Police seize $60M of Bitcoin from fraudster, but he won’t provide the key | Hacker News Reader

Police seize $60M of Bitcoin from fraudster, but he won’t provide the key

reuters.com

29 pointsThisIsMeEEE74 comments

Open articleView on HN

$60M for a few years in prison is something most people in this world would happily take.

Looks like they didn't seize anything, and he controls the coins.

With that amount of money he can get out of their jurisdiction and live a really nice life.

> Looks like they didn't seize anything, and he controls the coins.

That depends where the convict has stored their private wallet key - and if it is accessible to him:

- Hardware wallets can be seized by the police and thus are worthless to both - the police can't access the funds without the password, the convict can't access the funds without the wallet.

- Similarly, on-disk wallets are worthless

- Brain wallets can be used in theory, but the police would instantly know if the convict did anything with them

In any case, the police statement that they "seized" a wallet containing the Bitcoins implies that it's either a hardware or on-disk wallet and that they are aware of the public key (otherwise, how would they know how many Bitcoin are in the wallet?).

With 600m you would think you would have (a lot) of backups. And what can they do when the statute of limitations expires or he goes to a place where germany cannot touch him?

Edit: 600m

its 600M now

Many people don't care about opsec. As for what the cops can do... international arrest warrants on both him and the money are one thing. I can easily think that the German government has notified the exchanges about the public keys and that any attempt to trade coins originating from them would constitute some anto money laundering guideline.

Besides, there is no statute of limitations on seized assets. If anything, he'd commit a new crime (theft of government assets) by accessing them.

You can also have a second well hidden "savings" wallet and send money there from the first wallet every month.

I find that an interesting question; if he does the time because he refuses/cannot give the password, can they still take him when he does use it? That seems weird as he will have done the time then? How does that work? They cannot pay that time back to him and, in a way, he exchanged it as punishment for the fraud + not paying back of the money right?

He may have served his time for fraud, but that doesn't mean he gets to keep the spoils. So would have the 60M seized, and then possibly arrested on new charges (something like tax evasion or lying to the court etc).

That time should have some provisions for the amount in it or not? I mean; if he does give them the password, does he get significantly less time or the same time? If it's the same, I would feel less morally conflicted about using the money afterwards as I already did my time, in part, as payback for the amount. But yeah, he committed substantial fraud, so not sure if the word moral enters anywhere in this conversation.

I would just flee to another continent

I would not have it in 1 wallet :) We do not know if he did either or do we? And yes, then maybe flee with one or more of the other wallets you stashed somewhere.

And hope the wrong people aren't tipped off that you're a $100M piñata.

With 100m you just change identities and shut up

> Prosecutors have ensured the man cannot access the largesse, however.

Ah yes, they've ensured he didn't memorize 12 words before they arrested him. Simple.

The password encrypts the wallet file which contains the private key which is required to transact on the coins. If the fraudster can not access the wallet file, it doesn't matter if he actually knows the password or not - the coins are essentially stuck in an eternal limbo.

12 words is a usual format for a so called "brain wallet". There, the 12 words are not a password, but a representation of the private key. Remember those 12 words and you don't need anything else to access the coins.

That's correct, but there are some extra considerations. Usually, a Bitcoin wallet will generate multiple addresses with different private keys, using the initial key as a seed alongside some extra parameters. The only real-world ramifications of this are that there could be compatibility issues between different wallet software, meaning some extra configuration is needed before being able to regenerate the wallet.

... and people were trying to convince everyone this is the new currency at one point

What I described is the complete procedure for regenerating a wallet set, from zero. If you want a real-world equivalent, it's like teleporting all the gold you own to your hand at any time. You might think the procedure is a hassle, but the reality is that you will have a well-secured computer as your primary storage. Being able to recreate a safe store out of thin air is just icing on the cake.

Unless they have a backup somewhere, which could be inside their brain if they memorized the 12 word seed phrase

One of the most amazing aspects of cryptocurrency is you can destroy your wallet and still retain your tokens so long as you remember the wallet seed: https://en.bitcoin.it/wiki/Brainwallet

I've done this and the way I remember it is by typing it in to a piece of software I wrote to connect to the Bitcoin network every day to ensure I still have access.

No just kidding. I don't do that for Bitcoin, but I do have an encrypted dead man's switch that has such a password.

