23 ms·

“My PGP key is compromised, and at least many of my bitcoins stolen”

345 points by TylerE 4y ago

0goel0 4y ago
[dead]
kumarm 4y ago
As soon as trouble comes to paradise, they wonder why traditional institutions they dissed all along is not dropping everything and take up their case (FBI in this case).
- deleted 4y ago
  [deleted]
  - deleted 4y ago
    [deleted]
- dang 4y ago
  Ok, but please don't post repetitive flamewar comments to HN—this kind of thing has been posted a thousand times by now; the only value left in it is indignation, which is the opposite of the curiosity we want here. Perhaps you don't owe paradise better, but you do owe this community better if you're participating in it. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - kumarm 4y ago
    Got it. I agree the comment was useless.
    - dang 4y ago
      Appreciated! Btw one more thought: this kind of thing is natural in conversation because repetition has other functions (e.g. it connects people to share and agree on familiar things). So commenters aren't doing anything wrong in principle when they post like this—it's actually HN's rules which are the unnatural thing. But it's clear that we have to have them, given the mandate of the site. https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sort=byDate&type=comment&query=curiosity%20optimiz%20by:dang https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...
- tibbydudeza 4y ago
  Yeah FDIC is for loosers - we are stepping out of the matrix.
  - deleted 4y ago
    [deleted]
deleted 4y ago
[deleted]
belmarca 4y ago
This is the tweet: https://twitter.com/LukeDashjr/status/1609613748364509184 https://twitter.com/LukeDashjr/status/1609613748364509184
- dang 4y ago
  Ok, we changed to that from https://preview.redd.it/fovmtx7gjh9a1.jpg?auto=webp&s=d5b896ab174c6280fd4843faef53d230d83befda https://preview.redd.it/fovmtx7gjh9a1.jpg?auto=webp&s=d5b896.... Thanks! Submitters: "Please submit the original source. If a post reports on something found on another site, submit the latter." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
mccorrinall 4y ago
Would be interesting to know how his BTC were stolen. Because he is a BTC core developer, I believe he followed the best practices, like not writing down his password. So infection or keylogger?
- sosodev 4y ago
  Storing most of his bitcoin in a single hot wallet seems to go against the best practices, no?
  - mateuszf 4y ago
    He said it was not most of his bitcoins. https://twitter.com/LukeDashjr/status/1609618498027753472 https://twitter.com/LukeDashjr/status/1609618498027753472 EDIT: Right, maybe it's all
    - sosodev 4y ago
      First he said "at least many of my bitcoins stolen" and then followed up with "Nevermind many. It's basically all gone" Which implies that it is indeed most of his bitcoins.
    - kube-system 4y ago
      He then said it was basically all: https://twitter.com/lukedashjr/status/1609647203890372609 https://twitter.com/lukedashjr/status/1609647203890372609
    - blibble 4y ago
      irreversible transactions are a feature!
  - gnull 4y ago
    What is hot wallet, btw?
    - sosodev 4y ago
      I don't know if it has a concrete definition but I generally say it to mean a crypto wallet that is directly or indirectly exposed to the internet. It's possible to create a bitcoin wallet completely offline in a secure environment. The details to the wallet are then stored physically in a secure location/medium. This is called a cold wallet. People typically use a cold wallet for long-term storage of coins.
TedDoesntTalk 4y ago
> What the heck @FBI @ic3 why can't I reach anyone??? Uh, because it’s New Year’s Day? Don’t get injured or become a crime victim on a holiday, if possible.
- Sebb767 4y ago
  Slightly off-topic, but who is this @ic3 and why does he tag them in the same way as the FBI? Here's the account, for reference: https://twitter.com/ic3 https://twitter.com/ic3 . Doesn't look like an official to me.
  - deleted 4y ago
    [deleted]
  - kube-system 4y ago
    Clearly he meant https://www.ic3.gov/ https://www.ic3.gov/ but tagged a wrong account.
    - logifail 4y ago
      > Clearly he meant https://www.ic3.gov/ https://www.ic3.gov/ but tagged a wrong account I use Twitter solely for moaning at service providers who respond [far!] faster on Twitter than they do by phone or email, but .. umm ... doesn't this [common] mistake demonstrate how broken this approach is?
- kristianc 4y ago
  Every crypto hack is followed by a swift call for a centralised authority to intervene.
  - nemo44x 4y ago
    Why is that inconsistent? There’s a lot of people that believe governments only legit purpose is to protect people and their property.
green-eclipse 4y ago
> "Nevermind many. It's basically all gone" https://twitter.com/LukeDashjr/status/1609647203890372609 https://twitter.com/LukeDashjr/status/1609647203890372609
tromp 4y ago
Loss of his bitcoin is not yet confirmed. It's possible that only his twitter account got hacked, and the hacker is having some fun with it. Beyond being a bitcoin core dev [1], Luke-Jr is also the author of an independent node and wallet implementation known as Bitcoin Knots [2]. [1] https://github.com/luke-jr https://github.com/luke-jr [2] https://bitcoinknots.org/ https://bitcoinknots.org/
- yuvadam 4y ago
  Peter Todd claims he has confirmation [1] [1] - https://twitter.com/peterktodd/status/1609655629903265795 https://twitter.com/peterktodd/status/1609655629903265795
  - gjsman-1000 4y ago
    If a Bitcoin Developer with >$3M in Bitcoin didn’t use a hardware wallet… God help the typical Bitcoin user. It’s a tragedy, and inexcusable.
    - SilasX 4y ago
      Gavin Andresen, a lead Bitcoin developer, sent me a 10 BTC donation ($3000 at the time) when he meant to send $10 worth of BTC. Yes, I refunded. https://news.ycombinator.com/item?id=14720921 https://news.ycombinator.com/item?id=14720921
      - hgsgm 4y ago
        Great example of how "Bitcoin is trustless" means "Bitcoin only works is the trust is provided externally".
        323 4y ago
        It's not just Goodness of heart. This case can fall under existing laws. You are not allowed to keep obvious transfer mistakes like these.
deleted 4y ago
[deleted]
sophrocyne 4y ago
Turns out the advice “not your wallet, not your coins” still holds true in this context.
- deleted 4y ago
  [deleted]
deleted 4y ago
[deleted]
jtchang 4y ago
If you hold a large amount of bitcoin your threat model should be way above the average person. It sounds like his infrastructure was specifically targeted. It can be very difficult to protect against targeted attacks from adversaries.
- Alex3917 4y ago
  > It can be very difficult to protect against targeted attacks from adversaries. Not really. The device used to sign transactions should never be connected to the Internet.
  - tsimionescu 4y ago
    If the level is millions of dollars, that device could be physically stolen, or some aspect of the cryptography/auth scheme could be attacked through a 0-day. Of course, it's also possible he just wanted something closer to the convenience of a bank account/credit card instead of a pile of cash and failed in the opsec.
    - lampshades 4y ago
      That’s why you don’t store millions of dollars in your physical location. You break up the seed and disperse it among several bank lock boxes. (See https://en.m.wikipedia.org/wiki/Shamir's_Secret_Sharing) https://en.m.wikipedia.org/wiki/Shamir's_Secret_Sharing). Keep a small amount in a hot wallet for convenience and a larger amount (but not too large) in a cold wallet accessed via hardware. But the bulk shouldn’t be accessible without breaking into at least two lock vaults.
      - tsimionescu 4y ago
        Why just two lock vaults and not some army bunkers, together with the nuclear codes preferably? At some point this level of care becomes more than absurd.
        4y ago
revskill 4y ago
Is this a trick to let BTC dip more (as planned), then when there's enough accumulation, good news comes ? ;)
echelon 4y ago
I've never been a fan of crypto (despite holding some for diversification), but I think some tweaks could be made to make it safer and more reasonable without comprising what its proponents like about the system. Crypto prtocols need a way to reverse transactions if the original address as well as some quorum of elected "supervisory overseers" agree [1] to it within a week or so. There should also be a mechanism to move the balance to another address with the original owner and these parties. This wouldn't allow the "regulators" to themselves steal or coerce, but they could provide assistance in large thefts like this. [1] Obviously the attacker would vote no, but a single yes from the true account owner would override.
- dns_snek 4y ago
  Since nobody has offered a response, I'll offer my 2c. Your suggestion flies in the face of what Bitcoin and other cryptocurrencies that operate according to the same principles were designed to be (trustless, some degree of anonymous) and it would make the system ripe for abuse (more than it already is). What if Luke Jr is lying and he spent those bitcoins in return for goods and services? Suddenly you have to establish a department that would hear from both parties which introduces the problem of identifying the other party and getting in contact with them, then they would have to evaluate the evidence and make some kind of judgement. Paypal attempts to do what you're describing and it's constantly abused by both buyers and sellers alike. Bitcoin might not be perfect, it might not even be fit for most purposes (highly subjective), but scrapping the idea outright would be a much better outcome than bastardizing it with "trusted" middlemen to the point where it's not fit for any purpose at all. I think progress could be made in UX design, by pushing users towards using hardware wallets and other areas, but changing the protocol such that trustless transactions now require trust is not an appropriate solution. It's the core of what cryptocurrency is as a concept.
  - echelon 4y ago
    Thanks for the response! I appreciate it much more than the downvotes, and it gives me a position to consider. I still find myself in disagreement - there need to be safeguards at the protocol level, and not just for ordinary people. Escrow and restitution could be built as a feature where trustless and anonymous transactions can still take place. Taking into account my previous post, imagine this setup: There are now two types of wallets/addresses. One type functions exactly as Bitcoin does today. The other type, however, automatically subjects transactions to temporally-gated restitution systems and allows you to recover funds if a side channel refund request is made. Funds in the original Bitcoin wallet type experience transactions that are instant and non-refundable, and you can keep "hot" funds here. The "cold" wallet type requires more time to pass before the funds "settle". It can function as your bank and offer lots of additional security. It'd be easy to make the wallet type an identifiable part of the address so that all parties know what types of transactions they're involved in. This extension to the protocol could be 100% opt-in.
green-eclipse 4y ago
Dude has 8 kids and someone is claiming it was around 200 BTC. That's ~$3.3M down the tubes. Ouch.
- notsrg 4y ago
  Looks like 3.6M: https://www.blockchain.com/explorer/addresses/btc/1YAR6opJCfDjBNdn5bV8b5Mcu84tv92fa https://www.blockchain.com/explorer/addresses/btc/1YAR6opJCf...
- Symbiote 4y ago
  [flagged]
  - deleted 4y ago
    [deleted]
  - dibt 4y ago
