Bitcoin Forum

This post is just to inform the community about a situation that occurred after I bought Lealana coins. I ordered some coins a few months back, after checking the funding once I received my coins (funding released via escrow), I saw that one coin was double funded. It turns out that the coin had a duplicate address, as well as a duplicate private key. This was confirmed by smoothie. A large portion of my order was duplicate coins, but only one had a double fund. I received a refund for my order and sent back all of my coins ordered. The coins were sent back for smoothie to destroy the duplicate keys, as requested. As informed by smoothie, this was an isolated incident and after destroying the duplicate coins, there are no further duplicates.

I had asked smoothie to make some sort of public announcement about this, but he had mentioned that it would open up a a new form of attack to his business by having people falsely claim that they also have duplicate coins. (Please do correct me if I am wrong in describing the new possible attack, I can't fully recall all of those details)

This isn't a flame or attack on smoothie and/or lealana, nor is it a rant thread. I felt that this was an important event to make public, even if it was just an isolated incident. I don't want to be held liable/accountable about knowing this information if a similar event occurred with other lealana coins.

Thanks for the information miffman.  How was it known that this was an isolated event with duplicate coins?

Smoothie let me know it was an isolated event. That's as far as I know.

I wonder what the odds of generating the same key from a 7 letter vanity address is. So then I would assume smoothie keeps the private keys if he was able to make duplicates 

Edit according to

Less than the odds of you winning the lottery twice in a row while purchasing only 2 tickets.  Much less...

This isn't cool at all

It's not cool that smoothie keeps private keys

How long before you had your coin was it funded before?  Was it close together or were the keys funded far apart (your funding and the original funding of the duplicate double funded coin)?

We need more information because this doesn't make sense to me.  What lealana coins are we talking about here?  He has made Bitcoin, Litecoin and Monero coins.  What do you mean by duplicate address?  Do you mean multiple coins had the same public key or something else?

How else could a duplicate coin be made if Smoothie did not have a record of the private key?  Not an accusation, but a question that needs serious answering.  I would expect him to keep records of the first bits/public keys, but not private keys.

Apart from the double funded coin, were there any single funded duplicates?
If so, how do you know that they were duplicates?

The only other explanation I can think of is that he accidently printed the priv key twice when assembling a whole batch.

I don't think it's a smart idea from smoothie to not go public with this. Honest mistakes happen but keeping it quiet can raise suspicion amongst some forum members.

It was fairly far apart. Here is the double funded coin address:

https://blockexplorer.com/address/1tSDzFH9oPgA9SfhVy9z464KobTX9ouTt

Looks like the first funding amount was in Aug last year, while my funding was done last month.

---

It was a bitcoin silver tenth. By duplicate address and private key, I mean that there was another silver tenth that had the same firstbits and corresponding address, as well as the same corresponding private key.

---

I have no idea, smoothie would need to answer that. It could have been a genuine mistake.

---

There were, and I didn't know they were until smoothie told me they were. There was no real way to tell the single funded coins were duplicates.

Oh my.  Hope to hear an explanation from Smoothie soon.

 
Did you own both the silver tenths that were duplicates?  I have several rolls of these and this makes me concerned.

I don't think there is any loaded coin maker that would admit to keeping a copy of the private keys, so the only option for smoothie is to say it's an "honest" mistake. But the fact that there is almost a year in between funding I don't see how the private/public keys can be printed twice

No, and I don't know who owns the other coin. I would ask anyone to check their coins against the address I posted in my previous comment.

Have you PMed Smoothie about this topic? I think it's best if try not to speculate too much and let him come up with an explanation.

He isn't making these as he goes.  The silver tenths are from 2013 and I believe he generated all the keys and applied the holos back then but smoothie should confirm.

Yep, I've PM'ed smoothie back and forth several times, as well as chatted about this situation over the phone already. Smoothie mentioned several times that this was an isolated incident. I mentioned that I think it's a good idea to make it public because it does seem like an honest mistake that can be forgiven, but smoothie did not want to due to the fact that it introduces another method of attack as mentioned in the OP.

