This is a copy pasta from /r/btc on reddit. The links are missing.
Please visit the full post with links here which also has better formatting!
While running the Censorship Notifier Bot, we generally try to stay out of any specific situations regarding any subreddits we monitor. But the very nature of the CNBot requires it to collect and store large amounts of data, and requires us to be aware of normal trends within a subreddit to ensure the bot is running correctly. Specifically, the bot needs to know exactly what was on the site at a specific time, and when things disappear from the site. This data positions us to diligently analyze events and check real data as we go. When we first began looking at the massive downvoting attack as shown in BashCo's previously stickied thread last week, the first thing we noticed was that both of the bot-voted comments ( Image of #1, link to #2 ) would normally trigger our censorship notifier detection. Both "censoring" and "censorship" are trigger words we have found triggering automatic removal, something we later confirmed again. This would imply that either the comments were explicitly approved by the moderators at that time, or our understanding of the subreddit's policies needed updating. We began to dig into the data available, and those findings lead us to the conclusion that we must publish what we had found. Note: All times are in UTC; Some references are moved to the end of the document, tagged as [REF-1], [REF-2], etc.
We'll start out by giving a rough picture of the events that transpired. The bots which were downvoting comments and posts on /r/Bitcoin and upvoting posts on /r/btc began their attack on 11/14/2017 at around 18:00 utc. A similar unusual pattern of voting appeared on /r/btc around the same time the day before, though less dramatically. The bots seemed to be pushing people to buy Bitcoin Cash in such a blatant way that it even left a bad taste in the mouths of Bitcoin Cash supporters. Both the attack the day before and the /r/Bitcoin bot voting attack on 11/14/2017 ended before or around 22:00 utc [REF-3]. The bots attacking /r/Bitcoin upvoted posts complaining about high fees and downvoted about 30 other /r/Bitcoin posts. At the same time they upvoted posts on /r/btc. We identified 65 comments downvoted by bots in /r/Bitcoin and 2 upvoted. The conclusions appeared to indicate that the bots were promoting Bitcoin Cash and /r/btc and harming /r/Bitcoin.
SUSPICIOUS COMMENT #1
We began investigating into the comments that caught our eye at first, referred to as [CU-1] and [CU-2] for short. [CU-1]'s content can be seen here as it originally looked. Immediately we noticed the next oddity - How were people able to see votes in /r/Bitcoin to discuss voting in the first place? /r/Bitcoin has blocked votes from being visible on comments during discussion for years. When did that change? We found that it changed right before [CU-1] was posted. BashCo stickied a comment stating they would "pull back the curtains" at 20:49, and archive.org confirmed that scores became visible between 20:32 utc and 20:50 utc. That, oddly enough, was just 13 minutes before [CU-1] was posted at 21:02:25.
We have determined that [CU-1] was indeed blocked by /r/Bitcoin's automoderator rules as we expected. The screenshot taken by /r/Bitcoin moderator StopAndDecrypt clearly shows this, as the "moderator approved" checkmark is present. We also tested automoderator rules with an aged account with karma and confirmed that "censors" and "censoring" were both blocked [REF-1]. Note that the poster, darwin2500 (under control of hacker, please don't ping them; they aren't a Bitcoiner) could not have been an "approved submitter" - they seem to have only had one comment in /r/Bitcoin before the hacking. So why was the comment manually approved? We are not aware of any other approved or allowed comments that blatantly reference censorship like that in the last several months. The obvious answer is that after "pulling back the curtain" and making votes visible, the /r/Bitcoin mods wanted to give people an opportunity to see this voting manipulation in action.
Except this idea did not hold up. We found 10 similar comments from the same time period which were not approved or were explicitly removed unlike [CU-1]. Some of these were uncannily similar to the original comment. For example this one was submitted 8 minutes after [CU-1] and never approved. Another here supported neither subreddit and was blocked at 21:48 and never approved. This one accused /r/Bitcoin mods of being paid by Blockstream and was manually removed at ~22:35. A fourth was identical to [CU-2] and blocked at 00:12 and never approved. The same account of [CU-1] submitted a second comment 5 minutes after [CU-1] and was blocked and not approved. The other 5 things blocked or removed around the same time were:     . The existence or absence of most of these comments around the claimed time can be verified independently of the censorship_notifier, see [REF-2]
But the why wasn't the only oddity. [CU-1] was submitted, approved, upvoted, and screenshotted all in less than 180 seconds, as shown by its screenshot ("2 minutes" rounds down on Reddit). That is an extremely short time for an automoderated comment to be approved based on what we have observed and in checking other subreddits open modlogs on approvals. Perhaps the moderators were very snappy about approving comments within this particular thread? Once again, this idea did not hold up. This comment appears to have been manually approved as it wasn't seen until the third scan after its supposed creation, ~11 minutes of delay. Perhaps only when the comment was a direct reply to BashCo? Still no - Here's a comment that was a direct reply to BashCo, but didn't show up in scans for 45 minutes. Here specifically the our data can be independently checked - This snapshot does not show the comment, but this one does.
