Who is the owner of these two addresses?

[GandalfBitcoin]

1PLn3ru1n7wERPP1BLVV9oAEGGuXUP1eoC is one of the BC.i's addresses used for returning the lost bitcoins (on Dec. 2014) to users.

But on Apr.10, 2015, 189 BTCs on this address were sent to another address and then splitted identically (94.75757823 BTCs) to these two addresses :

• 3JmdHRuTDuFTqxk7bFazY6GooNgwohZQwa
• 3Fq28aWZf5SCF6VbhPZf9X33XPGS833mKS

There are thousands of transactions related to these two addresses, and they seemed to be daily used by somebody (not like a user who have lost 189 BTCs on december last year).

My question is "Who owns these two addresses?".

[ghost]

address balance incoming txs last used in block
3EP4xyWmB8u6ZDmMQHFv1oYPEETUjwMrQV 1068.28925435 762 365054
337RfngTLRTpU7RT9sKWQWDdmfcdmWnugi 1061.95050049 777 365044
39Dp7MnmMn4Au7emMPm6z6TJvVzJWeAinu 1055.94349109 803 365051
3L9qAGBQLbXkFAB2GpijnJXPScSVjuiJio 1054.91207418 770 365064
357M3eYk7BTMGhLwkS84fWigqPDEJ9gp25 1041.14726639 809 365065
3GpGgT3sFxcBtt6JZRG3Kn7N4JfmsszXy6 1040.5186313 782 365065
3ChedKXRseKyPwufAWWL85MDXtF54BxAY8 1040.42197531 763 365033
3NSAY3HF6Afd4KyEoYUiQdkJFLfr4E7ubj 969.85953943 731 365051
3Mek9CUGo99byMrLKCfMSakCUF6hqR3vTU 964.20584963 770 365064
391UPbq8v9tXwTWJH8qeZiXT21hVLTbC1X 875.72519058 765 365023
37vQmmLfThGCumry9nAapvtdbYc9gVmaa5 801.8262439 813 365051
3731QcRZTXqdEpjXVjyf9T8zXeSAqZt6Ms 593.66398578 791 365021
3NuGTcQVx9m2D6Wcd3gDSw81cXsojXFF52 545.54414459 770 365051
31qneokFGwpEkoZRksjymxZAiTEmAim3Ab 534.89718019 769 365064
34LxvX15nrj1TW9pnsPC1uLPewoEb6dYrF 205.23982034 814 365053
3EYyfuqH7zMPUJYymbNsLjYBG2pxGjgjDe 155.23081584 764 365009
3QbN8U4dfCxwtXAcgWTkqwGtP1PcaZ2sgv 102.27698197 759 365051
37Kbnc7dkB8AiqGfGHgeqKkgd3C65EwqE9 90.60888805 796 365053
3C4ABC7iPcAAKBh6SJXfvUSDBew3abCtw3 88.3452429 745 365059
3CswTd6V8V2uv24P9yWHpPnFiLfN4CABgW 86.73260314 860 365042
3AckDd1ot9rSiRUCfazd7yufVbCorerWjV 86.69557291 774 365059
3CgQeSxqroG8obuiMwFQpZCzSBuhW4FDAP 83.25197778 785 365060
3ChiCWdXotownkore5tyFYuzRydYzrBmkB 81.5715241 820 365064
3NPzLv1Jy4vhCgavfz6Zt7injzaHMUuJYk 81.17134728 769 365035
3QkXtcSWJA9w77eCujnMBKDWFe7F7zwxTg 78.9013821 761 365049
3GEaT8ZRXELcjMSFvGro6eZcC5S1LSLZuN 76.82493624 781 365064
35UNmoRCafgXSpNL7y5U19GK67sbquPysA 75.18060699 758 365023
3BuQmbmdce3e31GEovq5SgowLdfMgJzLDE 72.36703495 750 365033
3BRpfecfDp2EfdNN76rPGDcd5oKvBzYQhy 71.78182774 743 365064
3Fe8E2Dg5VMFPmUGFyJ58G5RVVUeK3p684 70.80835992 735 365038
3DUFGeoVdHer7h3XRg6H5otHMRBtzGo2NN 67.33341178 799 365064
3Pei4hHgGpXQAJFremyy3yNREcLzvBvh4E 67.31443221 741 365048
3ECJwvx9VgfotcUuEJMVNvmWnTGVMk179L 66.92909245 778 365029
3AX7T8fd6F2LsZyPdk6e6M1ddbzd5ZPbek 65.29188128 779 365034
35DVAzDtZDKAU94kFT9sxoscnuLCTxgwYc 63.64559989 788 365033
31nhZFonD2ApChTd2VgRz6TTQHtDh25Vj3 63.60881733 819 365063
3P2eoKr3vAeZhJcTzon3VFkv5r7DqSXW9G 63.43581371 749 365051
3FUcTQa2XWHfnCZQmUWEU18xQQeMuMuVgJ 61.95672936 799 365039
37PMVmY2NzTK3zVQLwVXsyfV4QPEJWYejG 61.7615073 715 365063
35zBvZd46TjSmPx7aUWo58GxNJ52RDoN74 60.84837865 773 365048
3MmajzyU2LFun5Xc4N6rmVYH7tnGxc8bqM 60.66982982 756 365044
39ijp4Gm1u5eobUXDvFeUkptCxzM4wTvB9 60.12004929 775 365031
