+x

 

kraut - 9 Aug 2018

Ok, now I'm a little bit confused. With "show bundle" you can see step for step, how the thief distributes the loot to several addresses. If I follow the big amounts, sometime the tags ANDROID9WALLET9TRANSFER and KZDROID9WALLET9TRANSFER will appear.

Here are more adresses:
WHLGKOOASMQWUWWNA9YJCWJIOJMQXWBMAWYFMBHSJBXXNSTQYHDRGNXYQTPZ9SIUJNZVOEXFHGZSXXNYG
ENCEKBOBCEJIQHBUJZLZFZQABMXKAEBGLGRWGUPMLQOQQYWNZWBWIKZBDZMSMBJUIIYGAW9QAXGPLUQEORXMAYCNTH
EKPRUGEGVENYDPCFFDJ9STVUGYISYXQGZIXYOHSKVLVEJRFUOVM9Z9VDXMHXFMASJTTXQWOVVNZDDPM9OCDJ9VLJQU
DVKQSKVLU99JJAWIIPDXJAJEITIXE9KBRAOPWMAFD9JPWAGNFXDCAQEGEJIGYTFLYND9JNPLIWQNOYPKQTQP9ZHYDN
YDONGDRNGTBMERWRWSOAMCDLMBRBABPQJKR9WYIRGLQIQCHLASLHS9TPBTABXDBYAIHKHXL9MVLJRIUFR
FPUX9BKUABOTYXMRTNGNPFIHAUNUKLDBMXNNIBOT9IOTQUV9KHTCETDPBAVLVEBWWTVKMLTPOBXJAL99Q
VG9VFMKIGOTTMPNKDBVZSXYVV9TWINHEAMRMEMOVWZZSBEOIVPRTVTVGEW9ZPWIQYBBWUBBRGITCHJOIN
SC9YROVAW9OJVUCJHSCKAPMNSWWJ9ZULZCQFYIWPEDCVKBGPZLLAIGKTF9ZJJ9BWGLTMEYOGZPOYRUYWU
AMWFICT9QIVOYWBGMOLLYRAGNKSNHDDVGUQIKHDVOQLSLVGZVBWPRTNSAESRVKUNURLAWISXNVQSXRUFG
EWJYGKTYWFANWHZEAJCTXREEWOBKDYDOJOQQNIGARFIQUDHYLEIYHDGOEBNBCJASEZKQHNBH9TAIHASKW
TKVFOBMGFFRADSWQOJSVFXXAFROCGIORACUH9CAIVTLKWTLZYECCXEMQWQDPSWZNBPNZMXONZAPAUACDK

You are welcome to outsource the discussion to a new thread.

Well, it is confusing really.
Usually, a thief would immediately send all the funds to an address of a seed that only he controls and afterwards start to split them up and distribute them. In your case, someone apparently moved the funds around between different addresses of your seed at first, which would be a very irrational and unnecessarily time consuming behaviour for a thief. 

And since you said that you’re not 100% sure that you didn’t make any transactions yourself, I was just hoping to find out when exactly you really lost control over your funds. Any transactions made before this might have led to a recoverable portion of your funds.

However, I think I’ve tracked the transactions enough by now to determine at which point none of the addresses used are your ownanymore. After the initial shuffling around, everything (except for 38.2 Mi) accumulated again on these two addresses and was then transferred further on from here (later on sometimes with the tag you mentioned, but this doesn’t really matter):
https://thetangle.org/address/WXFDHRJZNFACMPCITYWFQHJRNRJGSDMIYREUMBFHBOJEFYNSIMNRUARTMFZTEAZL9UUSF9MLZTKSFQXHJ
https://thetangle.org/address/ZTOZDIQFA9JRZJAPDYWKFOFGHPYHISDNLEEDBVKYJHRXQWCGCDZWAJDMUW9XGKMHQVVBIVKKJKVEKYVUO

I think we can be quite sure that you’ve finally lost control when your funds arrived at these addresses, in some cases a bit earlier even.
This is of course not the outcome I was hoping for, but it was still worth taking a closer look.