    In an attempt to make this a more productive comment, can you elaborate on what is an "honest way" to make a living in a way that is not "environmentally destructive?" I assume the "other people with 8 kids" are not Amish people selling produce at a farmer's market. Someone providing for 8 kids would likely have a car (maybe two), and go to a job in a building that uses electricity, right? What about your leisure time? Xbox/Playstation? TV? PC/smartphone? Or are you somehow posting your comment via smoke signal or semaphore?
    - somenewaccount1 4y ago
      Any job not burning the equivalent energy of Argentina to accomplish a technical feat that could be done better with psql running on a raspberry pi.
      - dibt 4y ago
        [citations needed]
- dinkblam 4y ago
sosodev 4y ago
https://bitcoinhackers.org/@lukedashjr https://bitcoinhackers.org/@lukedashjr his mastodon feed indicates that one of his servers was physically compromised multiple times. Seems like he should have been more paranoid about securing his coins with that knowledge?
- perihelions 4y ago
  Speaking of paranoid, that link you've posted, isn't that a link to a server that's known to be compromised, and also an apparent watering hole for crypto wallet holders? Am I unreasonable in thinking that's a very scary link?
  - sosodev 4y ago
    Dunno, it's unclear if that Mastodon instance is hosted on his compromised servers.
    - deleted 4y ago
      [deleted]
  - doodlesdev 4y ago
    1. Disable JavaScript. 2. Access (almost) any website in the internet 3. ????? 4. Profit edit: Mastodon doesn't work without JavaScript, holy hell. We truly are living in a dystopia. Thankfully you can still access his profile from another trusted instance such as mastodon.social at https://mastodon.social/@lukedashjr@bitcoinhackers.org https://mastodon.social/@lukedashjr@bitcoinhackers.org
    - perihelions 4y ago
      I always have JavaScript disabled by default (uMatrix policy), but (0) there's many other attack vectors, to my layman understanding, and (1) at any rate that one's a Mastodon instance and those are blank pages without JS. I'm electing to add new URL regexps to my uBlock filters, to reduce the risk of accidentally clicking a link similar to this. I don't think I want to visit any web domain that caters to people who hold crypto wallets. /.*coin.*/ /.*crypto.*/ /.*eth.*/
scottiebarnes 4y ago
Strange, a month ago he tweets about his server being compromised: https://twitter.com/LukeDashjr/status/1593227756841578496 https://twitter.com/LukeDashjr/status/1593227756841578496 Go figure
- bpanon 4y ago
  Supreme negligence on his part. He knows his server was accessed, but he didn't transfer the coins to a new address.
  - theCrowing 4y ago
    Worse he just "purged" what he found instead of nuking the whole system.
phphphphp 4y ago
Apparently his servers keep getting hacked, which doesn’t reflect well on his security practices: https://twitter.com/LukeDashjr/status/1606885577843957762 https://twitter.com/LukeDashjr/status/1606885577843957762
- technion 4y ago
  Assuming this physical access claim is truthful (and i have doubts), I would feel at this point its budget letting him down. If your threat model includes "targeted attacks from people with physical access", it's time to run a vm on aws or azure and use the tooling they make available to secure it further. If you want tonnes of resourcing at a quite low budget, there's only a certain amount of "calling out" the group that supplied it that's reasonable.
  - tinus_hn 4y ago
    If he has enough Bitcoins for it to be possible for ‘many of them’ to be stolen, he doesn’t have a small budget.
    - technion 4y ago
      Just makes this thread stranger. I know if I had over $3m in btc and was working professionally with them I wouldn't state my top budget was $55. Edit: his tweets specifically talk about not using "cloud nonsense " and states getting your own key to a rack is too expensive for him.
      - johnklos 4y ago
        My goodness. Really? He refers to "cloud nonsense", then uses a "dedicated server"? That's a new kind of special.
    - pshirshov 4y ago
      From his tweets: he was renting a physical server for $55/m. So, a total joke.
  - 4y ago
simonw 4y ago
I still think the reason Satoshi vanished is that he lost his private key and couldn't handle the embarrassment.
- MattPalmer1086 4y ago
  That is the most plausible explanation I've ever heard. And it made me smile! Happy New Year :)
- tiahura 4y ago
  Agreed. Another plausible reason is that he died.
- xrd 4y ago
  Almost right. He spilled two (!) beers on the paper he wrote his private key upon, and he died of embarrassment.
  - dennis_jeeves1 4y ago
    Now, what was the brand of beer he was having?
    - 1MachineElf 4y ago
      If he really was Japanese, then the only sensible conclusion is Asahi.
      - xrd 4y ago
        Why not Sapporo? Or, perhaps he was drinking Suntory Whiskey. That would be a plot twist!
        ElfinTrousers 4y ago
        Maybe he didn't want it getting out that he'd actually been drinking Tsingtao.
vbo 4y ago
[flagged]
- green-eclipse 4y ago
  Is it HN's problem? Never even knew the guy existed until 5 minutes ago.
  - vbo 4y ago
    Fair enough, though what I meant was really in relation to a class of problems, not this one person’s issue.
- Barrin92 4y ago
  because it's a useless problem to solve. The affected person going "FBI help me please" is the definition of that 'Bike Fall' meme. The answer to these situations is, use a currency where you can call someone that can roll your transaction back.
  - vbo 4y ago
    That’s one answer. But the question also applies to non-cryptocurrency uses of cryptography where you need to guard your private keys (like identity) — ie how to best enable people to use their keys while keeping them safe and also allowing for some form of recovery.
- reducesuffering 4y ago
  You're right, I've got it! We'll store our money in a savings account, with transfer safeguards, where someone can't irreversibly yeet my life savings into the abyss.
  - rkho 4y ago
    And yet they did: https://www.bloomberg.com/news/articles/2022-02-17/police-begin-financial-squeeze-trudeau-defends-emergency-edict https://www.bloomberg.com/news/articles/2022-02-17/police-be...
b3nji 4y ago
Anyone noticed there are no repeat messages on his Mastodon, that historically reflected his Twitter, or vice versa?
samwillis 4y ago
Context now that the editorialised title has changed, this is a core Bitcoin developer. These things happen every day, but happening to a core developer (if confirmed!) who has a deep understanding of the systems and security indicates just how fragile crypto can be (in my opinion)
- spicymaki 4y ago
  Exactly! if the experts can’t secure their accounts, what hope does anyone else have? Soon you will see people saying you should have done this or that complicated thing, or how somebody so smart could should have known better. No matter what they say it is never enough. This is why lack of consumer protections suck.
  - psychphysic 4y ago
    That's why hardware based security is really the only way at this point. He might be a bitcoin core Dev but does he use ledger/trezor etc? Is his PGP key on his hardrive or a smartcard? In this day and age your computer not a bastion it once was. (It never really was but it's more of a problem in 2022 than 1982).
    - woodruffw 4y ago
      This completely talks past what the person you're replying to is saying: it doesn't matter if "hardware based security is [...] the only way," because its conspicuous absence indicates that even the experts fail to meet the onerous requirements placed on them by cryptocurrency.
      - bena 4y ago
        Yeah, this only highlights how ridiculous the requirements are. The system needs to be tolerant of failures and faults of multiple natures. And cryptocurrency is very intolerant or many types of failures and faults.
      - psychphysic 4y ago
WFHRenaissance 4y ago
Going to go out on a limb and say this is a Twitter account compromise.
dang 4y ago
Submitted title was "Top Bitcoin dev gets owned". It's great to post that kind of explanation in the comments, but please don't use the title for it. That's against the site guidelines: "Please use the original title, unless it is misleading or linkbait; don't editorialize." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
reducesuffering 4y ago
"the pedos who took over Vatican City are NOT Catholic" Sympathy cratering...
- Macha 4y ago
  A broken clock being right twice a day and all that. Prior to becoming Pope, Benedict did lead the Congregation for the Doctrine of the Faith which was responsible for covering up the child sex abuse scandals of the Catholic Church in Ireland. In addition, while he was Pope, someone high up in the church instructed the Irish part of the church to stymie the government's efforts to investigate said child abuse scandals which resulted in threatened expulsion of the vatican ambassador[1] (recalled by the vatican before it came to that), the closure of the Irish embassy to the Vatican[2] and a public condemnation by the Irish government[3]. What is much less up for debate is that Benedict and his sucessor Francis (who to be fair, has not had the same pre-papal track record as his predecessor) were fairly elected leaders of the catholic church by its own mechanisms. Also don't take this as approval or support for the guy's reactionary views of what he thinks catholicism should be. [1]: https://www.bbc.com/news/world-europe-14281441 https://www.bbc.com/news/world-europe-14281441 [2]: https://www.huffpost.com/entry/ireland-closes-embassy-to-vatican_n_1076528 https://www.huffpost.com/entry/ireland-closes-embassy-to-vat... [3]: https://www.irishtimes.com/news/kenny-condemns-vatican-response-to-allegations-1.880058 https://www.irishtimes.com/news/kenny-condemns-vatican-respo...
  - deleted 4y ago
    [deleted]
deleted 4y ago
[deleted]
wereallterrrist 4y ago
This all stinks. Between the bio, the vague tweets about server hacks (implying Intel ME or a physical server compromise is at fault, really?), the vague tweets about this situation... Something fishy is going on or wow, really proof that sometimes it's just about being in the right place at the right time because wow dude does not have the first clue about security. Hot wallet, compromised, unrotated servers, come on. "My colo'd server that stores my hot wallet keeps getting compromised. <days later> Welp the wallet is emptied". I don't know how to take this seriously?
- nemo44x 4y ago
  Luke Jr is rather famous in the crypto world and has been for over 10 years. This isn’t a rando posting something. It could be his Twitter has been hacked? We don’t know the whole story.
- nibbleshifter 4y ago
  The mans a halfwit, basically.
- shortcake27 4y ago
  I’m struggling to understand it. I hate crypto but I thought the ease of spinning up new wallets was a benefit. With that amount of money and the knowledge I was being targeted, I’d have hundreds of cold and hot wallets to distribute the attack surface. Perhaps I’m misunderstanding crypto or the situation.
- turtleman1338 4y ago
  Not to defend Luke but I nowhere read that he stored wallets on the hacked server and I think he explicitly stated that the server was not used for wallets.
CyberDildonics 4y ago
