Bitcoin developer @lukedashjr's wallet was hacked

[jubalix]

So, LJR apears a bit niave, he thinks office was hard to get into
Gets hacked, does not change his addressess or wallet or make a new wallet.

Also I thought he would have more than 200 BTC.

He should be able to sue his server provider for losses

[1714815631]

1714815631

[1714815631]

1714815631

[1714815631]

1714815631

[1714815631]

1714815631

[franky1]

giving best practice advice vs following own advice is a human trait.

also best practice advice is sometimes too impractical.
it all depends on how much wealth you have at risk then decides how much effort you want to take to protect it

someone with just a month wage stored. may just have a seed wrote down they import into a wallet to spend and have the change go to a completely new seed based address. so that the seeds are secure each time

where as someone with more wealth might have multiple devices that separately sign and only present the signatures to each other via a air gapped method (convert to QR code and snap a picture and send it to the main system to append signatures)

some may want more then a paper wallet and have a hardware device that can enter seeds without touching a computer

there are many many many ways to back up seeds, keys, wallets. the world is your oyster, but it all depends on your personal risk/preference.

its like fiat world
only a months salary.. normal ATM visa debit card.. 'tap and pay risk' of losing maybe $100 per payment via card cloners, where when spotting it you move funds to new account

$mansion money$  set up a family trust requiring co-signer trustee's to sign off on funds to beneficiaries

some have both set up.. a multisig 'trust' for main hoard of coin. with a lite wallet seed of weekly/monthly spend amount

[dimonstration]

He should track and contact the exchanges asking them to freeze the funds incase the hacker tries to deposit in any of the top ones to convert the coins into stables.

That is good. CZ from Binance has already replied to his tweet:

Trying to exchange 3mil won't be so easy, any sight of these coins on a Cex and these coins will certainly get frozen.... Btw can a mixer freeze such coins knowing that they are tagged stolen in the event they try to clean them

didnt SBF (of FTX fame) cash out like 600+ million USD of some crypto on non KYDd exchanges a just few weeks ago? so it seems possible.

Fair enough, There some exchange that still doesn’t required KYC and allow 2BTC deposit and withdrawal per day. Also there are some DEX that let user buy and sell bitcoin for fiat P2P like Bisq. I believe a 200BTC can be easily cash out nowadays due to the P2P offered by DEX.

[vapourminer]

didnt SBF (of FTX fame) cash out like 600+ million USD of some crypto on non KYDd exchanges a just few weeks ago? so it seems possible.

Fair enough, There some exchange that still doesn’t required KYC and allow 2BTC deposit and withdrawal per day. Also there are some DEX that let user buy and sell bitcoin for fiat P2P like Bisq. I believe a 200BTC can be easily cash out nowadays due to the P2P offered by DEX.

it was 600 thousand usd not 600 million usd, i made a mistake (and deleted my message but you quoted it before that lol), but yeah non KYC exchanges do seem to abound.

[harapan]

A very terrible way to begin the new year, although has this been the first time he lost large amounts of Bitcoin? Imagine a Bitcoin dev lossing such what would be said if same got lost by a rookie. I feel so sad for the loss because that is more than enough for anyone.

I hope everyone learns the lessons here no one is above mistakes like this all one has to do is to make sure you are well updated about the current security to back your wallet.

  I hope the news does not affect newbies and rookies entering the crypto space.

[Rikafip]

Also there are some DEX that let user buy and sell bitcoin for fiat P2P like Bisq. I believe a 200BTC can be easily cash out nowadays due to the P2P offered by DEX.

Given the Bisq low volume, it would take you a long time to cash out 200 bitcoin that way. But I agree, cashing out 200 bitcoin at this day and age is not that hard if you know where to look, and people that managed to hack him are surely not some noobs.

years back first generation hardware wallets were just USB devices that when plugged in, opened a webbrowser with the interface being a webpage(facepalm) . so soo soo many flaws back then

Oh damn, I had no idea that it used to be like that in the early days. Just a thought of typing my seed into some web browser app or whatever it was makes me very uncomfortable. I got my Ledger Nano S back in the late 2017 (after I lost almost everything I had) and wouldn't go back on any other type of cold storage.

although has this been the first time he lost large amounts of Bitcoin?

My guess is yes, because if he was hacked before, he would be way more careful than he was. Btw not saying that he was careless, but he would probably be extra careful it it has already happened in the past.

