_QCX ETH (Primary Document)
 Share
The version of the browser you are using is no longer supported. Please upgrade to a supported browser.Dismiss

View only
 
ABC
1
Hello! Welcome to the Ethereum QuadrigaCX Research. I'll be your guide through this hot mess!
2
3
Multiple people helped with the curration of this, but it was primarily put together by https://twitter.com/tayvano_

Questions are welcome.
4
5
Huge thanks are owed to some people & their tools and servers that allowed us to easily grab this data:
6
EtherscanThank them on Twitter
7
QuickblocksThank them on Twitter
8
9
* Any notes are personal notes that may or may not be helpful and may or may not be factually correct.

* For example, some notes on addresses are simply for us to remember the address (e.g. "customer - foundation tip jar") and doesn't really have much meaning beyond being a reminder.

* Another example, "whale". This was an initial assumption that may or may not be true. It may turn out some of these addresses are indeed controlled by Quadriga.

* Regardless, take all notes with a grain of salt. Verify any assumptions you are making against the actual data, not the notes.

* Lastly, numerous people have pointed out that customers can withdraw to exchanges and ShapeShift. This is indeed true. Always assume that a transaction to an exchange deposit address or ShapeShift is a customer, not Quadriga, unless confirmed otherwise, even if the note assume otherwise.
10
11
To play with this data yourself, go to File -> Make A Copy. If you find anything interesting, let us know.
12
13
Overview of the Sheets
14
Addr NotesThis is a messy compilation of notes about various addresses.

When we were initially researching, we pulled addresses based on things like large number of interactions with known main wallets, large transactions, even transactions (1000 ETH vs 583.9490239 ETH), etc. We then put it in a sheet with notes

For this reason, some addresses show up multiple times in the list. This is because they showed up across multiple addresses with anomalous behavior.

This isn't really worth reading as the most up-to-date summaries on the important addresses are below.
15
16
0x027beef (green)Full transaction history of 0x027beefcbad782faf69fad12dee97ed894c68549, which was the main hot wallet used by Quadriga between 4/9/2016 and 6/2/2017.

You will see the address 0x1e143b2588705dfea63a17f2032ca123df995ce0 show up frequently. This is the address of a smart contract known as the "Safe Split" contract, which ensured exchange did not send both ETH and ETC when processing deposits. We have grabbed the original "from" address for these transactions so we can look at the transactions/values in the same format over on the green + blue compiled sheet.

This address had a top balance of 30k ETH. It had a balance of >20k ETH primarily between 3/2017-5/2017.

From 5/23/2017-5/30/2017, you will notice a distinct lack of deposits. This is because the transactions they were generating were incorrectly formatted and all funds depositted into the exchange during this time were stuck in the safe split contract. You can read more about that incident below. This prompted the move from using 0x027beef as the hot wallet to using 0xb6aac3b56ff818496b747ea57fcbe42a9aae6218, which is still being used as the hot wallet to this day and is mentioned in the affidavit.
17
* ETHNews short version:https://www.ethnews.com/quadrigacx-provides-explanation-for-costly-code-error
18
* BokkyPooBah's discovery and analyis (technical):https://np.reddit.com/r/ethereum/comments/6er78h/warning_do_not_use_safeconditionalhftransfer_or/
19
* Quadriga's statement: https://www.reddit.com/r/ethereum/comments/6ettq5/statement_on_quadrigacx_ether_contract_error/
20
* Related data thanks to BokkyPooBah:https://github.com/bokkypoobah/BadBeef/blob/master/data/BadBeefData.xls
21
22
0x0ee4e (blue)Full transaction history of 0x0ee4e2d09aec35bdf08083b649033ac0a41aa75e, which was actually the first wallet ever used by Quadriga. They launched support for Ethereum on 3/11/2016 and this address was used for testing before that date.

Moving foward this address was used as a "reserve" wallet (mostly to move funds to other exchanges) and occasionally as a hot wallet.

It was specifically used as a hot wallet between 3/11/2016-4/8/2016 and on 6/22/2017. On 6/22/2017, the Status ICO clogged the network and exchanges had immense trouble gererating large numebrs of valid transactions due to transactions being dropped from the transaction pool and future transactions not having the correct nonce.

It mostly sends funds to ShapeShift deposit addresses, other Quadriga addresses that send to ShapeShift, other exchange deposit addresses (below), and to/from the active hot wallets in times of need.
23
24
0xb6aac (purple)0xb6aac3b56ff818496b747ea57fcbe42a9aae6218 is the main, current, active hot wallet for QuadrigaCX. It has nearly 500k transactions and counting.

