Part 3 – Much more on why clues suggest Peter Todd is probably Satoshi

TLDR: The evidence presented in this series is good enough to support the argument that PeterTodd is Satoshi, but the degree of that support is uncertain. There are a number of unusual factors introduced here or taken from prior publications that likely can be explained only by this simple theory. The last three pictures, a MircoStory if you will, possibly tell the story that Peter Todd may or may not be allowed to communicate himself. This article may have located the hacker of Satoshi’s P2P Foundation account.

This is Part 3 of a series of posts in which I present some open source material that suggests Peter Todd is Satoshi Nakamoto or one of several persons (including family) who created Bitcoin under a shared pseudoniem. To get caught up, review the following links, some of which are newly presented here:

  1. Part 1
  2. Part 2
  3. (hmmmmm)
  4. (see retweets + likes)
  5. (see retweets + likes)
  6. (see also here)


  1. (see also RBF Drama)

* * *

So far, I’ve presented publicly available information as evidence that can be used to make the case that Peter Todd is Satoshi Nakamoto or part of a group operating under that name.  In Parts 1 and 2, I explicitly stated that the evidence presented in this series of posts is circumstantial and that one should not “bet the farm on this argument being true.” I am reiterating that disclaimer again here. While the evidence is at best indirect, it lends itself to a few easy to digest inferences that round out the theory that Peter Todd is Satoshi Nakamoto.

I want to use this post to summarize the evidence presented so far and to explain how I came to the conclusion that Peter Todd is Satoshi. Before I do that, I’ll explain my perspective, method and Motive for these posts.

* * *

First Suspicions – Blocksize Debate Gets Serious

I have suspected Peter Todd as a possible Satoshi since late Spring 2015/early Summer 2015. I was not confident enough to post anything about until recently, and I still have a handful of other Satoshi prospects (some of which are among the usual suspects and some that are totally unheard of), but Peter Todd (PT) strikes me as the best guess among all of them moment.

In the Spring of 2015, Gavin Andresen (“Gavin”) began a series of posts designed to get people talking about the blocksize limit and its role in scaling the protocol. Around then, and even before, I started noticing PT  and Gavin publicly colliding on the forums and in social media. See also [1], [2], [3].  For example, PT publicly supported reviewing whether Gavin should continue to have commit access on GitHub and keep his title of Chief Scientist with the Bitcoin Foundation. At the time, I could not understand the hostility from PT, especially since it was directed toward the person who others say Satoshi entrusted the network with before he disappeared.

Until I started uncovering a few rocks and kicking a few tires, I did not know much about PT (I still don’t), but I was very aware of his presence in the community. I had noticed how well his professional opinion seems to be respected and sought after by industry participants. [4] It makes sense: he writes code, presents at conferences, attracts a fair amount of attention by industry media outlets, visits with regulators (see also here), and gets carted around in private jets.



However, being an expert developer was not and is not a good enough reason alone to explain why PT is more popular than any other expert developers given some of the public displays or why anyone should care whether he sells his bitcoins.  I am not alone – It is not unusual to see forum posts or Reddit threads inquiring about Mr. Todd’s origins and/or relevance in the community. Once I started to notice a trend, I began following his Twitter account and read through his post history at Bitcointalk closely. In August on 2015, I saw this post by Jackson Palmer and took another look.  I found lots of unique folks with connections to the Paypal Mafia and Canada.  I kept finding that a person named Ryan Lackey, who along with Peter Todd, routinely appeared as a connection in almost every social media background I looked at – their work seems to share some similarities (compare Sealand/HavenCo. with Project Portage). In reality, Lackey might be Satoshi (and possibly a stronger candidate now) or part of a crew constituting Satoshi (perhaps with the usual suspects, like Back, Finney, possibly Szabo and Dai (Dai’s tone in writings is more like Satoshi’s than either Back, Finney, or Szabo). What follows is how I’ve connected some dots to date. This is a working draft and will be updated and edited as necessary.

* * *


I have been a Bitcoin enthusiast since 2013. I read all the main forums, mailing lists, IRC channels, etc. I follow Bitcoin news outlets as well as the mainstream media. I am very aware of the most pressing issues of the day that impact the bitcoin ecosystem. This blog and my various social media accounts (twitter, bitcointalk, etc.) demonstrate my curiosity about and interest in Bitcoin and cryptocurrency generally. I mention this background only to be clear about my presence in the community and that I’m not a professional journalist.

That being said, it is important to highlight methodology so that other researchers can retrace my steps and build on the work presented here.

First, I have a legal background and therefore my approach will be as if I were preparing to present legal argument to a jury in a civil case. That presentation will present a theory supported with evidence.  The evidence here is mostly circumstantial and has varying degrees of directness and indirectness (I assume direct evidence typically produces a settlement, confession or admission well before trial). Admittedly, I have no great way to authenticate evidence. 

Second, the burden of proof for this article is best stated as a question: based on the information presented, is the claim that PT is Satoshi (or group) more likely to be true than not true (i.e., preponderance of evidence)? 

Third, and to reiterate, this article has limitations and weaknesses.  I am not a journalist and do not have the benefit of time or funding to research this matter. Therefore, the claims in the article are likely not as developed or supported as they might be in court or by investigative journalists at Newsweek or The New Yorker (not sure about Wired and Gizmodo). Likewise, this article is not scientific (you’ll find not attempts at anything like an linguistic analysis here). 

I have conducted no interviews, hacked no accounts, or participated with others in the search for Satoshi. The evidence presented was “collected [solely] from publicly available sources.” I’m not a spook, cowboy, agent, officer, or anything like that, but I’d probably be o.k. at it. Cf. (word search “intelligence”).

Without question, this article does not prove the identity of Satoshi conclusively, but it does contribute to that the current body of research about him. It is worth noting that the PGP keys others will require before believing any claims about Satoshi’s identity are not conclusive either due to the possibility of hacking, lying, social engineering, etc. Therefore, unless there is a witness with direct knowledge of Satoshi’s identity or an admission, nobody will be able to present anything more than a theory built on circumstantial evidence.

Fourth, despite the short-comings, this article does have the benefit of being able to build on prior works and to connect a number of variables in new ways. Additionally, its written by someone that actively watches and participates in various crypto-currency communities.

