Father-son hacker duo is helping people crack into their lost Bitcoin | Hacker News Reader

Father-son hacker duo is helping people crack into their lost Bitcoin

hypebeast.com

58 pointsfortran7758 comments

You’re expected to hand over as many of your passwords as possible, and explain how you generate them. The company then attempts to use variants of your passwords, by changing capital letters and numbers.

They claim they’re making decent profits and have a 27% success rate. Good for them and their clients if true, but a lot of the early adopters who would require their services would presumably be tech-savvy enough to have tried some of their techniques themselves and be skeptical when expected to have “100% trust in the process”.

So I doubt we’re getting a thriving cryptocurrency recovery cottage industry any time soon.

I am tech-savvy enough to have ran hashcat and everything else in attempts to unlock my Ethereum pre-sale wallet yet I still contacted someone with decent recovery rate to try it, too in the end (they also failed) under similar conditions. It's not that rare but my impression is that there's only occasional work.

That’s fair. I’m wondering if the team you contacted had the same approach, i.e. required you to provide your other passwords and reasoning behind them.

Yes that and more. Thankfully I have long ago changed how I generate passwords so there weren't drawbacks for me.

I know I’d still be reluctant to give those kinds of details, but that makes sense. Hope you end up recovering your coins… or at least getting over it.

It has been long enough, that spouses discover their partner's wallets upon their death, that children a parent's.

In these contexts, there may be no tech savviness..

Given that their approach to recovery includes extensive collaboration with the owner, i.e. the individual who created the password, I doubt those types of scenarios would apply.

The original owner gone, close relatives often have some inkling of account passwords.

They also know best how the original owner thought.

A lot of people have passed on, leaving crypto behind! A non-tech savvy sort, often has zero clue about brute-forcing, and may seek a "reputable" source of assistance.

I concede it is possible. I just don’t think it would be a sustainable business model. Maybe if you get one really big catch…

I do wonder about the overall sustainability...

Something is wrong here. Either with the article or with my understanding of Bitcoin wallets:

    The process of cracking into a Bitcoin wallet
    is simpler than it seems, though it requires a
    deep understanding of how humans choose passwords

Isn't it that Bitcoin wallets produce a sequence of 12 random words? And then display those 12 words to the user to memorize?

As I understand it, humans are not chosing passwords in this process.

It sounds like you’re talking about BIP39 which is a fairly new idea. A Bitcoin wallet is actually a 256-bit random number (the private key) and a corresponding public key (which is derived from the private key).

Before BIP39, people would generate private keys by hashing passwords. Which is probably what this article is referring to.

Actually no, the private keys were generated randomly but the wallets were encrypted with a password. Private keys hashed from regular passwords don't have enough entropy. This encryption made sure that in case a hacker gets access to your wallet file, they can't access it without the password.

Sure, that would also work and was likely popular with people who were confident they would not lose the cipher-text.

See the "Brain Wallet" tab on bitaddress.org to see how a password-based secret key can work (please don't actually use this).

https://www.bitaddress.org/

The wallet seed is a list of 12 words, which can be used by any wallet to restablish ownership. But many wallets allow you to export an encrypted backup, protected by a user generated passphrase. In this case, you don't need the seed.

I have been procrastinating on this for a long time, so I might as well ask here:

I own a very old wallet.dat[1]. It is from a time when you had to compile some C files to a command line tool which downloaded the whole blockchain [2] to your computer locally.

I'm pretty sure I have never had to specify a password (or 12 random words). I remember this because it seemed odd to me back then.

What is the easiest way to check if this wallet.dat is intact and what is in there? [3]

I'd prefer if it would be possible to check without transferring it to a service (like Coinbase, or similar), but I'm open to that, if it is safe.

[1] Actually I have two different versions of it with slightly different sizes and couldn't figure out which is the most recent.

[2] I think it must be in my backups as well, but it is probably not of much use.