It was initalized via 0x0ee4e2d09aec35bdf08083b649033ac0a41aa75e on 6/2/2017 (right after the incident with the SafeSplit contract on 0x27beef).

We have gone thru this data the least, but some conclusions from it can be found in the article linked below.

This dataset is too big for Google Sheets. You can find the .xls below instead. It also has transactions from 0xee4e and 0x027beef from 6/2/2017 and on (so you can see the movements)
25
Dataset:https://drive.google.com/open?id=1IYDq6VBTvmCXZXwlS7SG3Mbiz9n61flZ
26
Article w/ some findings:https://medium.com/coinmonks/quadrigacxs-collapse-was-an-inside-job-a61dc4b3dd78
27
28
green + blue compiledThe transaction histories for 0x027beefcbad782faf69fad12dee97ed894c68549 & 0x0ee4e2d09aec35bdf08083b649033ac0a41aa75e combined into a single spreadsheet with notes. Most useful when sorting by date.
29
30
locked in safe splitThe transactions that were locked up in the SafeSplit contract 0x1e143b2588705dfea63a17f2032ca123df995ce0 that should have been passed along to 0x027beef, if they had not been trapped.

Interestingly, it seems as if they were using this as a "deposit hot wallet" for almost a year. Funds would move directly from individual user deposit addresess, to this address, and then passed along to the primary "hot wallet" 0x027beef (green).

Background (copied from 0x027beef above): "From 5/23/2017-5/30/2017, you will notice a distinct lack of deposits. This is because the transactions they were generating were incorrectly formatted and all funds depositted into the exchange during this time were stuck in the safe split contract. You can read more about that incident below. This prompted the move from using 0x027beef as the hot wallet to using 0xb6aac3b56ff818496b747ea57fcbe42a9aae6218, which is still being used as the hot wallet to this day and is mentioned in the affidavit."
31
32
0x57b72 polo (orange)Transaction history for 0x57b727dc48b5d9261958e0fb9f94fa02dc328bf6, which is typically referred to as "orange polo" or something similar.

It is an individal's (or company's) Poloniex deposit address (see --> for what a deposit address is).

We are very confident that this deposit address belongs to QuadrigaCX, Gerry, Michael, or another top person within Quadriga due to:
- the frequency with which this address is sent to
- the first transaction for this address being before Ethereum was added to Quadriga, while they were testing the functionality of the site

In total, 218,312.79680776 ETH worth an equivalent 7.791M USD at the time of each transaction was sent to this address between 3/10/2016 and 1/13/2019.
A deposit address is an address than an exchange assigns to an individual account on said exchange. When you want to send money to the exchange, you send it to this address. The exchange then (1) detects the deposit (2) credits your exchange account with that amount (3) moves those funds into the exchange's hot wallet.

It is easy to detect an exchange deposit address by the distinct in, out, in, out, in, out pattern of transactions, where each transaction out is the full amount of the previous amount in, except for a small amount used for transaction fees.
33
34
0x696dd bitfinex #1 (pink)Transaction history for 0x696dd748a2edd9692ed93bd592dd2f293483eada, which is a Bitfinex deposit address.

While it's possible this is an innocent customer address, it's highly unlikely due to:
- the amount sent
- frequency of sends (especially early on)
- the fact that it's only received funds from addresses known to be Quadriga or associated with Quadriga
- the times of deposits line up to when other manual transactions were being iniated by Quadriga Admins:
- 3/18/2016 17:55 0x0ee4e2d09aec35bdf08083b649033ac0a41aa75e -> 0x696dd748a2edd9692ed93bd592dd2f293483eada
- 3/18/2016 17:56 0x0ee4e2d09aec35bdf08083b649033ac0a41aa75e -> 0x57b727dc48b5d9261958e0fb9f94fa02dc328bf6

In total, 133,720.905 ETH worth an equivalent 1.569M USD at the time of each transaction was sent to this address between 3/14/16 and 7/14/2016.
35
36
0xd727 bitfinex #2 (dark pink)Transaction history for 0xd72709b353ded6c8068cc78988613587a4cae8de, which is a Bitfinex deposit address.

While it's possible this is an innocent customer address, it's highly unlikely due:
- the amount sent
- frequency of sends
- the fact that it's received funds from all QuadrigaCX main wallets
- the fact that it's received funds from the "ShapeShift" addresses (described below)
- the times of deposits line up to when other manual transactions were being iniated by Quadriga Admins
- 0x0ee4e sent 50% of it's remaining balance here when the use of 0x0ee4e was discontinued

In total, 44,008.156726 ETH worth an equivalent $13.61M USD at the time of each transaction was sent to this address between 5/31/17 and 12/3/2018.
37
38
0x7ea5 SS #1 (light yellow)Transaction history for 0x7ea5e875a386b66d11a0ad1866ca7b5f2745f049 with corresponding ShapeShift data.