I will agree that it's best not to speculate too much until smoothie posts some explanation.

I meant to ask if you PMed him about this thread ;D. I think it would be in his best interest to reply in here as soon as possible to bring some clarification to this whole thing.

I emailed him the link to this thread.

I Pm'd him about ~24 hours ago to let him know I'm gonna be making the announcement, but he hasn't been online since. I'm sure we will see a response soon enough.

 I'm sure that Smoothie will square things away, and make things right with everyone. It's probabally at the top of his "to do" list as we are conversing over it right now. :) Relax, he'll surface soon.

Besides, we already know that he's an honest man. Nuff said.  :)

How do you know that any other part of your order were duplicates?

I think it is because Smoothie told him:

Ahhh, gotcha.

If I had to guess, I would speculate that smoothie creates his coins, generates the vanity address/private key pairs, the associated sticker, places the sticker on the hologram, destroys any remaining copies of the private keys and places the hologram on the coins ahead of selling his coins. In other words, the coins are 100% ready to ship, provided he has access to them (he likely has them locked up somewhere and does not have easy access to his inventory). This would at least make the most sense from a production standpoint.

If there was a printer jam when he was printing the stickers for the coins that you purchased, after the jam is cleared, printers will sometimes print one page that was already correctly printed. It is possible that the sticker that your private keys were printed on were printed immidiately prior to smoothie's printer having a printer jam, resulting in the same private keys/first bits being printed twice.


The above is of course speculation. I have purchased many Lealana coins directly from smoothie multiple times without incident, with smoothie always being very professional when trading. I personally think that smoothie is safe to trust and that smoothie's coins are desirable, and safe to store BTC on.

We can all speculate but until Smoothie replies it's just purely speculation.
I think it was an honest mistake. He may have just printed out the same keys twice and didn't realise when assembling the coins.
Just remember that Lealana have had thousands of coins sold and traded and there have been no other such incidents. As mentioned, this is an isolated incident. In my eyes it seems like a genuine mistake.
Let's wait for Smoothie to confirm.

I think as well as explaining, a full list of public addresses would help

1. There are no duplicate keys in our coins that are currently being held by customers.

2. It was an honest mistake that was determined to be isolated to miffman’s specific order of coins.

3. One reason why no post was made regarding this issue by LEALANA was because it could have caused unnecessary concern among customers who have our coins in their possession. 

4. While no one lost any money or was harmed, I welcome any customer with concerns to contact me directly.

I apologize if any of LEALANA customers felt that we should have made a post/announcement given the circumstances. It was determined that in the best interest of LEALANA and our customers and because it was an isolated incident, that such an announcement was unwarranted.

How did it happen smoothie?

I understand the decision of not making a post about it but I also understand miffman's obligation to make this public (in case of a recurring event). Thanks for clearing this up.

I would be interested in a postmortem of the incident (if necessary after some amount of time, if additional research is required to determine the root cause). This may help other coin makers avoid similar mistakes in the future.

I think it is a fairly regular practice for buyers of coins to check the first bits and funding when they receive coins, so I think it is reasonable to believe that if this happened on any kind of regular basis that we would hear about it one way or another.

I would like to know too.  I think an easy desription of what happened will settle everything.

Id like an explanation of how it happened since there is a huge amount of time in-between the double funding and private keys and the only way that is possible is if the private keys where saved. I feel like this issue is going to be glazed over. 

Killyou i agree.  There are hundreds of btc tied up in lealana coins.  Smoothie can you explain what happened?

Ok, but why would there ever be any duplicate keys, under any circumstances, whether held by customer or otherwise?

Also, in a game of trust such as this where you clearly see and print the private keys tied to many tens of thousands of dollars of other people's money, it is ALWAYS better to be up front when a breach of security or protocol has occurred.   Keeping things quiet and somehow saying that is in the best interest of you and people holding your coins is wishful thinking on your part.  I hate to say that, but that is a naive stance to take and your answers are vague and fall short of putting this issue to rest.

