Man has two more chances before $232M in Bitcoin is lost forever | Hacker News Reader

Man has two more chances before $232M in Bitcoin is lost forever

au.finance.yahoo.com

32 pointsbelltaco65 comments

This is one of those scary things with a cryptocurrency based society that I worry about. We want decentralisation (supposedly), but this is one of the benefits of centralisation where I can speak to and very my identify with someone with authority to access my funds should I happen to lose my password/key. Bank's provide this protection.

Perhaps I'm ignorant of other aspects/solutions. But this is my take with being solely responsible for access to my own funds.

I don't see how a "cryptocurrency based society" would actually work, but key management is not really the issue? You can give a copy of your key to a "bank" to hold (or even let them generate and keep it for you), use shamir's secret sharing schemes to split it for redundancy, etc. In a society where cryptocurrency was of any actual relevance, services and tools would be widely available to assist, just like you need to interface with and learn about banks today. Plenty of people in the world are still unbanked and even from those that are I would assume plenty "prefer to store cash in their mattresses".

Involving a third party in key management like a bank is entirely antithetical to the principles espoused in the white paper. Trustlessness is all or noting, and once you trust someone you are just doing what we do now but far less efficiently. A classically envisioned crypto society requires individual custody, or to borrow a turn of phrase “not your keys not your coins.”

Most people are unbanked not because banks don’t exist for them but because they don’t have money to put into an account. In the US online banks like Ally or Schwab are way better for folks who are legitimately unbanked than a crypto wallet - esp one they are unlikely to properly custody. Postal banking is an approach that has been historically hugely successful too.

Outside the US honestly I don’t know how folks wouldn’t be better served with for instance access to an account at circle.com vs USDC.

People not having money is a social problem that deserves a meaningful social solution - not digital magic beans.

You’re talking about Satoshi’s whitepaper? Because it talks about escrow services, etc. What principles are you talking about?

Bitcoin's trustlessness is not affected by people choosing to store their keys with a centralized entity; although the same can't be said about PoS coins. It's all about giving people the option to choose their preferred method of interacting with it, each with its own pros and cons.

> Trustlessness is all or noting, and once you trust someone you are just doing what we do now but far less efficiently.

Not true at all, as the GP explicitly mentions Shamir's secret sharing:

> Shamir's secret sharing (SSS) is an efficient secret sharing algorithm for distributing private information (the "secret") among a group so that the secret cannot be revealed unless a quorum of the group acts together to pool their knowledge. To achieve this, the secret is mathematically divided into parts (the "shares") from which the secret can be reassembled only when a sufficient number of shares are combined.

* https://en.wikipedia.org/wiki/Shamir%27s_secret_sharing

So you can trust various persons / entities such that m out of n need to come together before the secret is revealed. And each person doesn't need to have just one share out of n: if you trust one person more that you can give them two (or more) shares out of the n.

> give a copy of your key to a "bank" to hold

The irony, lol.

social recovery wallets mitigate this

look at argent.xyz

Nothing stops you from having a custodian with crypto; you’re merely allowed not to — and instead directly execute digital transactions.

If you don’t want to manage a wallet, just use Coinbase.

There are plenty of solutions, “account abstraction” with social recover is making big waves this week in some crypto ecosystems

This guy is using one solution from nearly 10 years ago, and it has some user experience issues

all the UX improvements are developed in bear markets, and they onboard the next million users that help result in the next bull market

> This is one of those scary things with a cryptocurrency based society that I worry about.

No, not really. It is the same kind of story as people putting all their money in a bag in a chimney to find out their family decided to finally lighten the mood by making a fire in long unused fireplace. It is an actual story about my neighbour when I was a kid.

People have been doing stupid things with money for thousands of years.

You can store crypto safely. It is essentially the same problem as storing encrypted backups. It has been solved.

As much as I hate cryptocurrency, I would actually be more at peace having lots of crypto than lots of stock on my account (if not for the fact that crypto is just a scam).

In happy magic future society, the community may decide to mint 232 billion ghost satoshis as a tribute, and they would accrue value out of sentimentality or whatever.

Something to keep in mind when talking to people about these ideas, they’re usually paired with some “apes together strong” kind of magnanimous idealism, where the community/market would come up with solutions.

