Last week's US government auction of confiscated Silk Road bitcoins has left a lingering mystery: who won the two biggest blocks of 27,000 and 20,000 coins?

The winners of the two previous US Marshals Service (USMS) bitcoin auctions always wound up announcing themselves within days of their successful bids.

The first auction winner was, famously, venture capitalist Tim Draper, who claimed all the 30,000 bitcoins for sale. The second auction saw the lion's share go to a syndicate organised by Bitcoin Investment Trust, although Draper again picked up some coins.

The third and most recent USMS auction had three winners, but only one of them has come forward so far. That's New York exchange itBit, which claimed 3,000 coins, the smallest tranche on the auction block.

Now blockchain-watchers believe they may have identified a second winner, who claimed the largest amount of coins – 27,000 BTC – on sale.

In following the trail of the mystery winner, members of r/bitcoin unearthed a two month-old tweet from an account bearing the name 'Cumberland Mining' that simply listed a bitcoin address. That address later received 27,000 coins from the stockpile known to be controlled by the USMS.

The Cumberland Mining Twitter account contains just one tweet, but follows five accounts, including Israeli exchange Bits of Gold, the London-based exchange Coinfloor and credit-card payments enabler Simplex. Its avatar is a picture of the character Steve Youngblood of the comedy troupe the Upright Citizen's Brigade.

At least two bitcoin notables among those following the Cumberland Mining account are Fred Ehrsam, the Coinbase co-founder, and Phil G Potter, a manager of the Bitfinex exchange.

The mystery deepens. A website that appears to belong to Cumberland Mining & Materials LLC reveals little information. The single-page site contains a large stock image of a mine trolley, and the only description of the company's activities is that it provides "solutions for bitcoiners". A contact email is listed.

A check with Delaware's Department of Corporations shows that Cumberland Mining & Materials LLC was incorporated there just over a year ago, on 25th February 2014. It is listed as being resident in the United States and it is in 'good standing', according to the state business registrar.

Cumberland Mining has filed no annual reports and it has paid $300 for its annual tax assessment, the standard rate the state requires from limited liability companies. The state does not require LLCs to file an annual report.

Independent analyst Danno Ferrin, who built a tool to track the movement of funds on the blockchain, has found that the Marshals Service used the same method for transferring coins to all three auction winners.

The USMS stated in auction instructions that coins would be transferred to winners in the sequence that their winning bids were received – first come, first served, in other words.

In the third auction, the first winner was itBit, the second winner won 20,000 BTC and the third winner – linked to Cumberland Mining – snagged 27,000 coins.

That method, detailed on Ferrin's Crypto Crumbs blog, shows the Marshals first sending a "test" transaction of 0.05 BTC to an address controlled by a winner.

A short time later – 30 minutes in the case of the first winner and two hours for the second winner – the full amount of coins won is transferred to the winner's specified address.

But when it came to the third winner, believed to be Cumberland Mining, the test transaction was sent near the end of the workday, at 4:30pm on 9th March. The Marshals then apparently left for the day, only transferring the full amount of 27,000 coins the following day at 7:45am Eastern Daylight Time.

According to Ferrin's blockchain analysis, the Cumberland Mining address began to "peel" coins off to be sent to other addresses.

The winnings were divided into three chunks of 2,000 BTC, 5,000 BTC and 14,000 BTC. They were broken up within hours of receiving the auction winnings from the US Marshals.

The 2,000 BTC chunk has gone to an address known to be controlled by Bitfinex for customer deposits, Ferrin told CoinDesk in an interview.

The analysis notes that 6,000 BTC was what remained after the three chunks were transferred out. This sum appeared to have the test transaction amount and other transaction fees deducted from it.

Ferrin believes that the Cumberland Mining address was acting on behalf of a syndicate of three winners, hence the coins being peeled off. The remainder of 6,000 BTC with the fees deducted were held by the syndicate organiser, possibly Cumberland itself.

He wrote:

Ferrin also noted that the transactions occurred in quick succession, taking place in three consecutive blocks.

"It's like he had a lineup of payments to make, or a plan of where to put the bitcoin," Ferrin said.

Ferrin cautions that while he stands by his theory that the big winner in the third auction was a syndicate with up to four members, including the organiser, the transactions could also show a single winner sweeping coins to cold storage and depositing a small amount to Bitfinex.

"There is a chance that this is just one winner instead of a syndicate, but the speed with which the three transactions were peeled off and the nice round numbers make it feel like they are [transactions] to specific entities that were known prior to Tuesday," he said.

While little is known about Cumberland Mining's activities, it appears to have links with several companies in the bitcoin space. Ferrin discovered the public PGP keys of individuals with Cumberland Mining email addresses while searching for information on the company.

The keys are listed on public PGP keyservers, where individuals using the PGP email encryption system list and verify their addresses.

These records also show that the keys have been 'signed', or had their identities verified, by executives in the bitcoin space. The public key for W. Eric Saraniecki, which has a cumberlandmining.com domain-name, and which is listed as a Cumberland Mining & Materials LLC user, has been signed by Mark Lamb, the chief executive of London-based exchange Coinfloor. It has also been signed by Shaul Kfir, the chief technology officer at Digital Asset Holdings and a former director of technology at Bits of Golds, according to Kfir's LinkedIn profile. Mike Paleokrassas, a senior trader at SecondMarket, is also listed among the signatories.

Other individuals with Cumberland Mining email addresses appear to have histories as professional traders. A Cumberland address belongs to an individual named Chadwick Miller, for example. On Twitter, Chadwick Miller lists himself as a bitcoin enthusiast, with a link to bitcoinbank.com in his profile.

In a 2012 interview with a website called Poker Tips, Miller says he worked for a "Chicago-based trading firm" after graduating from Indiana University. An individual named Chadwick Miller from Indiana is listed as a political donor by the Center for Responsive Politics, which maintains an open database of donations. Miller lists DRW Trading Group as his employer.

DRW Trading is the giant proprietary trading fund headquartered in Chicago. Its chief executive Don Wilson co-founded the bitcoin firm Digital Assets Holdings last year, which announced Wall Street star Blythe Masters as its chief executive yesterday.

Another signatory of Saraniecki's public key, Joshua Charnin-Aker, has a name that corresponds to a 'weather trader' employed at DRW Commodities. Saraniecki himself has a name that matches a New York-based "commodities trader" quoted in a New York Times article about buying property in the city.

CoinDesk has contacted the email listed on Cumberland Mining's website and the individuals listed on the keyserver for comment, but has received no response. The exception was SecondMarket, where Brendan O' Connor, a managing director who supervises Paleokrassas, requested a phone call to state that the firm doesn't comment on companies it may or may not be doing business with.

If the coins were won by itBit and the mysterious Cumberland Mining, what of the 20,000 BTC that has gone to an as yet unnamed winner? Ferrin has no guesses, although he stressed the importance of not re-using bitcoin addresses to maintain transaction anonymity.

"This winner had excellent 'privacy hygiene'," he said.

Image via Shutterstock

Correction: A previous version of this article called Simplex a brokerage. It actually enables digital currency companies to accept credit card payments.