Ancil
A $3 million Bitcoin wallet was hacked 11 years after the owner forgot his password.
Imagine his joy when he found $3 million worth of Bitcoin after being locked out of his wallet for 11 years.
An unknown owner asked electrical engineer Joe Grand (‘Kingpin’ online) to hack a 43.6 BTC encrypted file.
The owner employed Roboform, a random password generator, to protect his crypto, but he lost it.
The anonymous owner was’really paranoid’ that someone would hack his computer and steal his password, allowing them to access his cryptocurrency. Kingpin had previously helped another owner recover over $2 million in crypto in 2022.
He stated scores of people have asked for help finding misplaced treasure.
Grand declined many for various reasons, but helped this anonymous owner in his mission.
In a YouTube video published by Grand, the wallet’s owner said: “I generated the password, I copied it, put it in the passphrase of the wallet, and also in a text file that I then encrypted.”
The owner lost access to the account while Bitcoin was worth $3,000–$4,000.
After bitcoin’s price rose over 20,000%, the owner contacted Grand.
Grand utilized an NSA tool to decompile the password generator.
He said: “In a perfect world when you generate a password with a password generator, you expect to get a unique, random output each time that no one else has.
“[But] in this version of RoboForm, it was not the case.
“While RoboForm’s passwords appear to be randomly generated, they’re not. With the older versions of this software, if we can control the time, we can control the password.”
Grand tricked the system by shifting the password generation time back to 2013, and after a few failed attempts, the same password was produced.
Together with his colleague Bruno, the hacker generated millions of passwords.
Grand told Wired that he cracked the encryption by luck.
“We ultimately got lucky that our parameters and time range was right. If either of those were wrong, we would have […] continued to take guesses/shots in the dark.” he told them in an email.
