Bitcoin Forum

Bitcoin => Development & Technical Discussion => Topic started by: nomorecoin on August 20, 2013, 02:01:12 PM



Title: Theft from Paper Wallet - FLHippy Notes compromised
Post by: nomorecoin on August 20, 2013, 02:01:12 PM
I have a paper note, unredeemed, that appears to be cleaned out. FLhippy appears to be a scammer.


Title: Re: Theft from Paper Wallet (Funds initially sent from Blockchain.info)
Post by: CIYAM on August 20, 2013, 02:05:06 PM
From some other recent topics it appears that there might be a problem with blockchain.info wallets (similar to the problem with Android ones).

If you have any other BTC in a blockchain.info wallet you might be best to move it *offline* (i.e. to an address created using bitcoin-qt or perhaps vanitygen - not something created by an online wallet).


Title: Re: Theft from Paper Wallet (Funds initially sent from Blockchain.info)
Post by: icey on August 20, 2013, 02:38:44 PM
Latest info from piuk

https://bitcointalk.org/index.php?topic=277595.msg2970668#msg2970668

Hopefully they can help and reimburse you


Title: Re: Theft from Paper Wallet (Funds initially sent from Blockchain.info)
Post by: Abdussamad on August 20, 2013, 06:15:16 PM
If the funds were sent from blockchain.info TO the paper wallet then how does that explain the theft from the paper wallet? The rng problem would affect the blockchian.info wallet and not the paper wallet unless said paper wallet was imported into blockchian.info and the coins spent.


Title: Re: Theft from Paper Wallet (Funds initially sent from Blockchain.info)
Post by: Tirapon on August 20, 2013, 06:52:56 PM
Can you give more information about the paper wallet? If funds were already sent to the wallet, they should not have been affected by any issues with blockchain.info


Title: Re: Theft from Paper Wallet (Funds initially sent from Blockchain.info)
Post by: Tirapon on August 20, 2013, 06:54:03 PM
A second note, created for a friend, given to him to get him started in Bitcoin

Who created these paper wallets?


Title: Re: Theft from Paper Wallet (Funds initially sent from Blockchain.info)
Post by: Abdussamad on August 20, 2013, 10:16:08 PM
If you imported the paper wallet key into blockchain.info and then used it to send coins you could have been affected by the bad rng problem.

Never import a private key into your main wallet.

Import it into a new wallet, spend all the coins and never use the wallet or that private key's bitcoin address again


Title: Re: Theft from Paper Wallet (Funds initially sent from Blockchain.info)
Post by: Abdussamad on August 20, 2013, 11:33:11 PM
If you imported the paper wallet key into blockchain.info and then used it to send coins you could have been affected by the bad rng problem.

Never import a private key into your main wallet.

Import it into a new wallet, spend all the coins and never use the wallet or that private key's bitcoin address again

Crap. At the time, I though this was the most secure way to do it. Worst case, I thought, facing a "race' with someone who had live access to my wallet, or communications. I never imagined I could have exposed the forward addresses key.

You may want to read this article I wrote. It covers some the basic concepts of bitcoin:

http://bitcoinspakistan.com/blog/private-key-public-key-bitcoin-address-and-the-blockchain/

A private key is basically a number and a wallet is just a collection of private keys. Once you have a private key you can spend the coins using any number of ways. You don't need access to blockchain.info.


Title: Re: Theft from Paper Wallet (FLHippy responsible?)
Post by: nomorecoin on August 20, 2013, 11:56:01 PM
How about a new theory?

FLHippy did it. https://blockchain.info/address/12nYheijKSLStynPSoNvnTMF8V5y9essVL

See any pattern to the keys originating transactions?


Title: Re: Theft from Paper Wallet (FLHippy responsible?)
Post by: TitanBTC on August 21, 2013, 12:21:15 AM
How about a new theory?

FLHippy did it. https://blockchain.info/address/12nYheijKSLStynPSoNvnTMF8V5y9essVL

See any pattern to the keys originating transactions?

I'm with you on this one. 