[MysteryMiner]

Best thing to do is just forget about coins. No life or limb is lost. This also happened to me. I forgot encryption password for hard drive of computer. And I miss the pictures and saved games more than the bitcoins stored there. Just we must take lessons how other people failed and not repeat them.

Also I feel good that the destiny got Luke for hacking CoiledCoin. It is hard to feel sympathy for a guy who looks like crossover of Amish husband and feces-smearing Johnny Knoxville. And Luke over years have acted as one, from genuine service to humanity as a free software developer to destroying altcoins and smearing blockchain content. Luke is like my cousin. My cousin is brilliant scientist and computer hacker, but complete imbecile in human relationships and behavior.

[tygeade]

Incidents like this always happen every year and we as bitcoin users always have to be careful in storing private keys, and applying maximum security, if we have done that then there is no way to stop hackers because they are always looking for ways to get into our bitcoin account which has a fairly large asset, the victims right now I'm concerned because no matter what way we do it's very difficult to detect hackers,hopefully this will be a valuable lesson for all of us.

It does happen commonly but not to a huge name like this. Not because he is famous, even famous people could get hacked, but because he is famous for being a bitcoin developer. Dude knows how to be safe, and yet he was still hacked and he doesn't even know how he was hacked neither.

I believe that the best thing to do would be letting him handle whatever he wants to handle to get the answers, give him full access to everything and find the issue. Because, if there is a hole somewhere that hackers could use to hack him, they could 100% hack all of us, if he couldn't protect himself, there is absolutely no way that we could ever protect ourselves better than he did.

[franky1]

It does happen commonly but not to a huge name like this. Not because he is famous, even famous people could get hacked, but because he is famous for being a bitcoin developer. Dude knows how to be safe, and yet he was still hacked and he doesn't even know how he was hacked neither.

I believe that the best thing to do would be letting him handle whatever he wants to handle to get the answers, give him full access to everything and find the issue. Because, if there is a hole somewhere that hackers could use to hack him, they could 100% hack all of us, if he couldn't protect himself, there is absolutely no way that we could ever protect ourselves better than he did.

his server was being hacked all through november and december multiple times by the same instigator.
he knew the hackers were making hacking bots scripted to hack his system(s) specifically..

he (supposedly) however didnt realise they trojaned in specific code for his system to then get at his home computers.
he thought they were only playing around with his servers and had no idea they got code into his home computers to mess with them too after christmas

..
some of his comments are a bit sparse. . cynically im thinking "the less you say the less lies you have to tell" where it could be, that he heard about FTX in november and seen how people like micheal saylor also (paper loss) declared a tax loss in december.. and thought he should do something similar to avoid taxes..

however he could have actually been hacked.
his vagueness could be genuine surprise or planned avoidance of multiplying his lies

[NotATether]

Fair enough, There some exchange that still doesn’t required KYC and allow 2BTC deposit and withdrawal per day.

Like what? Not Binance, is that what you're talking about?

[Edwardard]

Fair enough, There some exchange that still doesn’t required KYC and allow 2BTC deposit and withdrawal per day.

Like what? Not Binance, is that what you're talking about?

From my knowledge, he might be talking about Bybit exchange which used to allow 2BTC daily withdrawal limit for non KYC accounts, but they have recently updated their policy[1] and changed the limits to 20k usdt equivalent withdrawals per day.
Also, kucoin allows 1 BTC/day withdrawal limit for non KYC. Dunno of any trustable cex allowing 2BTC withdrawal limits today, but would love to know.
[1] https://announcements.bybit.com/en-US/article/enhanced-kyc-policy-to-be-implemented-after-dec-15-2022-bltf3d717c057f2a044/

[franky1]

Fair enough, There some exchange that still doesn’t required KYC and allow 2BTC deposit and withdrawal per day.

Like what? Not Binance, is that what you're talking about?

