The complete story of the MCT+ Exit Scam 3

The complete story of the MCT+ Exit Scam

Part 3 of 4

Other parts

Part 1: https://issuu com/mctplus/docs/mct 2b exit scam

Part 2: https://issuu.com/mctplus/docs/mct exit scam 2

Part 3: https://issuu com/mctplus/docs/mct exit scam 3

Part 4: https://issuu com/mctplus/docs/mct exit scam 4

Investigation conducted by tax79

Version: 2021-01-04

Link to the original file: https://drive google com/open?id=106rsZiOJDNpaeHNI C3SjwS3tA1JZQ1gU2dGXRf0SBg

Contact me via Telegram: https://t me/tax79

Join the “MCT+ Exit Scam” channel: https://t me/MCTPlus

How to discover addresses in the MCT+ Platform wallet Basics

If we see a transaction like this what we can say about it:

At first sight, not much. We see that from one address from the left some funds go to two addresses on the right. But in reality a person who was going to make a transaction did not intend to move his funds to two different addresses, he wanted to send his funds only to one definite address The second address was created automatically by a program during executing this transaction within the initial wallet - the wallet owner doesn’t even know that a new address in his wallet was created And as you guess the funds that were automatically moved to the second address do not leave the initial wallet - they are still there The balance of the wallet was reduced only by the sum that went to the first address outside the wallet

The funds that were automatically moved to the second address within the wallet are called “change”

In this particular transaction above we see that funds (0 5 BTC) from the MCT+ Platform wallet, on the left, go to Andrew[MCT+]’s private wallet, on the right The change from transaction is 0 09219872 BTC that stays within the Platform wallet

So as we know now how it works let’s visualise that transaction a little bit. Red border - Platform wallet Orange border - Andrew[MCT+]’s private wallet Green background - change

As we see, addresses on the left and on the right side can be in the one wallet II.

Here we see multiple addresses on the left side and only two addresses on the right

On the right side as we can guess from the previous example can be one destination address outside the wallet and one address with the change from transaction within the initial wallet.

On the left side everything is very simple - all addresses on the left side are always in one wallet

In the transaction above the change left from the previous transactions is transferred from the MCT+ Platform wallet to Andrew[MCT+]’s private wallet. You could even notice the same address “3Cq3XJGUbZfJh6BaFqi2ZDuGH7szUatguc'' that was on the right side in the previous example is on the left side now III.

Let’s combine two previous transactions above and determine what addresses from these two transactions are in the same wallet.

From the first transaction it follows that the following addresses are in one wallet: 3L5LxCQg6r9cZZKT9c3PCnxEbb68F67HX4

3Cq3XJGUbZfJh6BaFqi2ZDuGH7szUatguc

From the second transaction it follows that the following addresses are in one wallet: 3R2FVPSaP86va7QYJp5w4SxndiB2YxCTq4

36ghzkkhQXE666Q74mNXpyuFhVb551wG3b

3Qg6myQXmckw6ww1dwn6gLAMfFX7jg84NH

3Cq3XJGUbZfJh6BaFqi2ZDuGH7szUatguc

34kVdBpHshjnDGWvv7GTz8pbKgNAMCPaLq

We see the same address (bold font) in two wallets, it means that ALL the addresses above are in the same wallet - even “3L5LxCQg6r9cZZKT9c3PCnxEbb68F67HX4” (initial address from the first transaction) and “34kVdBpHshjnDGWvv7GTz8pbKgNAMCPaLq” (change address from the second transaction)

IV

We can go further and take the next transaction:

37fQrf1k3FS2CNShNmjKvpGnDzkUFtWfy7

34kVdBpHshjnDGWvv7GTz8pbKgNAMCPaLq

2019-05-14 1KASu8KTKbb5kmPUB3iFrVCvZVRR2wrh3h 0 01550000

3AJDtaiEYjCwWaBX8MPWnYDL5EmZxjeDJW

Here we see the change address from the second transaction (bold font) on the left with one more additional address It means that this additional address “37fQrf1k3FS2CNShNmjKvpGnDzkUFtWfy7” is in the same wallet as the previous addresses mentioned above.

If we look at where this additional address came from we will see the following transaction:

3A95cjabyXQ4TvHVSMUZYmXHjN4ADxQTwt

We see this address on the right (bold font). And it is, most likely, a change address. If so - the address on the left side is in one wallet with that change address

So now we know even more addresses that are in the same wallet To the previous group of addresses we can add the following addresses:

37fQrf1k3FS2CNShNmjKvpGnDzkUFtWfy7

3AJDtaiEYjCwWaBX8MPWnYDL5EmZxjeDJW

3A95cjabyXQ4TvHVSMUZYmXHjN4ADxQTwt

Following change addresses

I.

Someone can ask how we determined that this address “37fQrf1k3FS2CNShNmjKvpGnDzkUFtWfy7” is a change address and not a destination address outside the wallet in this transaction:

3A95cjabyXQ4TvHVSMUZYmXHjN4ADxQTwt

This is the point. We can do it only manually by analyzing each transaction individually.

