Tracking the BitFinex Heist

Last week, 119,754 BTC worth around $80 million USD were stolen from the BitFinex exchange in what was probably the second biggest Bitcoin theft of all time.

Yesterday their Director of Community Zane Tackett posted a list of the transactions made by the thief.

I was curious to check whether any of the coins had been spent since the theft, and also wanted to check that the published total was correct. So I made a new Bitcoin Core wallet and imported all the theft addresses as "watchonly". After rescanning the blockchain all the transactions showed up. I was surprised to find that not a single Bitcoin has been spent yet:

Here's the wallet sorted by amount, showing the biggest thefts at the top. The thief rather sensibly emptied the biggest accounts first, so we see the biggest thefts at around 2am:

And here it is sorted by date, showing the newest transactions first. Notice the top 5 transactions are all tiny. They were likely made by victims of the theft in an attempt to track their coins. Other than those 5 we see the smallest thefts (around 4 BTC each) happening 3 hours later, at 5am. The whole theft took 3 hours to complete, although it is possible that most of that time was spent waiting for confirmations:

I have made a copy of the wallet available for download if you want to load it into your own Bitcoin Core client to monitor for future spends. If I see the coins start to move I will make another post about it, and link to it from here.

Edit: I don't know if it matters or not, but I made the wallet using a release candidate of version 0.13 of Bitcoin Core. I wouldn't be totally surprised if the wallet.dat is incompatible with earlier versions of the client.

Edit2: I was asked how I made the 'watchonly' wallet. I put a list of all the addresses I wanted to watch into a file, then did this:

cat address.txt | while read x; do
    echo $x; bitcoin-cli importaddress $x '' false
done

The false causes the client not to rescan the blockchain after adding each address. At the end I did this to cause it to rescan the blockchain:

bitcoin-cli importaddress $x '' true