I asked smoothie to clarify how no customers are affected when the coin was funded over a year ago but so far silence.

 
It is concerning as many of us hold funds in lealana coins some more than others but if it was a mistake than it should be easily explained.  :-\

Hellot has he reached out to you.  Im just wondering what happened and how, i think disclosure isnt to much to ask especially if it was an isolated incident.

I can't believe there isn't more of a public outcry about this

If smoothie ever makes an exit scam I guess this would be the first clue correct?

I wouldn't spread FUD. Although it has been a while since smoothie has responded, I wouldn't call him a scammer as he has at least hundreds maybe even thousands of Bitcoins/litecoins entrusted within his holograms. He still hasn't sweeped or stolen AFAIK.

He has not.

What do you call someone who saves private keys for at least 8 months? Just because they have no swept or stolen anything yet does not mean they do not plan too in the future. pretty sure mt. gox was trusted with over 800kbitcoins, what about Bitcoin Savings & Trust which got around 700k bitcoins I dont think the number of bitcoins you hold/have access to makes you trustworthy. Coinographic didnt have anywhere near that much LTC but still scammed.

How do you know that he saved private keys? He probably accidentally printed 2 of the same sets of keys at once and assembled a batch of coins with the same keys. It honestly could be a one off mistake. Just wait for Smoothie to confirm before pointing fingers. It won't do your reputation any good....

How to proof you destroyed the priv. keys as coin maker ?
As buyer You will take that risk when you buy the coin and assume it is.

I don't really see how that's relevant to my post at all but sure  :D

This is really not possible.

Why would smoothie admit to saving the private keys? Of course he wouldn't. The only option he has is to say whatever reason it was an accident, but the more everyone speculates how it could have happened you are all giving him ideas on how to play it off as an accident if he indeed is saving the private keys.

If he printed 2 sets of the same keys at the same time, why was there 8 months inbetween assembling/funding them?

For anything that it's worth I now 100% believe this was a printing error where smoothie printed the private keys twice by mistake. I hypothesis there is 8 months between the funding because it took that long for that many coins to sell before this error coin came to be

In no way am I comparing them but the difference between Lealana and every coin maker that has pulled a scam is that Smoothie has been 110% transparent in his business. Yes he was slow to reply here, but with everything else he has done, he has been open and done so with full transparency. He doesn't hide behind an alias and is very public with his identity. Most of the other companies are shills with fake personas. Again, that's not to say that all of them are but you can't even bring Smoothie into that circle. Stop speculating and just wait for him to comment.

smoothie has stated in the past he does not save private keys.  It is not unreasonable for him to track the public keys for various reasons.  In the past before he started using privnote, he used to communicate the public keys to customers for funding in email.  If he wasn't actively tracking public keys, it is not unreasonable that he could just search his email for a public key to see who he has sent it to.  I have no problem with him tracking pubic keys and he has given us zero reason to believe he keeps private keys.  You should stop jumping to conclusions without proof.  It has been stated this isn't something he or we can prove either way so it is futile.  

The only thing that raises suspicion here is the time between funding of the duplicate coin as you have stated.  His silence on this matter hurts him more than it helps in my opinion but I can see why he would just want to keep this between affected customers so I am not pressing him.  This community at large seems to have a propensity for latching onto anything and crucifying them for the smallest thing.  I believe he is being honest when he says it was an isolated incident and I will respect his privacy since I am not affected.

I personally own 130+ Lealana funded coins of various types and I don't feel like I need to worry about them.  I trust smoothie.  This might sound stupid but I have met many pacific islanders in my life and they are some of the hardest working and honest people I have ever met.  Obviously there are exceptions to everything.

Has anyone heard anything from Smoothie regarding this topic through PM or email?  Would really like for this issue to be addressed so that full confidence can be restored in Lealana coins. 