If we take this transaction by its own without a surrounding context and without analyzing the previous transactions in the chain, we cannot determine what kind of address it is

This is the main difficulty in analyzing blockchain We constantly have to decide where to go further - in this way or in that way, this particular address belongs to this wallet or to that wallet

In the next chapter I will provide techniques of how to determine the kind of address in a transaction based on my own experience of analyzing blockchain transactions

As you might understand from the previous chapter a change address always stays in the initial wallet and it can help us find other addresses in the wallet while the next transaction

That’s why following change from one transaction to another is so important

The table below shows us how it works in practice.

This is Andrew[MCT+]’s private wallet The first transaction - some investor decides to buy one MCT masternode from the MCT+ founders and transfers 0 2 BTC from Binance to Andrew[MCT+]’s private wallet Yellow background - funds received for a MN Green background - change from transaction Orange background - address outside the wallet

3PyPxpB3ArUBqVmRz36bKnezRBPzXJyupk

As we can see, destination addresses outside the wallet are almost useless for our purposes They cannot help us find out other addresses in the wallet They only show us how much funds were moved out of the wallet and their possible destination - some exchange, for example That’s it

But if we follow the change from each transaction many things show up In the table above we can see a lot of discovered addresses within the wallet (the left side of the table)

If we explore each of the newly found addresses using the same method we will discover much more new addresses in the wallet Theoretically, we can discover almost all the addresses within the wallet if we determine change addresses correctly.

Methods of how to determine a change address

Common methods for any case I

As it was already mentioned each change address is created automatically only for one particular transaction Therefore, each change address has only one input One address cannot be used as a change address twice

In the screenshot below we can see how a typical change address looks like. It has only one input and only one output The final balance after the output is always zero

If we see something like in the next screenshot - it is not a change address, it is a destination address and we have no reason to follow its further transactions - in most cases we will be exploring some other wallet we are not interested in But if we determine that some transaction is made within one wallet, when some funds are moved from one address to another within the wallet - why not to explore this address as well

When a person makes a transaction he tries to use round or “nice looking” figures In most cases a person will rather send something like 0 5 BTC to a destination address than something like this - 0 09219872 BTC

So when we have to choose between two addresses when each of them has only one input and one output, we will probably choose 0 09219872 BTC as a change address:

3L5LxCQg6r9cZZKT9c3PCnxEbb68F67HX4

In almost 100% of all cases we will be right

Specific methods for the MCT+ Platform

III

The MCT+ Platform uses only addresses that start with a “3” and a few ones that start with “bc1” For example, “3L5LxCQg6r9cZZKT9c3PCnxEbb68F67HX4” is a Platform address. “bc1qt6ckelsj6as80awzq4rjmkqwv2ce0yz8yejzny” is also a Platform address

But if we encounter an address that starts with a “1”, we can be sure that this address does not belong to the Platform Such legacy addresses are usually used by old exchanges For example, this address “1NDyJtNTjmwk5xPNhjgAMu4HDHigtobu1s” belongs to Binance.

So when we encounter a transaction like this, we know for sure where a change address is:

37fQrf1k3FS2CNShNmjKvpGnDzkUFtWfy7 2019-05-14 1KASu8KTKbb5kmPUB3iFrVCvZVRR2wrh3h 0 01550000

34kVdBpHshjnDGWvv7GTz8pbKgNAMCPaLq 3AJDtaiEYjCwWaBX8MPWnYDL5EmZxjeDJW

IV

As you might notice from the previous examples that the MCT+ Platform has only two addresses on the right side - a destination address and a change address

I do not remember that I saw only one address on the right side that was within the Platform wallet

So when there is only one address on the right side, it is definitely a destination address going outside the Platform:

38BviT6Mej7sFpSJqjJUy1TZ6tdkiYUdZ5

3NPSWQn3tvcRXL81USxHQy5eSVybpKA4TJ

3Gy9zZF9n2osWjqaG2Rv1tuEXcA1Br2PaS

33yLRdqQShdRXYo7bC5Ha4ix6Ea8XYFYTM

3ErgNHBhZktSUF9JmMrCYnfZDVRpJ7CyAb

2019-04-24

3CodGyUVoSojiDft29GmeACp5KJnhSv3Ge

Also when there are more than two addresses on the right side, you are definitely in the wrong place - it is not the Platform addresses neither on the left nor on the right side:

378jyBDr6jBTs4E8GBJPM4oM7L3iyBbxJU

2020-06-15

3E8VBXefshdhL8aJSb6G2Uhmf6Qi1d13p6

1GvWoPfj61cRH1aECWqvA75iraPy5LH7hg

1MwQFFwbTHYzbigGxq3dF4MsVm5CB8xVqW

3NpRSchePgQbVcqR9pUAqWUzUqR8nNfQ6G

When there are more than 20 addresses on the left side and more than 2 BTC transferred to a destination address, it is definitely not the Platform addresses neither on the left nor on the right side:

1 3Hqc1nb9ANWisunLiAP2zjPNdpySedybA7

2 3QDereRiGUNEPfgn9MsJrBqJZvuLUJGRXm

31 34GXRDfKeuYjoMbzyDXcu7wE9U8tQQ1ocP

Most likely, it is some other exchange

The most advanced and convenient BTC explorer we can use for free is Bitinfocharts: https://bitinfocharts.com/bitcoin/explorer/

The most useful feature of this BTC explorer is that it combines addresses in blocks and gives each block a unique number

The method used in creating such blocks is described by developer of another BTC explorer (walletexplorer com) that has a similar feature but less convenient:

“Addresses are merged together, if they are co-spent in one transaction So if addresses A and B are co-spent in transaction T1, and addresses B and C are co-spent in transaction T2, all addresses A, B and C will be part of one wallet ”

This is the only reliable method of determining wallet addresses that can be done in an automatic way - very limited but very helpful.

We have to collect such blocks manually and then combine them together in order to see the whole picture

The second most useful feature is that this BTC explorer has its own database of some well known services and exchanges

So we can determine sometimes to what exchange funds from the Platform were transferred

II

Let’s look at how the Bitinfocharts BTC explorer can help us in practice.

In the table below there are two transactions The last one - Andrew[MCT+] transfers 0 352 BTC from the Platform to his private wallet

In the first transaction Andrew[MCT+] transfers funds from the Platform to some exchange (a legacy address) and the change from this transaction becomes part of the second transaction.

These two transactions were made one by one almost simultaneously Blue font - change from the previous transactions where Andrew[MCT+] transferred funds from the Platform to his wallet

This is how the first transaction looks in the Bitinfocharts BTC explorer:

As we see, each address got its own block number and the legacy address was determined as the Bittrex exchange

And you might notice that Bitinfocharts could not determine that “3Qg6myQXmckw6ww1dwn6gLAMfFX7jg84NH” is a change address and it should have the same number as the address on the left. It is a limitation of such explorers. Only a human can do it

So we manually have to create our own database of such block numbers and then combine them together

Now we know that addresses in block 40543092 and in block 50563567 are the Platform addresses

Block 50563567 is not so interesting for us as it contains only four addresses that we already know from the table above.

But block 40543092 is very interesting Bitinfocharts using its simple and reliable method of determining addresses in the wallet has found several hundred addresses in this block:

https://bitinfocharts com/bitcoin/wallet/40543092

In the screenshot only a small part of all addresses provided And the first address is “32u1n64oTEeRYuzDLLT1Wk6cLCs5ppQuTK” from the transaction above.

And as we can see, the addresses in this block were part of outcoming transactions made from 09 June 2018 until 14 May 2019 And these are the exact dates when the Platform was operational Seems, we found the “spine” of the Platform wallet.

III

In the screenshot below we see outcoming transactions in block 40543092 Using these transactions we can follow their change and collect more block numbers that contain addresses of the Platform

It is easier to move forward than backward in order to follow change from transactions, so as a starting point we choose the preceding output transaction closest to the last ones:

So let’s start analyzing transactions now.

1 This is the first transaction and as we can see the addresses on the left belong to block 40543092

The upper address on the right has a round figure (0.00419000 BTC) and it has multiple inputs, so this is a destination address Therefore, we choose the lower address as a change address

2 Two addresses below have one input and one output each and thus have equal chances to be a change address So we have to analyze them both

2 1 This is the next transaction of the lower address in the table above:

As we can see, there is only one address on the right side And when we analyze block 47194819 clicking on the green link, we will see that this address belongs to some exchange and it cannot be part of the Platform

2.1.1. The next transaction only confirms this conclusion:

So we choose the upper address as a change address in paragraph 2

The lower address has multiple inputs, so this is a destination address So we choose the upper one

4. Two addresses below have one input and one output each and thus have equal chances to be a change address. So we have to analyze them both

4.1. This is the next transaction of the lower address in the table above:

Not very helpful These both addresses also have one input and one output each So we have to go further and explore each address above more

4.1.1. This is the next transaction of the upper address:

Here we see legacy addresses which start with a “1” So the addresses on the both sides are not the Platform addresses

4.1.2. Now let’s look at the lower address:

There are more than a hundred addresses on the left side So even now we can say that this is not the Platform 4 1 2 1 But we can go further:

Two addresses on the right side have multiple inputs So they are both destination addresses and this is probably some exchange

So we choose the upper address as a change address in paragraph 4 5.

The lower address is a legacy address Therefore, we choose the upper address as a change address

The lower address is a legacy address Therefore, we choose the upper address as a change address

The lower address is a legacy address Therefore, we choose the upper address as a change address

The upper address has multiple inputs Therefore, we choose the lower address as a change address

And finally we encounter block 40543092 We went through all the transactions without any mistake

Now we can collect block numbers of the addresses which we encountered in the transactions above: 40543092 50451856 50456420 50484115 50485944 50531289

Each such block can contain from 2 to several hundred addresses

After that, we take another preceding output transaction closest to the previous one we chose before as a starting point and do the same thing that is shown in this chapter And we do it until we reach the earliest output transaction that was made on 09 June 2018.

