A few days ago in the news, it was revealed that the main Bitcoin developer Luke Dashjr had his wallet hacked and lost 200 BTC. A small fortune and something shocking. I’m assuming that someone with this experience wouldn’t leave their private key lying around, so as a non-crypto enthusiast, I wonder how attackers could do this. So I called a few of my friends who have traveled these roads for clarification, and what resulted was an interesting conversation. The most likely answer is still that someone got into his computer and copied the keys – outright computer theft. But there’s another possible avenue that doesn’t involve stealing anything, and it’s surprisingly simple.
Are You A Gambler Or An Engineer?
I’m guessing that most Hackaday readers will know something about how blockchain works, as well as how public key cryptography works. Public key cryptography is the key to the security of a cryptocurrency like Bitcoin, the key that unlocks all your wealth for you is your private key, and the key that allows other people to transact with you is your public key.
If you want to send cryptocurrency to someone else, you encrypt the transaction using their public key, as the name suggests, and your private key, which is known only to you. So it is important to keep your private key safe indeed private because it controls your cryptocurrency junk if someone finds it. So someone had the private key to steal all those bitcoins, which should never have happened. We can safely assume that his key protection was as good as it could possibly be, assuming no one physically stole his hardware wallet or anything he stored, but his key was captured by other means.
The real security of public key cryptography is that it is extremely difficult to guess an individual’s private key. A brute force algorithm to guess Luke Dashjr’s private key would require unimaginable computing power on a geological time scale, so it’s safe to assume that no one has set their computer just to guess his key. At this point, it is useful to stop thinking like an engineer and start thinking like a gambler. Engineer Luke calculates the time it takes to brute-force Dashjr’s private key, but the gambler rolls the dice and sees if the roll wins.
From a gambler’s point of view, what are the dice and how likely is the roll to win? If you randomly guess a private key and roll the dice and only test it against Luke Dashjr storing Bitcoin, then you’re in geologic time waiting for an engineer to crack your computer. But if you’re a gambler, you don’t care about Luke Dashjr or anyone else, you just care about the keys to any wallet that has some Bitcoin in it. The odds are stacked against you at this point because instead of one chance with Luke Dashjr, you have all the blockchain possibilities for a match.
How To Steal 200 BTC With Brute Force
So here’s how it works. Blockchain contains the public keys of all its participants, everyone who owns or owns Bitcoin. You collect that list that is big enough and keep it. Then you roll the dice, generating a random private key. From that private key, you generate the corresponding public key and check if it is in the list of public keys on the blockchain. If it matches, you empty the wallet associated with it; if not, you repeat the process by generating another key. By not focusing on a specific individual account, you’ve reduced the time you have to wait for a hack in any count from a geological aeon to a more manageable number. My friends suggested that if they had enough resources, it might be possible to find something within months.
As the title says, it’s a surprisingly simple way to steal cryptocurrency. But simple does not mean that an attack makes economic sense. Guessing key pairs takes significant resources and time, and you have to compare that to the chance of finding an account with a few dollars that will sting after investing millions in a computer, versus the chance of finding a whale with lots of bitcoins. time. Doing so is seriously a gamble, and thankfully probably a bad bet for Bitcoin’s integrity. But who knows? nation do play the lottery.
If you want to roll the dice yourself, there’s even a handy proof of concept in the form of keys.lol , a product of Dutch web developer Sjors Ottjes. This site displays a set of keys and queries the Bticoin and Ethereum blockchains to see if there are any matches. You’ll soon see the magnitude of the task when loading random pages, and it’s safe to say that the chances of loading a page with a valid key are very small indeed.
If you’re holding Bitcoin, you should at least think about a brute force attack. But it doesn’t concern us – our wealth is stored in inaccessible semiconductor devices hidden in a safe deposit box.
Header image: Ralf Roletschek, CC BY-SA 3.0.