[3] I have a pretty good idea what should be in there and even know the Bitcoin address used. Still I would like to verify independently if my memory serves me right and if I could transfer the Bitcoins if I wanted to.

Get the official bitcoin client, sync it, and put your own file in place of the default wallet file. Then you're done.

Also don't forget you will have coins on all the forks, get those as well.

Never had time to wrap my head around forks. If I have a wallet from the time before forks existed, do I have to do anything to not lose my money in case a fork "wins"? Or is this the wrong way to think about forks?

I'll answer about the forks at the end...

I personally would only import that wallet.dat on a fully offline/airgapped computer (which you've synched to the BTC blockchain first), prepare the transaction to move those coins to a safe address (like an hardware wallet), put that transaction on a USB stick, put that stick in an online computer and broadcast the transaction.

But first and foremost: buy a hardware wallet, learn how it works, make sure to have copies of the seed (24 words probably), "warm" you address by having a friend send you 0.01 BTC on it or something, move these coins to another address (you really want to be sure this address works and everything is smooth). This costs some money (a hardware wallet + the fees to "warm up" the addresses / test how it all works) but if you have an old wallet.dat with some or a lot of BTCs, it's worth it.

And also: move the most valuable coins first. So BTC first, then BCH, then BSV. I'm not kidding with this. So many scams with the forks / executables to synch the forks etc. Don't even think about moving the BCH/BSV etc. before having moved all the BTCs.

Re- forks: depends on what you mean by "winning". BTC "won" over BCH if you take the market price (45 K vs 500 USD) but BCH lives on. So if your wallet.dat predates that fork, you'll have both. Once again: do not ever try to move the BCH before moving the BTC... For you want to minimize the places where you import that wallet.dat for the most important coin.

Now if by "winning" you mean: one chain wins and the fork dies a sad death, the point is moot as there's no other fork/chain and hence coins there are worth 0.

If you have an old wallet.dat, you'll have coins on the BTC chain, the BCH chain, the BSV chain, the BTG Gold chain, etc.

If you purchase a hardware wallet, make sure you buy it directly from the company making them, and read the official instructions.

There have been scams where people sell hardware wallets with seeds that the scammers provided, and once the victim uses the hardware wallet with the scammer-provided seed, the scammer steals the victim's coins.

First you make many copies of that file, to different disks and usb-memories.

Then you can load one of them into bitcoin-core wallet and you are done.

That file should be all you need, it is unencrypted and contains your bitcorns.

> First you make many copies of that file, to different disks and usb-memories.

This is exactly what I've done with it so far, haha.

> Then you can load one of them into bitcoin-core wallet and you are done.

Sorry, I'm completely out of touch with Bitcoin by now. In the beginning there was not much info and everything was low risk anyways. Nowadays there is so much noise and I'm never sure what to trust.

When you say bitcoin-core, you mean the client I can get from https://bitcoincore.org?

If I understand the instructions correctly I should enable pruning and need to download and store about 6 GiB, but that's it.

> That file should be all you need, it is unencrypted and contains your bitcorns.

Sounds good...

I think you can also import them in "light" wallets like Electrum. That way you don't have to download the whole blockchain. You may be leaking the information that somebody with your IP address has Bitcoins, though.

It's easy to configure Electrum to use Tor or any socks proxy if that's a concern.

bitcoin-cli --dumpwallet "filename" should give you the private keys in WIF format

He needs the public keys to check the balance.

Those random words are the master seed. Usually you don't enter the master seed to use your wallet. Your wallet encrypts the master seed and unlocks it with a password of your choosing. I suppose they are talking about the password to the wallet, not the Bitcoin keys.

So you have to remember two passwords?

The master seed and the wallet password?

How is the wallet password created?

No you don't have to remember the master seed. You should write it down and hide it somewhere, though. You need it if you lose access to your wallet. (It's a bit like a backup of the encryption keys for your hard disk, if you have enabled disk encryption).