Just for a little context luke jr was infamous on cryptocurrency forums for being adamant that the sun revolved around the earth, all religions other than catholicism are evil, there is an "ethical aspect to slavery" and that bitcoin's 1 KB/s throughput was too much and should be cut down even further. https://archive.is/sS5Ml https://archive.is/sS5Ml https://archive.is/DrP83 https://archive.is/DrP83 https://np.reddit.com/r/Christianity/comments/36w6nw/why_didnt_jesus_condemn_slavery/crhljba/ https://np.reddit.com/r/Christianity/comments/36w6nw/why_did... https://np.reddit.com/r/Bitcoin/comments/490dyi/serious_question_if_raising_the_max_block_size/d0o4mjl/ https://np.reddit.com/r/Bitcoin/comments/490dyi/serious_ques... I would take what he says with a grain of salt.
- vorpalhex 4y ago
  I'm not going to comment on his overall opinions, but it does seem like his judgement is severely compromised. I wonder if that led to the negligent behavior which allowed the coins to be compromised and stolen - a discount server host with a history of being compromised seems like the absolute wrong place to store large sums of value.
  - bbbbb5 4y ago
    Inclined to agree here. Luke is going on about Intel ME backdoors on Twitter, but in reality there will be a far less crazy explanation for how he got owned.
    - dannyw 4y ago
      In reality a $55 per month colo provider with a history of security incidents is not a reasonable choice for a high security application.
      - bbbbb5 4y ago
        You can easily protect your hardware from all but the most determined adversaries with extensive physical access. Epoxy in ports, case intrusion detection and locked down boot chain. Use TPM2-totp for verified boot. Your colo provider can be thoroughly owned, your adversaries can have physical access to the server for extended periods of time and still not be able to do anything because you've denied them access to any ports that'd allow DMA. Lots of cheap DIY options for fancy case intrusion detection going way beyond that offered by mfgs. USB camera and some tape?
TillE 4y ago
It's certainly not the cause of this hack, but nobody should be using asymmetric encryption to protect their own stuff. It should only be used for communication with another party. Quantum computing will eventually be a thing. So use symmetric encryption whenever it's at all possible.
- eastbound 4y ago
  Is symmetric encryption safer? Why so? As well, if asymetric encryption is ever broken, then nothing is safe on the internet.
  - dtech 4y ago
    From quantum computing attacks it is safer, specifically because there is a fast quantum algorithm for prime factoring [1]. However, including working quantum computers in your threat profile is ridiculous for things like this at the moment. [1] https://en.wikipedia.org/wiki/Shor%27s_algorithm https://en.wikipedia.org/wiki/Shor%27s_algorithm
- MuffinFlavored 4y ago
  > asymmetric encryption PGP? RSA? Can you elaborate please? > symmetric encryption AES? Is this what you mean? What's the best way to do AES these days? AES-256-CBC? Is there "symmetric encryption" that is public key/private key? I know AES you just need IV + key and you're "good to go"?
  - torben-friis 4y ago
    I think he’s just implying that since asymmetric depends on the reverse operation being slow, there will eventually be a system fast enough or a non slow algorithm for the operation. A bit far fetched IMO if the threat model depends on quantum computing but I have no idea about the subject so…
kinnth 4y ago
Would this happen if his wallet was a hardware wallet like a ledger or trezor?
- tromp 4y ago
  999,999 times out of a million, the answer is no. the 1 time out of a million is when an attacker manages to intercept the hardware wallet being shipped to the victim and tamper with it.
  - paulpauper 4y ago
    read Reddit. way more people being hacked than 1/1,000,000 . Having malware that changes the destination address for example.
    - rewtraw 4y ago
      That's not the hardware wallet being exploited though, it targets the user's computer. Verifying the address on the screen of a hardware wallet during confirmation would reveal the mismatch. But most HW wallets have tiny screens that make users apathetic to validating tx data.
      - yifanl 4y ago
        It might be a bit presumptious, but wouldn't there be a point where the friction in user interface reduces the security of the system?
- ChrisClark 4y ago
  Probably not, he was storing his bitcoin private key on a low cost server, that regularly got hacked, as recently as a month ago. And he kept using it.
Raed667 4y ago
One of the linked transactions: https://www.blockchain.com/explorer/transactions/btc/432ded946431a9612f09d73bd15ded045d11d1095ffdfe8d68306ea9b2e78930 https://www.blockchain.com/explorer/transactions/btc/432ded9... The destination address (https://www.blockchain.com/explorer/addresses/btc/1YAR6opJCfDjBNdn5bV8b5Mcu84tv92fa https://www.blockchain.com/explorer/addresses/btc/1YAR6opJCf...) seems to have received ~216 BTC yesterday in the span of 4 minutes
- sillysaurusx 4y ago
  The hacker will have a rough time converting these to USD without exposing himself. If they’re in Russia they probably don’t need to care, but there’s a reasonable chance they live in a country that the FBI can reach. On the other hand, no one can do anything until the coins are moved or more information is uncovered. What a nightmare to lose $3.6m overnight.
  - mrtksn 4y ago
    Or just make a deal with someone in Russia?
    - sillysaurusx 4y ago
      That’ll likely go about as well as making a deal in RuneScape. Though the hacker doesn’t have many options.
  - integricho 4y ago
    couldn't he convert it to monero, perform a couple of wallet to wallet transfers (maybe even divide the amount along the way), and then sell from there?
  - Yizahi 4y ago
    Just use Defi - take a loan from a "smart" script with a collateral of tainted bittokens, then cash out loaned tokens, and never repay the loan. Isn't Finance 2.0 amazing? :)
SkyMarshal 4y ago
Update: https://twitter.com/naka_frodo/status/1609655813789949959/photo/1 https://twitter.com/naka_frodo/status/1609655813789949959/ph... Looks like possibly a supply chain attack targeted specifically at Luke Jr's server.
- gigatexal 4y ago
  Color me surprised … haha nvm rofl
- Havoc 4y ago
  He put info connected to 3.6m BTC onto a colo crossing server? Jikes
  - dannyw 4y ago
    He is also looking for new "affordable" colo options. Budget $55 a month.
Havoc 4y ago
pytorch supply chain thing related perhaps?
- bigiain 4y ago
  I was wondering if he used LastPass. If I had those exfiltrated vaults, a key Bitcoin dev would certainly be high up in my list of who to brute force first.
wkdneidbwf 4y ago
a hot wallet on a $55 dedicated server from some rando colo? he would have been more secure having it at coinbase…
- doodlesdev 4y ago
  [flagged]
  - MuffinFlavored 4y ago
    What do we know that the "hacker" achieved? Was it physical access to the datacenter at the VPS he chose or was it... some "Linux malware virus"? What did they get? His PGP keys were his Bitcoin private keys? His passphrase? They were just a file laying around on his VPS machine?
doodlesdev 4y ago
Could this be a "boating accident" since it's tax season? Or maybe only his Twitter was hacked? No info from him at his mastodon https://mastodon.social/@lukedashjr@bitcoinhackers.org https://mastodon.social/@lukedashjr@bitcoinhackers.org If true this is absolutely devastating. Somewhat funny too, but devastating. edit: Well, it's confirmed. Insane. https://twitter.com/peterktodd/status/1609655629903265795 https://twitter.com/peterktodd/status/1609655629903265795 https://twitter.com/peterktodd/status/1609666001251229696 https://twitter.com/peterktodd/status/1609666001251229696
- hgsgm 4y ago
  Peter writes in that thread that "computer security is a mess" and also that any competent IT professional can secure their cryptoc with [whatever is considered state of the art this year]. Imagined banking was only available to people with equivalent of a college degree in finance and ongoing continuing education ..but also half the education is provided by criminals trying to rob use across national borders.
- cuteboy19 4y ago
  It all seems so implausible that boating accident seems true enough
- bagels 4y ago
  I believe there is a relatively low limit for theft losses when it comes to tax writeoffs.
  - tim333 4y ago
    Also tax losses are usually calculated as cost minus value received. In this case the cost is probably minimal as I imagine he mined them way back.
- mjg59 4y ago
  When referring to Peter Todd, it's worth remembering that he's accused of rape and may not be a reliable source: https://storage.courtlistener.com/recap/gov.uscourts.cand.340308/gov.uscourts.cand.340308.30.3.pdf https://storage.courtlistener.com/recap/gov.uscourts.cand.34...
paulpauper 4y ago
hmm cold wallet compromised too? https://twitter.com/LukeDashjr/status/1609661811455819776 https://twitter.com/LukeDashjr/status/1609661811455819776
- adql 4y ago
  I don't think author truly understands what cold wallet was supposed to entail lmao.
jwie 4y ago
It’s unfortunate. Though what do you expect when possession is ownership and there’s no mediating institution to help you with theft. If your brokerage account somehow gets hacked and all your funds gets stolen that’s not an unsolvable problem. You’ll likely get made whole after a while. There’s people, institutions, and laws to help you. Store digital cash in your mattress and someone will steal it, and no one will or can help.
- from 4y ago
  It may come as a surprise you to that the recovery rate for BEC incidents that are not immediately detected is very low and that victims often spend years suing their banks for faulty fraud protection in court for either only a partial settlement or nothing in return.
  - bbbbb5 4y ago
    Not only BEC, the recovery rate for ridiculously named authorized push payment fraud fraud (i.e. craigslist car scams) is also very low. Reg E at least protects consumers from some banking malware, but still does not provide protections for phishing victims (despite new non-binding CFPB guidance)
  - somenewaccount1 4y ago
    Having worked in banking for 20 years and knowing how many fraud transactions are reversed, I do indeed find that false information to be surprising.
    - bbbbb5 4y ago
      It's very well documented that less than 20% of BEC losses in the US are recovered.
    - from 4y ago
      > The challenge is that most BEC attacks will use bank accounts outside the US. In truth, the IC3 RAT recovered less than 14% of the total US$2.4 billion in BEC losses last year. https://www.welivesecurity.com/2022/04/26/trouble-bec-how-stop-costliest-scam/ https://www.welivesecurity.com/2022/04/26/trouble-bec-how-st... https://www.ic3.gov/Media/Y2022/PSA220504 https://www.ic3.gov/Media/Y2022/PSA220504
lizknope 4y ago
I needed a good laugh to start off the new year! Couldn't have happened to a more awful person. https://www.reddit.com/r/Buttcoin/comments/4936kw/lukejr_is_a_seriously_a_super_crazy_person_quotes/ https://www.reddit.com/r/Buttcoin/comments/4936kw/lukejr_is_...
- torben-friis 4y ago
  Jesus. Why is it that people with this level of crazy keep appearing at the top of important tech projects??
  - bhaak 4y ago
    My guess is that he makes the other developers look sane in comparison.
  - lizknope 4y ago
    That thread I linked to is 6 years old. The people in charge of the Bitcoin software know this and keep him on the project. To me that says a lot about the core Bitcoin people. Maybe Ethereum people are better? Let's see what Vitaly thinks about child pornography. https://www.reddit.com/r/Buttcoin/comments/v0n5d5/vitalik_buterins_perspective_on_child_pornography/ https://www.reddit.com/r/Buttcoin/comments/v0n5d5/vitalik_bu... I'll proudly go on record saying that I think 99% of crypto related things are scams, money laundering, or for illegal activities including sanctions evasions, but the people at the top are pretty disgusting.