+x

 

rose - 24 Jan 2019

This is amazing if it pans out. I just considered the stolen tokens a lost cause.

I briefly looked up the info, but there's not much posted about it. Do you know if they actually caught the people or if they just have a suspect they are questioning? That's all the video said was that a suspect was taken.

Any idea if funds can be recovered and what any of us need to do now?

+x

 

isidore - 15 May 2019

Hello,

I have only just caught the updates regarding the capture of the thief. For some reason, I stopped getting updates to this thread.
Is there any update on the process to reclaim our stolen IOTA?

Thanks,

+x

 

dontuseiotaseedio - 24 May 2020

Hello, I have been in contact with a Cyber Crime Unit in the UK and want to share an update on the investigation into the theft I received last week. Here is the information that has been shared with me:

the criminal investigation into the theft of IOTA on 19th January 2018 valued at €10M has been conducted, initially by Hesse State Police Cybercrime Investigations Unit, Germany, and more recently South East Regional Organised Crime Unit Cyber Crime Team here in the United Kingdom. With the assistance of Bitfinex, a proportion of the stolen assets have been successfully recovered, which in the current markets hold a value estimated at £1.97M, and these remain secure in cold storage with law enforcement. 



The detailed report outlining the case against the suspect, and evidence we have obtained throughout a lengthy investigation process, has today been sent to the Crown Prosecution Service (CPS). I have made my recommendation that the suspect is charged with offences of theft, fraud, money laundering and failing to comply with a section 49 notice to disclose the key to protected information, however it is the CPS who will ultimately decide as to whether charges can be brought against the identified suspect. The lawyers will take all information into account, including: the effects the crime has had on you, both financially and emotionally; the element of public interest in prosecuting the case; and consider the likelihood of successful conviction, and combine all of these factors to inform their decision.



An additional factor of complexity in this case, assuming the threshold is met to charge with offences I have recommended, is determining in which jurisdiction a prosecution case should be held. There are over 200 victims from all across the world, and although the suspect was arrested in the United Kingdom, the crime was committed in more than one country, and the suspect now resides in The Netherlands as he is not a UK citizen.



As such, I do not believe a charging decision from CPS will be made quickly, as discussions will need to take place between prosecuting lawyers from all the relevant countries, however I will endeavour to keep you updated with events and decisions as they are made. 

 

+x

 

dontuseiotaseedio - 24 May 2020

Hello, I have been in contact with a Cyber Crime Unit in the UK and want to share an update on the investigation into the theft I received last week. Here is the information that has been shared with me:

the criminal investigation into the theft of IOTA on 19th January 2018 valued at €10M has been conducted, initially by Hesse State Police Cybercrime Investigations Unit, Germany, and more recently South East Regional Organised Crime Unit Cyber Crime Team here in the United Kingdom. With the assistance of Bitfinex, a proportion of the stolen assets have been successfully recovered, which in the current markets hold a value estimated at £1.97M, and these remain secure in cold storage with law enforcement. 



The detailed report outlining the case against the suspect, and evidence we have obtained throughout a lengthy investigation process, has today been sent to the Crown Prosecution Service (CPS). I have made my recommendation that the suspect is charged with offences of theft, fraud, money laundering and failing to comply with a section 49 notice to disclose the key to protected information, however it is the CPS who will ultimately decide as to whether charges can be brought against the identified suspect. The lawyers will take all information into account, including: the effects the crime has had on you, both financially and emotionally; the element of public interest in prosecuting the case; and consider the likelihood of successful conviction, and combine all of these factors to inform their decision.



An additional factor of complexity in this case, assuming the threshold is met to charge with offences I have recommended, is determining in which jurisdiction a prosecution case should be held. There are over 200 victims from all across the world, and although the suspect was arrested in the United Kingdom, the crime was committed in more than one country, and the suspect now resides in The Netherlands as he is not a UK citizen.



As such, I do not believe a charging decision from CPS will be made quickly, as discussions will need to take place between prosecuting lawyers from all the relevant countries, however I will endeavour to keep you updated with events and decisions as they are made.