Title: Re: Theft from Paper Wallet - FLHippy Notes compromised
Post by: EmperorBob on August 21, 2013, 01:14:21 AM
Not just that but this address is also receiving money from 1FLH1pPyN5nNxhJUafyd2cUkBwbAaZUNQP directly.


Title: Re: Theft from Paper Wallet - FLHippy Notes compromised
Post by: Abdussamad on August 21, 2013, 01:29:35 AM
Normally when you buy paper wallets they don't come with private keys already printed on them. That is something you do on your own. Because otherwise how can you trust the security of that wallet? The person selling it to you could have kept a copy of the private key to spend your coins at any moment he chooses.



Title: Re: Theft from Paper Wallet - FLHippy Notes compromised
Post by: Tirapon on August 21, 2013, 02:39:25 AM
That was my worry on this one - A paper wallet is only as trustworthy as the person who created it. So if you want to trust it completely, you have to make it yourself...


Title: Re: Theft from Paper Wallet - FLHippy Notes compromised
Post by: johnniewalker on August 21, 2013, 07:42:44 AM
Funny that on the original thread (here: https://bitcointalk.org/index.php?topic=120221.0) not a SINGLE person brought up the notion that the OP could VERY easily have sent out bills w/keypairs generated on bitaddress or something, kept records of them, periodically checked them on blockchain, and then when he saw a balance CHA CHING. The notion that the OP was last active 12/12 is probably something to consider, too.

The verdict: SCAMMER TAG and also common sense - you and only you (unless you are gifting a bill/coin) should EVER see the private keys.


Title: Re: Theft from Paper Wallet - FLHippy Notes compromised
Post by: escrow.ms on August 21, 2013, 08:25:48 AM
Sorry for your loss man, contact bitmit, they might have his address, get it and file a complaint against him.
Ps: His pics http://www.flickr.com/photos/flhippy/


Title: Re: Theft from Paper Wallet - FLHippy Notes compromised
Post by: Abdussamad on August 21, 2013, 09:48:09 AM
There is another possibility. This shows transfers *from* flhippy's own address to the scammers address:

https://blockchain.info/address/12nYheijKSLStynPSoNvnTMF8V5y9essVL

So maybe what happened was that flhippy's computer got hacked and the scammer got all the private keys and cleaned them out.


Title: Re: Theft from Paper Wallet - FLHippy Notes compromised
Post by: Abdussamad on August 21, 2013, 09:54:07 AM
Funny that on the original thread (here: https://bitcointalk.org/index.php?topic=120221.0) not a SINGLE person brought up the notion that the OP could VERY easily have sent out bills w/keypairs generated on bitaddress or something, kept records of them, periodically checked them on blockchain, and then when he saw a balance CHA CHING.

Because people don't know the basics of what they are dealing with. They don't the importance of keeping the private key safe. They have no idea that once the private key is out it doesn't matter if your blockchain.info wallet is protected or not your funds will get stolen. Take this quote for example:

Worst case, I thought, facing a "race' with someone who had live access to my wallet, or communications.


Title: Re: Theft from Paper Wallet - FLHippy Notes compromised
Post by: johnniewalker on August 21, 2013, 10:38:13 AM
Funny that on the original thread (here: https://bitcointalk.org/index.php?topic=120221.0) not a SINGLE person brought up the notion that the OP could VERY easily have sent out bills w/keypairs generated on bitaddress or something, kept records of them, periodically checked them on blockchain, and then when he saw a balance CHA CHING.

Because people don't know the basics of what they are dealing with. They don't the importance of keeping the private key safe. They have no idea that once the private key is out it doesn't matter if your blockchain.info wallet is protected or not your funds will get stolen. Take this quote for example:

Worst case, I thought, facing a "race' with someone who had live access to my wallet, or communications.

OK, but its all about 1 person. AT LEAST one early, bitcoin-savy person must have seen that posting, I think its safe to say. Yet no one warned "customers" about any risks (which said "bitcoin pioneers" certainly knew about). Maybe I'm just too bitcoin-altruistic lol, I would have done it.


Title: Re: Theft from Paper Wallet - FLHippy Notes compromised
Post by: Abdussamad on August 21, 2013, 11:57:18 AM
Well there is no guarantee that someone knowledgeable will see every thread out there. Even the mods put up notices that they don't delete threads with suspected scams.