Hi

Had many dealing with Smoothie in the past, totally legit guy. Had one delivery returned by mistake to him, he sorted it out, even though I realised ages after the event, and it ended up at the shippers storage.

Holding Public Key records isn't an security issue, totally agree with Hellot this, it's a PUBLIC Key .... sort of how the system works.

Casascius Coins Public Keys are tracked on https://casascius.uberbills.com/

It would be unwise for Smoothie not to keep a list of the Public Keys he used for his coins.

https://blockchain.info/address/1tSDzFH9oPgA9SfhVy9z464KobTX9ouTt

Shows a payment from OgNasty, so maybe some confusion on the Escrow ?

Smoothie may be on vacation or just busy .... 

Also had the occasion to help redeem two of Smoothie's coins, they were redeemed 'live' on Twitter

https://twitter.com/HardBTC/status/805408026026983424

Coins worked a treat.

Looks like there where 8ish 0.10 payments sent out with that one from OG

Apparently OgNasty funds Smoothie's coins, holds funds in Escrow, nice security touch for buyers.

I was asked to do an escrow by miffman. This is the transaction. That is the extent of my involvement.

https://blockchain.info/tx/f653d341a14ec53d85c9a7e7ad99daf990e856768a2c2eab239ca8bb64057da8

The issue here isn't about Smoothie holding onto PUBLIC keys.  This was an issue about PRIVATE keys.  Please go back and read the full thread so that you are at least commenting on the subject matter at hand. 

I hate to jump into this but miffman's comments are essentially that the same hologram with identical public and private keys were created twice...right? 

I read that as he simply made an error when printing and printed it twice.  Not realizing it they were placed on two sets of coins.

That is VERY different than keeping private keys.  Can someone help me connect the dots to why there is discussion of him keeping private keys?

The coins were produced several months apart.  So if it was a double-printing error, then that means the private keys were printed and sitting around for several months before being assigned to another coin.  I think most here feel that private keys are produced as needed and not created, printed and stored for months on end.

At the end of the day, I just want to hear a reasonable and satisfactory answer to how this happened.  Holders of funds in Lealana coins coins deserve a better answer than the one that was provided so far by Smoothie.  Simply saying that it was a mistake and that he didn't want this error to be made public leads to more question and uncertainty. 

I thought the public and private keys are created at the same time....like when I create a paper wallet...maybe I don't understand the process.  I too would appreciate a clearer response as I have quite a few Lealana coins.

Sold, not produced.

    When you create a paper wallet the Public and Private keys are  created at the same time. No reason why this process with coins would be any different.

And you know that for a fact? 

I know they were sold months apart, yes, as per what was said in the OP (some of the coins were funded months ago). I have not seen anything that indicates the coins were produced months apart.

I think it is important at this juncture to make a very clear distinction about the key issue of this thread.  

Many of you have weighed in either vouching for Smoothie or giving him a vote of confidence/benefit of the doubt based upon your personal experiences with him over the years.   All of that is great and well founded.  For what it's worth, I don't think anyone weighing in here asking for a better answer from Smoothie is implying that he is a bad guy or having done anything underhanded.  They just want a more clear and reasonable answer as to how 2 of his coins, sold several months apart, would ever contain the same private key, because there is a tremendous amount of money at stake in the answer.

From his own comments, Smoothie said that he didn't want this issue to come to light.  I don't think he did himself any favors in stating that, but I think he was just concerned that this issue would create a level of uncertainty about the integrity of the private keys and funds loaded to his coins.  So fine, but the cat is now out of the bag and the issue is before us.  So it needs to be answered.

The longer this goes on without a clear explanation from Smoothie, the more doubt and uncertainty will creep in.  He owes it to everyone who has bought, or holds one of his coins to provide a satisfactory answer, and fast.

It seems the main sticking point is why the coins were funded several months apart.  I recall having a discussion with smoothie where he indicated that, unlike many coin makers, he doesn't distribute his coins in any particular sequence.  The serial #'s are sold more or less at random (other than for special auction sales of specific serial #'s).