From my knowledge, he might be talking about Bybit exchange which used to allow 2BTC daily withdrawal limit for non KYC accounts, but they have recently updated their policy[1] and changed the limits to 20k usdt equivalent withdrawals per day.
Also, kucoin allows 1 BTC/day withdrawal limit for non KYC. Dunno of any trustable cex allowing 2BTC withdrawal limits today, but would love to know.
[1] https://announcements.bybit.com/en-US/article/enhanced-kyc-policy-to-be-implemented-after-dec-15-2022-bltf3d717c057f2a044/

i too think the luke stash splits that end up on bc1q addresses(precise amounts of 1-5btc) will end up on those types of CEX and converted to some other currency
converting it to true fiat via those sites wont be non-kyc because doing fiat withdrawals reveals bank account holder name. so those sites will be just conversion bridges to altcoins/stable coins and them moved again before the entity doing it thinks its safe to then "cash out" or hoard back as BTC again elsewhere

[Jason Brendon]

It does happen commonly but not to a huge name like this. Not because he is famous, even famous people could get hacked, but because he is famous for being a bitcoin developer. Dude knows how to be safe, and yet he was still hacked and he doesn't even know how he was hacked neither.

I believe that the best thing to do would be letting him handle whatever he wants to handle to get the answers, give him full access to everything and find the issue. Because, if there is a hole somewhere that hackers could use to hack him, they could 100% hack all of us, if he couldn't protect himself, there is absolutely no way that we could ever protect ourselves better than he did.

his server was being hacked all through november and december multiple times by the same instigator.
he knew the hackers were making hacking bots scripted to hack his system(s) specifically..

he (supposedly) however didnt realise they trojaned in specific code for his system to then get at his home computers.
he thought they were only playing around with his servers and had no idea they got code into his home computers to mess with them too after christmas

..
some of his comments are a bit sparse. . cynically im thinking "the less you say the less lies you have to tell" where it could be, that he heard about FTX in november and seen how people like micheal saylor also (paper loss) declared a tax loss in december.. and thought he should do something similar to avoid taxes..

however he could have actually been hacked.
his vagueness could be genuine surprise or planned avoidance of multiplying his lies

honestly speaking, when i first heard of this news, i was shocked. But then when i relooked at the whole thing, i acutally thought to myself, fuck it, he can't be really hacked. Until these days, i still couldn't believe that a 200BTC wallet stolen from a btc developer. It just doesn't look like he was really fucked. And what you said here actually validates my point.
So, fuck it, he is a trying to fool the public around.

[fillippone]

Fair enough, There some exchange that still doesn’t required KYC and allow 2BTC deposit and withdrawal per day.

Like what? Not Binance, is that what you're talking about?

From my knowledge, he might be talking about Bybit exchange which used to allow 2BTC daily withdrawal limit for non KYC accounts, but they have recently updated their policy[1] and changed the limits to 20k usdt equivalent withdrawals per day.
Also, kucoin allows 1 BTC/day withdrawal limit for non KYC. Dunno of any trustable cex allowing 2BTC withdrawal limits today, but would love to know.
[1] https://announcements.bybit.com/en-US/article/enhanced-kyc-policy-to-be-implemented-after-dec-15-2022-bltf3d717c057f2a044/

i too think the luke stash splits that end up on bc1q addresses(precise amounts of 1-5btc) will end up on those types of CEX and converted to some other currency
converting it to true fiat via those sites wont be non-kyc because doing fiat withdrawals reveals bank account holder name. so those sites will be just conversion bridges to altcoins/stable coins and them moved again before the entity doing it thinks its safe to then "cash out" or hoard back as BTC again elsewhere

I have just only one question.
Why didn’t he cash the UTXO sending them pro the exchange? No one would have never known that, as those funds were not tied to him.
Now he has to be extremely careful handling those utxo's.

[NotATether]

According to reddit, he did not use a seed phrase, but instead "split all his bitcoins across hundreds of private keys" which by virtue of being on the same computer, were stolen at once.

I don't even.... just take a look for yourself.

Also, he mentioned that he didn't use a standard seed phrase.

He also said that he independently generated each private/public key pair.

His funds were spread out across "hundreds" of private keys, which ended up all being compromised.

With a complex setup like this, and the fact that hundreds of independently generated private keys were all compromised, it's clear that he had all those keys backed up on a hot computer somewhere, which was compromised.

Kids, don't be stupid out there. Just use a 24 word seed phrase and never back it up on any computer ever. This situation is 100% avoidable.

I guess this is not so surprising anymore. I was thinking somewhere on the lines of his seed phrases getting burgled.

[franky1]

it actually does not matter if its seed or legacy or multisig or segwit

if you expose any seed, wallet file, private key to a system that is hackable(online) where you probably downloaded a compromised file that contains a trojan. those coins no matter the format of the private key, becomes their

[Ryu_Ar1]

This is truly an unprecedented event!  From such an experienced developer in the field of blockchain, hackers managed to steal a large sum of money in Bitcoins....