Despite all the comments being blocked or removed as normal that we found, what we did not find was any other examples of anti-r/Bitcoin comments approved or allowed except the comments the bots upvoted. Three snapshots(  ) of the thread in question show no other strongly anti-r/Bitcoin comments present except [CU-1] and [CU-2]; Why did the moderators specifically allow [CU-1] and [CU-2] and nothing else? Perhaps they wanted to reveal the voting patterns, but then why only those comments? Further, by the time of [CU-1], the bot had not upvoted any comments at all. Why would the moderators assume that particular comment and no others would be upvoted, a mere 13 minutes after they "pulled back the curtain?"
In addition to the data we're referenced, our claims about the moderation of [CU-1] can be verified by either the admins or any current moderators of /r/Bitcoin, as moderator log events cannot be deleted. If anyone sends us an image of the moderator who approved this comment(preferably with full HH:MM:SS timestamp!) we will add the image to this post and keep their identity anonymous.
HOW DID THE BOTS PICK TARGETS?
The next thing we investigated was the behavior of the bots during the "attack". How many posts and comments did they downvote? How many did they upvote? What did they pick and were there any obvious correlations? We initially identified only two posts inside /r/Bitcoin that were upvoted by the bots - Both being posts about long delays on the OP's transaction confirmations. The first post was removed by moderators but otherwise no one seemed to notice the sudden upvotes. The second post upvoted on the other hand had users commenting on the upvotes within 8 minutes of it being posted and had several comments downvoted within it by the bots. Generally (but not always) the targets of the bots got 200-250 votes, either up or down [REF-3]. Even before the moderators of /r/Bitcoin revealed comment scores, users were commenting on the obviousness of the downvotes (edits). We found images from hacked users which showed what posts the bots chose to upvote and downvote, which further helped us identify as many of the posts as possible [REF-4] [REF-5].
The comments upvoted, too, were specifically chosen. Both comments upvoted were ones attacking /r/Bitcoin over censorship, and without any subtlety. Both comments were in the primary stickied thread with most of the comment downvotes. We quickly determined that the account that posted [CU-1] was under the control of the hacker, something other users also concluded. [CU-2] was posted by a clear /r/Bitcoin supporter based on history. Both comments used words that /r/Bitcoin's automod rules normally silently block [REF-1]. Other comments that subtly denigrated the subreddit's policies were noticed by the bot - but were downvoted instead of upvoted. Why?
The comments and posts chosen for downvoting were all over the place. Many of the comments chosen for downvoting seems to have been simply "because they were there in the thread" - For example every single comment visible in before 20:50 was downvoted. BashCo was targeted more than any other user(8 comments), but the bot generally didn't seem to focus on specific users. The vast majority of comments downvoted(54/65) happened in the stickied post, with 6 more happening in the second upvoted post. The remaining 5 comments downvoted were scattered across 4 different posts [REF-3]. The bot specifically went after comments and posts talking about downvotes, the accounts hack, or the attack itself [REF-5] but they also downvoted neutral posts. The voting seemed to come almost exclusively in waves targeting one thing at a time, which made the bot votes obvious to anyone who was looking for them - which people were, since many posts targeted were about the downvotes.
We also noticed that an extremely high number of /r/Bitcoin and /r/btc users were reporting that they themselves were hacked and part of the bot attack. We identified 35 such users, but the highest number of votes seen on a single thing indicate between 250-300 accounts involved with the attack. Over 10% of the hacked users were Bitcoiners, what are the chances of that? Well, Reddit has (very) roughly 50 million accounts, and the CN database indicates that about ~50k are regular or semi-regular /r/Bitcoin and /r/btc users, which is 1/1000th. 35 / 300 of hacked users being regular Bitcoin users and feeling the need to post about it is > 1/10th. Whoever was running this bot seems to have intentionally chosen Bitcoin users - It seems like they wanted the hacked users to see the results of the hack.
The result of all of this was that many many people commented on the blatantness of the voting, with many of them suspicious as to why anyone would do such a blatant attack. More examples:         . Amidst all of this there was one exception so subtle that we almost missed it - There were two posts voted on that ran completely contrary to the rest of the behavior of the bot. The first image showed upvotes on a pro-/r/Bitcoin post "PSA: Attack on Bitcoin" thread and a downvote for the anti-/r/Bitcoin "awkward meme orgy" /r/btc thread. At first we thought maybe this was a legitimate vote by this user mixed in with bot votes, but archive.org showed us that indeed that /r/btc thread got a sudden wave of downvotes in less than 23 minutes. Perhaps the bot forgot which side it was pushing for? But both changes were subtle and not noticed by any users as far as we can tell.
The final thing the bot did as far as we have identified was to upvote [CU-2], and then the attack seems to have stopped suddenly. That comment wasn't upvoted until 21:55 - 22:05. So what about that comment? Why was that the only comment not under its own control upvoted, and why did the attack stop suddenly afterwards?
