# Who stole the bitcoins?

### Introduction

You want to give bitcoins to a person you have met. Part of the deal is to give the bitcoins in the most untraceable way. So you have decided to send an email to him with the address (you already have sent the private key). The email you sent to him is shown here below:

Email 1:

I have already sent the private key to you in another email.

To get the bitcoin address, please take a look at the attachments,

Regards,

*****

The attachment lead to this image:

Email 2:

It looked as if everything went smooth, until you got an email back from the person you sent the email to. The email he sent is shown below:

Hi,

It seems that the wallet you sent me is empty,

Regards,

*****

It seems that the bitcoin wallet was already emptied by someone else. Your task is to find out who has stolen the bitcoins.

### Tips

Tip 1:

It was not the person you have sent the email to.

Tip 2 (important}:

The name of the person who stole the bitcoin is in this list.

• Well, decrypting that QR code gives me 'NGnc7', which is probably the extent of my usefulness.
– user21703
May 31, 2016 at 11:25
• When I scanned the QR code and googled it, the first result was this puzzle with part of the solution shown in the preview. How ironic. May 31, 2016 at 17:35
• Who stole the Bitcoins from the Bitcoin wallet? Adnan stole the Bitcoins from the Bitcoin wallet! Who me? Yes you! Wasn't me... Then who?! May 31, 2016 at 23:12
• @corsiKa ¯\_(ツ)_/¯ May 31, 2016 at 23:14
• Hmm. Cannot the address be derived from the private key already? Jun 1, 2016 at 5:07

Solution:

Bee Holzman

Explanation:

When the QR code is decrypted, we are given NGnc7. As @LeppyR64 figured out, this is an Imgur address, which leads us to this image:

Open this image with a text editor and you will find the bitcoin address at the end (see here for an image):

1GJ2CBCjBjqa7F9XscorRTfoUXAA2G4FHV.

Running a blockchain search for this address gives us :

One transaction: -0.02 BTC to the address 14j3zgcJoDGPzfUNEUzMAPHB57E4xVBSoL.

Bee Holzman.

Most of this is from @LeppyR64's partial answer, I just finished off.

• Thanks for updating your answer to include all the information after getting the check. Good work! May 31, 2016 at 12:05
• lol I got this one on imgur imgur.com/a/ngNC7
– Yar
Jun 6, 2016 at 19:16

Partial - No time to finish it now

As was mentioned by Beastly Gerbil the QR-Code decodes to:

NGnc7 - This is an imgur address

This points to a new image:

With this image:

Edit it with notepad and you'll find at the end of file the text

Next Step:

This is a bitcoin address of the empty wallet. So now I don't know how to find the transactions and don't have time to research it now. Hopefully someone can continue or I will come back later.

When we check the transactions on the bitcoin wallet with the address we obtained, we see a transaction to address: 14j3zgcJoDGPzfUNEUzMAPHB57E4xVBSoL

Which belongs to:

Bee Holzman

Using a QR Scanner, I get the text

NGnc7

I imagine that in the list of suspects the line of letters and numbers will have the first two capitals N and G, the two lowercase letters after that n and c and the first number after that 7

Alternatively it could be something to do with the initials

EDIT: The others realized it was an imgur adress, which lead to Bee Holzman. Guess I was wrong

• NGnc7 is correct. Your suspicion is wrong. (I'm already on the next step) ;) May 31, 2016 at 11:39
• @LeppyR64, well done you, I have no idea what to do now! May 31, 2016 at 11:40
• No initials either haha :p May 31, 2016 at 11:45
• I can find nc7 in one of the addresses...
– user21703
May 31, 2016 at 11:46
• @GeorgeGibson Check my answer. May 31, 2016 at 11:47