    - hacym 4y ago
      No wonder it’s used for that based on the people that are the biggest advocates.
- MisterBastahrd 4y ago
  Yeah, I'm not sad about any of this. The guy is an ivory tower conspiracy theorist and moralistic extremist whose crazy apparently does not reach to the point of doing the bare minimum to ensuring that his stash was safe. Not even the first time he was hacked in the past 2 months.
amadeuspagel 4y ago
> The irony here is Luke being a dev probably made it easier for him to be complacent. His security setup was frankly a lot worse than what most plebs seem to use. > The standard advice of buy a Trezor and write down your seed on paper is much better than a Gentoo hot wallet. https://twitter.com/peterktodd/status/1609667983298658304 https://twitter.com/peterktodd/status/1609667983298658304
- MuffinFlavored 4y ago
  So most crypto users should: 1. Sign up for Coinbase (where you give your driver's license + bank account ACH and get validated as a legit US citizen or whatever) 2. Transfer USD into Coinbase 3. Purchase BTC with that USD 4. Transfer that BTC from Coinbase to a $80 Trezor Model One wallet from Amazon?
  - DJBunnies 4y ago
    From Trezor directly.
    - MuffinFlavored 4y ago
      https://trezor.io/trezor-model-one https://trezor.io/trezor-model-one $70 Got it. Thanks.
      - Bootvis 4y ago
        Not just to save $10 but also to have a smaller chance of someone (e.g. an Amazon affiliate) tampering with your device.
  - mancerayder 4y ago
    5. Make sure you didn't forget the pin to your Ledger wallet and you still have your magic words printed somewhere or in the Keepass file you haven't unlocked -- all in several years. Coinbase is lower risk here. There are more things that can go wrong in process or memory than the above than Coinbase going belly up or getting fully hacked.
gafferongames 4y ago
Moron loses 3.6 million. News at 11
- andrewmcwatters 4y ago
  Makes good entertainment.
- adql 4y ago
  Byecoin
xslvrxslwt 4y ago
Can't wait for MentalOutlaw's cover of this topic. This dude looks like he's part of Jehovah's witnesses and listens to Kanye west day-night, how can someone like that be a core BTC developer..
323 4y ago
Even a 10 year core developer failed to secure his keys. Not your keys, not your bitcoin is a dumb thing for the general public. Exactly why we don't keep our money in our house, but in banks. Nobody says "not under your mattress, not your cash".
tkiolp4 4y ago
Maybe off topic: is it fine to publicly say that you have $3.6M in bitcoin using a profile name that exposes who you are in real life? Wouldn’t the IRS (or local equivalent) come to knock your door and ask for taxes on that money?
- petesergeant 4y ago
  Assuming you’re not committing tax fraud, you’ve already told the local tax authority whatever you’re required to about it. Not an accountant, but in many places then unless it’s income generating, you may not need to declare it until you actually sell it / convert it / use it.
- creatonez 4y ago
  As of 2021 the IRS asks about cryptocurrency assets, so anyone who screws this up and lies to the IRS is already under threat of perjury.
- gruez 4y ago
  >Wouldn’t the IRS (or local equivalent) come to knock your door and ask for taxes on that money? Not sure about other countries, but at least in the US any gains on crypto is only taxable after you've sold (or transacted with) it. Given that he just got his bitcoin stolen, my guess is that he hasn't sold yet, and therefore doesn't owe any taxes yet.
  - usrusr 4y ago
    So we can add another possible explanation to the list: it could all be theatre in preparation of selling in the unregistered way?
- tgsovlerkhgsel 4y ago
  It's particularly fine to say it publicly when you're going to try to get a write-off for the loss...
SangareEel 4y ago
I wouldn't wish this upon anyone. But I don't believe him. Lukejr has done irreparable damage to Bitcoin. His role in the mass censorship and gaslighting program that locked Bitcoin into sluggish, expensive, tiny blocks (ostensibly in order to carve out a market for Lightning, in which he had significant interest) is disgraceful, condemnable, and must never be forgotten. This exploitation of opportunity and power spat in the face of every early Bitcoin adopter and evangelist as it violated the perfect system we came to know and love from the whitepaper for commercial gain, arguably starting the trend of charlatans and fraudsters in the crypto space looking for a quick buck with reckless, corrupting abandon. He will say anything to get what he wants, and he will truly believe he is right and entitled to do so. He has a casual, naive tone to everything he says but this man is far from either. He would look right into his own mother's eyes and tell the most wicked lies for the $5 in her purse. Don't believe anything.
throwaway128128 4y ago
Wow, the Tonal Bitcoin guy got hacked!
deleted 4y ago
[deleted]
draw_down 4y ago
[dead]
s5300 4y ago
This twitter account is quite wild. Timeline of dunking his frozen store bought pizzas (still in bag) into hydrogen peroxide to “kill the coranavirus” before putting them into long-term freeze, then getting mad & @‘ing the pizza company’s twitter account upon liquid ingress to aforementioned packing… This is what has come of the cool thing (bitcoin - twitter user is a core dev to my knowledge) I learned of as a tween, well over a decade ago.
netheril96 4y ago
If I had 200 BTCs I would use several multi-sig wallets. Stealing any single wallet would grant the hacker no access, and stealing multiple would grant them only access to a slice of the asset. Maybe 200 BTC isn't just worth much to the developer to warrant so many protections.
greatgib 4y ago
Side note: twitter really sucks now. I have to click 200 times on "view the replies" to unroll the thread comments. I gave up in the end
- Cub3 4y ago
  It never loaded for me, I had to use threadreader to see the original tweet Maybe because I'm behind a VPN
- DangitBobby 4y ago
  It's never really been a joy to navigate, tbf.
qualudeheart 4y ago
Malarky like this is why I am a nocoiner.
darthrupert 4y ago
I used to be a proponent of anonymous money transfers. Then I read a few books about the extent of money laundering of criminal organisations, largest of them Putin's Russia, and how difficult and dangerous it is to investigate those crimes. Now I think the priority should be maximum transparency. The job of solving a money laundering scheme should be as simple as a single search query, or a GPT bot question. BTC could be a part of this solution, since its ledger is open. This is not a perfect solution, but the amount of power these criminals distill from money laundering is far too great.
birracerveza 4y ago
How to have this not happen to you: 1) Use a hardware wallet 2) Don't be an idiot. That's it. That's the whole guide. He missed both steps of the guide.
xch 4y ago
why nobody listens to bram's clawback suggestion?
- timdaub 4y ago
  more details please
knorker 4y ago
This is a core developer. Even core developers are not competent to run their own bank. Can we now stop hearing about how the unbanked should start running their own banks?
throwaway67743 4y ago
Haha! Evidently a complete lack of security or worth judgement. "$300/mo for a rack is expensive" (no, no it isn't) "Someone booted an unknown OS from external media" (no FDE) Machine compromised on the "17th of november* and instead of considering everything compromised, the guy continued using it evidently. Zero sympathy whatsoever, if you can't manage the basics you certainly shouldn't be running it yourself, and definitely shouldn't be "core" developer on projects that require at least some security clue (Also religious nutjob, as referenced in another thread)
- bartimus 4y ago
  I still don't entirely get what has happened. So he runs a bitcoin node on a compromised machine. But why would he store (or use) his 200+ BTC private keys there? He also mentions: > No, they got my cold wallet too somehow How can that happen?
  - throwaway67743 4y ago
    After reading some of the (many many) replies to tweets, it seems the story is pretty much what I summed it up as: he got compromised and failed security 101 They likely used the access they had to further infect or snaffle credentials etc - a very simple and obvious one is reverse SSH tunnels for example
- imperialdrive 4y ago
  He's actually pretty clever for claiming to 'lose' the BTC... does that mean no taxes to pay?
  - throwaway67743 4y ago
    Hadn't considered that as I still don't believe anyone bothers declaring and paying tax on it - not always deliberately but because most people are uninformed stupids about pretty much everything
TravelTechGuy 4y ago
Self custody is hard. And even professionals can make mistakes. Most people don't think about it: they have a bank holding their "balance", a broker "holding" their stocks, an employer "holding" their salary, and maybe even a crypto exchange "holding" their tokens - until they don't. Only when you get into the nitty-gritty of self custody, you understand it's a security hassle: you need to save a seed for crypto, or boxes of gold ingots, or precious art in special climate-controlled packaging etc. People traded this insecurity, this chance of losing it all in one unfortunate event, for the warm comforts of having someone else custody your assets. But ask Greek people in 2008 (or Lebanese people now) how does it feel to come to a bank where you've had an account until yesterday, and find out there's no money to go around. We're starting to see some strides being made into simplifying and securing crypto custody (MPD, Multi-sig etc.). But at its core, if you want to truly hold your asset, you will need to keep ahold of something (safe key, seed phrase, physical item etc.).
itsthejb 4y ago
Well this sure is a pretty fascinating case, if it proves to be true, which it _seems_ to be? One thing I'm not seeing mentioned here is discussion of the password for that wallet.dat. This reminds me of back during the 2017 bull run, when I tried to help a friend recover a forgotten password for a bottom 6-figures Dash coin wallet. We went even so far as spinning up some EC2 GPU instances to run Hashcat. In the end, considering the modest value of the wallet, it wasn't cost effective to brute-force. I think we got up to the threshold of 7-9 characters where the time/cost becomes prohibitive. So I'm wondering, assuming the guy even HAD a password on the database file, or that we didn't have a password.txt on this server, I wonder about the sequence of events where: 1. Server is hacked a few months ago, either knowingly (target a core dev), or farmed (searching for vulnerable servers, grabbing high value assets such as wallet.dats) 2. wallet.dat is copied. IIRC gives free access to the public key, therefore revealing a high value wallet 3. In the meantime, attacker employs compute resources to crack the private key 4. After some months of doing this, finds the passwords, empties the wallet This would seem to match my quick reading of the events. I'm now intrigued to do some sums to work out the feasibility of doing this when a 7-figure wallet is found. This is assuming compute prices are that much cheaper than 5 years ago, and that this might be a independent attacker, not some NK-style state actor. I may come back to this and do the calculations...

