Don't get hacked for Christmas by Ledger

[jossiel]

Hi guys, Ledger made a blog recently of how to avoid getting hacked not just this Christmas but for all seasons. There's an experiment that they've made and simulation how quickly the participants were hacked. Please read the whole blog, watch the experiment and tips they've given and there's something hidden in that video as said on reddit. It's a good read especially to those who are new to crypto.

Blog: https://www.ledger.com/dont-get-hacked-for-christmas
Reddit: https://www.reddit.com/r/ledgerwallet/comments/ebggok/dont_get_hacked_for_christmas_3_hacks_and_one/

PS: I'm not associated with Ledger, I just want to share it after I've seen it.

[1715412231]

1715412231

[1715412231]

1715412231

[1715412231]

1715412231

[1715412231]

1715412231

[Pmalek]

Ohh, there seems to be seed words implemented in the video and a bunch of them. I wonder if they have already been discovered and someone emptied the account. Nice promotion here by Ledger. According to the Reddit post, it is already gone but no official statement by Ledger admins.

[hugeblack]

The video on YouTube looks funny, it's nice and good for promotion. I liked the appearance of the collapse of the value of cryptocurrencies and Bitcoin.
The rest of the article does not appear to contain more detailed information than it is a promotional offer with some advice.

Many things such as computer safety, how to keep words safely, offline transactions...etc, and others are not touched upon.

[o_e_l_e_o]

According to their twitter, it still hasn't been claimed as of 2 hours ago.

There's a further clue here: https://www.ledger.com/christmas-campaign-easter-egg



I've watched the video a couple of times, and between all the text which is clearly displayed plus the "hidden" words, I've ended up with over 60 valid BPIP words. Even using their guide, I'm currently coming in at over 18 billion possible permutations. Anyone else working on it?

[Pmalek]

Anyone else working on it?

I have word combinations for each and every part of the seed. Several different combinations for the letters t, m, w, a, s,h,p
How about we work on the seed together? Full disclosure between those who want to help and we share the spoils.
I have a good eye for details.

Who is in?

[o_e_l_e_o]

Who is in?

Haha, I'm in the exact same situation with multiple words for the exact same letters. I would be using https://github.com/gurnec/btcrecover on them right now, except I'm away from home on my laptop and therefore don't have access to a full node (and obviously we don't know the master public key or address.)

I wondered if maybe there was a clue in the video to the order of the words? I though maybe the time stamps on the camera feeds, or the random coding that shows up in the background, but I've not found anything useful yet.

Might just have to wait for them to release another clue.

[jossiel]

I wondered if maybe there was a clue in the video to the order of the words? I though maybe the time stamps on the camera feeds, or the random coding that shows up in the background, but I've not found anything useful yet.

I doubt those posts on reddit about exact words if those really were. And there's someone commented there and said that there's a hint on their facebook post but when I peeked for the comments, I've found no clue.

I have word combinations for each and every part of the seed. Several different combinations for the letters t, m, w, a, s,h,p
How about we work on the seed together? Full disclosure between those who want to help and we share the spoils.
I have a good eye for details.

Who is in?

Good luck guys, I'll tune in on what you're working at. I'm not really good on this matter so I'll just watch out your finds. 

The video on YouTube looks funny, it's nice and good for promotion. I liked the appearance of the collapse of the value of cryptocurrencies and Bitcoin.
The rest of the article does not appear to contain more detailed information than it is a promotional offer with some advice.

Many things such as computer safety, how to keep words safely, offline transactions...etc, and others are not touched upon.

Yeah, it's a good promo and warning. This is possibly the happening when some folks just come in to the forum and tells a story of how they've lost their funds without logging in to a phishing link. Although I still have my old Nano S this makes me want to buy the X version.

[Pmalek]

I wondered if maybe there was a clue in the video to the order of the words?

Probably the order they first appear in the video is the order in which they should be written down in the seed.
I didn't find any other hints in the video. They said they would release more hints in the upcoming days...

[o_e_l_e_o]

Probably the order they first appear in the video is the order in which they should be written down in the seed.

Definitely not the case. The first two words which appear are series and again, but the clue they gave said the first two words should start with "u" and then "o".

I've narrowed it down to 26 words which I'm fairly confident are correct. None of the words are words which appear in the normal text they write over the video - they are all either hidden in the video or displayed in the graphics. I have two words for "p" - pact and pretty - and 2 words for "w" - word and welcome.

