Bitcoin developer @lukedashjr's wallet was hacked

[franky1]

i would say even i got complacent...
thinking back i probably also have my keys at some point touching atleast three PC's i own (not this one i use for forum/lifestyle internet use. im not that dumb)
and i havnt moved the coins in over a decade. so i probably will be moving my stash to fresh keys (when i can be bothered) where the new private keys have not touched a online pc

i kinda dont feel its complacency. it was more of a trophy to not want/need to touch/move coins in years. but from this saga, i can see it from an outsiders prospective of being like complacency

so i agree it might kick some people up the ass to motivate them passed the 'trophy hoard' mindset (appeal of not moving=its own proof of patience. (that my excuse anyways))

[1714262786]

1714262786

[1714262786]

1714262786

[1714262786]

1714262786

[Rruchi man]

It appears more than $3 million in bitcoin was stolen. This is very sad to see and I reckon some people should not make fun of this similar to those imbeciles who are replying in this thread in Twitter.

This year has started terribly for him, to loose $3 million at the beginning of the year where there are many expenses to bother you already is a very sad story. This story only is a reminder that anyone can be hacked if they let their guard down. Anyone can be target regardless of how well you know about bitcoins or not, if you don't practice safe security measures and you let your guard down even for a day, It can put your bitcoins in danger of being stolen. I sincerely hope he finds out how he was hacked to prevent it from happening in the future.

[PrivacyG]

Not trying to joke around or anything.  But could this be a 'lost my Monero in a boat accident' kind of 'hack'?  I can not wrap my head around how this could have happened.  Unless lukedashjr's way of storing his balance was mediocre.

-----

Maybe I am wrong but I think that his Twitter is perhaps compromised and it’s not him posting. He is a smart guy. He probably has iron clad security.

You see.  I think it is wrong to tie some body's domain to how much knowledge they have about a particular subject or to how good their behavior is.  May be a smart guy, but this does not stop him from being silly for once and trusting not storing his Bitcoin in Cold Storage.

I bet you there are a lot of people who are Seniors in digital security and have devices with weaker security than mine or have weaker passwords than I do.  There are things I sometimes preach that I do not do.  Do not know why if you ask me.

I think that his Twitter is hacked due to the leak last week and he is going to post a “please send donations” tweet and that’s the payoff in this hack.

Maybe.  Sounds plausible, actually.  Who knows.

-
Regards,
PrivacyG

[Artemis3]

A simple cold wallet cannot be hacked, that is because you write your seed words with your own hands to a piece of paper in a room without cameras. The fact that these coins were available behind a password means there was a huge flaw. It is a shame this happened to someone who should have known better, but remember that is not Bitcoin's fault.

If you are going to hold that many coins, move them into a cold wallet. Its simple, write those words and don't tell anyone. Make another physical copy (with your own hands, no cameras or any electronic device) and store it in a different physical location, transfer the funds and delete your wallet. The truly paranoid learns to do this in an offline computer with a good OS running from optical media so that once you finish the wallet is gone and only the (written on paper by hand) seed words remain.

Remember that you can still do that today: Make a new wallet, write the words, transfer funds, delete. Practice with a few satoshis. You don't need to have those words electronically available behind a password, what for? Please learn from mistakes people.

[illusioNiZt]

In the absence of a revocation cert for the allegedly compromised PGP key, my money's on his Twitter account being hacked and posting FUD. Does Twitter even still have a security team after Ol' Musky's latest round of firings?

I had same thought too but there are transaction hashes provided in tweets too, well they could be just random big transactions done by some other party, hope he gets them back.

[franky1]

the practice of security is easy
but alot of people with old timer coins enjoy the "proof of patience" of not moving coins periodically. its a trophy to hoard coins where the utxo is dated over 10+ years

im personally guilty of it, i imported wallets just to make sure that the data has not degreded or been edited to ensure i still had access to keys

the complacency is more about importing keys into wallets of hot (online) devices when you have no desire to move the coins, having keys presented to multiple systems even if your not moving coins. not wiping said devices after whatever you done

[digaran]

This is what happens when you reveal your real life identity to the public, especially if you are well known bitcoin developer which means you own at least a few hundreds.

This incident has nothing to do with him being sloppy with the security of his coins, this was an organized attack just because they knew his whereabouts.

Maybe if you are reading this post and have millions of $ in bitcoin be more careful what you reveal about what you have and who you are.

Maybe Satoshi knew something all along, that's why he disappeared given if he actually still alive.

[PrivacyG]

This incident has nothing to do with him being sloppy with the security of his coins, this was an organized attack just because they knew his whereabouts.

Do you have any source for this claim?  If there is a place he would look into first, probably before even posting a tweet, I would assume it is where his seed was stored.

-
Regards,
PrivacyG

[mindrust]

This is what happens when you reveal your real life identity to the public, especially if you are well known bitcoin developer which means you own at least a few hundreds.

This incident has nothing to do with him being sloppy with the security of his coins, this was an organized attack just because they knew his whereabouts.

