Hacker News Reader

Comment by andrewla | Hacker News Reader

At one point a couple of years ago, for testing purposes, I created a brain wallet (that is, a short phrase that when hashed would yield a key pair) in Bitcoin testnet so that a group of people could each have access to them for testing purposes. It was just a simple substitution -- a common enough word with 3's and !'s mixed in. For testnet coins, which are worthless, it seemed harmless enough.

It was "stolen" literally minutes after first depositing the coins at the address; we assumed by someone running a monitoring daemon looking for a large rainbow table of bitcoin addresses, and testing out there efforts on the testnet. I wonder how many bitcoins they managed to extract once they put their system into production.

View on HN

Or they were a whitehat wanting your problems to be caught in testing.

If he screwed up their project without permission, that's not totally "white hat".

It was testnet, though, so worthless, and easily obtained (in small amounts) from a testnet faucet (like [1], [2], or [3]). We considered continuing to share, but in the end it was just easier for individual developers to obtain their own and use them for testing rather than managing a central pool.

[1] https://testnet-faucet.mempool.co/

[2] https://bitcoinfaucet.uo1.net/

[3] https://kuttler.eu/en/bitcoin/btc/faucet/

Is testnet just for ... testing?

That's the kind of stuff testnet is for. It's better to have worthless coins stolen during testing than real coins stolen later.

It's possible. We did a cursory look for the destination address to see what was happening. If I were a whitehat looking to educate people I would publish the destination address with a message saying what had happened, and probably send the coins back to one of the testnet faucets. As it was it looked like our coins went to a single-use address and sat there, which seems like more of a black-hat strategy.

I don't remember the address we used, though. Here's [1] a similar one, for "correct horse battery staple" -- the funds were moved (in the same block) from the address to a single-use address where they sat.

[1] https://live.blockcypher.com/btc-testnet/tx/835509e51ab9054e...

> I would publish the destination address with a message saying what had happened

Bitcoin does not support embedding messages in addresses (and embedding messages in transactions is controversial as it will be stored in blockchain forever, so many block explorers do not render such messages to discourage it).

I mean publish in the old fashioned sense - put it on a web page so someone could google it.

Reply on news.ycombinator.com