How is this different than cash though? You need to be responsible with it or you'll lose it. No different than if he kept $232M in cash, buried it somewhere and forgot where.

When we don't want to be responsible with cash, we give it to a bank. Same with BTC.

Nobody sane and honest would keep $232M in cash, however.

Hmm

https://www.cnbc.com/2021/01/27/apple-q1-cash-hoard-heres-ho...

Its not held as actual cash https://www.investopedia.com/ask/answers/06/companycash.asp

http://www.ahead-education.eu/why-apple-sits-on-so-much-cash...

Nor should they. That's an insecure, single point of failure to have all your cash stolen. Same with storing $232M in BTC on a single HDD. Of course, at the time it wasn't worth anything near that and he wasn't concerned. The point is, BTC should be treated as cash. If you can't handle it yourself, you give it to someone else to secure for you.

Centralized solutions are often better in every single way save for them being the easiest to misuse and abuse.

> Bank's provide this protection.

A similar problem arises under other circumstances. And yes, there are off-the-shelf solutions now, eg: https://bitwarden.com/help/emergency-access/

Technically, "I forgot the key" access is not a difficult problem to solve. And because of they have digital contracts as part of their DNA, crypto currencies provide all the tools you need to solve it even without things like Bitwarden.

You are right about there being no "banks" in one aspect though. While there are any number of solutions out there to the crypto-currency key problem and some will do a better job than a bank, there is no easy and low risk way to find the solution that works for you. Certainly nothing remotely as easy and low risk as "walk into any USA bank and open an account". The real magic of a conventional bank is not all the protections in place (who hasn't been screwed over by a bank or credit card company at some point?), it is that it is a "well understand, everybody knows about it" convention.

It’s like we have made laws/rules in society to prevent/solve a litany of edge cases when it comes to money. It has problems for sure, but crypto would just hard reset all that without even thinking about the consequences.

It's a weird news. For sure there must be plenty of people who for say 10M$ would find the vulnerability or reverse engineer the whole thing.

Some of these encrypted hard drive devices are weirdly secure.

However, I can't see any harm in offering a bug bounty of 1/4th of the stash, putting up the model and serial number of the drive, and seeing who can crack it the fastest.

I think you’d probably need a team that could clone the drive first and then you could do your attempts. From what I understand, that’s difficult here because of the encrypted flash drive he used (tho obviously not impossible).

I’m sure someone like Cellebrite or the other agencies that have done iPhone hacking could do something like this — or at least figure out how to clone the drive to do multiple attempts at getting into it - but I don’t know how many places would do it on someone’s word that the crypto is there.

Like, yeah, for 25%, I bet you could find people who could get it done. But I don’t know how many of those people who would undertake that work on a promise. What if it’s like Al Capone’s vault [1] and turns up empty?

[1]: https://en.m.wikipedia.org/wiki/The_Mystery_of_Al_Capone%27s...

I think the comment above is: "show me cracking a similar drive with nothing on it" as a capabilities test.

if they could crack it for 1/4, why would they give him any of it?

"Sorry, we couldn't crack it, bye"

They demonstrate that they can crack it on a replica drive of the same model, then do the work in front of him to extract the private key.

And if the bitcoins somehow move after they "fail" (remember, the blockchain is public), he knows who to sue.

Joe Grand is one of those people: https://www.youtube.com/watch?v=dT9y-KQbqi4

Also here's a presentation on finding vulnerabilities in Ironkey flashdrive: https://www.youtube.com/watch?v=R8iAqA0pklw

Yeah, it’s weird the guy hasn’t reached out to someone like Joe. Instead he just keeps sharing the story with the press, but like, you need to be going to white and black hat hackers and security professionals.

I understand why it isn’t in Kingston’s interest to try to help him out, but if I had that much money trapped on something, I think I would do everything I could to actually free it, including paying people to look for vulnerabilities in the drive and reverse engineer. Getting those people to take me at my word might be tough, but I would do everything I could to release $200m in a wallet.

IIRC this device was actually secure due to being developed/audited for use by the NSA as well as plebs, so it's not as simple as cloning something then doing unlimited attempts.

The future of money ladies and gentlemen.

The government can’t take away your hard-earned crypto if you lost it forever.

you made a throwaway account to post this? Was this too hot a take for your real account ?

That account is actually a few days old.

My guess is that GP does the same as me. Create a throwaway account, use for a few weeks, then abandon it to create a new one.

