Originally published by Patron#1 on Oct 22, 2021 at pint.network/t/forensics-indexed-finance/

Since the Indexed Finance heist of ~ $15m USD is a case involving a community at large, we are releasing our masked forensics report (no DOX), presenting our intelligence provision and its relation to that performed by the Indexed Finance team. The efforts combined strengthen the classic case of diversion in PsyOps. However fun-seekers may be notified in advance that this is likely not as exciting as the team report, because we are not publishing any reference links.

This report is intended primarily for the security community of decentralized space, as the focus of PINT Network are things that build on top of needs and natural course of the ecosystem i.e. putting closed functions of society on-chain first, contrary to the radical approach of eliminating human needs. That will make more sense as we proceed.

Following, we will get into specifics in a definite tone, however with a disclaimer that nothing is definite in cyber forensics, anyone claiming so is making a mistake and/or misleading their audience.

The identified primary motive of plausible perpetrator is feeding passion in relevance to asset management.

Definitions

• The team: Indexed Finance team

• Individual: Singular entity

• Faceless person: Limited trace of IRL identity, having no significant social proof

• Face person / Face: IRL identity having sufficient media and social proof

• Anon person: No trace of IRL identity

Common entities codenamed as

• Based: 0xba5ed1488be60ba2facc6b66c6d6f0befba22ebe ethereum address owner

• Disneyland: A close radius geographic circle within Canada

• Safehouse: A tri-country region of western europe

• DoughFactory: An active registered corporate within Safehouse jurisdiction

• Doughnut: Public code repos associated to DoughFactory

Profilings codenamed as

1. Alpha: mtheorylord nexus with evident ties to Disneyland and an individual face person, also the most prominent character

2. Bravo: Individual face person based out of Safehouse with evident ties to Disneyland

3. Chad: ZetaZeroes on twitter and the IDX team DOXed .xyz websites and email

4. JohnDoe: Individual anon person with evident ties to DoughFactory and Doughnut

Following is brief profiling factoring in: time, place, events.

2021

• UTC - Hour 19, Oct 14: Concludes the exploit moving funds in approx. value of $15m USD at the time.

2014

• Jun 20: The Face from 6th Grade, in a sports park within Disneyland, competes in a long race holding position in 20th percentile.

2015

• mtheorylord joins chess.com.

2016

• Sep: mtheorylord joins stackoverflow.

• Nov 25: mtheorylord on stackoverflow expresses being a beginner at C++ programming.

• Dec 23: mtheorylord joins github and creates "Grade-12-Project" repo, commit email is on official domain of education board in jurisdiction of Disneyland, attributed to the Face.

2017

• ~Mar: The Face competes in a programming contest from a 12th grade team.

• Oct 14: mtheorylord1 joins github.

• Dec 2: Competes and ranks below average in a maths competition as a university student.

2020

• Oct 5, 2020: mtheorylord on stackoverflow expresses having a master's degree in maths, and wants to pursue PhD in US, and has some knowledge of admissions in EU.

• The Face assisted in academic publications.

2021

• mtheorylord1 github associates to a crypto contract audit competition, indirectly linking to various discord accounts and conversations with team as well as competition organizers.

Bravo is a Face tied to academia, and has produced content in particular sciences over decades.

2000s

• Originates in Safehouse.

• Demonstrates ability in applied physics and biology.

2013

• Completes higher studies from an institute in Disneyland.

2015

• Professionally associates with an institute in Disneyland.

2016

• Publishes research work from Disneyland on [redacted], topics significantly relevant to mtheorylord.

2017

• Establishes a research group in Safehouse.

• Published more research work than ever before.

2019

• Dec: Reveals visual profile of a distinguished contrarian.

2021

• Aug: Discusses idealism, consciousness and brain in a conference.

2020

• Creates a website presenting information of Alpha Face in first person, an email with no other prior trace, and a photograph unevenly cropped out from a group photo.

2021

• Oct 3: Joins twitter as ZetaZeroes.

• Oct 15: Removes crypto association from the Alpha Face website.

• Oct 17: Tweets hello as ZetaZeroes.

JohnDoe is a faceless individual associated with DoughFactory and Doughnut.

2018

Acts from Safehouse.

• Github, twitter and medium handle have a peculiar handle+name match with those of Bravo across other platforms.

• Oct: Pushes documentation commits to Doughnut alongside other handles pushing code to the same, initially pushing a complete project built on C++.

2021

Acts from Safehouse.

• Sep 15: Pushes documentation commits for the first time since Q1-2019.

• Oct Week 1: Moves the website over to cloudflare.

• UTC - Hour 23, Oct 14: Pushes documentation commit to core repo of project.

2018

Oct: Two associated domains are registered from Safehouse.

2021

Aug 30: Associated corporate is registered in Safehouse in the presidency and directorship of closely associated Face person(s) residing in Disneyland as well as Safehouse, and active on finance twitter.

--

The Principal activity of DoughFactory is computer programming under the IT industry. While Dough is a product built around crypto portfolio management, balancing, diversification, algo-trading, AI assist etc. The open source code associated with it is a complete blockchain written mostly in C++.

Dough name, name of its components, handles of JohnDoe and Based have commonalities.