IV.

To make our life much easier we can use already collected block numbers in the process of discovering new addresses For that we can use the “searchwp” plugin for Firefox: https://github.com/legege/searchwp

Now this plugin is not supported by modern Firefox That’s why we need to use Waterfox Classic instead: https://www waterfox net

How it works

We insert just collected block numbers in the search box of our browser:

And after that, it automatically highlights all found search results on the page:

So while following change from transactions we encounter a highlighted block number, it means we are on the right way.

Also we can repeat the same path that anybody already did before just by following highlighted block numbers

I managed to collect about a thousand block numbers by following change within the Platform wallet So anyone can repeat my path and can follow change addresses from transactions made from 09 June 2018 until 14 May 2019 on the Platform:

So you can insert all these block numbers in the search box of the Waterfox Classic browser and follow the same way I did before

A starting point can be the following transaction: https://bitinfocharts.com/bitcoin/block/526675/40543092

And I have to say one more time - this is only the “spine” of the Platform wallet If we need to find more addresses - we need to explore every discovered block one by one

V.

Additional information

1. Sometimes while exploring the Platform wallet we can encounter the following situation:

It is a normal situation as some transactions go like this in the Platform wallet:

We can choose any highlighted block number, in several transactions we will be in the right place anyway But I prefer to use the “follow change” technique. So I would choose the upper address in the table above.

For many times we will encounter transactions with block 32493266 It is the ex-CryptoBridge exchange, and it has an enormous amount of incoming and outcoming transactions connected to the Platform

So when you see a situation like this, just press the other address - there will be no mistake In the table above choose the upper address

3 When we encounter such a transaction where one address has 0 01xxxxxx BTC and the other has something like 0.001xxxxx BTC, for some unknown reason the first variant with “0.01” will always be a change address.

4 There is a gap in transactions approximately during the period of 10 - 20 June 2018 The Platform was offline at that time:

https://bitcointalk org/index php?topic=4315891 msg40280000#msg40280000

How to discover addresses inAndrew[MCT+]’s private wallet

A starting point we can use to discover addresses in Andrew[MCT+]’s private wallet is the following post from the MCT+ team on Bitcointalk:

https://bitcointalk org/index php?topic=4315891 msg40386159#msg40386159

From this post we determine that the following addresses are involved in the transaction: https://bitinfocharts.com/bitcoin/tx/8932d2c1dfa0f02212438bec45ec8eb00ecf790cf173c89cb591542337f6b915

Red border - Andrew[MCT+]’s private wallet Orange border - CryptoBridge Exchange wallet Green background - change 3NGHWV1GXFERFQFUJJWjh6eGEuLMf2dCFX

Initial addresses:

3NGHWV1GXFERFQFUJJWjh6eGEuLMf2dCFX

3E4r3ShCtf3UA9iY3ntMKev2AKAuatAVch

Change address:

3BzRn4tNSQh7E6p5JWmKzLiru9aH9phogV

So now we have three addresses belonging to Andrew[MCT+]’s private wallet

The Bitinfocharts BTC explorer shows us that the addresses on the left are in block 39557553 and the change address on the right is in block 41278768

If we look at block 39557553 we can discover that it includes 41 addresses:

And as we can see, block 41278768 includes 5 addresses:

So after analyzing only one transaction we immediately found 46 addresses of Andrew[MCT+]’s private wallet

We can use the “follow change” technique as we did while exploring the MCT+ Platform wallet to further discover addresses in Andrew[MCT+]’s private wallet

Thus, I managed to collect the following block numbers within Andrew[MCT+]’s private wallet:

The key block of Andrew[MCT+]’s private wallet is the first discovered block 39557553 We can say it is the “spine” of the wallet.

A list of all addresses of Andrew[MCT+]’s private wallet:

https://bitinfocharts com/bitcoin/wallet/39557553

3NGHWV1GXFERFQFUJJWjh6eGEuLMf2dCFX

38NRBmKiQff3Q6EWntE768fu9UsdpvzBud

3LRR4RRXbAicrcgfajbq9FGaNtmc1a3Fi8

3BaJgRjPMp9ipiMg7a4qgyzcVeP4vX2K7X

3CtT1tr4KPFdvdCuH85dS27Kd93mYWUCe7

3MoTTz66GhDYAQW9iFAyYXMztvrr5pu1VU

3HncyDJsqG7WXZKqtSvWSVcEuB2Wvzkzwo

3E4r3ShCtf3UA9iY3ntMKev2AKAuatAVch

3QN4fgxp2qLheVD4zWmBH4TRcifEBHs6y8

33jpSZRH91EUvvXMePY1eqejzH93boGBVR

35R26YiBfcB1MnrXcJYQzRE85rvcYpXWTe

33cK1BeRb4Ho4HXLbjuN2w7ZgCvJNQwQ8M

32ktQAM35uJ2sdwaGHqxCnoDCKyivmp5eU

35KTC5cnF5H9Va4FnKwmSQokoj4Ng5khDv

3N3CgLSsyG5BG6ZX1sFp33sP31YY3vd8kR

34ZgjJ8CfZx9dd5uHjYzVPtX3952WM8SkD

3AZYR8VWKymo3PdAk9V86oa6NGQnmNcSfN

3JF5VnAUoYWHSTdqVjzYbrt6C1NPQAf5u4

3Dou7bvdDvciFfZdu6wRLsJUxLzRRWGKJL

36naoY8DPK9HmYFyKTtJzNs3v1QfQsaHuR

3LGyrx974bUJodSx73tjLhsYbj2m15hG2o

3KfoxuaWs4HTvx7iF56jiY6hNbXoHZwSP7

3BxQEcNqGbT88ikpMkZDisYtk6GisP2HGM

3FDVSBMe1fZnaDRzNMsXUwYbHeXRPYm6Q4

36YKd71qHsfxN78FZAcxJZ8tDoUUgVe9Dk

36xFZb2dvZctVVxZEtTbYLBucsdjbUyYMe

359n7azE5MLhq1SZNdjidEyw83ix7PTrBd

3BRNLce3fZCdb3groA5BsivS8wnc9XnFXi

3JGqaadkEvocGT2CvzH4xbnr1aXd7kSAhE

39otwJoztHNZjDa5SkxUbzHPVDKVP4rn3i

3MCMivnYiGuw37FD4Sc62y85wYp6wLAKH5

3F3mkxCxDfdMPhmuqLj2AzVQ5cyxVpgpht

3PZ1vZ7FzkZjncJcLr3G6UpUnZ7V4mpD6L

35VPi2mgGQCwS2hRcqYyf6B9nqA7vunUbS

32B2NiyMtJUVGqwkU8sUerVdV1ybwxN4LF

3NzGspw86vXCmQpCtdfFtRSfNMZgjVRfH9

3JpcdBT99CDdS8P6cYGup1Y4UwpE5x8AG3

3KNX3b41ZD6xKB2CQHczBumxu3wnZJHR4a

3MK8y2miPWsKTTB7KETbsMZac7zKqqdzvy

3P1iFQr1Zz2vqnhjmazwDWKEdumPD8oGCH

https://bitinfocharts com/bitcoin/wallet/41842171

31jLsgYBx2nq5N8CJFJWRtiaqq6yFQkYHz

https://bitinfocharts com/bitcoin/wallet/41865074

3CBd724ZBEMNsS2tzmNYxPozMbXnh6nfw8

https://bitinfocharts com/bitcoin/wallet/42742220

3BUf9tE3Cox89v2uUQhprXsqCA2fpWgNpR

https://bitinfocharts com/bitcoin/wallet/46986262

3NkHpdAdk4Xs4FS2Vm84NdcghePQxw4N7S

3GvGGpTPmYh5d6hZ8X3ELRK1T5JrnV4PJQ

https://bitinfocharts com/bitcoin/wallet/50291209

3Q1Jqfq3rTNkNVVWcBcrMfScWzou4ALXUZ

https://bitinfocharts com/bitcoin/wallet/50716777

35Nxaw8ksPXxTbWJHiMfm9Jf6cPUH82QdL

3QJFDC1UcnfC2jNRPnqyfkxkZ37a9yYKA5

https://bitinfocharts com/bitcoin/wallet/41278768

3BqPTuUjW7eh5tE8JeJXBkxMH3CLenZW1p

3BzRn4tNSQh7E6p5JWmKzLiru9aH9phogV

https://bitinfocharts com/bitcoin/wallet/40449983

3AjMdx2mqTYv8d7MFwcYHBrHMNHpxz2xKX

https://bitinfocharts com/bitcoin/wallet/40701544

34X4UF7itKLCLwqbKYZtFmTYkJ5GzJr7Jz

https://bitinfocharts com/bitcoin/wallet/47803682

39uLez2zhHhPcBd8RsvC49XcJYuPmTx8AG

https://bitinfocharts com/bitcoin/wallet/53615237

3MwTSr15tXc1CxQxbFSZurk4pX7pSxxcub

36ZrTmNUG7T8ZzUjJUGy2g9vygLtSepVnp

https://bitinfocharts com/bitcoin/wallet/50715939

3EHZNGDAszNips47crGP3oqhRG9LYmpG4Y

3JZED1aKAkmTh6uUdnvW283r4EAFqdHoK5

https://bitinfocharts com/bitcoin/wallet/39535386

3BsVseyDuKfEJdL8hirqymjW84UWtik8G2

III

3JuRpNErDxCyByqwJsyRJWtGykyqbh5Ugg

3FGkUm8DY5r7eLCQgz7mNxZDdJnUAfEoDb

3FdPZfFSyzV1nKZmD7CwbrEyvo9w1SaNNN

37mVDNLXX7Fe81gWFR8oXU97kvT2jNJiQb

32nqRFPv6PrpV71uTXiWA1BGwk3GYJPj5m

3PyPxpB3ArUBqVmRz36bKnezRBPzXJyupk

36xEqk6xHG1ZexM4qUSegyETQcacKxsC4u

3QoLu7svxemGDyAmgZ7JyKUmb55ck9gmGa

3N2y7SiHgkKg2aFEx2myMBmJ8MCuAZNotR

3PHkocMLqHAtCqJd3YpccHdKgxwF7AujjM

3NFmQiiQEPAsELP21dZbR2oFDaYav7p2fj

3LWwK8pmMeJDi7FtxschwbodTht22Wk2Y6

3HixFU8rKekt8jBM2Fs3JZCT8YQwjsFRJh

3Hd1DnJ7eYDCiEpjm4J62YpaoK8oZggVV8