It has received a total of 24,115 ETH from all Quadriga main wallets & 0x0b9defea64d1808bcdec76d532984dd24fb8bcff between 5/17/2017 and 10/27/2017.

It has also sent to the Quadriga main wallets & 0xd72709b353ded6c8068cc78988613587a4cae8de.

It primarily sends individual transactions to ShapeShift deposit addresses for the maximum amount allowed by ShapeShift at the time.

In total, it has sent 19,229 ETH to ShapeShift, worth about 4.42M USD at the time of each transaction.
39
40
0x0b9def SS #2 (med yellow)Transaction history for 0x0b9defea64d1808bcdec76d532984dd24fb8bcff with corresponding ShapeShift data.

It has received a total of 69,750.02 ETH exclusively from Quadriga main address 0xb6aac3b56ff818496b747ea57fcbe42a9aae6218 between 9/9/2017 and 4/25/2018.

It has sent a majority of that back to the Quadriga main wallet, 0xb6aac3b56ff818496b747ea57fcbe42a9aae6218.

It could be considered a "reserve" wallet, however it's primary goal is to send individual transactions to ShapeShift deposit addresses for the maximum amount allowed by ShapeShift at the time.

In total, it has sent 7,235 ETH to ShapeShift, worth about 2.5M USD at the time of each transaction.
41
42
0xc3cae41 SS #3 (dark yellow)Transaction history for 0xc3cae4118fec40ef386e01eb04b7e66dc0e5b643 with corresponding ShapeShift data.

It has received a total of 7,126 ETH exclusively from Quadriga main address 0xb6aac3b56ff818496b747ea57fcbe42a9aae6218 between 4/25/2018 and 11/01/2018.

It has sent a majority of that back to the Quadriga main wallet, 0xb6aac3b56ff818496b747ea57fcbe42a9aae6218.

It also has sent to 0xd72709b353ded6c8068cc78988613587a4cae8de (Bitfinex Deposit Address #2 above)

It could be considered a "reserve" wallet, however it's primary goal is to send individual transactions to ShapeShift deposit addresses for the maximum amount allowed by ShapeShift at the time.

In total, it has sent 7,126 ETH to ShapeShift, worth about 1.1M USD at the time of each transaction.
43
44
SS TXs (Compiled)All (and only) the transactions from Quadriga-controlled accounts...

- 0x0ee4e2d09aec35bdf08083b649033ac0a41aa75e
- 0x7ea5e875a386b66d11a0ad1866ca7b5f2745f049
- 0x0b9defea64d1808bcdec76d532984dd24fb8bcff
- 0xc3cae4118fec40ef386e01eb04b7e66dc0e5b643

...that were sent to ShapeShift deposit addresses. With cooreseponding SS data.
45
46
SS Receiving Addr (Compiled, De-Duped)Compiled & de-duplicated addresses on the receiving end of all the above ShapeShift transactions.

The first column are all the addresses. The remaining columns are some light tracking to see where the funds mostly ended up. It's hard, bc they were mostly mixed.

Interestingly, it seems as though they lost or forgot about some of the BTC in these receiving addresses. These are highlighted.
47
48
? 0x169c65 bitfinex #3 ?A Bitfinex Deposit address that we aren't certain if it is a customer or belongs to Quadriga. More notes on that sheet.
49
50
? 0x0247bc ?Weird address 0x0247bc4e03142079cfa2e3daf500722ed0f9a6b2 that we initially thought was a user's deposit address that was an arbitrage bot across multiple exchanges.
However, it shows up so consisently and with such large amounts that we suspect it belongs to Quadriga.

It has similar patterns to 0x45cab8d124fce8663581172c614f2ee08d01d48e and 0x4a21057d80cf2c208068de099ed829f7e3b5d3fb.

All three of these addresses are labeled in dark red and usually referred to as "Weird Arb Addresses".