345 points by TylerE 4y ago

[dead]

As soon as trouble comes to paradise, they wonder why traditional institutions they dissed all along is not dropping everything and take up their case (FBI in this case).

deleted 4y ago
[deleted]
- deleted 4y ago
  [deleted]
dang 4y ago
Ok, but please don't post repetitive flamewar comments to HN—this kind of thing has been posted a thousand times by now; the only value left in it is indignation, which is the opposite of the curiosity we want here. Perhaps you don't owe paradise better, but you do owe this community better if you're participating in it. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- kumarm 4y ago
  Got it. I agree the comment was useless.
  - dang 4y ago
    Appreciated! Btw one more thought: this kind of thing is natural in conversation because repetition has other functions (e.g. it connects people to share and agree on familiar things). So commenters aren't doing anything wrong in principle when they post like this—it's actually HN's rules which are the unnatural thing. But it's clear that we have to have them, given the mandate of the site. https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sort=byDate&type=comment&query=curiosity%20optimiz%20by:dang https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...
tibbydudeza 4y ago
Yeah FDIC is for loosers - we are stepping out of the matrix.
- deleted 4y ago
  [deleted]

deleted 4y ago

[deleted]

belmarca 4y ago

This is the tweet: https://twitter.com/LukeDashjr/status/1609613748364509184 https://twitter.com/LukeDashjr/status/1609613748364509184

dang 4y ago
Ok, we changed to that from https://preview.redd.it/fovmtx7gjh9a1.jpg?auto=webp&s=d5b896ab174c6280fd4843faef53d230d83befda https://preview.redd.it/fovmtx7gjh9a1.jpg?auto=webp&s=d5b896.... Thanks! Submitters: "Please submit the original source. If a post reports on something found on another site, submit the latter." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

mccorrinall 4y ago

Would be interesting to know how his BTC were stolen. Because he is a BTC core developer, I believe he followed the best practices, like not writing down his password. So infection or keylogger?

sosodev 4y ago
Storing most of his bitcoin in a single hot wallet seems to go against the best practices, no?
- mateuszf 4y ago
  He said it was not most of his bitcoins. https://twitter.com/LukeDashjr/status/1609618498027753472 https://twitter.com/LukeDashjr/status/1609618498027753472 EDIT: Right, maybe it's all
  - sosodev 4y ago
    First he said "at least many of my bitcoins stolen" and then followed up with "Nevermind many. It's basically all gone" Which implies that it is indeed most of his bitcoins.
  - kube-system 4y ago
    He then said it was basically all: https://twitter.com/lukedashjr/status/1609647203890372609 https://twitter.com/lukedashjr/status/1609647203890372609
  - blibble 4y ago
    irreversible transactions are a feature!
- gnull 4y ago
  What is hot wallet, btw?
  - sosodev 4y ago
    I don't know if it has a concrete definition but I generally say it to mean a crypto wallet that is directly or indirectly exposed to the internet. It's possible to create a bitcoin wallet completely offline in a secure environment. The details to the wallet are then stored physically in a secure location/medium. This is called a cold wallet. People typically use a cold wallet for long-term storage of coins.

TedDoesntTalk 4y ago

> What the heck @FBI @ic3 why can't I reach anyone??? Uh, because it’s New Year’s Day? Don’t get injured or become a crime victim on a holiday, if possible.

Sebb767 4y ago
Slightly off-topic, but who is this @ic3 and why does he tag them in the same way as the FBI? Here's the account, for reference: https://twitter.com/ic3 https://twitter.com/ic3 . Doesn't look like an official to me.
- deleted 4y ago
  [deleted]
- kube-system 4y ago
  Clearly he meant https://www.ic3.gov/ https://www.ic3.gov/ but tagged a wrong account.
  - logifail 4y ago
    > Clearly he meant https://www.ic3.gov/ https://www.ic3.gov/ but tagged a wrong account I use Twitter solely for moaning at service providers who respond [far!] faster on Twitter than they do by phone or email, but .. umm ... doesn't this [common] mistake demonstrate how broken this approach is?
kristianc 4y ago
Every crypto hack is followed by a swift call for a centralised authority to intervene.
- nemo44x 4y ago
  Why is that inconsistent? There’s a lot of people that believe governments only legit purpose is to protect people and their property.

green-eclipse 4y ago

> "Nevermind many. It's basically all gone" https://twitter.com/LukeDashjr/status/1609647203890372609 https://twitter.com/LukeDashjr/status/1609647203890372609

tromp 4y ago

Loss of his bitcoin is not yet confirmed. It's possible that only his twitter account got hacked, and the hacker is having some fun with it. Beyond being a bitcoin core dev [1], Luke-Jr is also the author of an independent node and wallet implementation known as Bitcoin Knots [2]. [1] https://github.com/luke-jr https://github.com/luke-jr [2] https://bitcoinknots.org/ https://bitcoinknots.org/

yuvadam 4y ago
Peter Todd claims he has confirmation [1] [1] - https://twitter.com/peterktodd/status/1609655629903265795 https://twitter.com/peterktodd/status/1609655629903265795
- gjsman-1000 4y ago
  If a Bitcoin Developer with >$3M in Bitcoin didn’t use a hardware wallet… God help the typical Bitcoin user. It’s a tragedy, and inexcusable.
  - SilasX 4y ago
    Gavin Andresen, a lead Bitcoin developer, sent me a 10 BTC donation ($3000 at the time) when he meant to send $10 worth of BTC. Yes, I refunded. https://news.ycombinator.com/item?id=14720921 https://news.ycombinator.com/item?id=14720921
    - hgsgm 4y ago
      Great example of how "Bitcoin is trustless" means "Bitcoin only works is the trust is provided externally".
      - 323 4y ago
        It's not just Goodness of heart. This case can fall under existing laws. You are not allowed to keep obvious transfer mistakes like these.

deleted 4y ago

[deleted]

sophrocyne 4y ago

Turns out the advice “not your wallet, not your coins” still holds true in this context.

deleted 4y ago
[deleted]

deleted 4y ago

[deleted]

jtchang 4y ago

If you hold a large amount of bitcoin your threat model should be way above the average person. It sounds like his infrastructure was specifically targeted. It can be very difficult to protect against targeted attacks from adversaries.

Alex3917 4y ago
> It can be very difficult to protect against targeted attacks from adversaries. Not really. The device used to sign transactions should never be connected to the Internet.
- tsimionescu 4y ago
  If the level is millions of dollars, that device could be physically stolen, or some aspect of the cryptography/auth scheme could be attacked through a 0-day. Of course, it's also possible he just wanted something closer to the convenience of a bank account/credit card instead of a pile of cash and failed in the opsec.
  - lampshades 4y ago
    That’s why you don’t store millions of dollars in your physical location. You break up the seed and disperse it among several bank lock boxes. (See https://en.m.wikipedia.org/wiki/Shamir's_Secret_Sharing) https://en.m.wikipedia.org/wiki/Shamir's_Secret_Sharing). Keep a small amount in a hot wallet for convenience and a larger amount (but not too large) in a cold wallet accessed via hardware. But the bulk shouldn’t be accessible without breaking into at least two lock vaults.
    - tsimionescu 4y ago
      Why just two lock vaults and not some army bunkers, together with the nuclear codes preferably? At some point this level of care becomes more than absurd.
      - 4y ago

revskill 4y ago

Is this a trick to let BTC dip more (as planned), then when there's enough accumulation, good news comes ? ;)

echelon 4y ago

I've never been a fan of crypto (despite holding some for diversification), but I think some tweaks could be made to make it safer and more reasonable without comprising what its proponents like about the system. Crypto prtocols need a way to reverse transactions if the original address as well as some quorum of elected "supervisory overseers" agree [1] to it within a week or so. There should also be a mechanism to move the balance to another address with the original owner and these parties. This wouldn't allow the "regulators" to themselves steal or coerce, but they could provide assistance in large thefts like this. [1] Obviously the attacker would vote no, but a single yes from the true account owner would override.

dns_snek 4y ago
Since nobody has offered a response, I'll offer my 2c. Your suggestion flies in the face of what Bitcoin and other cryptocurrencies that operate according to the same principles were designed to be (trustless, some degree of anonymous) and it would make the system ripe for abuse (more than it already is). What if Luke Jr is lying and he spent those bitcoins in return for goods and services? Suddenly you have to establish a department that would hear from both parties which introduces the problem of identifying the other party and getting in contact with them, then they would have to evaluate the evidence and make some kind of judgement. Paypal attempts to do what you're describing and it's constantly abused by both buyers and sellers alike. Bitcoin might not be perfect, it might not even be fit for most purposes (highly subjective), but scrapping the idea outright would be a much better outcome than bastardizing it with "trusted" middlemen to the point where it's not fit for any purpose at all. I think progress could be made in UX design, by pushing users towards using hardware wallets and other areas, but changing the protocol such that trustless transactions now require trust is not an appropriate solution. It's the core of what cryptocurrency is as a concept.
- echelon 4y ago
  Thanks for the response! I appreciate it much more than the downvotes, and it gives me a position to consider. I still find myself in disagreement - there need to be safeguards at the protocol level, and not just for ordinary people. Escrow and restitution could be built as a feature where trustless and anonymous transactions can still take place. Taking into account my previous post, imagine this setup: There are now two types of wallets/addresses. One type functions exactly as Bitcoin does today. The other type, however, automatically subjects transactions to temporally-gated restitution systems and allows you to recover funds if a side channel refund request is made. Funds in the original Bitcoin wallet type experience transactions that are instant and non-refundable, and you can keep "hot" funds here. The "cold" wallet type requires more time to pass before the funds "settle". It can function as your bank and offer lots of additional security. It'd be easy to make the wallet type an identifiable part of the address so that all parties know what types of transactions they're involved in. This extension to the protocol could be 100% opt-in.

green-eclipse 4y ago

Dude has 8 kids and someone is claiming it was around 200 BTC. That's ~$3.3M down the tubes. Ouch.

