&gt;By definition, Rovion was in deep undercover mode. How would Bob have gotten a hold of Rovion? Did he know of Rovion&#x27;s partial penetration? If so, how? If not, then how did they meet up? In any case, how did the two hackers exchange messages?<p>If the attacker didn&#x27;t have root or wasn&#x27;t using a fancy rootkit, it&#x27;s not surprising at all that his hack could have been discovered. Discovering the hack could be as simple as finding an unfamiliar php file that hosted a reverse shell in some directory. The attacker might&#x27;ve had some scripts in a folder. Communication could be started by editing one of the scripts to print a message instead.<p>A friend of mine as a student sysadmin once found a server was part of a botnet, figured out the bots communicated via an IRC channel, joined the channel himself, lurked for a while, found the operator connect one day, and talked. The server never had anything worthwhile on it, the server was re-imaged, the school never bothered pursuing legal action as the guy was in Russia, and I&#x27;m told they&#x27;ve played counter-strike together sometimes since then.<p>&gt;Why wouldn&#x27;t Bob take advantage of the backdoor himself? It&#x27;s not like he had much to lose. He&#x27;d already been ousted from ShapeShift and was already the target of an investigation.<p>Because he could get a bunch of money now and have someone else do most of the work probably.<p>&gt;Red Flag #4. Bob demands only 50 BTC for a backdoor. ... Why not split the proceeds in half, for starters?<p>If Bob has Rovion do all the work with the backdoor access, why would Bob trust Rovion to split the proceeds once he&#x27;s hit the motherlode? Much easier to get some money up-front and be done with it.<p>&gt;Red Flag #5. Rovion pays 50 BTC for a backdoor. ... How would Bob, then, demonstrate to Rovion that he wasn&#x27;t just a scammer, or a honeypot operator, but indeed had a legitimate backdoor to sell?<p>It probably wasn&#x27;t a single 50 btc transaction. Start it slow. (Just like how Erik managed to work out some trust with Rovion later.) Bob probably offered to not boot Rovion&#x27;s original access into the system for a few btc to start with, and they found somewhere to go from there.<p>&gt;Red Flag #6. Rovion is a moralistic individual who not only is a thief himself, but wants to see Bob, another thief from whom Rovion supposedly obtained credentials, severely punished, for being a thief.<p>Seriously, this is just grasping for straws. That doesn&#x27;t seem so strange. Or hell, maybe Rovion just wants to try to throw someone else under the bus morally. People trying to justify themselves is nothing new.