Due to a server migration on January 19, 2018, any transaction that was missing a date was updated with the date and time of the migration, which we believe explains the January 19, 2018 dates on several transactions.

As we are looking at a blockchain, the order of the transactions is correct. Therefore, if we are able to date one or more transactions, using data outside of the block Explorer, we can infer when undated transactions happened in relation to the dated transaction(s).

While the Core team is still waiting on additional information from BitGrail regarding the lost funds, we have been notified of one account that allegedly received “unauthorized transactions.”

https://raiblocks.net/account/index.php?acc=xrb_1fioob7u6ia76rfo1medtrwwdobey1ua8qe7z55qyjimir5b9d95hkdabbjn (account 1, referred to as ‘bbjn’ from this point), which was cited by Firano in the Telegram text conversation from the original BitGrail Insolvency announcement, withdrew 9.84M Nano, worth around $1 million at the time.

We’ve identified a second account with a similar behavior pattern as ‘bbjn’, but without more information, we don’t feel comfortable publicly citing the wallet address. We are waiting for BitGrail to release all of the wallet addresses associated with the lost funds, which is necessary to potentially have other exchanges freeze stolen funds.

In the conversation dated February 8, 2018, Firano provided a SQL dump of over 100 transactions for the account ending in ‘bbjn’. The file included BitGrail’s internal time-stamps for these withdrawals. From the Unix time-stamps, we can, with sufficient confidence, date some of the transactions. They occurred between October 19–23, 2017. Dates noted in that file are for transactions greater than 100,000 XRB.

Specifically, this transaction for a withdrawal of 1,000,000 XRB occurred on October 23, 2017, at 1:22 AM, GMT, according to BitGrail’s database time-stamp data. You can see from the Explorer data that there were significant funds withdrawn before and after this transaction to account ‘bbjn’.

Firano categorized this transaction on Twitter and in our telegram chat as “unauthorized:”

A recent example of following the money, this wallet sends 350,000 XRB into an account which sends 499,999 XRB to another account which then does 6 transactions, sending the funds into BitGrail or Mercatox, in an alternating pattern.

In conclusion, using the time-stamps from the BitGrail database, a portion of the withdrawals from the account ending in ‘bbjn’, cited by Firano as “unauthorized,” can be dated to October 19–23, 2017, with many of the funds making their way back to BitGrail or Mercatox.

It is still unclear what other wallet addresses may have participated in this and we are awaiting more information from BitGrail.

We would like to sincerely thank everyone who has helped resurface old articles and data points that may be relevant to the alleged hacking. The details have been passed directly to law enforcement and we will continue to investigate this situation.

The Nano Core Team