Users of online underground bazaar Sheep Marketplace are trying to figure out who got away with $5 million, $40 million, or even $100 million worth of bitcoins from the site — and whether it might be the owners themselves. Yesterday, Reddit user CrazeeFruito posted a message from the front page of Sheep Marketplace, which appeared to have been shut down. 
 
 Sheep is down We are sorry to say, but we were robbed on Saturday 11/21/2013 by vendor EBOOK101. This vendor found bug in system and stole 5400 BTC — your money, our provisions, all was stolen. We were trying to resolve this problem, but we were not successful. We are sorry for your problems and inconvenience, all of current BTC will be ditributed to users, who have filled correct BTC emergency adress [sic]. I would like to thank to all SheepMarketplace moderators by this, who were helping with this problem. I am very sorry for this situation. Thank you all. 
 
 With bitcoins hovering around $1,000 apiece, that meant that "EBOOK101" had effectively stolen over $5 million from users. Bitcoin owners have experienced serious hacking losses before: last year, exchange site BitFloor had 24,000 bitcoins (then worth a mere $250,000 USD) stolen because of a security hole, and a little over 1,000 bitcoins went missing from virtual wallet BIPS last month. But users had serious doubts that an outsider had really found and exploited a bug, especially after what was described as a week of suspicious behavior. In late November, the site SheepMarketScam.com started warning readers that vendors and buyers couldn't withdraw money from Sheep Marketplace. At the same time, it said that market moderators had started offering bulk drug purchases if people would pay first rather than keeping the money in an escrow account. 
 
 "All day, we've been chasing the scoundrel with our stolen bitcoins." 
 
 "They know Sheep is closing and so they are reducing all prices, introducing new products, and making everyone [finalize transactions early] to try and take as much as they can," wrote the author. And the actual theft is thought to be much higher than 5,400 bitcoins. As noted by Tapscape, Andy Greenberg of Forbes, and others, some people have pointed to an address with transactions totaling a little over 39 bitcoins, supposedly the amount in Sheep Marketplace before it shut down, as an indication that the site's owners had absconded with the funds. 
 
 On Reddit, a pair of users have worked to follow a trail of allegedly stolen bitcoins as they're bounced around addresses for laundering. "All day, we've been chasing the scoundrel with our stolen bitcoins through the blockchain," wrote sheeproadreloaded2. The money they're chasing, which is still being moved through accounts, is closer to a total of 96,000 bitcoins, and users hope that knowing where it's gone will help identify the thieves if they try to sell or convert their ill-gotten gains. Overall, though, the whole shutdown is a confusing mess, and it's far from clear even how much has been stolen, regardless of who took it or whether this hunt will help solve the mystery. 
 
 While some hope to track down the people behind the theft, others wonder if the site's owners are starting a new scam. SheepMarketScam.com writes that Sheep Marketplace started linking a service called TorMarket, which the author suspects is run by the same people. TorMarket, however, has disavowed the site and asked its administrators to take down the link. "This is the worst PR we can get right now," its home page reads. For users who moved to Sheep Marketplace from Silk Road after its shutdown by law enforcement, this means another major bitcoin black market is gone, along with their money. ||||| One of the largest heists in bitcoin history is happening right now. 96,000 bitcoins - that’s roughly £60m as of the time of writing - was taken from the accounts of customers, vendors and administrators of the Sheep Marketplace over the weekend. 
 
 Sheep was one of the main sites that came to replace the Silk Road when it closed in October, but it too has now closed as a result of this theft. It’s a little hard to work out exactly what’s happened, but Sheep customers have been piecing it together on reddit’s r/sheepmarketplace. 
 
 Here's what happened: someone (or some group) managed to fake the balances in peoples’ accounts on the site, showing that they had their bitcoins in their wallets when they’d actually been transferred out. Over the course of a week the whole site was drained, until the weekend when the site's administrators realised what was happening and shut everything down. 
 
 Originally it was thought that only 5,200BTC - or £3m - was taken, with a message posted on Sheep's homepage blaming a vendor called "EBOOK101" for finding and exploiting a bug. However, over the weekend it became clear that the amount stolen was much, much larger. 
 
 In a normal robbery that money would be gone by now, but it isn't. Bitcoin is pseudonymous, not anonymous, and bitcoins can’t just disappear. It works because each and every transaction is public and visible to each and every other person using the Bitcoin network, and a person is only as anonymous as their link to their wallet. 
 