Fifth  the process used simply focused on connecting dots by searching for as many unique variable combinations as possible and working reverse chronological order on any interest possibilities.  Like with the Moolah research on this site (Trail of Doges 1 & 2), I used a combination of both genealogical and archaeological research.  I also limited the scope of many searches to the period between Jan 2000 and Dec 2008.  

Sixth, I used several standards to evaluate whether PT is a better Satoshi than any other.  The standards I used to evaluate candidates include some broad parameters and the use of what is known as the “eye test” in college sports. It clearly has limitations and is subject to bias.

For this investigation, for any person to be considered Satoshi, they must:

  1. Possess certain technical knowledge relevant to writing the Bitcoin protocol.
  2. The candidate should demonstrate some time commitment/experience with working on the types of problems solved by Bitcoin.
  3. The candidate’s background must explain certain factors unique to Satoshi such as the use of English (more on varieties of English later), knowledge of economics and programming.

Factors that are helpful, but not required, include:

  1. Use of both British and American English writing conventions. Not required since writing styles can be faked, modified and automated; likewise dialects can be practiced and pre-programmed. 
  2. Expert-level Knowledge of Cryptography.
  3. Knowledge of and a relationship with the usual suspects such as Szabo, Finney, Back, Dai, etc. 
  4. Is already a known Satoshi candidate.
  5. Tone in writings and overall disposition.
  6. PGP Keys, etc. – As stated previously, this/these would be conclusive only if a person whose identify has been verified is witnessed signing with private keys. Further, it is my understanding Satoshi rarely used them.

* * *

Theory of the Case

Based on the evidence presented, Peter Todd is probably Satoshi or worked with one more people acting pseudonymously as Satoshi.

1. How Many Peters am I Holding Up?

In response to Part 2, PT stated he was born on March 14, 1985. I can’t say that “Peter Todd” strikes me as an uncommon name, and having the date alone by PT’s own admission is not necessarily sufficient for identifying a particular PT. His facebook account suggests that his middle name starts with a K.  In confirming his email exchanges with Hal Finney and Adam Back, PT implies that he has studied electronic money for a long time, in part, by synthesizing what he learned from Finney and Back with the economic principals garnered from his father who is a professional economist.


Several statements by PT can be cross-checked against public records. First, Peter Todd’s birthday does seem to be March 14, 1985. I was able cross-check the Reddit post with a birth announcement contained in the University of British Columbia Alumni magazine from 1985 (page 22).


You’ll notice that PT’s parents’ names are Eve and Kevin (I have not been able find middle names for either – in particular Kevin.). You will also notice that PT’s middle name is “Kevin” and that he was born in Vancouver, British Columbia on March 14, 1985 as represented on Reddit.  I am reasonably confident this is Bitcoin’s PT and his family as the parent’s names cross-check against an obituary for PT’s paternal grandmother.

Peachland is an important geographical point to note as Todd’s resume references working for at least one summer at a family business in Peachland known as Todd’s Tent Town, which is the former name of the business his uncle Graham now manages. 




 Peachland is located in the Okanagan Valley, which has historical gold rush roots – don’t be surprised if that name contribued to naming Satoshi (e.g., a cryptoquip or anagram, etc).

From his resume, it appears PT has an interest in model trains and can build them too – he purchased a Sherline lathe and was once hired to build a model train Christmas display for The Aragon Group (a gambling-related business). You’ll recall that Dorian Nakamoto liked model trains and could build them as well .  Dorian does not live far from the Sherline factory, fwiw.  Dorian also liked steam engines from Pennsylvania, probably even the Leviathan #63 as it was a precursor to the #68 that he built (located in New Freedom, PA). Cf. Interestingly enough, Dorian is a brand of tool used in the model-train world

I’ve mentioned PT’s dad, Kevin (KT).  He’s an economist that likely specializes in natural resources and is or was at the top of the Northwest Territories’ economic policy and analysis department

He also maintains a connection with folks looking to immigrate from China. Compare with PT’s knowledge and connections. (there are many examples)

ktfb1Aside from being a fan of Japanese food, he must also be a rail road fan to want to visit Virginia City, NV – practically an abandoned gold mining town that would have been connected to northern California and in which the #63 would have passed through on the Central Pacific Railroad.

The Central Pacific Railroad (CPR) was the U.S.’s first transcontinental railroad.  From northern California, British Columbia (and the Canadian Pacific Railroad (also CPR)) would have been linked by rail. The Canadian Pacific Rail Road was Canada’s first transcontinental railroad and is known, in part, for its “Silk Trains” which made a priority of transporting raw imported silk from China between the 1890s and 1933 (the monetary of incentive of silk trains referenced in this article obviously should not be overlooked). [note: CPRs vs DPR . . .[1] [2] – bit of a stretch, but still ]

I will save the Atlas Shrugged discussion for later. 

Are your wheels spinning yet?  It is about to get weirder.

I mentioned who I think Peter Todd’s dad is most likely given a few parameters.  I say “likely” because I do not really know with out more. . .  and because – what if Kevin Todd is really Peter Kevin Todd, Sr., etc.?  For example, I found another Canadian named Peter Kevin Todd (PKT), who sometimes goes by Peter and sometimes by Kevin, who is an expat living in Spain and used to live in Alberta province (Canada).  


PKT has a degree in economics from Newcastle (U.K.) and has been self-employed working in e-commerce from home since January 2009 (wink).  He’s older – almost 70 – and is involved in the electronic cigarette business specifically. Now, I can’t explain this person’s identity.  Not much of anything is easily findable about PKT on the internet other than social media (links below). He’s currently trying to freelance as a proofreader and claims to have well versed in both UK and North American-style english.

I did find evidence of a recent adverse tax action in the UK for a Nicholas Peter Todd, who is from the exact same area of Spain as PKT, related to smuggling tobacco into Canada and the UK (not quite e-cigs, but still . . . and, yes, the ages are off too). Most, but not all, of the pictures of PKT seem to be very far off from depicting either PT or KT, but they could be pictures of somebody else, modified, published for the purposes of disinformation (I think could be the case), etc..  However, perhaps Satoshi loves speedos (and John Galt). 