Title: Re: Theft from Paper Wallet - FLHippy Notes compromised
Post by: piuk on August 21, 2013, 12:13:18 PM
http://blockchain.info/address/1NoteMZQT89tRZpEdf2UrGLnjixMf9ME9b
and
http://blockchain.info/address/1NoTezXo3e4SzawYki7tm9thSUgQXz5X64

No transactions from these addresses appear to have been made from blockchain.info and they are not affected by the recent rng problem.

Unfortunately it looks like the person who generated the paper wallet may have retain a copy of the private keys and waited for you to fund the addresses.


Title: Re: Theft from Paper Wallet - FLHippy Notes compromised
Post by: P_Shep on August 21, 2013, 01:07:38 PM
Funny that on the original thread (here: https://bitcointalk.org/index.php?topic=120221.0) not a SINGLE person brought up the notion that the OP could VERY easily have sent out bills w/keypairs generated on bitaddress or something, kept records of them, periodically checked them on blockchain, and then when he saw a balance CHA CHING. The notion that the OP was last active 12/12 is probably something to consider, too.

The verdict: SCAMMER TAG and also common sense - you and only you (unless you are gifting a bill/coin) should EVER see the private keys.

OMG.

Serious palm-face. Can't believe people bought these.

So sad :(


Title: Re: Theft from Paper Wallet - FLHippy Notes compromised
Post by: Abdussamad on August 21, 2013, 02:09:42 PM
OMG.

Serious palm-face. Can't believe people bought these.

So sad :(

I am not surprised. Two posts:

And another question...wouldn't it make sense to keep your private key separate from the BTC address that it is associated with?    If someone found both, they could drain your account but if all they have is the Private Key, it doesn't seem like they could do anything with it.

Then there is this thread where someone sells a domain + $30 wordpress theme for over $100:

https://bitcointalk.org/index.php?topic=232317.0

I am the only one in that thread to notice (https://bitcointalk.org/index.php?topic=232317.msg2452649#msg2452649) that it is not a custom theme but a mass market one. And yet despite my posting that someone actually bought it!


Title: Re: Theft from Paper Wallet - FLHippy Notes compromised
Post by: Tirapon on August 21, 2013, 02:50:56 PM
If you are fairly sure that this guy is a scammer, you should try to track him down and threaten to take him to court. I don't know what country you're from, but after the judge's ruling in the Trendon Shavers case, it seems that you could stand a reasonable chance?


Title: Re: Theft from Paper Wallet - FLHippy Notes compromised
Post by: johnniewalker on August 22, 2013, 09:29:19 AM
Well there is no guarantee that someone knowledgeable will see every thread out there. Even the mods put up notices that they don't delete threads with suspected scams.
I think there is a pretty good bet there is at least 1 ; ) And you don't have to call someone an outright scammer to warn buyers. But you should inform them of the potential for being scammed. More knowledge for the "do-good bitcoiner" is never a bad thing.

BTW, one [serious] question: Why do you guys say you only suspect he is a scammer? It seems pretty open and shut to me.


Title: Re: Theft from Paper Wallet - FLHippy Notes compromised
Post by: Abdussamad on August 22, 2013, 01:40:17 PM
BTW, one [serious] question: Why do you guys say you only suspect he is a scammer? It seems pretty open and shut to me.

This is an interesting question. How do you prove someone owns an address? Unless the individual opts to sign a message with his private key or publically declares ownership "guilt by association" is the best you can do I think.



Title: Re: Theft from Paper Wallet - FLHippy Notes compromised
Post by: Abdussamad on August 22, 2013, 01:57:49 PM
In this instance though the blame does lie with flhippy. He stole the funds or he got hacked either way his fault.


Title: Re: Theft from Paper Wallet - FLHippy Notes compromised
Post by: johnniewalker on August 22, 2013, 11:23:17 PM
In this instance though the blame does lie with flhippy. He stole the funds or he got hacked either way his fault.
Exactly. He is a scammer. There is no other reasonable explanation.