At the same time, Bitcoin Core developers themselves give recommendations on the safe storage of the first cryptocurrency on their website.  Most Bitcoin users are guided by these recommendations when choosing one or another wallet to store their coins. 

In my opinion, this means acknowledging the fact that there is no completely secure way to store Bitcoins.  It is necessary to use all available methods to minimize the existing risks of losing cryptocurrency.

It's hard to see the current condition when even experienced developers in the field of blockchain can be penetrated but on the other hand this can't just happen because I think there must be cause and effect and there could be some oversights that occur when looking at this from a broad perspective.

Right now I think we have to be more vigilant than before because hackers are getting smarter and smarter and I agree with what you said, use all the methods currently available to make your assets really safe because I don't mean to scare you but it could be people people who are out there right now are waiting for us to let our guard down and seize the moment as it happened to this seasoned developer.

Should he be removed from bitcoin development team? It seems this could have a negative impact on bitcoin as a whole. Just my opinion.

This will obviously have an impact because seeing some of the retweets there, a lot of people are worried because even a developer class is still being infiltrated, especially with people who only rely on daring to take risks and indeed this is a real target for haters of bitcoin because they seem to see a new weapon for make it look like bitcoin is indeed a means of scam and fraud for now.

[franky1]

i too think the luke stash splits that end up on bc1q addresses(precise amounts of 1-5btc) will end up on those types of CEX and converted to some other currency
converting it to true fiat via those sites wont be non-kyc because doing fiat withdrawals reveals bank account holder name. so those sites will be just conversion bridges to altcoins/stable coins and them moved again before the entity doing it thinks its safe to then "cash out" or hoard back as BTC again elsewhere

I have just only one question.
Why didn’t he cash the UTXO sending them pro the exchange? No one would have never known that, as those funds were not tied to him.
Now he has to be extremely careful handling those utxo's.

whomever the entity is (luke/hacker) they are not stupid to just throw coins into an exchange to cash out, straight from the "event". as the lack of taint jumps are to close to the publicly known address, which has been called out as stolen funds

their game is to taint jump and tx format change to hope they can skip passed the limits and tolerances of coin analysis where the fresh addresses of small amount wont raise any red flags when eventually entering an exchange/service

im surprised that these coins have not moved on much. i would have expected those precise(no decimal) coins on bc1q addresses to have been 'spent' through a mixer by now. several times. or looped through a non kyc exchange to swap for altcoin/stablecoin.

edit

end result of the 2 paths of p2sh
https://www.blockchain.com/explorer/transactions/btc/6fc2f7370682b068c78778ce591a24c13dc797a172c69e31a1fd331e0cb80bff

i just checked address in tx above. and it has now split the 1btc into smaller amounts of 0.002
as have some other bc1q adddreses(taint back to 1yar) of precise amounts now split into 0.001 amounts
https://www.blockchain.com/explorer/addresses/BTC/bc1qr3vpj9ffshqp53u9la0g6nwhx6f5n3z9l7xhwd
this to me shows signs of splits of "mixer token" allotments (al)ready to be mixed
https://www.blockchain.com/explorer/addresses/btc/bc1qm2qljj3a64ueqfq885ne2yy9pddnez7vz4y2v5

i would say beyond this point it is now hard to tell if these funds when spent are the entity(luke/hacker) or some idiot that is in receipt from some mixed funds.

but knowing (due to FATF regs) that regulated exchanges do not tolerate funds that went through a mixer, it should be fun to see what exchanges accept or reject deposits from those spends, even if the user is not entity(hacker/luke)

as for the funds the entity does get (different mixer deposit stash) they too may have issues trying to deposit into exchanges unless another taint jump ordeal is done to outpace chain analysis tolerances

[fillippone]

Update on the funds.
Fist they went trough Chipmixer:



Then according to this analyst they were transferred to a CEX:



My question is : how the chainanalisys stood after the ChipMixer Round?

[NotATether]

My question is : how the chainanalisys stood after the ChipMixer Round?

And my question is, have they not heard the alarm bells from people (Twitter?) warning them that they are currently holding Luke-jr's stolen funds?

OKX has got to freeze all those funds. Never mind, they apparently haven't even been sent to an exchange yet.