Exclusive: Address with 1564 Bitcoins of Unick Forex is target of dusting attack on the first day of 2021

Address containing 1564 Bitcoins of Unick Forex and which were seized by Federal Police were attacked on the first day of 2021

The year 2021 started with Bitcoin trading above US$ 29 thousand and testing the levels in search of surpassing the US$ 30 thousand mark.

But, besides the price, a fortune in Bitcoins linked to one of the biggest blows in the history of Brazil, Unick Forex, is being attacked this January 1st.

From the Telegram messages of Leidimar Lopes sent to Cointelegraph our team was able to identify a possible address to which more than 1564 Bitcoins, from Unick Forex, would have been sent.

The address – bc1q0q6rshyllhwj6r9808meqcjl44c9rj7y7jzf62 – is in BC1 format, that is, in bech32 format with segwit activated and is being targeted by a Dusting Attack since several transactions with values of 547 satoshis are being sent from addresses that are no longer associated with a private key.

Who are the Unick Forex Bitcoins with?

The supposed address containing the Unick Forex Bitcoins and the dusting attack they are receiving generate important questions about the Federal Police investigation and the result of the Lamanai deal.

In the messages that the Cointelegraph had access on September 4th, 2019 “Rudimar Fernandes” which is a pseudonym of Leidimar Lopes, sends an address to another member of the supposed Unick scheme, “Israel Agência”, which would be the Unick’s communication and technology director, Israel Nogueira e Souza.

Nogueira e Souza is accused of acting in the development of systems for the operationalization of the company’s activities. He would assist in opening a company for the alleged criminal organization in Los Angeles (USA) and bank accounts for the supposed receipt of funds from investments.

In the conversation, Leidimar passes an address to Israel and requests the sending of the Bitcoins and, for that, provides the credentials for the access to wallet (probably at Bitgo)

The address informed by Leidimar – 3GxPSHrE55SXfbfCReg7bcH9gL7RKSeJ1a – would have received 824. 25104100 Bitcoins that, in turn, were moved to other addresses, such as – 3Q4Fi8VWeAAzmVAe1T88PXH7bDvXF8b3if – leaving a balance of more than 444 Bitcoins that were moved to the address – bc1q0q6rshyllhwj6r9808meqcjl44c9rj7y7jzf62 – on September 17th, exhausted on the day that the Lamanai Operation was performed.

So, everything indicates that the address that today contains the more than 1500 Bitcoins of Unick Forex was created two days before the Lamanai Deal, by the Federal Police on September 15 since that day the address received 0.00050000 Bitcoins from an exchange – 1NDyJtNTjmwk5xPNhjgAMu4HDHigtobu1s.

In the sequence, the address starts to receive transactions again only on September 17th, starting at 9am. The Lamanai Transaction that culminated with the arrest of 13 Unick Forex leaders, among them Leidimar and Israel occurred on the same day 17th and started around 6am.

So, in the press conference of that day, PF had informed that it had seized around 1500 Bitcoins, besides money, jewelry, real estate, luxury cars and other Unick Forex items.
Hackers or Leidimar Lopes himself

To Bitcoin Expert and Chief Scientist & Disruption of BRQ Digital Solutions. Courtnay Guimarães, it’s hard to say who’s trying to ‘attack’ Unick Forex Bitcoins.

“I believe but I have no proof or information, so it’s just guesswork, that the Brazilian Federal Police know very well how to generate a dusting attack and how to prevent them. They are very well educated, not only them, but the FBI and other organizations around the world know very well how Bitcoin works technically, but it is hard to say that it is trying to attack, and if there is even an attempt to attack, the Bitcoins at this address”.

Guimarães raises that, in case the transactions involve a dusting attack, they may have originated from a ‘random’ hacker who searches for addresses with large amounts of Bitcoin like Leidimar Lopes himself.

The specialist points out that a dusting attack to the address is taking place not only on the 1st of this year, but on August 16th of last year and then for other times throughout the previous year.

It may be Leidimar himself who hired someone trying to find out if there was any movement in his wallet and trying, in some way, to recover ‘his’ Bitcoins, but we will probably never know who the real author is, if a hacker, if someone from Unick or if it is you who discovered the address”.

Leidimar, who was arrested on September 17, 2019, was placed under house arrest on April 2, 2020 with an electronic anklet, but between May and July the anklet was released due to technical problems.