38wbftRC8fDE5ZKUfFK6aW7fioNNK34cs2

328GJAoCSfxUuqbqjpuXd1VWL5KwVNAzDa

3EmWjkAKYYwLQ7J78fmnDrpJtQmcKXcskn

3Dbkab4YWQc8DW1W6KdHY8bRXk8Nyei1un

3FYXx6p4BZpHUCAzZaskYzdbBRueztckp3

3QNVYWeTidNqnATF6dJGZjGMWGmBgrJiFs

3NuDvgDwUW1ZPu6j39hU8LaLZCJHfWJ7fs

337KgbFruTj3Pdpicra5HTHzoZVDe9KDX5

3JsLZB8XruTwKeFiUE7HSa4N8eZdLzfSXR

3EkdFqPWnQ1kfMHmVXPDrL8XanHfms41B6

As we know the context, exact sums and approximate dates of transactions and events that were going on with the MCT+ Project, we can easily identify the majority of incoming transactions in Andrew[MCT+]’s private wallet.

So after analyzing only the last three transactions in the main address “3NGHWV1GXFERFQFUJJWjh6eGEuLMf2dCFX” of block 39557553:

https://bitinfocharts com/bitcoin/tx/696aaff884e484d32c7c46cf924123897d504b95fb7d4a761f3fc81ead838881

https://bitinfocharts.com/bitcoin/tx/65a4c44ce7947aaf8b027de6a318b6af3e4bf6c355023254e28820f2f40ccc01 https://bitinfocharts com/bitcoin/tx/67cc8d373cd36d4724df7d44ca999f68784b2e376ba606d76bd8d54d32e16e3a

we can immediately find several addresses that were used for receiving funds for the sold MCT masternodes in June 2018 and for receiving payments from the WOLF team in February - May 2019:

33cK1BeRb4Ho4HXLbjuN2w7ZgCvJNQwQ8M

3BaJgRjPMp9ipiMg7a4qgyzcVeP4vX2K7X

3JF5VnAUoYWHSTdqVjzYbrt6C1NPQAf5u4

36naoY8DPK9HmYFyKTtJzNs3v1QfQsaHuR

How was it done?

We know the context: payments for the MCT masternodes and the WOLF “fee”.

We know exact sums: 0 2 and 0 4 BTC for a masternode and 0 2 BTC per week for the WOLF “fee”

We know approximate dates of transactions and events: late May - mid-June 2018 for masternodes and late FebruaryMay 2019 for the WOLF “fee”

In this way it was managed to identify, for example, all funds received for the sold MCT masternodes during Presale.

IV

In the screenshot below we see that the MCT coin topic on Bitcointalk was created on 27 May 2018 and the topic starter has the “ copper member” status:

https://bitcointalk org/index php?topic=4315891 msg38727246#msg38727246

The “ copper member” status is a paid option on Bitcointalk:

https://bitcointalk org/index php?action=credit;promote

And in 2018 it cost 0.00208333 BTC. We can see it from the following topic, for example: https://bitcointalk org/index php?topic=5072767 0

While analyzing early outgoing transactions in the main address “3NGHWV1GXFERFQFUJJWjh6eGEuLMf2dCFX” of block 39557553 we encounter the following chain of transactions

One of the transactions dated by 27 May 2018 with the sum of 0.00208333 BTC. And as we remember 27 May 2018 is the date when the MCT coin topic was created on Bitcointalk

Red border - Andrew[MCT+]’s private wallet Green background - change

Magenta background - Bitcointalk wallet

The last address in the table is a known Bitcointalk donation address where all donated BTC are collected:

And the previous one where 0.00208333 BTC was transferred to is an individual address automatically generated for the “MCTplus” user

So now we know when and how much Andrew[MCT+] paid to Bitcointalk for the “ copper member” status Moreover, we found out that he had another account on Bitcointalk

Transactions

during the Incident on 14 May 2019

On 16 May 2019

Andrew[MCT+] announced to the public that 2.5 BTC was stolen during the Incident two days earlier:

On 18 May 2019

Simon[MCT+] posted in the team channel a draft of his future announcement he was going to publish on that day And as we can see, he provides only three addresses where the stolen BTC was transferred to For some reason Andrew[MCT+] decided not to tell him about the fourth address:

https://i imgur com/HhFIh0H png (click to enlarge)

Based on this information, I checked all the addresses above and posted my own list of the Platform addresses from which the funds allegedly were stolen:

https://i imgur com/1IIth43 png (click to enlarge)

This was later announced to the public:

https://i imgur com/EXcV8rr png (click to enlarge)

So this is the “official” information from the MCT+ founders now:

3L5LxCQg6r9cZZKT9c3PCnxEbb68F67HX4

3PYATA4v296eqqLdg4dzmAoeUd8d652rVK 0 7 BTC

Change addresses from transactions above:

3R2FVPSaP86va7QYJp5w4SxndiB2YxCTq4 0 35 BTC

36ghzkkhQXE666Q74mNXpyuFhVb551wG3b

3Cq3XJGUbZfJh6BaFqi2ZDuGH7szUatguc

Change address from another transaction:

3Qg6myQXmckw6ww1dwn6gLAMfFX7jg84NH

II

The first question shows up - why only from these addresses the funds were transferred. The second question - why such big amounts were kept on these addresses And the main question - the addresses above actually belong to the Platform or not

First we have to determine the source from where the incoming funds went to the Platform For that we use the “follow change” technique but only backwards. For example, let’s take the following transaction where the funds leave the Platform: 3L5LxCQg6r9cZZKT9c3PCnxEbb68F67HX4

We have to find out from what address the funds initially came to the address on the left For this we take the previous transaction from where funds were moved to that address:

Now we see that this address was a change address from the previous transaction

Next we have to find out from what address the funds came to the address on the left in the last table above and for this we do the same operation as we just did before And we keep doing it again and again until we reach some address we can definitely determine as an exchange or something like this In other words, we have to determine the boundaries of the Platform wallet and the initial source from where funds were transferred to the Platform.

So let’s start analyzing the Platform addresses mentioned by the MCT+ founders in their announcement one by one III

The first mentioned Platform address: “3L5LxCQg6r9cZZKT9c3PCnxEbb68F67HX4”.

The table below is the result of using the “follow change” technique in reverse mode It was managed to determine the boundaries of the wallet (red border) and the entry point of the wallet (light green background). Moreover, it was even managed to determine exactly who transferred funds to the Platform And it was the WOLF team How we found out that it was them you will see a bit later.

Red border - the Platform wallet

Light green background - the entry point of the Platform wallet

Green background - change

Blue background - Andrew[MCT+]’s private wallet

In the next table the key transaction is dated by 24 February 2019 when the WOLF team did the first payment of the WOLF “fee” to Andrew[MCT+]’s private wallet. After that it was not difficult to see the whole picture. Moreover, the WOLF team always used the “1PJe7tiCNnYQddxGbZF8MxYa8PhBkMwLVk” address as a start point of their further payments of the WOLF “fee” and not only

Orange border - the WOLF wallet

Light green background - the entry point of the Platform wallet

Green background - change

Blue background - Andrew[MCT+]’s private wallet

IV

The second mentioned Platform address: “3PYATA4v296eqqLdg4dzmAoeUd8d652rVK”

The initial source from where the funds go to the Platform is, most likely, some service.

Red border - the Platform wallet

Light green background - the entry point of the Platform wallet

Green background - change

Blue background - Andrew[MCT+]’s private wallet

As we can see, some funds were already moved to Andrew[MCT+]’s private wallet on 03 May 2019

The rest was moved during the Incident on 14 May 2019

The third mentioned Platform address: “38HhT31H26GVsjStqj9URv1TXqMyNKGkZW”

The initial source from where the funds go to the Platform is probably some exchange

Red border - the Platform wallet

Light green background - the entry point of the Platform wallet

Green background - change

Blue background - Andrew[MCT+]’s private wallet

VI

As you might already notice, two big amounts of BTC were transferred to the Platform on 21 April and 25 April 2019

One possible explanation of this can be the following

Earlier in April 2019 it was announced to the public about upcoming incorporation of MCT+, implementation of BTC/USD and BTC/EUR trading pairs, PayPal and adding new coins currently not supported on the Platform

One of Andrew[MCT+]’s announcements about investing money in the MCT+ Project dated by 17 April 2019:

So it is quite possible that some investors transferred such big amounts to the Platform in order to buy the MCT coin

My message to Andrew[MCT+] on 02 May 2019, for example:

As we see, one investor under the nickname “gominer” bought more than 1 6M MCT - more than 10% of the total supply VII.

https://i imgur com/ZMVYqEa png (click to enlarge)

The fourth transaction was made in order to transfer change from the previous three transactions to Andrew[MCT+]’s private wallet

As we can see in the table below, to the three addresses already mentioned in the previous tables as change addresses (blue font) the fourth address is added. And this is crucial. Without this address it would be impossible to connect the three transactions above to Andrew[MCT+]’s private wallet with the Platform But the added fourth address changes this situation completely

As we see, the added address is a change address from the first transaction in the table below In its turn, the initial address of this transaction, “32u1n64oTEeRYuzDLLT1Wk6cLCs5ppQuTK”, is the Platform address belonging to block 40543092 which, as we remember, is the “spine” of the Platform wallet

It was even managed to determine that this initial address was a deposit address of “Jack[CHT Dev]”, developer of the CryptoHashTank shared masternode service. And by his words they lost about 1.000 USD during the Incident.