It is unclear how relevant or how much weight should be given to the PKT material given the likeness differences in the pictures.  Pictures discrepancies extend to PT himself (and since there are many possible explanations). We know how PT looks today, but I can’t say he looks close to what he looked like in the early 2000s:


PT looks more like a strategy guy from Blockstream 

Note how similar that name is to John Dillion and recall Jackson Palmer’s post.  Note the plane peter was flying in the pic above (Hint: start with the person sitting behind PT in the plane picture).

2. Abilities; Buddies

As stated in Part 2, Peter Todd has both the capability and experience to have created Bitcoin.

He was writing on mailing lists (freenet-dev, cryptography, piclist) with Finney, Back, and Dei since at least 2000 with some frequency.  For example, Feb 2000:freenetdevHe was invited to join the Blue Sky list by Hal Finney, which is what I linked to previously in Part 2.


As mentioned above and in Part 1, PT has experience developing software based on clocks, time-stamping, and ledgers. He wrote about electronic money years before Bitcoin. Project Portage is very interesting, especially in comparison with Sealand.

PT appears to be a serious model train fan, hello Dorian. See also Here.

3. PT has acted like an expert in charge since his very first post on Bitcointalk.

Mr. Todd’s first substantive post on Bitcointalk was on Dec 10, 210 responding to a post made by Sastoshi in a thread titled “Fees in BitDNS confusion.”  The thread is about giving users the ability to control the amount of fees that go into a transaction.  Around this time, transaction fees were hot discussion in the bitcoin world and this thread was a variation on that theme vis-a-via the BitDNS. At that time Bitcoin 0.3.18 had just been released a few days prior and Bitcoin 0.3.19 (introducing some new DoS controls) was released with his final post.  From this first post, PT has been an authoritative figure in Bitcoin directly deliberating with the most senior developers.

Unlike what others have said about Satoshi’s limitations, I think he was well aware of a certain type of transaction reversibility but was unable to say anything before a fix was in sight.  I think PT is now racing to fix certain gaps he perceives as more urgent before transaction volume really takes off, even if that means publicly double-spending against Coinbase.

4. Unique Interests

As of 2000, PT had written game software to model trading and resource extraction scenarios from a corporate raider’s standpoint (compare with Finney’s background):

corp raiders and software

He knows about nuclear power. In essence, PT sets his own agenda.  His positions tend to be unique and not aligned perfectly with any particular group.  For example, in the blocksize debate, he has never said hard-forking should not be done ever or that blocksize limit should not change.  In fact, he has suggested, IIRC, the blocksize limit could be increased or decreased.

5. Strange Micros – “Satoshi Nakamoto Brought Me Here” 

As you know, Satoshi’s P2P Foundation account was hacked.  This was not known until September 2014. On March 6, 2014 Newsweek published their dox on Dorian, model trains and all.

Looking through the P2P Foundation page, note:

  1. Satoshi understood economics, including resource extraction. Read his Bitcoin announcement and his subsequent comments here – he’s clearly an economist.
  2. Shortly after the Newsweek article, a person who goes by the name MicroGuy gets befriended by Satoshi. Weird. At times, he claims to be family (SDR).


Just last week, before I had resumed and completed my research, I saw this:


Most likely a coincidence, but you never know.  Clearly, I’m not the only person who thinks PT may be Satoshi. Based on the preceding picture, the founder of Bitcoin’s replacementGoldCoin, would agree with me (See also @Railboss ). Why, though? This and This? Or, how about this from September 6, 2014, which is interesting when you consider that just two days later on September 8, 2014 these posts appeared on Satoshi’s P2P Foundation Wall:(Moolah and Mintpal fireworks were about start around this too, as if things couldn’t get any weirder (Refresher + Moolah Resources + Posts)):

View post on

* * *

Concluding Thoughts

So far, I’ve covered a lot of circumstantial evidence.  The value my approach adds is that it puts together a story that is not so random and out of the blue (but possibly BlueSky or BlueIraq – pun intended) as others. For instance:

  1. It explains odd factors like trains. It shows PT was involved with primary Satoshi candidates (before PT was one).
  2. It links PT, Satoshi, Blockstream and the Blocksize debate.
  3. It presents part of the background of a previously understood authority figure in the bitcoin community.
  4. It eliminates any legend-like backstory (other than clearly being gifted, and known to be since an early age).
  5. Its shows motive for what appears to be arrogant or difficult behavior (who would let their project be changed permission without a fight) and his need to put RBF in place.

If I am correct about PT’s involvement as, with, or part of Satoshi, then their are some unique conclusions and questions that follow

  1. PT is possibly very connected. Including to governments – perhaps he has knowledge about the Silkroad case (either as an agent or an adversary to governments). Perhaps PT being pressured by a hacker and can’t talk.*
  2. If KT is involved, then there is definitely a government connection (but who knows which side).
  3. If there is government connection to PT, either as an agent or through a relationship, then its not a stretch to wonder if Blockstream has one.
  4. It explains, in part, PT’s knowledge about and connections to China and potential Chinese contacts.
  5. It presents a possible understanding of an end goal for Bitcoin’s use cases – see Sealand/HavenCo.
  6. GoldCoin? Why is Satoshi making friends on P2P in March 2014?
  7. Truth is indeed stranger than fiction.

I’ll leave it to the jury to decide.

*I think its possible the Newsweek article could have tipped off an adversary about Satoshi’s interest in trains.  I could easily imagine someone trying to retrace Goodman’s footsteps RE: model trains in hopes of finding Satoshi (PT), who may have known Dorian from train forums (or maybe Dorian is Satoshi or part of a Satoshi group – and what is with that brand of Dorian tools (weird!)).  From there, but also separately, the adversary could have been waiting for Silk Road information from the Courts to further triangulate Satoshi’s identity.  Many people probably think that DPR must have crossed paths with Satoshi. Once the DOJ made DPR’s records available, it was only a matter of time until Satoshi was located.



Did some more kicking of the tires on the model train issue.

Look who started this sub-reddit:
He owns this domain too:

Kraken was down yesterday (interesting timing).  Didn’t they just acquire two Canadian exchanges? Oh, a CloudFlare issue you  say, see here:  AND here: (recognize the name from Part 3?).

Here’s a thread about;u=35541;sa=showPosts;start=0 (and:

And, guess what OGRR stands for? O-gauge railroading.  Here’s a reference to the here:  In that thread, you’ll find another user  referencing the #63 (Leviathan) making a trip to Toronto and also some other cryptic talk all over that forum, especially by a guy w/ the name JD – kinda like the JD referenced in Part 3, except here his name is JOHNNY DEGGESTY.  He even started talking about bitcoin after the Newsweek article came out.  He seems wise.

