this month mentions that they seized a bitcoin address from a suspect, containing 11 BTC. There are no specifics given, other than it was for conspiracy to distribute a controlled substance, and that his AKA is "Casey Jones" who is also a SR vendor selling suboxone and methylone. What does it mean to "seize" a BTC account? They mention one address, so it's speculated that they physically seized the suspects computer with the wallet.dat file locally stored. The rest of the article is a half-assed blockchain analysis that comes to no conclusion. (I can't criticize too much -- blockchain analysis is beyond my ability as well) and an appeal for help from someone who actually knows how to do blockchain analysis.

They claim the DEA didn't seize his wallet, but that maybe he sent the BTC to them.

That's why I said, although they may have met on SR, the transaction didn't happen there.

Who knows what really happened.
Title: Re: So... do we have our first DEA honeypot?
Post by: P2P on June 24, 2013, 05:39 am
That's not just you P2P, it's a pretty poorly written article. The crux is that a DEA public notice of seized property this month mentions that they seized a bitcoin address from a suspect, containing 11 BTC. There are no specifics given, other than it was for conspiracy to distribute a controlled substance, and that his AKA is "Casey Jones" who is also a SR vendor selling suboxone and methylone. What does it mean to "seize" a BTC account? They mention one address, so it's speculated that they physically seized the suspects computer with the wallet.dat file locally stored. The rest of the article is a half-assed blockchain analysis that comes to no conclusion. (I can't criticize too much -- blockchain analysis is beyond my ability as well) and an appeal for help from someone who actually knows how to do blockchain analysis.

Yes I would assume they seized a file or got it out of the suspect. You can't "seize" a btc address any other way. But has it been made clear that it was, in fact, a honey pot and whether or not they actually caught this individual via the blockchain? I read the article and apparently they're getting the full report of what happened on Monday.
Title: Re: So... do we have our first DEA honeypot?
Post by: a10101 on June 24, 2013, 08:40 am
This Casey Jones requested a sample from me a 15 days ago. The crazy thing is, he messaged me from his vendor account, and willingly gave me his entire personal address, not a drop address. I myself warned Casey at the time to be careful because anyone at anytime could blackmail him, and he pretty much dismissed the idea and said "no problem, I might start a alternate buyer account to start buying. I'm not worried about it"

Wow. Not worried, huh? That's what you get. No one deserves that, but I'm always aghast when vendors link to their buyer account. There's a post which is active right now from a vendor trying to borrow money and he lists his buyer account. When the feds do come, you don't want to be the easy pickings. You don't have to outrun the bear, just the other people doing illicit activities.
Title: Re: So... do we have our first DEA honeypot?
Post by: Lorimer on June 25, 2013, 03:17 am
An Eric Daniel Hughes is currently facing drug charges in Charleston, SC, for the distribution of Clenazepam, weed, and a few other drugs, and is now out on a $10,000 bond. I'm not sure how the case relates to the seizure, as it looks as though his arrest was in early June, not April. Maybe the seizure was part of a case they were building, or maybe the DEA handed it over to local authorities (can they do this?)

On another note, there have been some pretty funny articles about it. From The Fix:

Quote
"It remains unclear how exactly the Bitcoin was 'seized,' but it's unlikely that it was literally plucked from the web... By comparing the time at which the DEA claims it seized the Bitcoins and the Bitcoin's transaction records, it seems the DEA caught the money as it came out from Bitcoin's security protocols, not before."

Someone obviously does not understand the concept of cryptocurrency.
Title: Re: So... do we have our first DEA honeypot?
Post by: Lorimer on June 26, 2013, 05:58 am
I think this was an SR vendor. Look at the nick name, "Casey Jones". He is indeed a vendor, but apparently in stealth mode. Here's his vendor page.

http://silkroadvb5piz3r.onion/index.php/silkroad/user/1c0fdae424

I hope no one minds, but I'm posting this here on behalf of gwern, who is still stuck in the newbie forums:

Sorry hypnotick, but I beat you to this last night :) See http://www.reddit.com/r/SilkRoad/comments/1gxiv7/srrelated_bitcoin_seizure/caoxlmg Incidentally, after I posted that I messaged Jones both here and on SR, so there's no need for anyone else to ping him with warnings. Personally, I'm shocked he is still using the account, selling or buying, even after a run in with the government and now having been de-anonymized; if nothing else, he's putting his customers at risk. Maybe there should be a SR policy against doing (illegal) business while having been linked or de-anonymized.