NotBiebs and 69 others's avatar
NotBiebs and 69 others notbiebs@primal.net 2 weeks ago
Found something interesting while looking at new txs made to an address containing hacked coldcard funds. Funds were sent from an Ocean miner payout address to an address linked to hacked coldcard funds and then that UTXO was peeled off immediately. Could this dummy have accidentally sent his mining pool payout to the address containing hacked funds? Copy pasta mistake? Block whose coinbase paid miner (tag OCEAN.XYZ):
The Mempool Open Source Project®
Explore the full Bitcoin ecosystem with The Mempool Open Source Project®. See the real-time status of your transactions, get network info, and more.
 Miner payout address (payout sat here ~14h 40m before moving):
The Mempool Open Source Project®
Explore the full Bitcoin ecosystem with The Mempool Open Source Project®. See the real-time status of your transactions, get network info, and more.
 Tx sending that payout to address containing stolen funds:
The Mempool Open Source Project®
Explore the full Bitcoin ecosystem with The Mempool Open Source Project®. See the real-time status of your transactions, get network info, and more.
 Stolen funds address (current balance ~0.69 BTC of stolen bitcoin):
The Mempool Open Source Project®
Explore the full Bitcoin ecosystem with The Mempool Open Source Project®. See the real-time status of your transactions, get network info, and more.
 Tx moving funds that originated from Ocean out of the address containing hacked funds:
The Mempool Open Source Project®
Explore the full Bitcoin ecosystem with The Mempool Open Source Project®. See the real-time status of your transactions, get network info, and more.

Replies (15)

NotBiebs and 69 others's avatar
NotBiebs and 69 others notbiebs@primal.net 2 weeks ago
so you think the mining payout was stolen by the hacker? i was thinking the hacker received the mining payout and moved it to the wrong address by accident. the movement doesn't match how other hacked funds are moving.
kc's avatar
kc kc@nostrplebs.com 2 weeks ago
It looks like I am going to learn something here. Are you asking if the pool logs the source address for more than just processing the hash? I hadn’t thought of them doing that.
Carlos Dave's avatar
Carlos Dave 2 weeks ago
Working with Craig has been one of the most rewarding experiences in my trading journey. He doesn't encourage shortcuts or unrealistic expectations. Instead, he teaches discipline, market understanding, and proper risk management. Thanks to his guidance, I grew my $30,000 investment into $90,000. If you're looking for someone who genuinely wants to see you succeed, Craig is an excellent mentor to follow. @Cragstradinghub Telegram ⬇️ t.me/Cragstradinghub WhatsApp ⬇️
WhatsApp.com
Share on WhatsApp
WhatsApp Messenger: More than 2 billion people in over 180 countries use WhatsApp to stay in touch with friends and family, any...
Kayne's avatar
Kayne kayne@kayneapproved.me 2 weeks ago
They sent stolen Bitcoin to an address, then changed the address of their mining pool payout to that address? Sounds like a psyop.
NotBiebs and 69 others's avatar
NotBiebs and 69 others notbiebs@primal.net 2 weeks ago
there's a lot. the payment didn't go straight from ocean to the stolen stash. they went to an intermediate address which has received a bunch of mining payouts from ocean first before moving to the stolen stash about 15 h later.
2 replies ↓
↑