See also (just for kicks):

In searching for train forums, i found this one random site that goes by the handle “BTC” –

Its about a civil war battle between the rebels and the union (There is at least one post about a rebel alliance on Bitcointalk).  Note the name of the home page – The Siege of Petersburg Online.

The site is owned by a guy named Brett Schulte – (Not sure if same guy: –> –> –> –> possible connection to Fraser Institute?  Not sure but the name and underly ideology is the similar to – a Fraser-owned site.  BraveTheWorld and Fraser both have locations in Toronto, where Satoshi (PT) lives.

Have no idea where this trail goes. There are many parallels to Atlas Shrugged, which is cool – its one my of my all-time favorites.

—Additional Update —

  1. Page 11
  2. “NASCAR”
  3. “Moolah”
  4. Nice dogecoin shirt:

Lee, Leo, Leigh, Li, Lion, Lions, Bitcoin

A few days back I posted this on

WARNING – a little off topic, but tangentially related. 

Can someone tell me, still very much a tech noob, what the significance is of the term “lion” or names containing “Lee” or “Leo” (including homophones like “Leigh” or parts of names (“Cleo,” as a made up example)).  In my sleuthing, I’m seeing an uncanny amount of usernames w/ Lee, Leo, etc. in the twitter followers (and other social media) of some of the most unscrupulous appearing individuals in digital currency. 

IMHO, this is not a coincidence (maybe it is, maybe its a figment of my imagination), but I haven’t been interested tech/computers in a substantial way but for a year and half or so and lack some of the foundational knowledge to know what’s going on. 

From the hacker dictionary: 

lion food /n./

[IBM] Middle management or HQ staff (or, by extension, administrative drones in general). From an old joke about two lions who, escaping from the zoo, split up to increase their chances but agree to meet after 2 months. When they finally meet, one is skinny and the other overweight. The thin one says: “How did you manage? I ate a human just once and they turned out a small army to chase me — guns, nets, it was terrible. Since then I’ve been reduced to eating mice, insects, even grass.” The fat one replies: “Well, I hid near an IBM office and ate a manager a day. And nobody even noticed!”

Very interested to read what others think and whether there is something to this. 

EDIT – Very aware of seeing patterns where none may exist . . . .  I just don’t see the Lee/Lion thing in other areas, just tech/digital currency/[possible] scammers. 

I also posted a tongue-in-cheek (but still serious) thread on Reddit about a week and half ago about ISIS’ use of internet memes to recruit young girls. Possible evidence of this playing out has been in the news recently with reports about three young girls leaving the UK for Syria to join up in ISIS.

Where am I going with this?

Recently, there have been several news reports about ISIS using bitcoin for fundraising and money transmission purposes. We learned a few days ago that Jihadi John (of ISIS ilk) is a well-to-do young Londoner with a computer science degree.  From his picture, he looks like he could be any young, modern individual and not a fanatical, ostrich-mimicking bozo that destroys historical artifacts in Mosul that date back to the time of Abraham.

On February 6, 2015, a man from Utica, NY was arrested in Indiana for suspected ties to ISIS. The gentleman, like John in the previous paragraph, appears to look like he could be anybody.  His arrest came after he and few others had  been watched for two years by law enforcement. During that period, and though September 2014, Mr. Rosic and others, both males and females, allegedly sent funds and supplies to third parties with the intent of supporting ISIS and its affiliates. The amounts were not exactly large either: $300 here, $1500 there, ete. – more or less the cost of a bitcoin depending on the date.

The Justice Department has indicted the gentleman and said indictment was made available today. Of note from the indictment are these allegations:


FB LION 1point2


Admittedly, this post appears a little paranoid and spastic.  However, I’ve now found some confirmation of a communication strategy I believe I see from time to time in the digital currency space and not other spaces (i.e., alias, references to Lions, etc.).  Incidentally, Lee, Leo, Leigh, Li – some of which share the same pronunciation – are used in literature and elsewhere to depict lions, etc. (Leo the Lion, for example). Some of the young women indicted depict themselves in anime-style drawings on Facebook (Jasminka Ramic) or other wise enjoy anime and like goofy pictures with cats – not all that uncommon from types that frequent the message boards, forums, and social media zones enjoyed by digital currency enthusiasts.

To be clear, I am not saying that what I’m seeing with regards to user names, lions, etc. in the digital currency space is ISIS or other terrorist group – I’m mainly discussing possible communication and chatter between some group of people – could be silly, harmless computer geeks for all I know.  Additionally, its important to note that today’s indictment potentially produces nothing more than more confirmation bias for my thinking about certain variables in the digital currency space.

Side note: it is interesting, however, PayPal and Western Union were specifically discussed whereas the “other means” are not.

The broader point, and why I’m sharing now, is to reiterate a need for internet users, especially bitcoiners and the like, to embrace due diligence, questioning, and critical thinking as part of their participation in the ecosystem.  Be observant in the digital currency social circles, in particular when using social media.  If you see something, say something. Report it to law enforcement.

 As it happens, this article is a good segue for revealing that WatchDoge has acquired the domain  You might recall, up until the middle of last spring, Ryan Kennedy (which may not even be his real name, more on that later) used the domain as the face of his business, MooPay Ltd.

Update on Kennedy’s arrest – Tweets w/ Syscoin

[Typos ahead]

Updates from Syscoin

Dan (Syscoin) and I discussed the status of Syscoin’s insolvency case with MooPay LTD this evening on Twitter. I asked a number of specific questions about their case and a fair amount were answered. Syscoin was able to reveal some specific info that added credibility to their representations about the status of their insolvency case against MooPay Ltd., which is not to be confused with the criminal case against Kennedy and Hopkins. Some of those details include:

1. That Syscoin published their article two months to the day from the Publication of the Winding Up Order against Moolah

winding up order


2. No first creditor’s meeting has been set yet (they are between steps 7 and 8 on this chart, counting down from the top).

I did not learn much of anything about the status of the criminal case. Until I can summarize and digest further, read and evaluate the discussion for yourself on Twitter. Start with Dan’s tweet here. The tweet will take you to his longer summary (not actually 5 pages long) on CryptoCoins News.

