A couple of months ago a considerable amount of MTGox’s trading logs were leaked online. MTGox was, of course, once the largest of the Bitcoin exchanges and eventually went under, taking huge amounts of people’s unwisely-invested Bitcoin money with them. This individual dug through the data and seems to have found some seriously concrete evidence that someone was engaged in some seriously shady business.
This is quite long and if you’re properly interested I recommend you hit the link to read up directly. But I’ll quote some of the more relevant oddities for you.
First, he begins by discussing some previously known odd behavior by what is assumed to have been a script or a bot that the community nicknamed “Willy”. Willy stood out in MTGox’s logs by not reading correct details for its location: rather than listing the location or using the !! tag for an unverified or suspicious account, it listed ??. It created one account, worked with it a while… well. Here’s what it did.
So basically, each time, (1) an account was created, (2) the account spent some very exact amount of USD to market-buy coins ($2,500,000 was most common), (3) a new account was created very shortly after. Repeat. In total, a staggering ~$112 million was spent to buy close to 270,000 BTC – the bulk of which was bought in November. So if you were wondering how Bitcoin suddenly appreciated in value by a factor of 10 within the span of one month, well, this is why.
This came to a head in November, when the price of Bitcoins hit their peak. The author is suggesting (not without merit) that the unidentified Willy bot was driving the price. In another unusual moment, the author realized that the account numbers Willy was creating were unusually high:
At this point, I noticed that the first Willy account (created on September 27th) unlike all the others had some crazy high user ID: 807884, even though regular accounts at that point only went up to 650000 or so. So I went looking for other unusually high user IDs within that month, and lo and behold, there was another time-traveller account with an ID of 698630 – and this account, after being active for close to 8 months, became completely inactive just 7 hours before the first Willy account became active!
Gee, that’s not fishy at all. But it gets better.
So it is a reasonable assumption that these accounts were controlled by the same entity. Account 698630 actually had a registered country and state: “JP”, “40″ – the FIPS code for Tokyo, Japan. So I went and compiled all trades for this account. For convenience, I will dub this user “Markus”.
So, to summarize before continuing, this guy investigated a known script making weird trades, followed it back to a strange account ID pattern, found another account showing the same strange account ID pattern that stopped trading 7 hours before the first we referred to. And this older one is called Markus. Although we can’t show ownership it’s worth noting that Markus was listed in Tokyo, same as MTGox the company. And what was Markus doing?
There were several peculiar things about Markus. First, its fees paid were always 0. Second, its fiat spent when buying coins was all over the place, with seemingly completely random prices paid per bitcoin….
In this table, the first two trades (buy/sell pairs) are by some regular user with ID 238168. In the second trade, this user buys 0.398 BTC for $15.13. The next trade is some large market buy by Markus (ID 698630): note how the “$15.13″ value from the previous trade seems to “stick”; regardless of the volume of BTC bought, the value paid is always $15.13.This is speculation, but perhaps for Markus, the “Money” spent field is in fact empty, and the program that generates the trading logs simply takes whatever value was already there before. In other words, Markus is somehow buying tons of BTC without spending a dime. Interestingly, Markus also sells every now and then, and for some reason the price values are correct this case.
Markus sees a real user place an order, Markus places a larger order but “pays” the exact same amount AND pays no trading fee at all. But when Markus sells, it’s always at the correct value. Could have been a bug in MTGox’s software… but always when the Markus user ID was involved?
I’ll leave the rest of the conclusions over on the original article. Bottom line, the data ties it into even more weirder activity that very heavily suggests fraudulent activity. Now, all of that’s headed to court, of course. So we’ll see what happens there.
Good times though, eh?>