A Clue About the DAO Attacker’s Location?

I used EthSlurp to scrape every transaction from The DAO since its inception. This first chart those transactions distributed by hour. There are more than 121,000 transactions:

As you can see, the transactions are relatively evenly distributed throughout the day. This is to be expected because the DAO token holders are presumably distributed evenly across the globe. This makes perfect sense.

So What?

Recently, a user called @kamvis on TheDAO slack published a list of accounts that he thought may have been related to the attack on the DAO. Here is that list along with names kamvis provided for each account:

Suspect Account Set 1

Let’s call this Suspect Set 1. These five accounts have made 795 transactions on the Ethereum blockchain.

In an unrelated but similar post, Johannes Pfeffer provided a larger list of possibly related accounts this very informative blog post: The Attack Story. Pfeffer’s larger list includes four of the five accounts from Suspect Set 1 in addition to seven other accounts. Pfeffer used his own names, but you can easily match up the addresses.

Suspect Account Set 2

There were 1,084 transactions on these eleven accounts. I charted the same hourly distribution on both Suspect Set 1 and Suspect Set 2, and while I cannot say for certain, I think I see a pattern.

Do you see it?

This is a person getting up and going to work in the morning, working for eight hours, and then going home. These times are Greenwich Mean Time. The start of the data is at 4:00 AM GMT. There are eight hours with non-trivail numbers of transactions.

I personally begin work at 9:00 AM every morning. So, when it’s 4:00 AM in Greenwich, where in the world is it 9:00 AM?

4:00 AM to 9:00 AM is a five hour difference. This would bring us somewhere in Russia, Kazakhstan, Pakistan, or India.

Of course, there is obviously no way to tell if the information I’ve provided is important or even pertinent. Is it anything? I’d love to hear what you think.

The data used in this post was provided by the EthSlurp software: http://ethslurp.com. If you find the information useful, please consider visiting our site and sending us a tip.