No, it's not a dead man's switch, it's just a bunch of documents that no one cares about.

OK fine, it's porn.

BUT. I do type it in every day.

Well, that escalated slowly.

Modern wallets don’t encrypt the keys — that’s too risky in terms of managing backups. Instead, they use a key derivation algorithm to produce key pairs from a master key, and the entropy to generate that master key is designed such that you can write it as a sequence of 12 words.

In other words, the prosecution is either making a stupid mistake (and presenting wrong information in court), or lying. I don't know which is worse.

We just think it's funny because in this case it's damaging the government, whereas it's usually the accused that suffers.

In the UK there's legislation (RIPA) that would probably result you staying in jail until you came up with the passwords or convinced a judge you genuinely couldn't for some reason.

It looks like the prosecutor may have screwed up in this case:

“We asked him but he didn’t say,” prosecutor Sebastian Murer told Reuters on Friday. “Perhaps he doesn’t know.”

That seems like something the defense could use...the prosecutor is openly admitting the defendant may not know the password.

Edit: Ah, never mind. Seems he already served his sentence.

There’s something very unsettling about a law which forces you to provide information that you might not actually know.

I can see the pragmatic arguments for such a law. But it’s unsettling nonetheless.

Yes, very. I occasionally have a day where I cannot remember my master password for my password manager. Often after a prelonged break or change of context.

There's also this method of subconscious password storage from a few years ago, which, at least in theory might make it difficult for you to even reveal your password: https://www.technologyreview.com/2013/06/06/178157/a-passwor...

It is tricky, but genuinely forgetting the key and seed may be regarded as an unintended outcome, and it is a reasonable ethical principle that people who commit crimes can be held responsible for unintended outcomes. For example, the people who want Boeing executives jailed for the 737 MAX crashes are taking that position, and the concept of manslaughter is an explicit manifestation of the principle.

Commit crime, and pay for unintended consequences principle looks quite reasonable, but it's not what this law is about AFAICT. "Commit crime" part means it's already proven. This law seems applicable to someone who won't produce a key for prosecution to look for evidence against him. IANAL, but in many countries it would be seen as aggressive infringement of constitutional rights.

You can phrase it the other way: if you can make restitution, you get a lighter sentence. You can also make recovering the funds without making restitution a separate crime - and that can be extended to any windfall profits on your 'investment', as legally they were not your investments.

I was curious and google it

> jail until you came up with the passwords

Actually is:

> Refusing to comply with RIPA can result in a maximum sentence of two years imprisonment, or five years in cases involving national security or child indecency.

I'd doubt not releasing a bitcoin wallet password is "withholding evidence" or "obstructing an investigation" in the same way as not giving the password to your 5TB child porn or terrorism related info hard drive

In America the police routinely use "obstruction" as a way to intimidate and bully people into pleading guilty, or giving up evidence. I think recent events have shown that if the government wants it, they're going to get it.

Stories like these are so scary because encryption is(/should be) indistinguishable from random data. Imagine being accused of some crime and the police finds a USB drive formatted by overwriting it with random data. Then the prosecutor, not having found any evidence for what you're accused of, decides to fuck you over by saying the drive contains billions in bitcoin or CP but you refuse to decrypt it.

Ideally they'd be required to have some evidence that it's not just random data. Unfortunately, I don't think we can assume the real world is ideal.

The password is "hunter2", I swear. It doesn't decrypt? Dunno, maybe the file is corrupted?

Can this fly?

It could work if your attorney persuaded the judge. But it could also backfire and be seen as contempt of court.

The thing is the powers that be can basically accuse you of anything anyway and plant whatever evidence they need to get it over the line. Your civil rights are an illusion sadly.

They didn't really seize anything.. Not your keys not your coins

A wallet is literally someone's keys. The big question in this case is whether it's the only copy of their keys.

Since they know the addresses they can certainly watch the funds. I wonder if he has any release monitoring conditions. He'd need to find a jurisdiction and ways in which to spend it.

The article says why the fraudster was sentenced: "The fraudster had been sentenced to more than two years in jail for covertly installing software on other computers to harness their power to mine or produce bitcoin."

