Restore 28,000 bitcoins behind the lost Rashomon

On September 3, a self-media released a title called "10,000 BTC rewards! The article that the mining ring lost 28,000 BTC compression package passwords caused a certain controversy within the circle.

Afterwards, the mines involved in the incident, "Cool White", accepted the interview from the media and revealed the incident. Early contact with this story will reveal the whole story – a fantasy story that is unknown.

As early as the beginning of this year, the incident had already been fermented in the currency circle. One of the miners of the mine circle flew to Guangzhou and negotiated with the currency owner. After meeting, he knew that the coin owner was a cook.

• Twitter Featured | Analyze the current status of lightning network: nodes can not make ends meet, channel, capacity stagnant growth
• Microsoft shot! Jointly released Ethereum expansion solution Nahmii
• Babbitt Column | Digital Currency Great Navigation Age: Private License and Supervision Sandbox Park, Drake and Zheng Chenggong

Time is back to 2009.

In 2009, the cook worked at a hotel in Guangzhou and met the hotel's network management. On one occasion, the hotel network management borrowed 3,000 pieces from the cook because it had no money to buy game equipment. After that, the hotel network management had no money to pay back the account, and took the bitcoin of comparable value to offset the debt. The cook first encrypted the file with a common password, but the hotel executive felt that it was not safe, using a more complicated password to encrypt the file and keep the cook in a safe place. Because the value of Bitcoin was low at the time, the cook did not care about it. He only saved the compressed package and did not save the password.

In 2017, with the appreciation of Bitcoin, the cook remembered that he had bitcoin. Since the password was not properly kept, the cook began to try to crack the password of the compressed package to get the bitcoin in the file.

The tools that the cook has tried are:

(1) Self-destruction, invalid;

(2) I found a "Singapore senior hacker" who is good at cracking passwords. In order to verify the hacking ability of the hacker, the cook created several compressed package files and used random complex passwords, which were all cracked by the hackers, but the final truth. The package chef did not send a "Singapore hacker" to crack.

In 2019, after a big introduction to the mining circle, the “user” came to the Weiwei security laboratory to crack the compressed package. This “user” was also commissioned by the cook to cooperate to crack the compressed package. At the beginning, the "user" said that the wallet password was 13 bits long and had no special symbols.

"How do users determine the length of the password?"

We raised our own questions. The information provided by the other party was that the chef found a "Singapore senior hacker" to crack the number of digits and the type of the character, but was afraid that the other party would steal the private key and did not let the hacker crack it. This reason was quickly overturned by the dimension reduction security laboratory.

The first doubt , rar from the 2.0 version, using the AES encryption algorithm, block encryption of the file, it is impossible to see the so-called "Singapore hacker" technology crack. We suggested to the user that this situation cannot be cracked. If the user transcribes the private key, this thing is simple.

As a result, the cook gave the user another clue to copy the “private key” on the recipe. However, due to the low level of transcripts, this private key is not identifiable in many places, such as case recognition. (In addition, "Cool White" also mentioned that the cook kept the recipe and memory card in a box)

There is a second doubt here. The Dimensional Security Lab said that it had seen the original key of the private key on the recipe. The private key copied by the cook on the “recipe” was a compressed private key starting with L. This format appeared in bitcointalk.org in 2011. Forum discussion, and application. The Dimensional Security Lab also compiled the bitcoin core wallet for 2009-2010, confirming that its private key is in the normal private key format starting with 5, and there is no function to export the private key in the wallet.

Due to the user's persistence, the Dimensional Security Lab helped them develop a private key brute force program. The wrong private key within a certain range can be guessed by brute force. I have been in contact with this customer for more than half a month, witnessing the whole psychological journey from hopefulness to despair to lucidity.

We must know that this customer has invested hundreds of thousands of RMB in the front and back of the “Kitchen”! 🙂

According to the currency wallet address (12tkqA9xSoowkzoERHMWNKsTey55YEBqkv) disclosed in the media earlier, the dimension reduction security laboratory said that the wallet, like other "cold" wallets in the blockchain, has not been transferred for a long time, but there are some transfers. Records, the currency received in the address is mostly advertising and "dust attack."

The well-known person in the mining circle who was interviewed by the media was “cool white” (it was revealed that it came from a cellular mine machine). Someone contacted him to propose to use the calculation power of the mine to crack the compressed package, so he was involved in this incident very early. Compressed packages do exist, but no one knows what their passwords are, and there is no way to verify what the files are stored in.

Be wary of fancy scams

Not long ago, a scam was particularly popular, and it was similar to the incident. There have been users selling bitcoin core wallet wallet.dat files, and 8 wallets have accumulated about 615 BTCs. The main wallet funds are: 198BTC, 131.63BTC, 75BTC, 150BTC and other wallets can be loaded and verified normally, but wallet.dat is also encrypted. The coin owner has been tossing for nearly a year. Because of the lack of computing power, the idea of ​​cracking is not correct.

The complete routine of such incidents: the initial judgment should be to defraud the user's trust, and then seek cooperation, claiming that there is a channel to buy computing power or a master can crack, etc. Of course, this cost "cook" can not afford it, need partner sponsorship to implement Fraud. We have been exposed to fake wallet frauds many times before, and the scams are always coming up, but the only thing that is the same is that some users will pay for such scams.

In the event of the loss of 28,000 bitcoins, the most important person, "Cool White", also publicly stated that the cook itself has no money, and all actions that require "partners" to provide funds should be vigilant. The loss of 28,000 BTCs may be true, and the true probability is equivalent to a person being hit seven times in a row by lightning.

Here, the majority of users are reminded to be wary of the wallet.dat documents transferred by channels such as idle fish, dark nets and forums. The prices are particularly attractive, and most of them are deceptive.

PS: "Dust Attack" Small Science: The Bitcoin account is not a book mode, but a UTXO model. In addition, the bitcoin HD wallet has the characteristics of deriving a number of sub-accounts, making the flow of bitcoin money more difficult. So in order to identify whether a group of accounts belong to the same HD wallet (that is, the same controller), some smart institutions/users send a small amount of tokens to these addresses (usually less than a few hundred Satoshi, ie 0.000001 bitcoin or less). By "dusting" these addresses, the controller behind these wallet addresses can then be determined by tracking the funds and all transactions in the wallet that has been dusted.

We will continue to update Blocking; if you have any questions or suggestions, please contact us!