 A couple of reddit users realised that the sheer size of the heist makes “tumbling” the coins - the normal method of laundering bitcoins - impossible, as long as they kept on their toes. Someone with bitcoin can send some to a tumbler like bitcoinfog, where it will be split into smaller subdivisions and mixed with other bitcoins from other places, recombining and splitting again several times over until the whole amount eventually comes out the other end, theoretically in such a way that it’s impossible to track. Silk Road’s in-built tumbler successfully foiled the FBI, allegedly. 
 
 However, reddit user TheNodManOut managed to track where the first bunch of transfers out of Sheep went, and from there and silkroadreloaded2 worked out which tumbler that the thief was using. Here’s how silkroadreloaded2 describes what’s happened since (“Tomas” is the alleged owner of Sheep, and one of the suspects for many users): 
 
 All day, we've been chasing the scoundrel with our stolen bitcoins through the blockchain. Around lunchtime (UK), I was chasing him across the roof of a moving train, (metaphorically). I was less than 20 minutes, or 2 blockchain confirmations, behind "Tomas". He was desperately creating new wallet addresses and moving his 49 retirement wallets through them, but having to wait for 3 or 4 confirmations each time before moving them again. Each time I caught up, I "666"ed him - sent 0.00666 bitcoins to mess up his lovely round numbers like 4,000. Then,all of a sudden, decimal places started appearing, and fractions of bitcoins were jumping from wallet to wallet like grasshoppers on a hotplate without stopping for confirmations. Shit! He was tumbling our stolen bitcoins a second time, and a tumbler is unbeatable.... Unless you guess which one it is, nearly all the coins belong to the person you're tracking, jump in with him, and get jumbled up through the same wallets using the same algorithm. I was hopping from foot to foot shouting "come on!" at my laptop, waiting an age for 6 blockchain confirmations to get 0.5 btc into "bitcoin fog". My half a bitcoin got sliced and diced through loads of wallets and I followed the biggest chunk with blockchain.info - along with 96,000 stolen ones! 
 
 Or, in other words: 
 
 He gathered 96,000 in one pot, then split it into about 50 smaller ones. then he saw me 666ing them all. Imagine a sports stadium with 96,000 people in it, each with $1000. He sent them all via different routes all over the world, but the same 96,000 people then arrived at a different stadium and he went to bed. Now there are 96,001, and I just phoned you on my mobile to tell you where the stadium is. 
 
 A major problem with tumblers is that they only work with lots of bitcoins coming and going from a lot of different sources - if a tumbler is taking in 96,000 bitcoins, those will massively outnumber all other bitcoins being tumbled and it’ll be easy to spot them coming out the other end. Mix in a little of your own with all those other ones and you'll find out the wallet addresses that the tumbler uses, and it should be easy to spot large transactions splitting off from there. 
 
 The fascinating consequence of this is that you can see the stolen bitcoins on the public blockchain, and as long as there are people keeping tabs on it there’s going to be no way for the thief to cash in on their haul. Considering how people rely on tumblers to maintain anonymity when buying illegal stuff online, this unusual loophole is something of a revelation. 
 
 Right now, as you’re reading this, you can watch as the the thief starts trying to move their bitcoins on again - it’s currently down to 92,000 bitcoins and dropping as smaller chunks begin going out. Selling those bitcoins and turning them into cash is going to be extremely difficult, as the major Bitcoin exchanges all demand proof of identity (specifically to avoid charges that they're involved in money laundering), and if they're broken down into smaller quantities to sell via a site like localbitcoins.com a paper trail will still be generated. As soon as it's possible to link one real-life bank account or identity to any bitcoins from that stash, it will be possible to work out their real-life identity. 
 
 This counts as one of the largest robberies in history at Bitcoin's current market value, ranking in the same company as real-life thefts like the $108m diamond theft at the Harry Winston store in Paris in 2008. 96,000 bitcoins also places the thief as one of the wealthiest Bitcoin millionaires on the current rich list (but bear in mind that few serious Bitcoin players keep their currency in just one wallet) - and all without having to go to the trouble of wearing balaclavas or threatening someone with a gun. 
 
 Let's watch and see what happens next. ||||| Another drug marketplace bit the dust over the weekend and another massive Bitcoin heist shook the deep web. 
 