37WSkANPVUQ8uuktf8hv671CejRtBtQ4tJ 59.80485902 750 365064
3HpQozfTzoXAsHf87m2mwJXUQ14LVtLgK4 59.37505104 795 365065
34b8chm1V4sfnNU4RxGppptfYnwTvmrzq7 58.74773311 816 365059
3Qy5mTpumWh24f5UdwGPJEhStoD3A25fK9 57.97734397 736 365032
3LMnJjz1RJjNZ1uFNhBvcwQdEp5T2rnFg9 57.87637499 789 365064
32qpvpX9DuefqGFmw9h6MJS95fgAP4w2gq 56.68610447 808 365033
3EC6GCRBCbLGBTHL3xJNUeDeQMELmZsUcD 55.43449736 759 365063
3HPF1x3g34oeiakfmrUb8Ej6mbWSj8CpZc 54.80535914 810 365038
3Fq28aWZf5SCF6VbhPZf9X33XPGS833mKS 53.87321566 777 365065
37X5mtn38nHj9ZtDeyZKfvwWjjuguNdvgK 53.71128869 753 365065
3FhWzKn8yU4s1ZTWm4kyHVS59GVKsVncCr 53.11986474 767 365063
34NRoKBRK8y1tvKdN6XZE2Wodqb5YfmCV9 53.01750456 755 365043
3NpXibj6WvpAuHh6nWHRTygGEJYRVnPPH2 52.27557127 740 365059
3LrLWTSdd69oZVVQ6dtWaAAaBLn7N3rRjz 52.27496427 793 365033
37CB9zG2yGyM4xZYacGKwn1728QtuZEyJj 51.82532762 832 365020
3NwKLjJjzXSnBFQWokXRgBG3JeuF3bsnfE 51.75878306 784 365063
3D9Gi4JsBaFRfyyDHiC3QM4o3zreV6oD4G 51.38666562 750 364918
39QNJSgQg5JnBXAtbF8ezkDn72VqWdPZPJ 51.03860463 765 365044
3JmdHRuTDuFTqxk7bFazY6GooNgwohZQwa 50.59890086 753 365064
33AibmPKKKDRfSZsqgugzGY5MQnrVYpfQr 50.53253076 767 365051
3FxNPjJmcQsw5czeheoLMub7sveWW1BNFK 50.21524047 797 365040
3QQKRwuVyRgv7xZVN9aR1z8p7SUFukAsCz 49.16214169 795 365040
3Nw96PpfFoiM863pEvWXyKpee9TFdCEV5G 49.02600477 808 365040
3AkcNwhD2RVDwxQ63mywLmQVqRGSSKZsCS 48.92927258 781 365042
33jhmQXe4Q9dP24Jm9EVa6XHxn85sZnQMR 48.26370522 812 364984
39pvSqfNcUosc8RGVWxyzKM3ny96a3uSkW 47.71211598 763 365063
3M1XKJMYxeKbdmLgwWWi7TPNtSuVKqEsJN 47.12218388 762 365064
3Q5Z56QaBoyetUR627RzR38jPBXyQp8Pz9 47.11366002 743 365064
3F3KVPrDX6MsBjKveQNBkkunKp1Uai2zvz 46.82415214 741 365065
3KR3WFLeW2bdWu1BGFM6uwM3uTkeJG3xvm 46.82148038 760 365031
3PbacVZwS2L5i9C2Cmz9rPu8s4qjyYkufk 46.44270397 766 365032
34UQSm2tUn7pnxAJiv7f4M6mjk51nhfeGA 45.84856839 773 365065
39oM6nD6SrTashAJnud8iLfSEgRD8mgeWF 45.54972917 747 365021
3GjEQWyEWSi6fCeWs7sE2UYUaAFcz6RR4q 44.89345539 768 365060
32jPMzNzHKE2f6u6V1Ch9qxXXf456D83F5 44.86553902 761 365065
3BTN4ZPKZnGJEGSVe9zPe4bTn8Qh39jkbd 44.76086486 845 365032
32XUXaJftyDXMqkQt81GJmwCP513SohC1W 44.33206319 730 365044
355gubKZeMnn9aF3pVP95rzj3uTDxwXyXr 42.96536887 747 365065
3HCufpyqXEtHjbdMU9RMWBXzupr4VRUPMR 42.89987543 793 365023
3Qd7hXZoZ1iyXZznrbdUwUQBxHMmujdqhJ 42.79005324 753 365057
3EEwPZZ6pYRJSotCz9RBoVYPRnoWyGWEka 42.15478537 789 365051
39XoQbLUvm9gb9fZ1MrtW8gRzkRZhSiFGP 41.96851591 772 365064
372QHtyJvHaTyqWUdKSTYoMydwkhDc79FR 41.44479861 799 365053
35mwqShnStDro6uEB4bmsgbyBo8en6Byfm 40.23403736 762 365023
3Nc4cS58WAbY9W4eTq5Y5rxwHaSC8CTCfL 39.13463655 759 365064
3D7uNptGHVwuZ9R96ZgzJmyndjoTRXNxXA 38.76262825 789 365031
3376X6m1YX3Jm4J4c2zq8w93VdSnUnZj31 36.91182895 817 365064
32XYbrgvhtZ9JFdrwrS5mQKL7Uzy2n7h1j 34.62694721 775 365004
3Eab4nDg6WJ5WR1uvWQirtMzWaA34RQk9s 33.30874523 790 365059
3Pwp5u7PwgrMw3gAAyLAkDKYKRrFuFkneG 32.62873951 806 365064
3NHB7u25szhW9vz3ikeBbDN8RGE5LC3VSR 31.66833919 743 365040
35Sr8veMauPrkLBZRJTHJH333QF5UfyTpW 29.22939151 780 365064
32MRhoyQb4Fh8EpWaw4rDioArrgMfnqbSx 26.41955524 804 365038
3PxZcbTwedQKjL2qXGP8oUg9gNXvDrFhuA 24.17461606 703 365051

