How My Client Lost 100,000 Bitcoins 

Inspired by a true story

I was inspired to write this story in response to the significant engagement and large number of DMs I got from this tweet:

This post explains how I first came across the case, what we have done so far to recover the funds, and where we stand today. To protect the true identity of the people involved, I have used fake names for parties and locations involved throughout the story. Also, the events described in this story happened a few months ago. I have tried my best to capture all the relevant information as accurately as possible in this story.  

The goal of sharing this story is to help Samantha (you will get to know her later) recover the bitcoins lost or find a conclusive ending to the mystery. 

The initial call

Several months ago I got a random call from a CPA (named Fox), based in Missouri. He knew my contact information because he had attended one of my cryptocurrency tax webinars.

Fox goes on to tell me a very strange story about one of his clients. The client in question received several bitcoins around 2010 and she couldn’t access any of them. For context, it is important to know that while Fox is a very sharp and experienced accountant, he's not much of a cryptocurrency expert. So, Fox asked if I could help him and the client regain access to the accounts.

At this stage, I assumed this was a case where a non-tech savvy user needed help figuring out how to recover a wallet using a seed phrase or It could even be a case where the user simply didn’t know how to reset the password for the account. I have encountered these problems a few times in my career and have successfully helped several people. With this in mind, I decided to help Fox and his client.

How a farmer received 100,000 BTC

I soon learned that Fox’s client’s name is Samantha. She runs an animal farm in rural Missouri. Back in 2010, she purchased some medicine for their farm animals from a European vendor using US dollars. However, before the drugs got shipped to the US, for some reason the drug had become illegal to import under US law. Since it was difficult for the European vendor to issue a refund in USD, the vendor instead refunded Samantha in bitcoin. We estimate it was about 100,000 bitcoin (worth about $1,000 at the time).

When Samantha first received the bitcoin, she didn’t think much of them. It was the early days for cryptocurrency and bitcoin didn’t have that much value. Also, she spent all her life in a small farming community away from technology.

At this point I was intrigued, though skeptical given how many scams exist in the cryptocurrency space.  I did some quick online research about Fox and his background, credentials, and affiliation with his accounting firm before I set up a Zoom call to learn more.

Troubleshooting remotely

During the Zoom call, Fox shared a bunch of public wallet addresses and xPub keys that Samantha had shared with him. I plugged them into CoinTracker to investigate their history. Some addresses came up with zero balances and no activity. Other addresses came up with balances with hundreds of bitcoin in them.

Exploring the Bitcoin addresses and HD wallets on CoinTracker

Again, I was intrigued that some of the addresses had significant bitcoin balances, but I also knew that these addresses could be public and belong to anyone.

At the end of the conversation, we both realized it was going to be too difficult to troubleshoot remotely. For example, we were trying to reset a password (with the client’s permission) for an exchange account she claimed to have funds in. The reset email was going to her personal email which we didn’t have access to and the mobile phone with the two-factor authentication was in her possession.

At this point, It was clear that I needed to be there in person to troubleshoot the issue. I took a leap of faith and made a 500+-mile drive from Houston to the small town where Fox’s office is located. I started the journey at 7 AM and got there by 7 PM on the same day. I was so anxious and excited at the same time so I didn’t feel any fatigue even after 12 hours of driving. As soon as I got there, I went to work straight away.

Reviewing the information in person

Fox’s room was filled with boxes and boxes of documents. It was a mess! These boxes contained hundreds of hand-written private keys and screenshots of every wallet and platform Samantha used in the past 10 years. In addition, there was an old iMac, ~3 USB drives, and one external hard drive worth of data. We also found out she had roughly five email accounts connected to different exchanges and wallets. We didn’t know which email account was connected to which. Some email addresses couldn’t be accessed at all. She also had data spread across multiple online drives (~two google drives, OneDrive, iCloud, etc).

You might think having this much data would be really helpful. It wasn’t. We were looking for a needle in a haystack.

After seeing the heaps of information around, my mind was racing to find a faster solution. I saw a bunch of bitcoin seed phrases in the boxes. I started recovering a few wallets, but they had no funds in them. Similarly, I scanned about 30 QR codes printed on paper. Again, no funds were found. Logging into other platforms using the emails and passwords she had written down was not successful either.

By this point it was 1:30 AM. I was exhausted and we decided to meet again on the following day with Samantha at the office.

Meeting Samantha

The following day, Samantha and her husband came to the office expecting some positive answers. We told her that we had started going through the documents, but failed to have any breakthroughs thus far.

Samantha seemed nervous and anxious. The loss of bitcoin had been haunting her for the past decade. She had tried multiple solutions over the years to recover the lost bitcoin, but nothing had worked. In addition to the stress, some of the events had occurred so long ago that they were difficult for her to remember. We calmed her down and helped her to re-think and re-create the series of events in a systematic way.

With our help, she was finally able to get access to an account. We saw a jaw-dropping $50 million dollars worth of portfolio being tracked. We were so happy and excited to see an account with a balance!

The same account captured on December 12, 2020 when cryptocurrency prices have ~2X’d

This was very promising and we had all been working 14 hours straight just to get to this point.

Unfortunately, this was as much progress as we were able to make. Samantha didn’t have any more information about where the balances were flowing in from, or flowing out to, nor access to the underlying account.

After spending two days there, I had to come back to Houston to carry out my day-to-day work. Over the past few months, we have been able to compile all the handwritten private keys, seed phrases, emails, and passwords into a spreadsheet and organize all the evidence to the best of our abilities.

Theories

  1. The private keys were compromised.

This is a very plausible scenario because Samantha was not a cryptocurrency expert. While going through her emails, we saw that she was talking to exchanges and various support personnel. She might have accidentally shared the private keys during these conversations. She also mentioned that she got help from someone from GitHub back in 2011-2012 to recover the funds. Her cryptocurrency holdings could have been compromised at several points along the way.

  1. She still has the coins somewhere; she doesn’t know where they are but the location is buried in the mountains of offline and online data.

This is the hopeful scenario. Unfortunately, we haven’t yet seen any concrete evidence supporting this (other than Samantha’s claims).

  1. She never had the coins to begin with.  

While possible, this scenario seems highly unlikely. Nobody in their right mind would talk about this subject to the point where it has negatively affected their personal and social lives. 

Right now, this project is on hold until we find some concrete evidence beyond her verbal claims. Having interacted with Samantha, I’d like to say I really believe her. She has no reason to deceive anybody. We will continue to look into the data and rebuild the story. I hope one day either we can recover some of her bitcoin or put a conclusive ending to the story even if it’s heartbreaking.

If you are still here, hope you enjoyed the story. I appreciate some of you who have reached out to me offering help. And remember to always keep your cryptocurrency keys safe!


Follow me at @TheCryptoCPA. 
Like, share & subscribe if you liked this 
www.shehanspeaks.com