The chronology indicates following:

• Alpha was finishing Grade 6 in summer 2014, was competing in programming contest from Grade 12 team in summer 2017, same year was enrolled in university, and already done with master's by end of 2020, likely through accelerated program, accelerated enough to be under four years, indicating Alpha jumped Grade 9 through 11 i.e. squeezed high school into a single year.

• The specific naming of github project could be convention of the contest, or just normal brain function of Alpha or it could be that coders don't prefer including superscripts in repo name, or placing numbers in lead, as Grade followed by 12 followed by Project is a hierarchical categorization.

• Alpha very likely conducted entire academics in Canada, their mention of the EU indicates they have active ties to people in the EU who they received the said information from.

We codename unison of profilings as:

1. BJC: Bravo, JohnDoe and Chad

2. JC: JohnDoe and Chad

With clarity of time and further intelligence, we place higher probability on one of the following scenarios:

1. Either BJC or JC are Based. They have established a diversion for case followers to lead them to Alpha, carefully over the months leading to the exploit. Also painting Alpha as an anti-semite, neo-nazi, anti-african-american, 4chan inspired character, using the code, the eth address, communication with the team in weeks leading in and out from the exploit. Using twitter, further incited the victims with reinforcing the same characterization, while taking the input from trolls and repeating the ideas with articulation.

2. One of the above is the handler of Alpha and is using directives to have Alpha conduct the exploit, which makes Alpha complicit in the act, but not prime suspect.

Evidence linked to Alpha face suggests they be mentally unfit, and after all the controversy and DOX, they might even wrongly confess when approached. However, following, we pronounce the null scenario group as well, but place least probability on it:

1. Neither BJC nor JC exists. Their constituting profiles have co-incidentally co-existed, co-worked and co-acted out with behavioral traces of Alpha and relevancy to Based, Indexed Finance, as well as Alpha over the last 6 years upto to proximity of hours leading to and away from the exploit. While Alpha is further in on the spectrum, gaining the acceptance in Disneyland as a genius and is confident that they are untouchable.

2. Same as above except Alpha knowing Bravo has applied Bravo specifications to their conduct during their time in the university, and then deliberately applied the same in carrying out the exploit.

In any scenario, the M.O of a passionate perpetrator is carrying out their mission as a craft which involves hints to their passion. We have identified four such long-existing verbal cues that are carefully crafted in irony, and lead to our most likely scenarios.

Sociology plug: If Alpha is the sole perpetrator by an off-chance, their black hat was handed to them by a centralized academic system; Jumping the hoops so fast caused delusional personality and a severe case of Dunning-Kruger. Instead of throwing their youth into college, handing Alpha an honorary PhD in 6th grade and putting them to work would have avoided construction of such abnormality resulting from years of artificial competition. All the evidence relates to not exceptional ability but enough time to zone into obsessions, because their subculture artificially pushed them to over-optimization and incentivized madness while disincentivizing a constructive social life and productive civic learnings.

Lastly there is derivative evidence of mtheorylord1 github that through recent private conversations and ethereum addresses linking to age-old transactions, circle to IRL person whom we call Alpha Face. We have lumped this derivative evidence as diversion that is Chad, on the other hand, zoning into these strengthens the case against Alpha Face, which is also by first principles the desired effect of a diversion, and results in things such as escalation with involvement of 3rd parties jumping to conclusions.

Practically, the traditional implementation of the justice system is not only broken in and of itself, but applied to the decentralized space, it is incompatible. Other actors have also reported that no kind of DOX and tip to traditional law enforcement and intelligence gets the actual perpetrators to traditional forms of justice. Perhaps, unless there is enough money involved for lawyers?

Decentralized Anything is the free-est construct there is, which is also what allowed the indexed finance team to dig in and release information as they saw fit. Their results, commendably so, are distinct and may be exciting to the community, yet need condemnation on certain acts. Instead of flipping posture and going independent on damage control, appreciating discourse on innovation, accountability and loss owned by the community is the only way to bootstrap the parallel systems without jeopardizing their spirit.

So what is the way forward? Crypto sub-community concerned with security side of things, should come together and work on mechanisms to document all such events in detail, secure them permanently, and build systems to aid open forensics through incentives, contrary to closed forensics by traditional legal professionals banking on loopholes in laws produced by kingmakers. Incentivize the community to counter exploitation, with the goal to shift some risk from investors to the would-be exploiters. Just throwing protocols out there with marketing is not the way forward, centralized audits have time and time again proven to be ineffective; We reckon they instead help the exploiters in their works.

The flaming of investors is justified given loss, harsh reactions against the team are also justified given the state of DeFi. Code, law, money, incentive, rule of intent or algorithm, middlemen enabling or disabling protocols? Is code law? Is law code? Is law law? All are fair topics that need careful attention, and discourse by builders across the space, and not just founders of "blue chip" projects. Neglect will lead to in-fighting.

Even with recent genesis of PINT Network on World Standards day, ironically the day of the exploit, we have worked by our spirit and proposed a direction for accountability and derisking of project teams, and will continue following up on our proposals. We invite community to use tx messages to Based eth address as a platform to share their relevant works, it costs but a small price to pay for progress.

https://web.archive.org/web/20220403160005/https://pint.network/t/forensics-indexed-finance/