notsrg 4y ago
Looks like 3.6M: https://www.blockchain.com/explorer/addresses/btc/1YAR6opJCfDjBNdn5bV8b5Mcu84tv92fa https://www.blockchain.com/explorer/addresses/btc/1YAR6opJCf...
Symbiote 4y ago
[flagged]
- deleted 4y ago
  [deleted]
- dibt 4y ago
  In an attempt to make this a more productive comment, can you elaborate on what is an "honest way" to make a living in a way that is not "environmentally destructive?" I assume the "other people with 8 kids" are not Amish people selling produce at a farmer's market. Someone providing for 8 kids would likely have a car (maybe two), and go to a job in a building that uses electricity, right? What about your leisure time? Xbox/Playstation? TV? PC/smartphone? Or are you somehow posting your comment via smoke signal or semaphore?
  - somenewaccount1 4y ago
    Any job not burning the equivalent energy of Argentina to accomplish a technical feat that could be done better with psql running on a raspberry pi.
    - dibt 4y ago
      [citations needed]
dinkblam 4y ago

sosodev 4y ago

https://bitcoinhackers.org/@lukedashjr https://bitcoinhackers.org/@lukedashjr his mastodon feed indicates that one of his servers was physically compromised multiple times. Seems like he should have been more paranoid about securing his coins with that knowledge?

perihelions 4y ago
Speaking of paranoid, that link you've posted, isn't that a link to a server that's known to be compromised, and also an apparent watering hole for crypto wallet holders? Am I unreasonable in thinking that's a very scary link?
- sosodev 4y ago
  Dunno, it's unclear if that Mastodon instance is hosted on his compromised servers.
  - deleted 4y ago
    [deleted]
- doodlesdev 4y ago
  1. Disable JavaScript. 2. Access (almost) any website in the internet 3. ????? 4. Profit edit: Mastodon doesn't work without JavaScript, holy hell. We truly are living in a dystopia. Thankfully you can still access his profile from another trusted instance such as mastodon.social at https://mastodon.social/@lukedashjr@bitcoinhackers.org https://mastodon.social/@lukedashjr@bitcoinhackers.org
  - perihelions 4y ago
    I always have JavaScript disabled by default (uMatrix policy), but (0) there's many other attack vectors, to my layman understanding, and (1) at any rate that one's a Mastodon instance and those are blank pages without JS. I'm electing to add new URL regexps to my uBlock filters, to reduce the risk of accidentally clicking a link similar to this. I don't think I want to visit any web domain that caters to people who hold crypto wallets. /.*coin.*/ /.*crypto.*/ /.*eth.*/

scottiebarnes 4y ago

Strange, a month ago he tweets about his server being compromised: https://twitter.com/LukeDashjr/status/1593227756841578496 https://twitter.com/LukeDashjr/status/1593227756841578496 Go figure

bpanon 4y ago
Supreme negligence on his part. He knows his server was accessed, but he didn't transfer the coins to a new address.
- theCrowing 4y ago
  Worse he just "purged" what he found instead of nuking the whole system.

phphphphp 4y ago

Apparently his servers keep getting hacked, which doesn’t reflect well on his security practices: https://twitter.com/LukeDashjr/status/1606885577843957762 https://twitter.com/LukeDashjr/status/1606885577843957762

technion 4y ago
Assuming this physical access claim is truthful (and i have doubts), I would feel at this point its budget letting him down. If your threat model includes "targeted attacks from people with physical access", it's time to run a vm on aws or azure and use the tooling they make available to secure it further. If you want tonnes of resourcing at a quite low budget, there's only a certain amount of "calling out" the group that supplied it that's reasonable.
- tinus_hn 4y ago
  If he has enough Bitcoins for it to be possible for ‘many of them’ to be stolen, he doesn’t have a small budget.
  - technion 4y ago
    Just makes this thread stranger. I know if I had over $3m in btc and was working professionally with them I wouldn't state my top budget was $55. Edit: his tweets specifically talk about not using "cloud nonsense " and states getting your own key to a rack is too expensive for him.
    - johnklos 4y ago
      My goodness. Really? He refers to "cloud nonsense", then uses a "dedicated server"? That's a new kind of special.
  - pshirshov 4y ago
    From his tweets: he was renting a physical server for $55/m. So, a total joke.
- 4y ago

simonw 4y ago

I still think the reason Satoshi vanished is that he lost his private key and couldn't handle the embarrassment.

MattPalmer1086 4y ago
That is the most plausible explanation I've ever heard. And it made me smile! Happy New Year :)
tiahura 4y ago
Agreed. Another plausible reason is that he died.
xrd 4y ago
Almost right. He spilled two (!) beers on the paper he wrote his private key upon, and he died of embarrassment.
- dennis_jeeves1 4y ago
  Now, what was the brand of beer he was having?
  - 1MachineElf 4y ago
    If he really was Japanese, then the only sensible conclusion is Asahi.
    - xrd 4y ago
      Why not Sapporo? Or, perhaps he was drinking Suntory Whiskey. That would be a plot twist!
      - ElfinTrousers 4y ago
        Maybe he didn't want it getting out that he'd actually been drinking Tsingtao.

vbo 4y ago

[flagged]

green-eclipse 4y ago
Is it HN's problem? Never even knew the guy existed until 5 minutes ago.
- vbo 4y ago
  Fair enough, though what I meant was really in relation to a class of problems, not this one person’s issue.
Barrin92 4y ago
because it's a useless problem to solve. The affected person going "FBI help me please" is the definition of that 'Bike Fall' meme. The answer to these situations is, use a currency where you can call someone that can roll your transaction back.
- vbo 4y ago
  That’s one answer. But the question also applies to non-cryptocurrency uses of cryptography where you need to guard your private keys (like identity) — ie how to best enable people to use their keys while keeping them safe and also allowing for some form of recovery.
reducesuffering 4y ago
You're right, I've got it! We'll store our money in a savings account, with transfer safeguards, where someone can't irreversibly yeet my life savings into the abyss.
- rkho 4y ago
  And yet they did: https://www.bloomberg.com/news/articles/2022-02-17/police-begin-financial-squeeze-trudeau-defends-emergency-edict https://www.bloomberg.com/news/articles/2022-02-17/police-be...

b3nji 4y ago

Anyone noticed there are no repeat messages on his Mastodon, that historically reflected his Twitter, or vice versa?

samwillis 4y ago

Context now that the editorialised title has changed, this is a core Bitcoin developer. These things happen every day, but happening to a core developer (if confirmed!) who has a deep understanding of the systems and security indicates just how fragile crypto can be (in my opinion)

spicymaki 4y ago
Exactly! if the experts can’t secure their accounts, what hope does anyone else have? Soon you will see people saying you should have done this or that complicated thing, or how somebody so smart could should have known better. No matter what they say it is never enough. This is why lack of consumer protections suck.
- psychphysic 4y ago
  That's why hardware based security is really the only way at this point. He might be a bitcoin core Dev but does he use ledger/trezor etc? Is his PGP key on his hardrive or a smartcard? In this day and age your computer not a bastion it once was. (It never really was but it's more of a problem in 2022 than 1982).
  - woodruffw 4y ago
    This completely talks past what the person you're replying to is saying: it doesn't matter if "hardware based security is [...] the only way," because its conspicuous absence indicates that even the experts fail to meet the onerous requirements placed on them by cryptocurrency.
    - bena 4y ago
      Yeah, this only highlights how ridiculous the requirements are. The system needs to be tolerant of failures and faults of multiple natures. And cryptocurrency is very intolerant or many types of failures and faults.
    - psychphysic 4y ago

WFHRenaissance 4y ago

Going to go out on a limb and say this is a Twitter account compromise.

dang 4y ago

Submitted title was "Top Bitcoin dev gets owned". It's great to post that kind of explanation in the comments, but please don't use the title for it. That's against the site guidelines: "Please use the original title, unless it is misleading or linkbait; don't editorialize." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

reducesuffering 4y ago

"the pedos who took over Vatican City are NOT Catholic" Sympathy cratering...

Macha 4y ago
A broken clock being right twice a day and all that. Prior to becoming Pope, Benedict did lead the Congregation for the Doctrine of the Faith which was responsible for covering up the child sex abuse scandals of the Catholic Church in Ireland. In addition, while he was Pope, someone high up in the church instructed the Irish part of the church to stymie the government's efforts to investigate said child abuse scandals which resulted in threatened expulsion of the vatican ambassador[1] (recalled by the vatican before it came to that), the closure of the Irish embassy to the Vatican[2] and a public condemnation by the Irish government[3]. What is much less up for debate is that Benedict and his sucessor Francis (who to be fair, has not had the same pre-papal track record as his predecessor) were fairly elected leaders of the catholic church by its own mechanisms. Also don't take this as approval or support for the guy's reactionary views of what he thinks catholicism should be. [1]: https://www.bbc.com/news/world-europe-14281441 https://www.bbc.com/news/world-europe-14281441 [2]: https://www.huffpost.com/entry/ireland-closes-embassy-to-vatican_n_1076528 https://www.huffpost.com/entry/ireland-closes-embassy-to-vat... [3]: https://www.irishtimes.com/news/kenny-condemns-vatican-response-to-allegations-1.880058 https://www.irishtimes.com/news/kenny-condemns-vatican-respo...
- deleted 4y ago
  [deleted]

deleted 4y ago

[deleted]

wereallterrrist 4y ago

This all stinks. Between the bio, the vague tweets about server hacks (implying Intel ME or a physical server compromise is at fault, really?), the vague tweets about this situation... Something fishy is going on or wow, really proof that sometimes it's just about being in the right place at the right time because wow dude does not have the first clue about security. Hot wallet, compromised, unrotated servers, come on. "My colo'd server that stores my hot wallet keeps getting compromised. <days later> Welp the wallet is emptied". I don't know how to take this seriously?

nemo44x 4y ago
Luke Jr is rather famous in the crypto world and has been for over 10 years. This isn’t a rando posting something. It could be his Twitter has been hacked? We don’t know the whole story.
nibbleshifter 4y ago
The mans a halfwit, basically.
shortcake27 4y ago
I’m struggling to understand it. I hate crypto but I thought the ease of spinning up new wallets was a benefit. With that amount of money and the knowledge I was being targeted, I’d have hundreds of cold and hot wallets to distribute the attack surface. Perhaps I’m misunderstanding crypto or the situation.
turtleman1338 4y ago
Not to defend Luke but I nowhere read that he stored wallets on the hacked server and I think he explicitly stated that the server was not used for wallets.