So now we know for sure that all the addresses mentioned by the MCT+ founders in their announcement are actually the Platform addresses.

Red border - the Platform wallet

Blue font - change from previous three transactions

Green background - change

Blue background - Andrew[MCT+]’s private wallet

VIII.

In the following tables it will be shown how it was managed to establish that Andrew[MCT+] moved the stolen funds from the Platform to his private wallet

As we know, the stolen funds were moved from the Platform to four different addresses

From the first transaction in the table below we see that all these addresses are in the same wallet.

Following change from further transactions we encounter a transaction made on 17 August 2019 And as we see, there are already four addresses on the left side One of them is a change from the previous transaction and three unknown addresses So we have to analyze each of them

Red font - stolen funds

Red border - one wallet

Green background - change

3MwTSr15tXc1CxQxbFSZurk4pX7pSxxcub

3NuDvgDwUW1ZPu6j39hU8LaLZCJHfWJ7fs

3EmWjkAKYYwLQ7J78fmnDrpJtQmcKXcskn

The two upper addresses on the left do not say much to us - just some incoming funds to the wallet. But the last address “3EmWjkAKYYwLQ7J78fmnDrpJtQmcKXcskn” clearly shows us the whole picture of what really happened

In the table below we see that this address is a change address from the transaction made on 16 June 2019 And it means that this change address is in the same wallet as all the three addresses on the left side:

One of these three addresses, “33cK1BeRb4Ho4HXLbjuN2w7ZgCvJNQwQ8M”, is the well known WOLF “fee” receiving address in Andrew[MCT+]’s private wallet. Also if we check to what block all these three addresses belong we will find out that all they belong to block 39557553, the “spine” of Andrew[MCT+]’s private wallet Therefore, all the addresses on the left side in the two tables above are in the same wallet

So we know for sure what really happened during the Incident on 14 May 2019 - Andrew[MCT+] just stole users’ funds from the Platform and transferred them to his private wallet Now it is a proven fact and cannot be argued

IX

We have answered two questions asked at the beginning of this chapter - it was proven that the MCT+ founders provided the real Platform addresses from where the funds were stolen and we found a probable reason why such big amounts of BTC somebody transferred to the Platform Moreover, we managed to prove that Andrew[MCT+] was the one who stole the users’ funds

So one question left - why from only those addresses the funds were stolen or maybe the MCT+ founders also managed to steal something else

So let’s take several transactions that lie on the surface and do not take much time to analyze.

The first transaction in the table below we have already analyzed - the change from previous transactions is moved from the Platform to Andrew[MCT+]’s private wallet Everything is clear here

Now we will look at the second transaction in the table As we see, change from the first transaction with some additional funds from another address is transferred to some external address outside the Platform wallet, most likely, to some exchange The transaction was made in several hours after the Platform was shut down on 14 May 2019

So even now we can already state that the MCT+ founders stole more than it was announced earlier. There were more than six thousand registered users on the Platform and most of them had BTC deposit addresses to where they moved their funds for further trading We can only guess how much funds were being kept on those deposit addresses and were later stolen

Before analyzing the next transactions we have to read the following message posted by “Jack[CHT Dev]”, developer of the CryptoHashTank shared masternode service:

https://i imgur com/yj05Uar jpg (click to enlarge)

What we have learnt from the message above is that there were two BTC transactions made right before the Platform was shut down and the TXIDs are unknown

I found these transactions and here they are:

1 Instead of 0 01508068 it was sent 0 01458068 to the Platform

2 Instead of 0 03202689 it was sent 0 03192689 to the Platform The difference is 0 0001 BTC, a withdrawal fee

The funds from the first transaction had been withdrawn from the Platform 40 minutes before Andrew[MCT+] moved the known stolen funds from the Platform to his private wallet

The funds from the second transaction were withdrawn from the Platform simultaneously when Andrew[MCT+] moved the known stolen funds from the Platform to his private wallet.

So you can make your own conclusions in whose pocket all these funds were put

Other parts

Part 1: https://issuu com/mctplus/docs/mct 2b exit scam

Part 2: https://issuu com/mctplus/docs/mct exit scam 2

Part 3: https://issuu com/mctplus/docs/mct exit scam 3 (current)

Part 4: https://issuu.com/mctplus/docs/mct exit scam 4