Additional Questions

Despite Syscoin’s revelations tonight about the insolvency case, and as noted above, there are still questions questions about the status of the criminal case, CoinFire’s article, and the whereabouts of MintPal/Moolah customer funds.


Regarding CoinFire, and as you might recall, CoinFire’s article gave the impression that Kennedy had been arrested recently – possibly even yesterday, the day their article was published. In contrast, Syscoin’s blog entry didn’t imply anything about  “when” Kennedy was arrested because it was silent on the issue. Twitter discussions with Ferdous yesterday revealed the arrest was actually back in December and that Kennedy and Hopkins are out on bail currently.

Sidenote: I attempted to cross-check Syscoin’s announcement of Kennedy and Hopkins’ arrest by asking Bryce Weiner, whom I believe served as a blockchain expert witness in Syscoin’s insolvency case against MooPay, whether it was credible (see “Experience” in BW’s Linkedin profile). He indicated that it was credible (for whatever this cross-check is worth).


Looking back on the CoinFire article 36 hrs later, it still seems pretty out of character given their overt attempts to distinguish themselves as truth tellers recently in their coverage of GAW and Paycoin. What is the title of the authentic document they saw? Where did it come from? Who was the “contributor” that got access to it? Why’d they leave out the date of the arrest?


Yesterday I indicated that Syscoin and Ferdous lacked credibility and that CoinFIre had some stored up. Today, Syscoin and Ferdous moved up a few ticks in my book while CoinFire moved down.

Customer Funds

Regarding customer funds, I’m still curious about the Carlisho2 funds. You might recall Moolah had a fundraiser for the Dogecoinball artist alleged to have committed suicide (no proof of this, just press releases). Moolah donated almost 50 bitcoins, a bunch of litecoins, and millions of dogecoin to the fundraiser. This past November, I traced those donations as originating form the collapsed MintPal exchange.

The question, then, this this: if MooPay was enjoined from moving any assets during the insolvency proceeding, how was he able to release them to Dogecoiners who ultimately released them to the Mind Charity? Those funds needed to be examined to determine whether they belonged to MintPal/Moolah Customers. A court might of have allowed the release, but I’m unclear on these details at the moment.

Where there is CoinSmoke, there might be CoinFire

Anybody consider the fact that the story here is that Coinfire made a mistake in reporting Ryan Kennedy had been arrested?

To recap yesterday’s events: Syscoin reported that Ryan Kennedy and Chelsea Hopkins of Moolah ilk had been arrested. CoinFire immediately published an article about the arrests, providing a long block quote from Ferdous S.  In case you don’t recall, Ferdous is a former owner of MintPal (maybe even current owner, although the Company House records still list Chelsea Hopkins as the sole Director of the Company).  In reality, and after a day of questioning people about the alleged facts in CoinFire’s article, Ferdous admitted that the arrest, if there was one, happened around Christmas 2014, and not recently.

CoinFire’s failure to report when the arrest happened is unusually sloppy given CoinFire’s Mike Johnson recently touting the publication’s strict editorial standards.  Also unusual were the vague references to a “document” evidencing the arrest, the convoluted chain of custody of said document, the non-disinterested sources confirming the story, and a nameless “contributor.”  Frankly, the story did not read did like a typical Coinfire story: pretty well thought out, inclusion of a step-by-step break down of how they know what they know, etc.

You might recall that Coinfire’s accounts have been hacked recently following their reporting about GAW facing various legal land mines (ahem…motive).

What? Fake/planted story?  Surely not . . .  But what about Syscoin’s blog and Ferd’s “confirmation” of this story?

Respectfully, Syscoin and Ferdous lack credibility – they believed Moolah the first time when there were obvious signs of trouble (not to mention legal baggage associated with their own initial coin offering – would they really want to create a record of this in court?). Another possibility is that Syscoin and Ferdous collaborated with Moolah to invent a fake lawsuit to exit the chaos from Moolah and Mintpal’s collapse.  It is notable that Syscoin and Ferdous are adverse parties to one another in the moo bankruptcy and civil matter, yet supposedly have the same attorney (ahem, holy conflict of interest). Remember, Ferdous fundraised a bunch of bitcoins to go after Moolah to so to be able to salvage MintPal. They might even need some cash right now (more motive).


Backs can be scratched.

Moreover, Syscoin and Ferdous probably would like questions about their Moo involvement to stop.  This story is convenient cover.

Have any crypto news outfits (if there are any) reported on the fact that the High Court has already ordered (December 23rd) a dissolution order in Moo’s Bankruptcy case and the implications thereof?

How about this: it sounds pretty far fetched that Ferd or Syscoin would be under confidentially orders to not speak of Kennedy’s arrest in December. Criminal proceedings are separate from civil matters and typically a matter of public record absent sex crimes or crimes against children. Now, confidentially can be built into a settlement agreement between private parties, which might be why there’s no news. Settlement would be in Syscoin and Ferd’s interest given their legal baggage related to unregistered security sales and operating an unregistered exchange (i.e., then they don’t have to admit to these behaviors in court and on the record). It also explains why they would go after Kennedy under involuntary bankruptcy rather than theft, embezzlement, fraud, etc.

Another possibility is that this was an effort to smoke out Kennedy is who clearly too smart for the people he allegedly ripped off.

Finally, are we sure that story was actually written by real CoinFire folks? Otherwise, we’re simply left to believe that CoinFire goofed and/or misled its readers. For me, CoinFire has at least earned the benefit of the doubt.


I’ll be putting together some resources for those interested in GAW, Paybase, Paycoin shortly.

In the mean time, starting with suchmoon’s thread at BitcoinTalk is not a bad idea.

For today, there are two things to know:

  1. Paybase looks to be on the ropes. There’s been another missed deadline, this time of a simple sign-up program for the paycoin BuyBack program.  The BuyBack program is designed to reward/reimburse paycoin holders expecting a minimum $20 price when they purchased their coins.
  2. Paybase/Paycoin’s demise has been foreshadowed by @gawceo. Last night, @gawceo attempted to excuse bad behavior and poor performance by throwing his investors under the bus by implying that things would have gone better with Paybase and Paycoin had he been in total control. He then expressed a desire to make things right, in part, by letting his reader think he was contemplating starting over with a new coin and/or “base” for paycoin.



