Researchers ‘hack time’ to recover $3 million bitcoin wallet
A decade-old flaw in a password generator allowed hackers to recover lost crypto fortune
Your support helps us to tell the story
From reproductive rights to climate change to Big Tech, The Independent is on the ground when the story is developing. Whether it's investigating the financials of Elon Musk's pro-Trump PAC or producing our latest documentary, 'The A Word', which shines a light on the American women fighting for reproductive rights, we know how important it is to parse out the facts from the messaging.
At such a critical moment in US history, we need reporters on the ground. Your donation allows us to keep sending journalists to speak to both sides of the story.
The Independent is trusted by Americans across the entire political spectrum. And unlike many other quality news outlets, we choose not to lock Americans out of our reporting and analysis with paywalls. We believe quality journalism should be available to everyone, paid for by those who can afford it.
Your support makes all the difference.Security researchers have cracked a password to recover over $3 million of bitcoin that had been stuck in a crypto wallet for 11 years.
Electrical engineer Joe Grand, who goes by the handle ‘Kingpin’, was hired to hack into an encrypted file holding 43.6 BTC, which had been held there since 2013. The cryptocurrency was protected by a password created by a random password generator called Roboform, however the password had long-since been lost.
The password was a series of 20 upper and lower case letters, as well as numbers, that had been designed to be as difficult as possible to crack.
“I generated the password, I copied it, put it in the passphrase of the wallet, and also in a text file that I then encrypted,” the wallet’s owner, who chose to remain anonymous, said in a video published by Mr Grand.
The password was lost after the encrypted part of his computer that held it became corrupted. At the time, the bitcoin was worth a couple of thousand euros, which the wallet’s owner described as “painful but OK”.
Over the next decade, however, the lost bitcoin grew into a fortune as the price of bitcoin rose by more than 20,000 per cent, causing its owner to reach out to Mr Grand.
After initially turning down the job, Mr Grand eventually agreed to try to recover the funds after coming up with a novel method to hack the initial password generator.
Mr Grand used a reverse engineering tool developed by the US National Security Agency (NSA) to disassemble the password generator’s code.
“In a perfect world, when you generate a password with a password generator, you expect to get a unique, random output each time that no one else has. [But] in this version of RoboForm, it was not the case,” Mr Grand said.
“While RoboForm’s passwords appear to be randomly generated, they’re not. With the older versions of this software, if we can control the time, we can control the password.”
He figured out that if he was able to trick the system that it was the moment in 2013 when the password was generated, then it would recreate the same password.
With only a rough idea of when the password was generated, Mr Grand worked with his colleague Bruno to generate millions of potential passwords in order to eventually crack it.
The RoboForm password generator has since updated its platform to improve the randomness of its tool, meaning the time-based hacking approach no longer works with passwords created after 2015.
Mr Grand hopes to now help more people locked out of their crypto wallets, though said new approaches may be needed.
He said: “If this project required hacking time, what dimension are we going to have to hack next?”
The Independent has reached out to RoboForm for comment.
Join our commenting forum
Join thought-provoking conversations, follow other Independent readers and see their replies
Comments