3 ms·

At one point a couple of years ago, for testing purposes, I created a brain wallet (that is, a short phrase that when hashed would yield a key pair) in Bitcoin

At one point a couple of years ago, for testing purposes, I created a brain wallet (that is, a short phrase that when hashed would yield a key pair) in Bitcoin testnet so that a group of people could each have access to them for testing purposes. It was just a simple substitution -- a common enough word with 3's and !'s mixed in. For testnet coins, which are worthless, it seemed harmless enough. It was "stolen" literally minutes after first depositing the coins at the address; we assumed by someone running a monitoring daemon looking for a large rainbow table of bitcoin addresses, and testing out there efforts on the testnet. I wonder how many bitcoins they managed to extract once they put their system into production.

im3w1l 8y ago
Or they were a whitehat wanting your problems to be caught in testing.
- 13of40 8y ago
  If he screwed up their project without permission, that's not totally "white hat".
  - andrewla 8y ago
    It was testnet, though, so worthless, and easily obtained (in small amounts) from a testnet faucet (like [1], [2], or [3]). We considered continuing to share, but in the end it was just easier for individual developers to obtain their own and use them for testing rather than managing a central pool. [1] https://testnet-faucet.mempool.co/ https://testnet-faucet.mempool.co/ [2] https://bitcoinfaucet.uo1.net/ https://bitcoinfaucet.uo1.net/ [3] https://kuttler.eu/en/bitcoin/btc/faucet/ https://kuttler.eu/en/bitcoin/btc/faucet/
    - duxup 8y ago
      Is testnet just for ... testing?
      - sunshinerag 8y ago
        Yes
  - tylersmith 8y ago
    That's the kind of stuff testnet is for. It's better to have worthless coins stolen during testing than real coins stolen later.
- andrewla 8y ago
  It's possible. We did a cursory look for the destination address to see what was happening. If I were a whitehat looking to educate people I would publish the destination address with a message saying what had happened, and probably send the coins back to one of the testnet faucets. As it was it looked like our coins went to a single-use address and sat there, which seems like more of a black-hat strategy. I don't remember the address we used, though. Here's [1] a similar one, for "correct horse battery staple" -- the funds were moved (in the same block) from the address to a single-use address where they sat. [1] https://live.blockcypher.com/btc-testnet/tx/835509e51ab9054ed22ee6a80084a45afc33cf0f56fae18bd778269863806c05/ https://live.blockcypher.com/btc-testnet/tx/835509e51ab9054e...
  - pm7 8y ago
    > I would publish the destination address with a message saying what had happened Bitcoin does not support embedding messages in addresses (and embedding messages in transactions is controversial as it will be stored in blockchain forever, so many block explorers do not render such messages to discourage it).
    - andrewla 8y ago
      I mean publish in the old fashioned sense - put it on a web page so someone could google it.

im3w1l 8y ago

Or they were a whitehat wanting your problems to be caught in testing.

13of40 8y ago
If he screwed up their project without permission, that's not totally "white hat".
- andrewla 8y ago
  It was testnet, though, so worthless, and easily obtained (in small amounts) from a testnet faucet (like [1], [2], or [3]). We considered continuing to share, but in the end it was just easier for individual developers to obtain their own and use them for testing rather than managing a central pool. [1] https://testnet-faucet.mempool.co/ https://testnet-faucet.mempool.co/ [2] https://bitcoinfaucet.uo1.net/ https://bitcoinfaucet.uo1.net/ [3] https://kuttler.eu/en/bitcoin/btc/faucet/ https://kuttler.eu/en/bitcoin/btc/faucet/
  - duxup 8y ago
    Is testnet just for ... testing?
    - sunshinerag 8y ago
      Yes
- tylersmith 8y ago
  That's the kind of stuff testnet is for. It's better to have worthless coins stolen during testing than real coins stolen later.
andrewla 8y ago
It's possible. We did a cursory look for the destination address to see what was happening. If I were a whitehat looking to educate people I would publish the destination address with a message saying what had happened, and probably send the coins back to one of the testnet faucets. As it was it looked like our coins went to a single-use address and sat there, which seems like more of a black-hat strategy. I don't remember the address we used, though. Here's [1] a similar one, for "correct horse battery staple" -- the funds were moved (in the same block) from the address to a single-use address where they sat. [1] https://live.blockcypher.com/btc-testnet/tx/835509e51ab9054ed22ee6a80084a45afc33cf0f56fae18bd778269863806c05/ https://live.blockcypher.com/btc-testnet/tx/835509e51ab9054e...
- pm7 8y ago
  > I would publish the destination address with a message saying what had happened Bitcoin does not support embedding messages in addresses (and embedding messages in transactions is controversial as it will be stored in blockchain forever, so many block explorers do not render such messages to discourage it).
  - andrewla 8y ago
    I mean publish in the old fashioned sense - put it on a web page so someone could google it.