This gallery contains 45 photos.

This afternoon I was provided with a link to a file full of documents related to Ryan Kennedy. Some have been seen before, some have not.  I make no representations about the accuracy or relevancy of any of these files. … Continue reading

Winding it Up

Had two people forward me this Notice to Wind Up [Moopay Ltd] yesterday:


Notice of the Petition was published in The Gazette on November 6, 2014. From the posting, it looks like the Syscoin folks filed their Petition on October 22, 2014 and have hearing about it on December 8, 2014.

Petitions to Wind up a Company can be used to start the insolvency process by a creditor of the Company. In other words, a person can file one of these petitions if a company owes them money and cannot pay their debts. If a Petition is granted, then a Court will order that the assets of a company be sold to pay its debts. The process is managed by a court appointed receiver.

If you’re owed money by MooPay, Ltd., then you need to file creditor’s a claim HERE.

You’ll recall that AG stated that MooPay was bankrupt on October 14, 2014.


To voluntarily enter insolvency proceedings, a company must pass a winding up resolution  (Insolvency Act, Sec. 84), publish notice in The Gazette (Insolvency Act, Sec. 85), and appoint a liquidator. However, when a debtor fails to pay a creditor, the creditor can start winding up proceedings against the debtor by filing a Petition to Wind up a Company with the court as Syscoin did. Whether its a voluntary or involuntary petition, notice is published in The Gazette.





Trail of Doges – v2.0


A. Review

Trail of Doges v1.0 charted the historical movement of dogecoin from a known Moolah wallet from April 20, 2014 to the time of posting.  Trail of Doges 2.0 will adopt the same basic concept by tracing the historical movement of funds associated with a wallet in Moolah’s control.  Unlike v1.0, however, v2.0 will work backwards in time from one wallet in Moolah’s current control to another that is believed to have been in his control at a certain point in time.

B. New Information: Summary of Objective and Outcome

The goals of Trail Doges v2.0 will be similar to v1.0: build a baseline information by establishing a starting point on the BTC blockchain and documenting all the transactions between it and the ending point. This post will also build on the method presented last time.

Trail of Doges v1.0 established that the 10M dogecoin given to the prize pool of the e-Sports competition came from a customer wallet affiliated with Moolah’s Prelude Exchange.

Version 2.0 will show that 99.83% of the bitcoin donated to the Remember Carlos mental health fundraiser came from a wallet believed to be a customer wallet on the MintPal Exchange (41.77BTC out of 41.84 BTC donated).


A. Review

Trail of Doges v1.0 laid out the following method for tracing digital currency transactions of a particular person:

A. Identifying the Trail

1. Identify a wallet; pick a starting point on the block chain.

Identify an M wallet that is identified as an M wallet by AG. Identification must be from a document, post, media or other source widely understood as being drafted, produced or otherwise operated by AG.

2. Identify as the “starting point” (SP) the earliest point at which said wallet was identified by AG as an M wallet (starting point).

    • Identify debits subsequent to SP.
    • Capture all recipient wallet addresses and the dates on which said transactions occurred.

3. Identify inputs to the M wallet or converging/merging of multiple wallets with the M wallet.

4. Determine whether there is a remaining/current balance.

B. Analytic foundations

1. Note as a significant wallet (SW) any payee wallets appearing more than once as recipients in a transaction.

    • Summarize total amount paid to each SW.

2. Mark as a notable wallet (NW) any payee wallets that correspond with or match notable events and individuals in the Dogecoin and digital currency communities.

    • Summarize total amount paid to each NW.

 C. Possible Limitations

1. Lack of identifying information beyond public keys.

2. Use of change addresses.

3. Overly simplistic.  Blockchain analysis, computer programming/coding, and the like may be beyond my skill set.  This post should be seen as very basic and as quite possibly having errors.

4. Confirmation bias.

In short, the method develops a history for the digital currency holdings of a particular person or entity.

 B. Supplemental Concepts and Assumptions

Trail of Doges v1.0 employed a linear chronological analysis. Version 2.0 will employ an reverse chronological analysis.

 1. Two technologies for analyzing historical data on the blockchain

  •  Linear Historical Reasoning (best explanation, based on best facts, follows events chronologically)
  • Archeological Method (reverse chronological).

Historical reasoning works forward in time from a starting point.  It is chronological. Historians construct a story between events, moving forward in time, and explaining events with what he or she believes to be the best or most relevant piece of evidence.

Archaeologies work backwards in time, peeling back layers of information and describing the layered artifacts without judgment about what causes of the different layers. The focus is how data is cultivated and what that data is rather than evaluating or judging it, ideally allowing for observations that may not otherwise have be made.

2. Version 2.0 Adjustments

Even though the chronology, or lack thereof, in v2.0 will be totally different from v1.0, the v1.0 method will be the same except for these three adjustments:

  • The SP will be the present time at the time of posting and not a historical event relative to posting.
  • From the SP, rather than tracing the largest outputs from one wallet to another, we will trace the largest inputs into a series of transactions (and in reverse chronological order).
  • Archaeologists stop digging when they encounter artifacts. We will stop looking backwards in time when we encounter a certain artifact – BTC wallet for the MintPal exchange. Said wallet will be the ending point (EP). The EP, therefore, will be the sole Notable Wallet (NW) in this post.

3. Assumptions

For this post I will assume that the largest input into a transaction represents the change wallet from a spend transaction. In order to build a transaction history, we will, in reverse chronological order, trace the running balance of a wallet believed to be under the control of AG and/or M from one change wallet to the preceding change wallet.


A. Data Points

1. Wallet – For this post, our SP will be the BTC donation wallet for the Mental Health awareness campaigned started by AG.

The wallet was and is believed to be under M and AG’s control.  You will recall that this campaign started in the wake of the alleged suicide of Carlos Rueleas (Carlishio2), who was known for drawing the Dogecoinball cartoons.

AG confirmed that he created the wallet here.