If smoothie had accidentally made duplicate coins, the randomness of choosing coins can explain why several months may pass between him selling (and funding at the point of sale) one coin and another coin with a sequential serial #.   Obviously this is not a definitive answer, and it would be preferable to get the explanation from the man himself. But having dealt with Lealana multiple times, there's nothing about this particular incident that causes me to think it's anything more than a minor production error.  If smoothie does not want to reveal the details of his production process for security and/or privacy reasons, I can understand that.

However, as collectors we should also never put too many eggs in one basket.  No matter how much faith or trust you have in a particular manufacturer of coins, you should never store a disproportionate amount of coins on any private keys you did not generate yourself, just as you shouldn't store a significant amount on an exchange or web wallet where you do not own the private keys. 

Jupityr and Hybridsole...Very well said. Both have excellent points. We should hear from Smoothie to say the least. And you are right, not to place all coins in one basket. The safest place would be your own paper wallet in a safe  :D

Guess the community doesn't care about this

I do still waiting.  Explanation would be nice with the amount of exposure in btc/LTC/xmr on the lealanas

Why does the explanation matter? He won't admit to keeping private keys even if he did and I doubt he would be able to prove any other explanation he says

I think we are all beating a dead horse here. Smoothie is not a criminal, he's a downright honest human - Yes, maybe he made a mistake or two handling hundreds if not thousands of complicated orders.

Personally, I don't care about this. There has never been ANY reason whatsoever to think he is keeping private keys. I truly believe this was a one-off mistake - maybe he had replaced his printer and had to re-use his old one, who the f knows. I personally don't care, I know his name and address in real life, so ...  not going to lose any sleep over it. I mean, sure, I would like to hear an explanation as well, but again, I think we should just move on and chalk it up to "Smoothie made 1 "known" mistake over 4 years coin making/creating.

I'm going to remove this from my watchlist as well, it's a waste of time. Either he doesnt' feel any need to reply for whatever reason, but I'm 100% sure he's not keeping private keys. He's got plenty of money, he doesn't need to steal from the very people here who helped make him a lot of money. ::)

/over and out here

Are you arguing with yourself now ???

What exactly are you looking for.  Smoothie to say something or not?  And dont take this as implying, i am just wondering what happened.

Given that Smoothie has elected to remain silent on this very important topic for many weeks now, I believe he has no intention of posting any responses in the future.

What that says for his ability to conduct business on this board in the future.....hard to say.  Perhaps he will become the Keyser Soze of the physical crypto world and simply disappear.  We can only hope that the duplicated coin/private key was truly an isolated incident and that he has no other access to any of the private keys he has produced.  Unfortunately I have a feeling that is not the case.  He of course is free to prove otherwise.

I am baffled at the respons from valued members of this community in this thread.

I won't take sides and I won't point fingers but the silence from smoothie is worrying. Not for the fact that he'd run away with money, but for the piece of mind for his customers.

Why some of you think all of this is fine and you don't care considering smoothie is an honest and hard working guy that'd never be able to do something bad, I don't know why you think that matters.

Anyone can be nice just up until they are no longer nice. Anyone can be honest just up until they are no longer honest. 

---

I won't make a comment on whether I think smoothie is storing private keys or if smoothie might pull an exit scam as I honestly have no clue or no personal connection on the matter. What I can and will say though is that some of you should not be so eager to defend someone as you might be liable and held accountable under unforeseen circumstances.

And smoothie, You should make an official statement. Keeping this buried raises questions, valid ones at that, on how you operate. I think that the steps minerjones is taking to start a ledger with all public keys from coin manufacturers is a step in the right direction but more needs to be done from the coinmakers themselves. For too long have we all been kept in the dark with a few exceptions.

What ever happened with this?

What you are reading, I hope? :D

Maybe there was another thread, but I cannot believe the community just let this go away without an official statement

no you just missed it I guess? :P

https://bitcointalk.org/index.php?topic=2011139.msg20061663#msg20061663