The wallet password depends on the wallet of course. I guess you often create it yourself or it may even be optional.

I wouldn't recommend that approach for storing large amounts.

From their website:

When we can help?

You wrote down a list of words, and the passphrase is some combination of those words

You thought you knew your password, but perhaps it involves different numbers or different capitalization than you remember

Also worth noting that the sequence of random words is a pattern that has only been standardised over the last few years. There are plenty of random zip-encoded (etc) files around from before this.

Is it bad-faith to suggest this was just an advertising piece? I don’t want to be that person, but there seemed to be absolutely nothing interesting or innovative in the technique this father-son team use, and the whole article (and now it’s on the front page of HN) seems like just a vehicle to spread the word about their service?

75% of Web content is designed to advertise in the content, 24% to advertise next to the content.

I wasn’t aware that there was 1% of anything else.

Unless the 1% is the embedded affiliate links?

That is cat videos

The 1% is content that is sold. WSJ, Economist, premium Substacks, etc.

Mt. Gox still has mine. I haven’t invested in crypto since.

you may already know this, but there's a little under a month left to secure recovery of about 20% (at today's market price) of whatever you had there.

I think I've been going through that process, but would you mind listing what one has to do to secure recovery?

There's currently a vote (https://twitter.com/theshawwn/status/1435320592350187523) but is it required for us to actually participate in the vote?

I've been involved with it since the beginning, when the process was less formalized then it is now, so I don't know what the steps would be for someone just starting the process right now. However you need to register a claim with the trustee handling the case in Japanese Court. I was under the impression that the window for initiating a claim under normal channels has passed, but I have heard of other claims still somehow being recognized.

Beyond this second hand info I couldn't help you. As I suggested to another commenter, check out r/mtgoxinsolvency on reddit.

Regarding the vote, the answer is yes - but you cannot vote without having an approved rehabilitation claim, which confers a claim balance that weights the impact of your vote.

How does one establish the ownership proof for class action lawsuits? I lost my holdings at Cryptsy, but I don't know how I would produce a proof of ownership. I do recall the net worth of my holdings.

I wanna know this too. I had some small amount of coins in there too, that I’d completely forgotten about until I was notified of the class action. I’m sure they were barely worth anything, but are you supposed to do in that situation?

I would like to know whether these mail are sent to everyone with an account there or only to people who had some standing balance.

I believe all of the balance information was destroyed, so I'm not sure how they're managing any of it.

I haven't heard of the class action for Cryptsy, did someone track down Vern from his (reported) bugout safe house in China?

Didn't know about this. How is this?

try the reddit forum for this topic, r/mtgoxinsolvency

Ditto. On the other hand, supposedly they're paying out someday.

So you give them a bunch of hints how to crack your password, and if they do and don't tell you, then you'll likely never know.

you could monitor the bitcoin address and watch if the funds deplete.

Also there is no guarantee they remember their address either?

Many people will have addresses saved at places they exchanged bitcoins with, like an exchange. And it only takes one customer with proof of stolen funds to ruin their reputation, and with that the whole business. It makes much more business sense to be honest and take the 20% commission, unless someone comes with a wallet with far above the usual number of bitcoins inside.

of course, you can also imagine someone using a decoy wallet too to see if they are honest. I am not saying they should do this obviously :)

If you wait enough time, you could get plausible deniability I suppose.

You’d see it move on chain

They’re not making much. In 5 months (and likely ever) the highest wallet they recovered was had $250k

I wouldn't mind making another $50k every 5 months. Assuming this wasn't their only success that sounds more profitable than a regular job in New Hampshire.

Right but micro companies make up to $1mm a year and they’re nowhere close to $1mm. It’s like a micro micro business. 1 employee kinda thing. I would’ve expected a bigger company given how much money is lost in btc

+ it's probably fairly interesting work. Beats putting up takeaway websites

Reply on news.ycombinator.com