This wallet is interesting for two reasons:

  • There is a second layer of authentication.  Looking at the transaction history of the BTC wallet for the campaign, I noticed that there have been only 5 btc donations. AG confirmed making this personal donation to the fund (“I have started by donating $20,000 to the Bitcoin address. I intend to donate more, but will be using that to match other donations to encourage people.”). AG’s confirmation of the donation is a second level authenticating factor.
  • The timing. Carlishio’s suicide happened on September 6, 2014. It was not announced until Sept 15, 2014.  It was around this time AG started missing MintPal migration deadlines:

Moolah’s blog on Sept 17, 2014


Moolah’s blog on Sept 23, 2014


2. Starting Point.  The SP will be the time of posting and this wallet: 15bBYUto5ucp3jGbvRHMTWkft8QbF5bqD3 (Remember Carlos Campaign BTC Wallet).

3. Ending Point: 1NjBaY8fKg85TfCvP1AoQGUSXjifD5Nw2G (believed to be Mintpal’s BTC wallet).

4. Transaction History. Transactions preceding the SP:


  • GR = Input;
  • GE 1 = Send;
  • GE 2 = Change Wallet

Some Analytics

1. Significant Wallets (SW)

17ztgkcaZbs4VFrAswMQGvnNDEtn47rsmu – Received over 1100 BTC, in 11 transactions, between Aug 26 and Sept 15.

1yGe5j4xh7fUHdLBcYtLCUj8Rmor4vJzR –  Received 2 payments of 5 BTC, one on Sept 8 and on Sept 13.

2. Notable Wallets (NW)

1NjBaY8fKg85TfCvP1AoQGUSXjifD5Nw2G – the Campaign wallet received a contribution directly form the change wallet of the MintPal Exchange.


1. There is a direct connetion between 99.83% of the Bitcoin donated to the Carlisho2 Mental Health campaign came from MintPal’s BTC wallet (41.77 BTC of 41.84 BTC donated).

2. AG said the 41.77 BTC donation was a personal donation.  There is no way to verify that claim at this time. Therefore, Version 2.0 does not state who owned the 41.77 BTC donated to the Remember Carlos donation wallet.

3. The timing of the Remember Carlos mental health campaign announcement corresponds with when MintPal migration deadlines were being missed. The donated bitcoins were not sent to Mind on Oct 1 as represented on

4. The largest donations of dogecoin and litecoin were comparable in relative size to AG’s bitcoin donation vis-à-vis the total amount donated.


Signature Moves

Four quick observations.

ONE. This is how Ryan Gentle signed his name in 2006.

This is how Ryan Kennedy signed his name in 2009: ryan2009Notice any similarities?  Elongated shape, structure of the R. How do they compare with the signature represented to be Ryan’s on October 28, 2014?

ryan sigNo. Hmmm.

TWO. How about a conspiracy theory?  In the October 28th Order, it is stated that Ryan’s counsel is Francis Hoar.

Syscoin_Oct28CourtHowever, it seems like this information is not supposed to be known. Notice the redactions here: Syscoin14_RKsolicitor1 Syscoin15_RKsolictor2Recall that Ryan has previously represented himself as an attorney. Also, recall Ryan Gentle’s middle name was Francis.

RG Sig

Does that signature look more like a “Ryan” or a “Francis”?

THREE. Syscoin’s attorney doesn’t like to publish his name nor sign it.

Syscoin4_DemandLetter1 Syscoin5_DemandLetter2 Syscoin6_DemandLetter3 Syscoin7_DemandLetter4 Syscoin8_DemandLetter5

Syscoin’s counsel is Richard Howlett, a solo attorney, who appears to have trade named his practice Selachii, LLP.  SOMEONE, ANYONE, please hook Selachii up with some free letter head, puh-leeze.

FOUR. There seems to be some confusion about which judge signed the October 27th injunction order.

Apparently, there was an emergency injunction on October 24, 2014 granted by Judge Hamblen. This injunction was obtained without notice to Ryan, so there had to be another hearing. That hearing was set for October 27, 2014, which Ryan apparently did not attend. Despite not attending, Ryan was allegedly ordered to return bitcoins belonging to Syscoin the next day. However, the next day, October 28, he purportedly moved the court to vacate the injunction order of October 27, which the Court granted. Here is his statement accompanying the motion:

Syscoin10a_RKStatement2 Syscoin10_RKStatement2 Syscoin12_RKstatetement4 It is curious that Ryan says the injunction order on the 27th was obtained without notice from Judge Hamblen, given that Judge Williams in his vacation order never references Hamblen.  In fact, Judge Williams references his own order from the previous day and not Judge Hamblen.


The Consent Order dated October 29, 2014 also does not reference Judge Hamblen (this order was likely jointly drafted by the parties).


Trail of Doges – v1.0

Draft 1.0


Green has misappropriated customer dogecoins held on deposit with, OR Green misled his customers and the dogecoin community when he represented that a certain wallet was Prelude’s and that customer dogecoin balances were stored in a certain manner, in a certain location.


Reliable and meaningful information about Moolah (M), Mintpal (MP), and Alex Green (AG) is sparse. This is unfortunate because M, MP, and AG are alleged to have caused numerous people substantial economic damage and may have committed several crimes in the United States and elsewhere.

This post will attempt to provide reliable and meaningful information about M, MP, and AG by reconstructing, as much as possible, the transaction history of an known dogecoin wallet believed to be used by M. (Prelude Transaction History)

M’s dogecoin holdings are significant given that M had a loyal following within the Dogecoin community. The following was cultivated, in part, because AG and other M personnel were very involved and visible in the community.

Transactions involving known M wallets are worthy of analysis given that such transactions, in addition to being indicative of a monetary relationship generally, are symbolic of legal, moral, and enterprise-level relationships between the owners of said wallets.


It is well known that Alex Green was a controversial character in the Dogecoin community.

Controversy stemmed from a mixture of AG’s personality, business practices, and unusual actions/behavior [collectively, events].

It is also well known that said “events” have been ongoing since at least the time that AG began posting as moolah_ (Reddit & IRC) and @moolah_io (Twitter).

Each “event” has meaning and is a clue to understanding what has happened and what is happening with M, MP, AG.  The relationships between events might be especially insightful to those individuals trying to better understand the past, present, and possible future with regards to M, MP, and AG.

Given, the foregoing background, this post will . . .

  • Help build a foundation for discovering relationships between events. Specifically, this post will identify the transaction history of an M-related wallet so that individual transactions and wallets from said history can be investigated (Prelude Transaction History); and,
  • Briefly analyze a sampling of transactions.


