Skip Navigation LinksJune 15, 2023

​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​⚠ Scam alert and transaction analysis

To be checked on request is a fake blockhead "i/thefrow-2 " on the Namecoin blockchain, minted on Friday 28th of January 2022 20:10:57 (GMT/UTC). The fake asset was sold for 10 ETH as vaulted asset on Ethereum, see further the listing on LooksRare.

First trace

The analysis starts at this (last) scam record of asset "i/thefrow-2 ". Then toggling back to input 0 (click on the transaction, not on the address). As next step toggle forward to output 1 with the most relevant TxID to evaluate:

Here toggling forward output 0 leads to fake asset ​"i/myles-1 ", while toggling forward output 1 leads to an output of around 15 NMC. Here toggling forward output 1, which is the name_new OP. This leads to the new transaction chain with UTXO of 93.30974648 NMC.

Toggling forward this UTXO leads to the firstupdate of u/atari. Taking one split up of output 1 with 0.2 NMC leads to a recycling of several outputs here and (with previous output 0) in the following here. This ends at asset id/kronos in the following transaction chain:

Opensea account namecoiner.eth is the only one who signed recently with "r", "0", "1" and "2" and he confirmed that this is his asset.

The main transaction chain of 93 NMC leads backwards to an UTXO of 259 NMC evidently coming from an exchange.

Second trace

The side transaction chain of 15 NMC referenced in the​ first trace leads backwards to a funds recycle with four inputs. Same transaction chain leads forward also to this name_new OP​. Output 0 leads to the firstupdate of asset d/我是 and a transaction chain with countless renewals of Unicode as​sets, finally to the nameupdate​ of asset id/norðurljósahviða with data value printingmoney420.bit, a known alt of namecoiner.eth.

The remaining output leads to a funds recycle and output 0 to the name update of asset i/adi-1. This was previously registered with value 2, like namecoiner.eth signs to identify his wallets. Toggling forward to UTXO 1 leads to the name update of asset u/greggindustries, which had previously been registered with value 1 as only namecoiner.eth does as well​.

Checking the UTXO with 16 NMC

Account namecoiner.eth stated, the transaction chain mentioned above around 15 NMC would result from an UTXO with 16 NMC coming from a trade. While the statement was right, that it results from this UTXO, his further statement, this 16 NMC were transferred through an OTC deal with a third person is evidently wrong: The 16 NMC UTXO leads forward directly to one of the Gospel fragments. Toggling backwards from the 16 NMC UTXO leads to this transaction. UTXO 0 from this transaction leads to a Gospel fragment as well. It's unlikely for 99.99 % that a third person registered exactly the same fragments of the Gospel of Mattew. Toggling back further from the UTXO with 16 NMC leads to this transaction. From here toggling forward UTXO 0 leads to a fake Punycode.

Screen capture second trace

This screen capture shows the reverse tracing of the second trace above​:

The start point of the reverse trace leads to a split of 1 NMC at block height 601,504 (08:15 of the video). At this point, the 1 NMC was transferred with TxID d611a29b172dec9b7c552623a1ac6b157b8d6cd4fcf3599151fd694972156a30, apparently from an Electrum wallet using Bech32 addresses, to a Core wallet using legacy addresses, both of which are used by namecoiner.eth.

​Toggling backwards leads directly to the scam asset "d/xn--7xa/" (with a slash at the end), toggling forward directly to the Gospel fragments and further to the ID record signed with the data value printingmoney420.bit as shown. It should be noted at this point that account namecoiner.eth joined the Namecoin Telegram group last year, and his very first question was how to register these Unicode Gospel fragments. ​

Exactly the same can be seen at block height 596,523 (09:46 of the video), where 10 NMC were split with TxID 0bc91dd4b469cddca2b577fb458feccd45f6b9b3108b726f589dc76eb0a2c60d, (most likely) from an Electrum wallet working with Bech32 addresses,​ to a Core wallet using a legacy address, leading directly to the fake Blockhead "i/thefrow-2 ​" (with whitespace at the end).