Given that there are 5 "s" words, 4 "t" words, 3 "a" words, plus the 2 above which I have duplicates for, I'm coming up with (5*4*3*2)*(4*3*2)*(3*2)*2*2 = 69,120 combinations. I still don't have a full node to run btcrecover on, but I'm going to write a little script to just check which combinations are valid seeds and then check the addresses manually.


Edit: Before I started trying combinations, I thought I would check for more clues. Literally 1 minute after I made this post Ledger confirmed it has been claimed: https://www.reddit.com/r/ledgerwallet/comments/ebggok/dont_get_hacked_for_christmas_3_hacks_and_one/fbnvd90/. Lol.

They haven't released the winning seed yet. Here are ones I came up with, be curious to see if I was on the right track:

again
aware
accident
coffee
design
eyebrow
guide
hockey
jacket
leader
maid
offer
pact/pretty
salad
series
short
slab
stumble
theory
trumpet
toddler
tackle
unveil
welcome/word

[Pmalek]

The 1st and 2nd words of the seed begin with U and O - yes.
I was referring to the same letter words. For example the first words with 'S' is the 10th word in the seed. So the first 'S' word that appears in the video is the 10th seed word. The next 'S' word from the video is the 11th seed word because the 11th word in the seed also begins with 'S' according to the hint... and so on...

Are you sure series appears before security? Security is written under the camera feed.

I found these possible combinations.

1 unveil
2 over
3 theory / trumpet / time
4 leader / learn / life / load
5 welcome / word
6 month / more / memory / mail / message / maid
7 account / all / average
8 account / all / average
9 camera / click / code / coin
10 security / series / system / short / subject / search / sorry
11 security / series / system / short / subject / search / sorry
12 security / series / system / short / subject / search / sorry
13 theory / trumpet / time
14 hello / history
15 eyebrow / error
16 theory / trumpet / time
17 jacket
18 account / all / average
19 security / series / system / short / subject / search / sorry
20 design
21 security / series / system / short / subject / search / sorry
22 pretty / play
23 theory / trumpet / time
24 guide

It has been claimed so who cares 
Still interested to see if all my words are part of the seed somewhere.

[o_e_l_e_o]

So the first 'S' word that appears in the video is the 10th seed word. The next 'S' word from the video is the 11th seed word because the 11th word in the seed also begins with 'S' according to the hint... and so on...

Yeah, I had tried that too.

Anyway, here is the actual seed:

Code:

unveil offer trumpet leader word maid again accident coffee series slab salad theory hockey eyebrow toddler jacket aware short design stumble pact tackle guide

Which led to this address: 3JeVd5ALNDvn7BbkqLYfV4qeQ16guPwJD2

For a win of $1,000.

Turns out I was on the right track though, and I had all the correct words (minus the two spare ones). The guy who won it also couldn't figure out the order on his own, and wrote a script (available here: https://github.com/AlexSSD7/Ledger-Xmas-Contest-Victory) to check all the possibilities for him. Perhaps there was no way to determine the order from the video? I was going to be pretty annoyed that he had beaten me by a few minutes, but it turns out from Twitter he actually claimed it yesterday, Ledger were just a bit behind in announcing it.

Anyway, that was a fun challenge. Would be cool to see more things like this in the future.

[HCP]

Anyway, here is the actual seed:

unveil offer trumpet leader word maid again accident coffee series slab salad theory hockey eyebrow toddler jacket aware short design stumble pact tackle guide

Oh man... I missed some words Looks like my play/pause strategy didn't quite catch some of them... Only just found "salad" and "aware" and "toddler"... and wow! They were only in a couple of frames?!?!

I even had a script ready to check the various combinations to get the correct order. Out of curiosity, can someone tell me where "accident" and "slab" were hidden? I've looked through the video so many times and still can't find them

[o_e_l_e_o]

Accident is at 1:19, written down the y axis of the graph on the TV.

Slab is at 1:32, just where it cuts from the close up of the guy's face back to the graphics, and there is like brown smoke/clouds all over the screen, near the bottom left. It is only on screen for 2 frames.

If you use the "," and "." keys, you can scroll a paused YouTube video forward and backwards a frame at a time. That's what I did to find them all.

[HCP]

Oh damn... I never would have seen either of those 2... 

If you use the "," and "." keys, you can scroll a paused YouTube video forward and backwards a frame at a time. That's what I did to find them all.

ahhhh thanks for that... I wish I'd known that sooner... I was using "k" to play/pause but was fairly certain I was missing frames.


Anyway, that was a fun puzzle... congrats to the guy who won $1000... bet they'll give him a nice little prize pack of a Nano X etc as well.