CyberDildonics 4y ago

Just for a little context luke jr was infamous on cryptocurrency forums for being adamant that the sun revolved around the earth, all religions other than catholicism are evil, there is an "ethical aspect to slavery" and that bitcoin's 1 KB/s throughput was too much and should be cut down even further. https://archive.is/sS5Ml https://archive.is/sS5Ml https://archive.is/DrP83 https://archive.is/DrP83 https://np.reddit.com/r/Christianity/comments/36w6nw/why_didnt_jesus_condemn_slavery/crhljba/ https://np.reddit.com/r/Christianity/comments/36w6nw/why_did... https://np.reddit.com/r/Bitcoin/comments/490dyi/serious_question_if_raising_the_max_block_size/d0o4mjl/ https://np.reddit.com/r/Bitcoin/comments/490dyi/serious_ques... I would take what he says with a grain of salt.

vorpalhex 4y ago
I'm not going to comment on his overall opinions, but it does seem like his judgement is severely compromised. I wonder if that led to the negligent behavior which allowed the coins to be compromised and stolen - a discount server host with a history of being compromised seems like the absolute wrong place to store large sums of value.
- bbbbb5 4y ago
  Inclined to agree here. Luke is going on about Intel ME backdoors on Twitter, but in reality there will be a far less crazy explanation for how he got owned.
  - dannyw 4y ago
    In reality a $55 per month colo provider with a history of security incidents is not a reasonable choice for a high security application.
    - bbbbb5 4y ago
      You can easily protect your hardware from all but the most determined adversaries with extensive physical access. Epoxy in ports, case intrusion detection and locked down boot chain. Use TPM2-totp for verified boot. Your colo provider can be thoroughly owned, your adversaries can have physical access to the server for extended periods of time and still not be able to do anything because you've denied them access to any ports that'd allow DMA. Lots of cheap DIY options for fancy case intrusion detection going way beyond that offered by mfgs. USB camera and some tape?

TillE 4y ago

It's certainly not the cause of this hack, but nobody should be using asymmetric encryption to protect their own stuff. It should only be used for communication with another party. Quantum computing will eventually be a thing. So use symmetric encryption whenever it's at all possible.

eastbound 4y ago
Is symmetric encryption safer? Why so? As well, if asymetric encryption is ever broken, then nothing is safe on the internet.
- dtech 4y ago
  From quantum computing attacks it is safer, specifically because there is a fast quantum algorithm for prime factoring [1]. However, including working quantum computers in your threat profile is ridiculous for things like this at the moment. [1] https://en.wikipedia.org/wiki/Shor%27s_algorithm https://en.wikipedia.org/wiki/Shor%27s_algorithm
MuffinFlavored 4y ago
> asymmetric encryption PGP? RSA? Can you elaborate please? > symmetric encryption AES? Is this what you mean? What's the best way to do AES these days? AES-256-CBC? Is there "symmetric encryption" that is public key/private key? I know AES you just need IV + key and you're "good to go"?
- torben-friis 4y ago
  I think he’s just implying that since asymmetric depends on the reverse operation being slow, there will eventually be a system fast enough or a non slow algorithm for the operation. A bit far fetched IMO if the threat model depends on quantum computing but I have no idea about the subject so…

kinnth 4y ago

Would this happen if his wallet was a hardware wallet like a ledger or trezor?

tromp 4y ago
999,999 times out of a million, the answer is no. the 1 time out of a million is when an attacker manages to intercept the hardware wallet being shipped to the victim and tamper with it.
- paulpauper 4y ago
  read Reddit. way more people being hacked than 1/1,000,000 . Having malware that changes the destination address for example.
  - rewtraw 4y ago
    That's not the hardware wallet being exploited though, it targets the user's computer. Verifying the address on the screen of a hardware wallet during confirmation would reveal the mismatch. But most HW wallets have tiny screens that make users apathetic to validating tx data.
    - yifanl 4y ago
      It might be a bit presumptious, but wouldn't there be a point where the friction in user interface reduces the security of the system?
ChrisClark 4y ago
Probably not, he was storing his bitcoin private key on a low cost server, that regularly got hacked, as recently as a month ago. And he kept using it.

Raed667 4y ago

One of the linked transactions: https://www.blockchain.com/explorer/transactions/btc/432ded946431a9612f09d73bd15ded045d11d1095ffdfe8d68306ea9b2e78930 https://www.blockchain.com/explorer/transactions/btc/432ded9... The destination address (https://www.blockchain.com/explorer/addresses/btc/1YAR6opJCfDjBNdn5bV8b5Mcu84tv92fa https://www.blockchain.com/explorer/addresses/btc/1YAR6opJCf...) seems to have received ~216 BTC yesterday in the span of 4 minutes

sillysaurusx 4y ago
The hacker will have a rough time converting these to USD without exposing himself. If they’re in Russia they probably don’t need to care, but there’s a reasonable chance they live in a country that the FBI can reach. On the other hand, no one can do anything until the coins are moved or more information is uncovered. What a nightmare to lose $3.6m overnight.
- mrtksn 4y ago
  Or just make a deal with someone in Russia?
  - sillysaurusx 4y ago
    That’ll likely go about as well as making a deal in RuneScape. Though the hacker doesn’t have many options.
- integricho 4y ago
  couldn't he convert it to monero, perform a couple of wallet to wallet transfers (maybe even divide the amount along the way), and then sell from there?
- Yizahi 4y ago
  Just use Defi - take a loan from a "smart" script with a collateral of tainted bittokens, then cash out loaned tokens, and never repay the loan. Isn't Finance 2.0 amazing? :)

SkyMarshal 4y ago

Update: https://twitter.com/naka_frodo/status/1609655813789949959/photo/1 https://twitter.com/naka_frodo/status/1609655813789949959/ph... Looks like possibly a supply chain attack targeted specifically at Luke Jr's server.

gigatexal 4y ago
Color me surprised … haha nvm rofl
Havoc 4y ago
He put info connected to 3.6m BTC onto a colo crossing server? Jikes
- dannyw 4y ago
  He is also looking for new "affordable" colo options. Budget $55 a month.

Havoc 4y ago

pytorch supply chain thing related perhaps?

bigiain 4y ago
I was wondering if he used LastPass. If I had those exfiltrated vaults, a key Bitcoin dev would certainly be high up in my list of who to brute force first.

wkdneidbwf 4y ago

a hot wallet on a $55 dedicated server from some rando colo? he would have been more secure having it at coinbase…

doodlesdev 4y ago
[flagged]
- MuffinFlavored 4y ago
  What do we know that the "hacker" achieved? Was it physical access to the datacenter at the VPS he chose or was it... some "Linux malware virus"? What did they get? His PGP keys were his Bitcoin private keys? His passphrase? They were just a file laying around on his VPS machine?

doodlesdev 4y ago

Could this be a "boating accident" since it's tax season? Or maybe only his Twitter was hacked? No info from him at his mastodon https://mastodon.social/@lukedashjr@bitcoinhackers.org https://mastodon.social/@lukedashjr@bitcoinhackers.org If true this is absolutely devastating. Somewhat funny too, but devastating. edit: Well, it's confirmed. Insane. https://twitter.com/peterktodd/status/1609655629903265795 https://twitter.com/peterktodd/status/1609655629903265795 https://twitter.com/peterktodd/status/1609666001251229696 https://twitter.com/peterktodd/status/1609666001251229696

hgsgm 4y ago
Peter writes in that thread that "computer security is a mess" and also that any competent IT professional can secure their cryptoc with [whatever is considered state of the art this year]. Imagined banking was only available to people with equivalent of a college degree in finance and ongoing continuing education ..but also half the education is provided by criminals trying to rob use across national borders.
cuteboy19 4y ago
It all seems so implausible that boating accident seems true enough
bagels 4y ago
I believe there is a relatively low limit for theft losses when it comes to tax writeoffs.
- tim333 4y ago
  Also tax losses are usually calculated as cost minus value received. In this case the cost is probably minimal as I imagine he mined them way back.
mjg59 4y ago
When referring to Peter Todd, it's worth remembering that he's accused of rape and may not be a reliable source: https://storage.courtlistener.com/recap/gov.uscourts.cand.340308/gov.uscourts.cand.340308.30.3.pdf https://storage.courtlistener.com/recap/gov.uscourts.cand.34...

paulpauper 4y ago

hmm cold wallet compromised too? https://twitter.com/LukeDashjr/status/1609661811455819776 https://twitter.com/LukeDashjr/status/1609661811455819776

adql 4y ago
I don't think author truly understands what cold wallet was supposed to entail lmao.

jwie 4y ago

It’s unfortunate. Though what do you expect when possession is ownership and there’s no mediating institution to help you with theft. If your brokerage account somehow gets hacked and all your funds gets stolen that’s not an unsolvable problem. You’ll likely get made whole after a while. There’s people, institutions, and laws to help you. Store digital cash in your mattress and someone will steal it, and no one will or can help.

from 4y ago
It may come as a surprise you to that the recovery rate for BEC incidents that are not immediately detected is very low and that victims often spend years suing their banks for faulty fraud protection in court for either only a partial settlement or nothing in return.
- bbbbb5 4y ago
  Not only BEC, the recovery rate for ridiculously named authorized push payment fraud fraud (i.e. craigslist car scams) is also very low. Reg E at least protects consumers from some banking malware, but still does not provide protections for phishing victims (despite new non-binding CFPB guidance)
- somenewaccount1 4y ago
  Having worked in banking for 20 years and knowing how many fraud transactions are reversed, I do indeed find that false information to be surprising.
  - bbbbb5 4y ago
    It's very well documented that less than 20% of BEC losses in the US are recovered.
  - from 4y ago
    > The challenge is that most BEC attacks will use bank accounts outside the US. In truth, the IC3 RAT recovered less than 14% of the total US$2.4 billion in BEC losses last year. https://www.welivesecurity.com/2022/04/26/trouble-bec-how-stop-costliest-scam/ https://www.welivesecurity.com/2022/04/26/trouble-bec-how-st... https://www.ic3.gov/Media/Y2022/PSA220504 https://www.ic3.gov/Media/Y2022/PSA220504

lizknope 4y ago

I needed a good laugh to start off the new year! Couldn't have happened to a more awful person. https://www.reddit.com/r/Buttcoin/comments/4936kw/lukejr_is_a_seriously_a_super_crazy_person_quotes/ https://www.reddit.com/r/Buttcoin/comments/4936kw/lukejr_is_...