Two times funds were split, e​vidently to a Core wallet coming from an Electrum wallet, from the same transaction chain, once to create the fake Blockhead, the second time to create all known transactions from printingmoney420 aka namecoiner.eth. It's even very unlikely that a third person was involved, as both wallets created fake assets, the Electrum wallet as well as ​the Core wallet.

Forth trace

The first Gospel fragment​ mentioned before has been transferred to a transaction chain (possibly a different wallet) with a change of around 97 NMC. This leads toggling forward through countless unredeemed name_new OPs to this transaction. The name_new OP leads to asset u/atari as previously traced. Toggling forward leads to a funds split up. Output 0 leads to this name_new OP, which leads to asset u/griffin, signed with "1" as it's usual for namecoiner.eth. This was another, even more direct trace between the fake assets and the known assets of namecoiner.eth.

Fifth trace

namecoiner.eth delivered another transaction to check, stating, the 1 NMC input would come from a third person. But toggling one transaction back and one forward with UTXO 1 leads to the same Gospel fragments mentioned before. Toggling further backwards leads to the fake Twitter Egg "u/jonthepilot ​". The scammer, who had sold the fake blockhead "i/thefrow-2 ", adapted this username for his OpenSea account jonthepilot, holding the vaulted fake Egg.

Sixth trace

A further suspicious transaction was provided for analysis. Toggling forward leads to the update of fake asset "d/xn--4tws85e ​". Toggling the colored token of 0.01 NMC backwards leads to this firstupdate transaction. Further backwards leads to another transaction chain with an UTXO of 91 NMC. Backwards to the next redeemed name_new OP leads to the firstupdate d/fl​ipme. Backwards leads to a spli​t up of 2 ​NMC.

A few blocks forward a funds recycle leads to asset d/btc420, which is vaulted by 👨‍✈‍.eth. Further asset of that transaction chain is x/money, which is vaulted by user 👨‍✈‍.eth as well. Here the UTXO of 93 NMC came from an exchange. This transaction chain is not the same as the UTXO chain with 93 NMC of the first trace before.

Transaction analysis on Ethereum

This transaction analysis shows the interactions of the involved accounts on the Ethereum blockchain, provided by metablck:

Transaction analysis on Ethereum

Involved accounts

In summary, there is a high probability that the accounts listed below collaborated with each other in a coordinated way. Since these accounts are anonymous, multiple persons may be involved in the transaction chains. It should be taken in consideration that the transaction chains may be mixed by trades as well, eventually even performed on different blockchains. Whenever a transaction chain gets interrupted and a new chain of UTXOs appears, a trade made have been made as well.

On the other hand, it is very unlikely that the transaction chain starting with TxID d4f14c32725dc24677867b5f5689fba878ce5938781a88f3d5ca3487d8158bad referenced in the first and second trace, which leads directly ​to two scam assets as well as to the known transactions of account namecoiner.eth, was interupted by any trade.

However, due to the number of traces, evidence was provided that all accounts listed below interacted with each other on the Namecoin blockchain:

A final conclusion was dependent from a plausible, traceable and verifiable explanation of the involved accounts, how to interpret the interactions with the scammer's wallet. Within a time frame of four weeks, the account namecoiner.eth was publicly unwilling and unable to provide such an explanation.

​June 15, 2023
Uwe Martens

Latest news and updates:

⚠ Scam alert and transaction analysis15.06.2023To be checked on request is a fake blockhead "i/thefrow-2 " on the Namecoin blockchain, minted on Friday 28th of January 2022 20:10:57 (GMT/UTC)Announcements
⚖ The Quantum Case22.03.2023The incredible Quantum case, for sure the most legendary court case in the history of the crypto universe, has come to its first court decisionOpinions
⚠ About real and fake NFTs21.02.2023For some time now, the “ordinals” pandemic has been hitting the NFT space, leading to an irrational rush for fake NFTs and technically ending in a long-lasting attack on the Bitcoin networkOpinions
⚙ New Namecoin specifications15.02.2023In preparation for the release of the new Namecoin DNS apps, a total of 48 new namespaces have been introduced.Announcements
Web3 Domain Alliance09.12.2022In order to become independent of ICANN's regulation, Namecoin was created in April 2011 as a Web3 blockchain DNS. Now the Web3 sector shall get regulated by the Web3 Domain Alliance?Opinions