SUSPICIOUS COMMENT #2
The CN database gave us some hints. Both the [CU-2] and this comment were deleted by the user, likely when they took back control over their hacked account. [CU-1] was deleted at 21:23 +/- 1 minute, ~21 minutes after creation [REF-6], and not present in that snapshot. The votebot operator probably didn't expect this to happen so quickly. After that deletion there was no obvious comment showing their upvotes on the thread, and there were no obvious choices to choose from. It seems that they wanted a comment that wouldn't vanish, so not a hacked account, and also that they preferred a comment that could ultimately be used to make /r/btc look guilty.
4n4n4's comment [CU-2] provided exactly this, and it was posted to the thread ~5 minutes after [CU-1] was deleted - at 21:28. [CU-2] was never blocked by automoderator, it was picked up in the next CN scan ~1 minute later... Seemingly because 4n4n4 is an approved submitter. They have a long history of pro-/r/Bitcoin comments; we archived 5 pages of comments. The moderators left the comment in place and the bot didn't touch it for at least 27 minutes. With the similarities listed above, [CU-2] made the ideal next target for the bot's upvoting. Almost immediately after it did so, 4n4n4 screenshotted, archived, and edited the comment. And then the bot's voting attack instantly ceased as far as we can tell [REF-3] [REF-5].
But 4n4n4 was not a hacked account. So who is 4n4n4?
SO WHO POSTED THAT?
We have a surprisingly large amount of evidence indicating that 4n4n4 is /u/nullc [-3] , the CTO of Blockstream.
The biggest indicator we found is that nullc has the very frequent pattern-- of writing--his sentences with two dashes separating words. This by itself is somewhat rare, though we confirmed that he uses it more times than anyone else in the CN database, the much more unusual habit is using two dashes with no spaces on either side. The CN database stored 860,000 comments for us to compare with, and very quickly confirmed the similarities between the two. His history is littered with examples, but we also used the bitcoin-dev email list to confirm the unusual habit. Like 4n4n4, nullc also has examples of using this--specific pattern twice in one sentence, which was extremely rare in our searches.
But there were many more things we noticed. We found several examples of 4n4n4 picking up nullc's conversations and continuing them. One such case was 4n4n4's third comment ever. 4n4n4 also referenced many of nullc's writings and posts. 4n4n4 referenced this code change that originated from nullc multiple times. 4n4n4's [CU-2] comment edit used the words "rbtc playbook," something our database confirmed was extremely rare but is a saying nullc likes.
And that was just the beginning:
Very knowledgable about Bitcoin Core development & the history of the scaling conflict.
4n4n4 picked up a thread after many replies by nullc arguing that low fees and empty mempools are actually a problem.
Just like nullc, 4n4n4 liked BIP148 but did not "support" or "endorse" it.
Seems to know an awful lot about nullc's life.
Used the phrase "Bitcoin's creator", a major nullc trait previously documented
Talks about nullc. A lot.
Somehow knows who is working on what within Blockstream.
And even responded directly to nullc in support of a claim nullc had made multiple times within that thread
After the massive amount of research we put into this, we believe that at least one moderator of /r/Bitcoin must have been either aware of the bot's plans (and allowed it to place blame on others), or have executed the attack themselves. This is most likely the moderator who immediately approved the [CU-1] comment. Other moderators may or may not have been involved. Meaning, yes, we believe that a moderator of /r/Bitcoin either directed or was complicit in the hacking of many of their own Bitcoin Reddit user accounts.
We believe that it is likely that /u/4n4n4 aka /u/nullc [-3] was also aware of or involved in this attack based upon the suspicious timing and similarities of [CU-2]. A Core Developer of /u/nullc [-3] 's experience would certainly have the technical abilities to pull off such an attack, but that is true of many others on both sides of the debate as well. Some users reported that the IP addresses the bots logged in from were vultr instances and that vultr 1) requires tracable payment methods like credit cards, and 2) takes an aggressive stance against abuse of their systems, so perhaps more information can come to light about this yet.
We encourage the Reddit admins to carefully review our claims and to validate them. If our claims here are true, surely some type of strong action is warranted. Please note that we have tried to make sure all of our links are archived, but they were archived under the http://www.reddit.com
domain and not the np.reddit.com domain.
For any people who found this post helpful and want to tip us, please donate your tips to archive.is and archive.org (not us). Without those two amazing services none of this research would be possible.
[REF-1] - Exact steps to confirm automoderator rules, on a aged account with comment karma: Before http://archive.is/ngxZk
-> direct copy of [CU-1] (blocked) http://archive.is/yq52B
-> "censoring" (removed) http://archive.is/geSvJ
-> "censors" (removed) http://archive.is/neMwe
-> After (showing) http://archive.is/LdZMb
[REF-2] - Links of userpages showing comments removed and subreddits showing missing: [1a] [1b] [2a] [2b] [3a] [3b] [4a] [4b] [5a] [5b] [6a] [6b shows missing]. These additional archive.org links show several of these items missing (or visible) at the snapshot time:     
[REF-3] - Data dump of all comments posted around the time of the event, with notes. CSV format.
[REF-4] - Images from hacked users:       
[REF-5] - Final vote tallies for all posts up to 24 hours prior to the event's end, with notes. CSV format.
[REF-6] - Records from the CN database regarding when darwin2500's comment was deleted. "minutesAlive" is incremented every time the item is seen and starts from the first_seen_live