Hacker News Reader

Comment by DaiPlusPlus | Hacker News Reader

I’m curious how they “seized” the units of cryptocurrency here.

The cypherpunk trope is they either hacked their targets’ wallet with hither-untold mathematics or they used rubber-hose cryptography…

The idea of a Bitcoin nerd being forced by a court to transfer BTC via Bitcoin.exe amuses me - but that doesn’t sit right with me for some reason…

Unfortunately the article is light in technical details - does anyone know more?

View on HN

Easy. If it's a third party service like an exchange or other custody provider, get a court order, done. If it's on a personal wallet (very rare) then compel them to hand it over right now or go to prison until you do. No rubber hose required.

That's just rubber hose with a warning and paperwork.

It's just rubber hose with extra steps!

This speaks to a fundamental truth about cryptocurrency. In order to make it easier to use, these currencies adopt the trappings of fiat currency. When I had Bitcoin a while back, I always used an exchange. Most new users will do the same. And any financial transaction you're able to perform will likely go through intermediaries. Not because they're necessary but because they make things easier. If cryptocurrency is going to become mainstream, it will have to be indistinguishable from fiat for end users.

I'm amazed by what has happened to Bitcoin in the last several years. I played around with it about a decade ago, and that involved setting up a node on my laptop, creating my private key, and going to town.

Now everyone is trying to move to a second network (Lightning), but that system is so overwhelmingly complicated that no normal human being can actually manage it themselves. So everyone just has all their coin stored with third parties and no one actually has their private key anymore.

Take a look at one of the "wallets" sometime in your app store of choice. The negative reviews are complaints about onerous know-your-customer processes (make sure to scan your driver's license into your Bitcoin wallet, kids!), deposit and withdrawal limits, etc. From the reviews, you can't even tell them apart from PayPal/Venmo/et-all.

Alternatively, the trappings of fiat are the onramp and the social support that enable the meaningful use cases for the minority of power users.

Why would you assume that it's rare to have it outside of an exchange/custody provider? For that sum I'd expect most operation to have most of them in their own wallets.

What does ‘rubber hose’ mean here?

A rubber hose attack is also sometimes called a wrench attack. It's the use of physical action (often implied as violence or torture) to gain some secret.

And the reality of a "wrench attack" is illustrated in this xkcd comic:

https://xkcd.com/538/

https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis

> In cryptography, rubber-hose cryptanalysis is a euphemism for the extraction of cryptographic secrets (e.g. the password to an encrypted file) from a person by coercion or torture[1]—such as beating that person with a rubber hose, hence the name—in contrast to a mathematical or technical cryptanalytic attack.

The "beating with a rubber hose" thing, in turn, comes from allegations that this method is favored by the likes of secret police, intelligence agencies, and organized crime because it leaves minimal marks on the victim compared to other forms of physical abuse.

Along the same lines: To “”throw the book at him” is a double entendre euphemism (American) for both bringing a lot of charges against someone, and/or beating them with a phonebook because it (purportedly) doesn’t leave bruises.

Pretty sure you just made that up tbh

Bulgaria still holds the record of seized crypto, at 200K BTC which is at about 6.5 Billion $ ATM.

AFAIK, when the police comes to you the computer people come alongside with the guys with the guns and immediately start messing with your equipment before packing them for evidence.

How would they take your coins? If it's on an Exchange they will simply tell the exchange to hand over the dirty money. If the exchange is out of their jurisdiction, it can be harder but the cyber crime tends to be international in nature so they will probably activate some cooperation agreement and compel the exchange to hand over. If the exchange is extralegal, their best bet would be to compel you to hand it over.

The first thing the computer people do would be to take a look at the running devices and extract as much information is possible. They will take alive snapshot and manually look around your folders and browser history for points of interest. Since the raid is most likely to be as a result of an investigation they would likely have an idea what to look for. If they know that you run your business with BTC they would be looking for wallets and Exchange login info.

Once the accessible data is collected and disk images are taken and you are in custody they will start pushing you to give them access to the stuff that is locked down. Because you were investigated before the raid, they will have an estimate of your possessions and will know what to press for. If they nail you for some criminal activity, your best bet could be to cooperate and hand over your crypto if you don't want to be in prison for longer.

>Bulgaria still holds the record of seized crypto, at 200K BTC which is at about 6.5 Billion $ ATM.

It was sold for more like 3B euro[0] but yes still pretty good.

0. https://bitcoinist.com/bulgaria-not-bitcoin-1-6b-finance-min...

Keyboard logging, located the key paper on paper or a pc, seized from exchange, or cracked whatever wallet software they where using seems more likely than cracking the encryption or beating it out of the suspects. Really the more time you spend around people actually using crypto coins the less secure they seem. It’s clearly possible to be secure, but many people are doing the equivalent of stuffing their mattress with cash.

Doing the equivalent of putting your money in Fort Knox kind of kills the appeal of "money you carry in your head".

All you need to do is find an exposed machine with keys. That could be via physical seizures as well.

Or if it was on a KYCd exchange you just get a warrant and seize it.

I'd be my bottom dollar this wasn't some sort of cryptographic attack.

Wouldn't they just need the private key file that can be taken from the target's device?

The private keys are usually encrypted, so the attacker would have to brute force the password, install a keylogger or use a wrench, to give some ideas.

your weekly friendly reminder that refusing to hand off passwords to authorities is a crime in the UK, punishable with up to 2 years in prison (5 if the case is marked as sensitive for "national security"). That's a pretty nice wrench.

Not sure if that applies to a password used to secure crypto, since you can argue that the gov can see what's behind the password (ie: the crypto amount), and the purpose of the law is to reveal data hidden by the password, not to take control over it.

The "legitimate interests" clause is broad enough that it can probably be bent for that, but I reckon it would boil down to the interpretation of the "no signatures" clause:

> (9) A notice under this section shall not require the disclosure of any key which-

> (a) is intended to be used for the purpose only of generating electronic signatures; and

> (b) has not in fact been used for any other purpose.

I'm not versed in bitcoin enough to judge if wallet data protected by that password is used only for signing. This clause seems largely meant to avoid the possibility that authorities will impersonate a user after forcing him to hand over his key.

Info about the relevant law: https://wiki.openrightsgroup.org/wiki/Regulation_of_Investig...

I forgot my password.

Judges love arguments like this.

This has been tested in court as a defense. Try to guess what the result was.

Found the recovery phrase during a house search? Or phone search?

In the UK you have to give up any passwords or you get 5 years or something for failing that.

Maybe it was just sitting on an exchange.

Yup. Most criminals aren't masterminds. Fuck - most of them don't even take basic steps to cover their tracks. That includes people with big bank rolls occasionally.

This is worth emphasizing. There's a reverse survivor bias at play. No matter what people do, some fraction will be really bad at it. Think about any workplace. In the criminal world, these are the people who get caught the fastest and result in the flashiest press releases.

Reply on news.ycombinator.com