A. Identify Trail of Doges

Begin mapping the inputs and outputs of dogecoins from Dogecoin wallets believed to be AG’s or M’s.

B. Build analytical foundations

Highlight notable & significant transactions from starting point to present time.

C. Develop new leads & identify areas of further study

Identify gaps in data and limits in this post’s scope.


A. Identifying the Trail of Doges

1. Identify a wallet; pick a starting point on the block chain.

Identify an M wallet that is identified as an M wallet by AG. Identification must be from a document, post, media or other source widely understood as being drafted, produced or otherwise operated by AG.

2. Identify as the “starting point” (SP) the earliest point at which said wallet was identified by AG as an M wallet (starting point).

  • Identify debits subsequent to SP.
  • Capture all recipient wallet addresses and the dates on which said transactions occurred.

3. Identify inputs to the M wallet or converging/merging of multiple wallets with the M wallet.

4. Determine whether there is a remaining/current balance.

B. Building analytic foundations

1. Note as a significant wallet (SW) any payee wallets appearing more than once as recipients in a transaction.

  • Summarize total amount paid to each SW.

2. Mark as a notable wallet (NW) any payee wallets that correspond with or match notable events and individuals in the Dogecoin and digital currency communities.

  • Summarize total amount paid to each NW.

C. Possible Limitations

1. Lack of identifying information beyond public keys.

2. Use of change addresses.

3. Overly simplistic.  Blockchain analysis, computer programming/coding, and the like are beyond my skill set.  This post should be seen as very basic and as quite possibly having errors.

4. Confirmation bias.


A. Data Points

1. Wallet – For the purposes of this post, I will use a dogecoin wallet represented by AG as being used to operate Prelude (, M’s first digital currency exchange (SeePrelude Transaction History).

Said wallet was identified by AG as being an M wallet on May 1, 2014. The identification happened on M’s blog, which has been deleted. However, the posting was preserved by Follow the Coin, where M is listed as a contributing author.

In his blog post, AG states the following:

On Prelude (which uses an internal ledger), there is currently 158315247.58584696 DOGE listed as the total sum of all balances. Funds are shifted to cold storage once they hit the 200M mark. This tallies with the amount in the main Prelude wallet. I have sent this exact amount of funds from the Prelude account, to a new address within that account.

Note, the funds are represented as being customer funds as a function of them being exchange balances.

The transaction where AG moves 158315247.58584696 DOGE from one Prelude account to another has the following transaction identification number:

  • TX ID: 8c866dd2deb43a78a9c4ba7d9473ada1bac0b6759bc43d0792f45740b4557bad

It appears that this transaction happened a day before AG’s blog post, on April 30, 2014. I’m unsure of whether this is due to the way time is displayed on my computer or some other reason. Likewise, I’m unsure whether the reason matters to the investigation given that AG represented to the public, in an attempt to earn trust and quell fears, that the wallet identified was under the control of M as a business and that the contents of the same were for the operation of the Prelude exchange specifically (as opposed to merchant accounts, for example). For this post, April 30, 2014 will be considered the day of the transaction.

In said transaction, the sending wallet is identified with the following public key:

In said transaction, the receiving wallet is identified with the following public key:

2. Stating Point – Given the above-identified wallet, the SP for our investigation is April 30, 2014.

3. Transactions subsequent to the SP are view in the Prelude Transaction History.  Said transactions were charted manually using the blockchain explorer at The transactions are current as of November 2, 2014.

B. Some Analytics

1. SWs


  • DEVLJVn2R3WxGpFwKofRLwmmDHnwfT6zeH____(2x – D17,091,019.19)
  • D6nWkVuaevdzpP2mogf8DV4CgRvUs21bVa______(2x – D4,999,999,999.92)
  • DH8HWYfxyBGTaF3Bg8eKWNjwu8CP9UBwLf_____(4x – D5,085,042 total)
  • D7xQuMq9vNzKkjP5VEf6GdhmfT3Z2SkRCL_______(2x – D1,963,766.93)
  • D5ijLsBRJuyeCC6gdnhR7sgXtT487s43a8_________(~23x – <D1 )
  • DPMvTtZwXjLG1jxcZC1Qdye8dBEhZJAcwP_______(~36x – <D50)


  • DHqSibuVV96qeLB9g9Vn6rSVFJVghHi4fh (merges w/ balances from several other wallets). 
  • DNpJQ9dCkZzE7DmcT4qKW244nfbnn3qtYf (merges w/ balances from several other wallets). 

2. NWs


1. AG either lied on May 1, 2014 about how he was holding customer funds and what amount of dogecoin he did in fact hold, OR he spent from the Prelude exchange wallet. Hypothesis possibly confirmed.

2. Assuming the wallet studied herein was in fact the Prelude dogecoin wallet, it appears that Prelude lacked volume.

3. Assuming the wallet studied herein was in fact the Prelude dogecoin wallet, it appears that AG still has access to it.

4. Assuming the wallet studied herein was in fact the Prelude dogecoin wallet, the customer dogecoin deposits on Prelude were never transferred to Mintpal.

5. Possible mixing of coins. The timing, frequency, and amount of deposits to two addresses (D5ijLsBRJuyeCC6gdnhR7sgXtT487s43a8 & DPMvTtZwXjLG1jxcZC1Qdye8dBEhZJAcwP) suggest the possibility of mixing. 

6. Green is sitting on a current dogecoin balance in excess of 70M dogecoin (remember, these were represented to be customer funds). Said wallet is here: DFuc88sKWtYRsLXW2oK1jVVw5oGS6ptdSG.


1. Analysis of wallets inputing funds into DFkxdX554g8QPhF7c2fNPpVtZK9Mp1RTaq. The goal is to learn anything about the Prelude depositors. There were 53 inputs into said wallet, some addresses inputting more than once.

2. Analysis of each recipient wallet since the SP. The goal is to determine who many payments/withdraws were the result of customers withdrawing vs. expenditures by Green.  The results may help clarify the actual purpose of the wallet.

3. Building on numbers 1 and 2 above, studying the expenditures of each payee wallet to determine additional connections to the M, MP, and AG enterprises (i.e., MooFarm 1& 2, Charity Drives, etc.).

4. Comparing each expenditure from the “prelude” wallet with various events, such as the Spring Talladega Race, major tips given out by AG, and other controversies.