This account I'm posting from is close to EOL, for example.

Why do that, though?

Edited to add, it's also against the HN guidelines:

"Throwaway accounts are ok for sensitive information, but please don't create accounts routinely. HN is a community—users should have an identity that others can relate to."

https://news.ycombinator.com/newsguidelines.html

I didn’t and don’t do that. This account is 9 months old and my only account.

I was responding to grog_tremor.

I was unaware of the guidelines. For a long time I was only a lurker here.

I won't contribute any other way however. Perhaps I don't feel comfortable having an "identity others can relate to".

That said, off I go back to read-only mode. Arrivederci.

I do the same. Anonymity is important to some here and not others and I think that's fine, despite the guidelines.

My account is 9 months old and definitely not a throwaway.

This account isn’t a throwaway. It has 9 times the karma of your account.

> throwaway5959

Yes, that is my name. Doesn’t make this a throwaway account, just like your username doesn’t make you a microprocessor.

The longer he waits, the less money he will lose in Bitcoin. A year ago, he would have lost $500M, maybe next year his losses will be down to $100M

Honestly, at this point he should try to sell the drive to someone for a fraction of the money.

I could see some eccentric billionaire paying a hundred grand to display it as an art piece.

>maybe next year his losses will be down to $100M

His losses will most likely increase next year as the bitcoin block reward halving is followed by an increase in price every cycle.

Worth keeping in mind that your own failing memory or poor information organization likely tops most threat models in practice.

https://www.kingston.com/en/solutions/data-security/ironkey

What's interesting here that even if Kingston would be able to help, it might not worth for them to do it because of their reputation (and $13B revenue)

Only 2 attempts left? Just clone the drive and run hashcat against it, I don't see the problem here.

it's on an IronKey.

The drive's firmware could be preventing that from happening: https://www.trentonsystems.com/blog/self-encrypting-drives

Although I don't think they have the auto-destruct feature.

But with 200M+ at stake, I'd put out a bounty for someone to reverse engineer the firmware.

Edit: sibling commenter says it's IronKey, reading about it, reverse engineering won't be that trivial...

It wouldn’t be. You’d think for a $50m or even $100m bounty, you could get people who hoard 0-days like Cellebrite to do it. I don’t know.

If it were me, I would easily give up half of it to get the money back.

You think they didn't thought about it?

Reading between the lines I think he has some sort of weird ass hardware coin wallet/high security encrypted flash drive that has some anti tamper smarts. I think the journalist used the word encrypted wrong here:

>Thomas has just two attempts left to guess the password before it's encrypted and lost forever.

I suspect they meant the drive would wipe itself after another attempt.

You could attempt to pull the controller chip and decap to extract the secondary key which would allow you unlimited attempts

This one would be extremely difficult.

https://www.cl.cam.ac.uk/~sps32/IronKey_teardown.pdf

There are good reason's why hardware tokens are more secure than password managers. First they are often damn near impossible to clone.

Offer someone 10% of the $200 million to find a zero day for it. That creepy Israeli company makes cracks for secure enclaves for lower prices than that, and for much newer security hardware.

If nothing else find a university with an election microscope and give some CS students a project of reading the key bits directly.

Enclaves keep out petty thieves, not determined attackers with unlimited physical access. Chapter 1 of cybersecurity is no hardware can protect against that.

It just isn't believable that you can have a storage drive sitting in front of you which contains both encrypted data and the decryption key (or at least the password-encrypted decryption key) and yet not be able to access the data.

Well it won't be forever. Eventually we will figure out the math to generate a private key for any bitcoin address.

At which point the coins will no longer have a value that is relevant

Or there will be a period of obscurity in which both the math is known (to some/few) and they will secretly profit off that knowledge.

More likely a bip (bitcoin improvement proposal) will be introduced that makes the math useless by changing key structure.

what's the point of storing a wallet on a self encrypting device that can "self destruct" vs just storing the data encrypted on a normal storage device? It seems its cutting off your nose to spite your face to an extent.

Easy scenario, someone DoS you by causing the device to self destruct thereby you losing large amounts of money.

The video where he explains how cryptocurrency works probably wasn't very good.

How much is he asking for the drive? I bid $500.00 USD.

This might have been a mistake.

Reply on news.ycombinator.com