i think these are other btc address in that same wallet.
Wallet [00da6b1813]

[ghost]

Accept reward for this work here:- 1TipGdV9TbMctpGUJZUDymoVx2vLfYZpY

[dexX7]

Sorry, maybe I miss the obvious here: why does it matter?

[GandalfBitcoin]

@dexX7 , so did you mean that nobody should ask about these lost money?

[dexX7]

@GandalfBitcoin: no, this is not what I meant.

At first it wasn't clear to me what this is actually about, primarily, because you provided almost no context.

I have a vague idea, and I'm sure this is about Blockchain.info Security Disclosure, but let me refine the question:

1PLn3ru1n7wERPP1BLVV9oAEGGuXUP1eoC is one of the BC.i's addresses used for returning the lost bitcoins (on Dec. 2014) to users.

• the lost bitcoins mentioned here are the coins lost due to this incident, right?
• does this address belong to BC.info?
• or is this the destination, where the lost coins went?

But on Apr.10, 2015, 189 BTCs on this address were sent to another address and then splitted identically (94.75757823 BTCs) to these two addresses ... There are thousands of transactions related to these two addresses, and they seemed to be daily used by somebody (not like a user who have lost 189 BTCs on december last year).

• if this address belongs to BC.info, then I don't see why this is relevant?
• and what does all this have to do with stress testing, if at all?

Let me rephrase: it's a bit difficult to understand this issue, given the lack of information and context.

[GandalfBitcoin]

@dexX7 ,

1PLn3ru1n7wERPP1BLVV9oAEGGuXUP1eoC is one of the BC.i's addresses used for returning the lost bitcoins (on Dec. 2014) to users.

I think the meaning of this sentence is clear, and you may have the UNDERSTANDING issue. Good luck. :)

[jonathancross]

Okay, I think I figured out what @GandalfBitcoin meant...

A large amount of money was sent from an address owned by BC.i to the two multisig addresses he listed. Those multisig addresses seems to be making a lot of low-value transactions (ie the connection to the stress-test). @GandalfBitcoin assumes BC.i knows who the owner of those addresses are.

[chrissydavid82]

Ok im completely lost at this whole bitcoins and where is it going when I am supposed to be getting then I just lost over 600000 from bitcoins anliens and if I didn't get it who did?

[0xMasud]

I thought I got the privkey of it but i was wrong that land me here!

[HvyHx]

I learned about jean.py from claudia.txt this may answer what is going on here.

[JesseB0rn]

One of these addresses (3PxZcbTwedQKjL2qXGP8oUg9gNXvDrFhuA) seems to be involved in fake covid certificates in europe