# Who stole the bitcoins?

### Introduction

You want to give bitcoins to a person you have met. Part of the deal is to give the bitcoins in the most untraceable way. So you have decided to send an email to him with the address (you already have sent the private key). The email you sent to him is shown here below:

Email 1:

I have already sent the private key to you in another email.

To get the bitcoin address, please take a look at the attachments,

Regards,

*****

The attachment lead to this image:

Email 2:

It looked as if everything went smooth, until you got an email back from the person you sent the email to. The email he sent is shown below:

Hi,

It seems that the wallet you sent me is empty,

Regards,

*****

It seems that the bitcoin wallet was already emptied by someone else. Your task is to find out who has stolen the bitcoins.

### Tips

Tip 1:

It was not the person you have sent the email to.

Tip 2 (important}:

The name of the person who stole the bitcoin is in this list.

• Well, decrypting that QR code gives me 'NGnc7', which is probably the extent of my usefulness. – George Gibson May 31 '16 at 11:25
• When I scanned the QR code and googled it, the first result was this puzzle with part of the solution shown in the preview. How ironic. – morxa May 31 '16 at 17:35
• Who stole the Bitcoins from the Bitcoin wallet? Adnan stole the Bitcoins from the Bitcoin wallet! Who me? Yes you! Wasn't me... Then who?! – corsiKa May 31 '16 at 23:12
• @corsiKa ¯\_(ツ)_/¯ – Adnan May 31 '16 at 23:14
• Hmm. Cannot the address be derived from the private key already? – Thilo Jun 1 '16 at 5:07

Solution:

Bee Holzman

Explanation:

When the QR code is decrypted, we are given NGnc7. As @LeppyR64 figured out, this is an Imgur address, which leads us to this image:

Open this image with a text editor and you will find the bitcoin address at the end (see here for an image):

1GJ2CBCjBjqa7F9XscorRTfoUXAA2G4FHV.

Running a blockchain search for this address gives us :

One transaction: -0.02 BTC to the address 14j3zgcJoDGPzfUNEUzMAPHB57E4xVBSoL.

Bee Holzman.

Most of this is from @LeppyR64's partial answer, I just finished off.

• Thanks for updating your answer to include all the information after getting the check. Good work! – LeppyR64 May 31 '16 at 12:05
• lol I got this one on imgur imgur.com/a/ngNC7 – Yar Jun 6 '16 at 19:16

Partial - No time to finish it now

As was mentioned by Beastly Gerbil the QR-Code decodes to:

NGnc7 - This is an imgur address

This points to a new image:

With this image:

Edit it with notepad and you'll find at the end of file the text

Next Step:

This is a bitcoin address of the empty wallet. So now I don't know how to find the transactions and don't have time to research it now. Hopefully someone can continue or I will come back later.

When we check the transactions on the bitcoin wallet with the address we obtained, we see a transaction to address: 14j3zgcJoDGPzfUNEUzMAPHB57E4xVBSoL

Which belongs to:

Bee Holzman

Using a QR Scanner, I get the text

NGnc7

I imagine that in the list of suspects the line of letters and numbers will have the first two capitals N and G, the two lowercase letters after that n and c and the first number after that 7

Alternatively it could be something to do with the initials

EDIT: The others realized it was an imgur adress, which lead to Bee Holzman. Guess I was wrong

• NGnc7 is correct. Your suspicion is wrong. (I'm already on the next step) ;) – LeppyR64 May 31 '16 at 11:39
• @LeppyR64, well done you, I have no idea what to do now! – Beastly Gerbil May 31 '16 at 11:40
• No initials either haha :p – Wu33o May 31 '16 at 11:45
• I can find nc7 in one of the addresses... – George Gibson May 31 '16 at 11:46
• @GeorgeGibson Check my answer. – LeppyR64 May 31 '16 at 11:47