I knew an IT tech at a school district I worked at who did this back in the early days of BTC. He had 3 schools under his care which totaled around 1500 PCs. He built a custom image that had a hidden mining pool running, and over the summer he reimaged the computer labs first, then for every issue that cropped up on non-lab PCs, he would install his hidden pool on those too.

I'm not sure how many BTC he eventually mined, or if he ever wiped the mining pool off the PCs, but 10 years later, I know he has close to a $1M in various cryptos, so maybe he made out like a bandit.

If he uses a Trezor for exampe, it uses PBKDF2 with SHA256 which is very easy to crack with a GPU if the password is not that long.

That sounds pretty innocent. Normally that computing power is consumed by bloatware. Two years for stealing computing power from bloatware? That's excessive.

Is there precedent for this kind of situation? Cryptocurrency is unlike most assets which are either physical (can be seized) or held in a ledger managed by some legal entity (which can be ordered to transfer it freeze the asset).

A Bitcoin private key is neither of those things, essentially it's a valuable piece of information (intellectual property perhaps?), of which copies may exist.

Maybe an encrypted treasure map to a coffin with 60m gold/cash in it? The first who moves it, has it. Just like cryptocurrencies.

How could they guarantee he can't access it if he didn't give them the password? They can't transfer it

You can never be 100% certain but cold stored only Bitcoin or seizing all his computers would probably do the trick. Maybe he has the wallet stashed somewhere still, but they would know if he accessed them, at least by keeping an eye on those addresses in the block chain.

Don’t let him near a computer

In practice, if they confirmed the wallet address they can see if the money is ever moved. If it is, they can charge the guy again. And if he sells the whole wallet in the future, the buyer is likely to touch it, proving known access.

Sounds like the only way around it is to wait for the statue of limitations.

I am not sure how the law stands here, especially in Germany, but if using stolen assets is or is made a crime, waiting out a statute of limitations on the original crime may not be useful to him.

Ah, but they would also need to prove that he accessed it, wouldn’t they?

Teams dealing with tax fraud know how to do that.

Can one "own" a number?

A private key is simply a number < 2^256. Knowing the specific number gives control of the bitcoin.

Either one cannot really own bitcoin, or bitcoin has proven that knowing is owning.

Can one own a shape? Locks have shown that knowing the right shape can let you in any door, so either knowing a shape is access to a property, or locks don't really prevent access.

The capability to control something is not the same as the legitimate right to control something.

if you can just know the shape of a key to a lock, do you now own the contents of the thing being locked up?

If knowing is owning then stealing becomes impossible, because bitcoin don't know who owns (knows) a key. You need a 3rd party.

> then stealing is impossible

Uh don’t forget that Big Media had altered the definition of stealing such that your statement is now wrong. Stealing (as in “don’t steal a movie”) no longer implies you’re depriving anyone of the thing you stole, and now just means you’ve made a copy of a thing someone owns.

Assuming he has his password in mind I wonder if he could find a legal solution with the help of a well paid lawyer. Maybe a settlement etc…

Just need the right connections. Plenty of traffic lawyers are able to get you out of a county charge for a “fee”.

Pretty standard low-tech-accuracy clickbaity article. I didn't realize Reuters did those, but I haven't paid attention in a while.

So what exactly did they seize? If it wasn't a brainwallet, or was a physical device that they believe had no backups, the story would make more sense. Would have been pretty easy to include that info.

Also, if they have ensured the guy can't access it, like the article says, then this goes beyond seizure. They just want the money for themselves.

It is impossible to ensure the guy can't access it. If he has the 12 word recovery phrase, he can regenerate the private key without needing the wallet.

Assuming he has a copy of the wallet, the btc wont be there for long.

Laundering it would be difficult, but with that much money I'm sure he will still get a decent amount out of it after all the losses involved with laundering.

Yet another reason why BTC is money launderer’s preferred asset.

I'm pretty sure it's actully the US Dollar. More money supposedly gets laundered in USD every year than the entire BTC market cap.

How would they ensure that LOL

Just destroy the bitcoin. Who cares.

You would have to destroy every copy of the blockchain to achieve that.

Don't fall for the idea of Bitcoin usefulness because of that. If he would deal with another criminals then cryptorectal thermoanalysis would retrieve the key easily. It just proves that Bitcoin is a perfect tool for all kind of criminals.

... sticking a blockchain thermometer up his butt?

Reply on news.ycombinator.com