 Sheep Marketplace, one of the two most prominent Silk Road competitors, went down on Saturday. A message briefly posted on the site on Saturday claimed that one of Sheep Marketplace's vendors exploited a security flaw and stole 5,400 BTC ($6 million at its current value). 
 
 The heist could be even larger than that, though; it may have involved up to 96,000 BTC ($100 million), which would be by far the largest Bitcoin theft in U.S. dollars, given that Bitcoin's value is currently at an all-time high. It's the third major Bitcoin robbery in the last month; cybercriminals also stole 4,100 BTC from inputs.io and 1,295 BTC from BIPS, both online Bitcoin payment providers. 
 
 On Saturday, Reddit user posted a message from the site's administrators, which has since been removed. The message claimed vendor EBOOK101 hacked the site and stole 5,400 Bitcoin: 
 
 Sheep is down 
 
 We are sorry to say, but we were robbed on Saturday 11/21/2013 by vendor EBOOK101. This vendor found bug in system and stole 5400 BTC - your money, our provisions, all was stolen. We were trying to resolve this problem, but we were not successful. We are sorry for your problems and inconvenience, all of current BTC will be ditributed to users, who have filled correct BTC emergency adress [sic]. 
 
 I would like to thank to all SheepMarketplace moderators by this, who were helping with this problem. I am very sorry for this situation. Thank you all. 
 
 Details of the incident are still unclear. Angry former users of the drug bazaar are pointing fingers in all directions, mainly on Reddit, and mounting a cyber-manhunt operation to track down the robbers. Many believe the heist was a scam, and the No. 1 suspect among Redditors is the Sheep Marketplace administrator, a Czech citizen named Tomáš Jiřikovský. Rumors of suspicious behavior from Sheep Marketplace's administrators began in late November, as documented on the website SheepMarketScam.com. 
 
 "You run a site partially dedicated to thieves and scammers selling their wares, yet somehow wonder how it ends up getting robbed?" wrote Reddit user twigburst. 
 
 Jiřikovský has, in turn, denied the accusation in a Facebook post. 
 
 The stolen 5,400 BTC were allegedly just the tip of the iceberg. Redditors pointed to a transfer of 39,900 BTC this weekend, claiming it was an indication that the administrators were siphoning money from users' accounts on the site, as first reported by Forbes. 
 
 On Monday, a Redditor nicknamed sheeproadreloaded2 claimed to identify a transfer of 96,000 stolen bitcoins. Along with another Redditor, sheeproadreloaded2 kept track of the money as it moved through Blockchain, the public repository of all bitcoin transactions. 
 
 "We've been chasing the scoundrel with our stolen bitcoins through the blockchain," sheeproadreloaded2 wrote. "Around lunchtime (UK), I was chasing him across the roof of a moving train, (metaphorically). I was less than 20 minutes, or 2 blockchain confirmations, behind 'Tomas.'" 
 
 As a side effect of the Sheep Marketplace heist and shutdown, another Silk Road competitor, BlackMarket Reloaded, has closed doors, claiming the site wouldn't be able to sustain the migration of users and vendors from Sheep Marketplace. 
 
 After the abrupt closings of both sites, others launched in the wake of Silk Road's shutdown in October will stand as the leading websites for buying drugs and other illegal goods online: Silk Road 2.0, which was launched less than a month ago, and the lesser-known Pandora Marketplace, Deep Bay and Budster. 
 
 Image: Flickr, Antana
– At this point, it's one of the largest thefts in history—and one of the most convoluted. Some person, or group, apparently made off with 96,000 Bitcoins worth a staggering $100 million, reports the Verge. The Bitcoins came from users of the underground bazaar called Sheep Marketplace, one of the successors to the shuttered Silk Road site. The cyber-thieves managed to drain users' accounts over the course of a week, and nobody was the wiser because they did so while keeping fake balance statements up, reports the New Statesman. Many of those who got bilked are on Reddit sharing information and trying to track down the money. "Many believe the heist was a scam, and the No. 1 suspect among Redditors is the Sheep Marketplace administrator, a Czech citizen named Tomáš Jirikovský," reports Mashable. The New Statesman article has details on the world of Bitcoin laundering—it's called "tumbling"—with this intriguing line: "Right now, as you’re reading this, you can watch as the thief starts trying to move their Bitcoins on again—it’s currently down to 92,000 Bitcoins and dropping as smaller chunks begin going out." In the meantime, Sheep Marketplace has shut down.