Interestingly, this one sends directly to the pink Quadriga Bitfinex address (0x696dd748a2edd9692ed93bd592dd2f293483eada) and the orange Quadgriga Polo Address (0x57b727dc48b5d9261958e0fb9f94fa02dc328bf6)

In total, it has sent 285k ETH (worth ~40M USD at the time of each transaction) over 500+ TXs between 3/16/2016 and 12/3/2016. There's that 12/3/2016 date again 😉
51
52
? 0x45ca weird arb 2?TX History for 0x45cab8d124fce8663581172c614f2ee08d01d48e. Similar to "? 0x0247bc ?" and "? 0x4a21057 weird arb 3?" (directly above and below)
53
54
? 0x4a21057 weird arb 3?TX History for 0x4a21057d80cf2c208068de099ed829f7e3b5d3fb. Similar to "? 0x0247bc ?" and ? 0x45ca weird arb 2? (directly above)
55
56
? 0x1f7dd SS ??As an exhibit in QCX's first affadavit, they included a screenshot of an admin panel that listed 3N8auHdN9rtmHDHqNnXK4eWhfukBAQcve1 as the Bitcoin hot wallet. This spreadsheet works backwards to trace the funds from that Bitcoin address to their original source on the Ethereum chain.

More information about this address is at the bottom of that sheet.
57
58
? 0xd54315 bitfinex #4?A bitfinex deposit address that I thought might be interesting. Nothing to remarkable that I've noticed though.
59
? 0x24d2bd ?No conclusions I'm willing to share at this point regarding this address. Hoping it and it's associated addresses will show up more as I research more.
60
61
62
0xd543154fb94528c4fc54b9c27128c2d86c6322beTo look into. From https://www.reddit.com/r/CryptoCurrency/comments/avwzce/breaking_over_600k_ethereum_belonging_to/

My Previous Notes:

- Bitfinex deposit address
- keeps showing up associating with other weird addresses listed above
- receives from Polo, kraken, qcx 0xbaac, etc.
- Last transaction: dec 8, 2018"

Sends multiple large TX FROM 0xb6aac3b56ff818496b747ea57fcbe42a9aae6218 which brings 0xb6aac3b56ff818496b747ea57fcbe42a9aae6218's balance to ~1000 ETH

2017-11-05 19:30:48 0xd543154fb94528c4fc54b9c27128c2d86c6322be 250.00 1,079.9624503576
2017-11-23 14:45:26 0xd543154fb94528c4fc54b9c27128c2d86c6322be 400.00 1,066.35484409767
2017-11-24 16:10:34 0xd543154fb94528c4fc54b9c27128c2d86c6322be 400.00 1,202.81322469078
2017-11-23 0:35:13 0xd543154fb94528c4fc54b9c27128c2d86c6322be 500.00 1,021.52779238799

addresses with the highest five balances that have directly interacted with 0xb6aac3b56ff818496b747ea57fcbe42a9aae6218
From https://medium.com/@ken_21625/quadrigacxs-collapse-was-an-inside-job-a61dc4b3dd78

Balance: 6502.524136
63
0x67fC93fD01A15D9FB02a80D0AE6207fB45625be4To look into. From https://www.reddit.com/r/CryptoCurrency/comments/avwzce/breaking_over_600k_ethereum_belonging_to/

My previous notes:

Sends multiple large TX FROM 0xb6aac3b56ff818496b747ea57fcbe42a9aae6218 which brings 0xb6aac3b56ff818496b747ea57fcbe42a9aae6218's balance to ~1000 ETH

2017-12-15 21:20:21 0x67fc93fd01a15d9fb02a80d0ae6207fb45625be4 1,199.995 1,248.27683434362
2018-02-09 1:10:44 0x67fc93fd01a15d9fb02a80d0ae6207fb45625be4 500.00 1,072.676516672"
64
0xb90a82ec61627885eab72f4253939285ba40c91dTo look into. From https://www.reddit.com/r/CryptoCurrency/comments/avwzce/breaking_over_600k_ethereum_belonging_to/

My Previous Notes:

0xb6aac has SENT large amounts of ETH to it
Whale? QCX? Polo deposit address

Sends multiple large TX FROM 0xb6aac3b56ff818496b747ea57fcbe42a9aae6218 which brings 0xb6aac3b56ff818496b747ea57fcbe42a9aae6218's balance to ~1000 ETH

2017-08-19 1:20:14 0xb90a82ec61627885eab72f4253939285ba40c91d 800.00 1,204.59540646004
2017-11-01 16:05:41 0xb90a82ec61627885eab72f4253939285ba40c91d 500.00 1,183.8620855135"
65
0x79855af491352646e73bd12d7b92d6c814e71b4cTo look into. From https://www.reddit.com/r/CryptoCurrency/comments/avwzce/breaking_over_600k_ethereum_belonging_to/

My previous notes:

Sends multiple large TX FROM 0xb6aac3b56ff818496b747ea57fcbe42a9aae6218 which brings 0xb6aac3b56ff818496b747ea57fcbe42a9aae6218's balance to ~1000 ETH

2017-11-02 0:55:29 0x79855af491352646e73bd12d7b92d6c814e71b4c 600.00 1,102.16104666123
66
67
68
69
70
Loading...