torben-friis 4y ago
Jesus. Why is it that people with this level of crazy keep appearing at the top of important tech projects??
- bhaak 4y ago
  My guess is that he makes the other developers look sane in comparison.
- lizknope 4y ago
  That thread I linked to is 6 years old. The people in charge of the Bitcoin software know this and keep him on the project. To me that says a lot about the core Bitcoin people. Maybe Ethereum people are better? Let's see what Vitaly thinks about child pornography. https://www.reddit.com/r/Buttcoin/comments/v0n5d5/vitalik_buterins_perspective_on_child_pornography/ https://www.reddit.com/r/Buttcoin/comments/v0n5d5/vitalik_bu... I'll proudly go on record saying that I think 99% of crypto related things are scams, money laundering, or for illegal activities including sanctions evasions, but the people at the top are pretty disgusting.
  - hacym 4y ago
    No wonder it’s used for that based on the people that are the biggest advocates.
MisterBastahrd 4y ago
Yeah, I'm not sad about any of this. The guy is an ivory tower conspiracy theorist and moralistic extremist whose crazy apparently does not reach to the point of doing the bare minimum to ensuring that his stash was safe. Not even the first time he was hacked in the past 2 months.

amadeuspagel 4y ago

> The irony here is Luke being a dev probably made it easier for him to be complacent. His security setup was frankly a lot worse than what most plebs seem to use. > The standard advice of buy a Trezor and write down your seed on paper is much better than a Gentoo hot wallet. https://twitter.com/peterktodd/status/1609667983298658304 https://twitter.com/peterktodd/status/1609667983298658304

MuffinFlavored 4y ago
So most crypto users should: 1. Sign up for Coinbase (where you give your driver's license + bank account ACH and get validated as a legit US citizen or whatever) 2. Transfer USD into Coinbase 3. Purchase BTC with that USD 4. Transfer that BTC from Coinbase to a $80 Trezor Model One wallet from Amazon?
- DJBunnies 4y ago
  From Trezor directly.
  - MuffinFlavored 4y ago
    https://trezor.io/trezor-model-one https://trezor.io/trezor-model-one $70 Got it. Thanks.
    - Bootvis 4y ago
      Not just to save $10 but also to have a smaller chance of someone (e.g. an Amazon affiliate) tampering with your device.
- mancerayder 4y ago
  5. Make sure you didn't forget the pin to your Ledger wallet and you still have your magic words printed somewhere or in the Keepass file you haven't unlocked -- all in several years. Coinbase is lower risk here. There are more things that can go wrong in process or memory than the above than Coinbase going belly up or getting fully hacked.

gafferongames 4y ago

Moron loses 3.6 million. News at 11

andrewmcwatters 4y ago
Makes good entertainment.
adql 4y ago
Byecoin

xslvrxslwt 4y ago

Can't wait for MentalOutlaw's cover of this topic. This dude looks like he's part of Jehovah's witnesses and listens to Kanye west day-night, how can someone like that be a core BTC developer..

323 4y ago

Even a 10 year core developer failed to secure his keys. Not your keys, not your bitcoin is a dumb thing for the general public. Exactly why we don't keep our money in our house, but in banks. Nobody says "not under your mattress, not your cash".

tkiolp4 4y ago

Maybe off topic: is it fine to publicly say that you have $3.6M in bitcoin using a profile name that exposes who you are in real life? Wouldn’t the IRS (or local equivalent) come to knock your door and ask for taxes on that money?

petesergeant 4y ago
Assuming you’re not committing tax fraud, you’ve already told the local tax authority whatever you’re required to about it. Not an accountant, but in many places then unless it’s income generating, you may not need to declare it until you actually sell it / convert it / use it.
creatonez 4y ago
As of 2021 the IRS asks about cryptocurrency assets, so anyone who screws this up and lies to the IRS is already under threat of perjury.
gruez 4y ago
>Wouldn’t the IRS (or local equivalent) come to knock your door and ask for taxes on that money? Not sure about other countries, but at least in the US any gains on crypto is only taxable after you've sold (or transacted with) it. Given that he just got his bitcoin stolen, my guess is that he hasn't sold yet, and therefore doesn't owe any taxes yet.
- usrusr 4y ago
  So we can add another possible explanation to the list: it could all be theatre in preparation of selling in the unregistered way?
tgsovlerkhgsel 4y ago
It's particularly fine to say it publicly when you're going to try to get a write-off for the loss...

SangareEel 4y ago

I wouldn't wish this upon anyone. But I don't believe him. Lukejr has done irreparable damage to Bitcoin. His role in the mass censorship and gaslighting program that locked Bitcoin into sluggish, expensive, tiny blocks (ostensibly in order to carve out a market for Lightning, in which he had significant interest) is disgraceful, condemnable, and must never be forgotten. This exploitation of opportunity and power spat in the face of every early Bitcoin adopter and evangelist as it violated the perfect system we came to know and love from the whitepaper for commercial gain, arguably starting the trend of charlatans and fraudsters in the crypto space looking for a quick buck with reckless, corrupting abandon. He will say anything to get what he wants, and he will truly believe he is right and entitled to do so. He has a casual, naive tone to everything he says but this man is far from either. He would look right into his own mother's eyes and tell the most wicked lies for the $5 in her purse. Don't believe anything.

throwaway128128 4y ago

Wow, the Tonal Bitcoin guy got hacked!

deleted 4y ago

[deleted]

draw_down 4y ago

[dead]

s5300 4y ago

This twitter account is quite wild. Timeline of dunking his frozen store bought pizzas (still in bag) into hydrogen peroxide to “kill the coranavirus” before putting them into long-term freeze, then getting mad & @‘ing the pizza company’s twitter account upon liquid ingress to aforementioned packing… This is what has come of the cool thing (bitcoin - twitter user is a core dev to my knowledge) I learned of as a tween, well over a decade ago.

netheril96 4y ago

If I had 200 BTCs I would use several multi-sig wallets. Stealing any single wallet would grant the hacker no access, and stealing multiple would grant them only access to a slice of the asset. Maybe 200 BTC isn't just worth much to the developer to warrant so many protections.

greatgib 4y ago

Side note: twitter really sucks now. I have to click 200 times on "view the replies" to unroll the thread comments. I gave up in the end

Cub3 4y ago
It never loaded for me, I had to use threadreader to see the original tweet Maybe because I'm behind a VPN
DangitBobby 4y ago
It's never really been a joy to navigate, tbf.

qualudeheart 4y ago

Malarky like this is why I am a nocoiner.

darthrupert 4y ago

I used to be a proponent of anonymous money transfers. Then I read a few books about the extent of money laundering of criminal organisations, largest of them Putin's Russia, and how difficult and dangerous it is to investigate those crimes. Now I think the priority should be maximum transparency. The job of solving a money laundering scheme should be as simple as a single search query, or a GPT bot question. BTC could be a part of this solution, since its ledger is open. This is not a perfect solution, but the amount of power these criminals distill from money laundering is far too great.

birracerveza 4y ago

How to have this not happen to you: 1) Use a hardware wallet 2) Don't be an idiot. That's it. That's the whole guide. He missed both steps of the guide.

xch 4y ago

why nobody listens to bram's clawback suggestion?

timdaub 4y ago
more details please

knorker 4y ago

This is a core developer. Even core developers are not competent to run their own bank. Can we now stop hearing about how the unbanked should start running their own banks?

throwaway67743 4y ago

Haha! Evidently a complete lack of security or worth judgement. "$300/mo for a rack is expensive" (no, no it isn't) "Someone booted an unknown OS from external media" (no FDE) Machine compromised on the "17th of november* and instead of considering everything compromised, the guy continued using it evidently. Zero sympathy whatsoever, if you can't manage the basics you certainly shouldn't be running it yourself, and definitely shouldn't be "core" developer on projects that require at least some security clue (Also religious nutjob, as referenced in another thread)

bartimus 4y ago
I still don't entirely get what has happened. So he runs a bitcoin node on a compromised machine. But why would he store (or use) his 200+ BTC private keys there? He also mentions: > No, they got my cold wallet too somehow How can that happen?
- throwaway67743 4y ago
  After reading some of the (many many) replies to tweets, it seems the story is pretty much what I summed it up as: he got compromised and failed security 101 They likely used the access they had to further infect or snaffle credentials etc - a very simple and obvious one is reverse SSH tunnels for example
imperialdrive 4y ago
He's actually pretty clever for claiming to 'lose' the BTC... does that mean no taxes to pay?
- throwaway67743 4y ago
  Hadn't considered that as I still don't believe anyone bothers declaring and paying tax on it - not always deliberately but because most people are uninformed stupids about pretty much everything

TravelTechGuy 4y ago

Self custody is hard. And even professionals can make mistakes. Most people don't think about it: they have a bank holding their "balance", a broker "holding" their stocks, an employer "holding" their salary, and maybe even a crypto exchange "holding" their tokens - until they don't. Only when you get into the nitty-gritty of self custody, you understand it's a security hassle: you need to save a seed for crypto, or boxes of gold ingots, or precious art in special climate-controlled packaging etc. People traded this insecurity, this chance of losing it all in one unfortunate event, for the warm comforts of having someone else custody your assets. But ask Greek people in 2008 (or Lebanese people now) how does it feel to come to a bank where you've had an account until yesterday, and find out there's no money to go around. We're starting to see some strides being made into simplifying and securing crypto custody (MPD, Multi-sig etc.). But at its core, if you want to truly hold your asset, you will need to keep ahold of something (safe key, seed phrase, physical item etc.).

itsthejb 4y ago

Well this sure is a pretty fascinating case, if it proves to be true, which it _seems_ to be? One thing I'm not seeing mentioned here is discussion of the password for that wallet.dat. This reminds me of back during the 2017 bull run, when I tried to help a friend recover a forgotten password for a bottom 6-figures Dash coin wallet. We went even so far as spinning up some EC2 GPU instances to run Hashcat. In the end, considering the modest value of the wallet, it wasn't cost effective to brute-force. I think we got up to the threshold of 7-9 characters where the time/cost becomes prohibitive. So I'm wondering, assuming the guy even HAD a password on the database file, or that we didn't have a password.txt on this server, I wonder about the sequence of events where: 1. Server is hacked a few months ago, either knowingly (target a core dev), or farmed (searching for vulnerable servers, grabbing high value assets such as wallet.dats) 2. wallet.dat is copied. IIRC gives free access to the public key, therefore revealing a high value wallet 3. In the meantime, attacker employs compute resources to crack the private key 4. After some months of doing this, finds the passwords, empties the wallet This would seem to match my quick reading of the events. I'm now intrigued to do some sums to work out the feasibility of doing this when a 7-figure wallet is found. This is assuming compute prices are that much cheaper than 5 years ago, and that this might be a independent attacker, not some NK-style state actor. I may come back to this and do the calculations...