Maybe if you are reading this post and have millions of $ in bitcoin be more careful what you reveal about what you have and who you are.

Maybe Satoshi knew something all along, that's why he disappeared given if he actually still alive.

Is is kind of sad, not so long ago I made post this and now this happened.

It is pretty hard to stay anonymous on the internet. Especially if you are a dev that has to work on a project all the time. Fixing bugs, creating updates all the time, sooner or later you will make a mistake and lose your anonymity. Hell, even if you do everything right, you still may lose your anonymity because some clever bastard may hack you.

That’s one of the weaknesses of crypto imo. Crypto itself is bullet proof but their devs aren’t.

Even gmaxwell merited it, as you see I almost described this exact situation.

[stompix]

Two consequences:
1.A  lot of bad FUD will come out of this story. "if even an OG bitcoin- core developer" cannot take his Bitcoin safe, who on Earth will be able to do so?"

That's the first thing I've thought about after reading achow101 reply stating that is is indeed real, this is just giving unlimited ammunition to critics, if the guy that helped develop the code, that for sure is more knowledgeable about risks and security, what about the uneducated that are risking everything, I can almost hear 1 million Helen Lovejoy screaming!

But I'm still not entirely convinced of this story, not because of the haking part, the coins moving etc, but this line in his tweet..

@LukeDashjr@BitcoinHackers.org on Mastodon @LukeDashjr
What the heck @FBI@ic3 why can't I reach anyone???
9:19 PM · Jan 1, 2023

This feels like trolling, why would you tweet that? For sure he knows better than everyone how a complaint is filed and how you deal with it, but tweet about this?
But assuming this is real, stay away from bitcoin knots fro a while (I doubt that many were using it in the first place)

That's how you might verify that your Bitcoin Knots or Core download isn't infested with malware.
So to be clear: DO NOT DOWNLOAD BITCOIN KNOTS AND TRUST IT UNTIL THIS IS RESOLVED.
If you already did in the last few months, consider shutting that system down for now.

[franky1]

i know alot of people think there is a single telephone number that if you call it, 'CSI:cyber crime' team answer and speedily arrive at your house in 20 minutes to explore your computer.. sorry.. this is not how things work

But I'm still not entirely convinced of this story, not because of the haking part, the coins moving etc, but this line in his tweet..

@LukeDashjr@BitcoinHackers.org on Mastodon @LukeDashjr
What the heck @FBI@ic3 why can't I reach anyone???
9:19 PM · Jan 1, 2023

if you read it properly and apply logic and common sense against it too
(if you read his other tweets it makes more sense in full context)

he did contact authorities by the usual routes(phone).. they were not interested/unable to help. his tweet was just a rant not a plea for help


to get hold of FBI you have to go through a rigmarole of call centres to escalate the situation. also it was late night of new years day. dont expect miracles


he was obviously not able to get to the centre of the FBI... and local authorities were (as known from other incidences of many people) just got sent around the pass the bucket brigade of call centres, saying there is "nothing they can do at local level and here is a crime reference number, bye"

[coolcoinz]

I don't get the part about his server being hacked months ago. I'd take that as a warning that somebody is working on getting my coins and moved all of it even deeper into cold storage, probably to a hardware wallet. I mean I already have mine on a hardware wallet but from the looks of it Luke had it all on his machine and thought that since they all connect to a routing server and the hacker couldn't get into them last time, they're safe.
It's easy to say now after the fact but wiping the server and reinstalling everything after the first hack might've been a good idea. Getting in touch with the ISP to change your IP within their network might help too. We're talking about 3 million in BTC, no amount of scrutiny is too much.

[franky1]

I don't get the part about his server being hacked months ago. I'd take that as a warning that somebody is working on getting my coins and moved all of it even deeper into cold storage, probably to a hardware wallet.

his coins were on old legacy keys (before seeds were even a thing, before hardware wallets(seed based) were a thing)
he had backups EG (maybe)paper wallet and/or (most probably) usb drive of wallet.dat files

[coolcoinz]

I don't get the part about his server being hacked months ago. I'd take that as a warning that somebody is working on getting my coins and moved all of it even deeper into cold storage, probably to a hardware wallet.

his coins were on old legacy keys (before seeds were even a thing, before hardware wallets(seed based) were a thing)
he had backups EG (maybe)paper wallet and/or (most probably) usb drive of wallet.dat files

This comment is interesting.

https://mobile.twitter.com/vicariousdrama/status/1609925987453571073

If this is true he was using those addresses for donations. Was this a double spending issue? Did someone somehow attach another transaction to the existing one?
I have to say this is fare above my level, but somehow someone had to get access to his private key stored on that machine. I doubt it was really a cold wallet (paper/USB) He must've had it on one of his workstations.

If hacking cold wallets was possible like that someone would've got Satoshi's coins long ago.

[adaseb]

What would be the safest and most secure setup for a cold wallet? I am now unsure how to transfer from cold wallet to an online address without compromising security.
Would it be possible to transfer BTC from cold wallet to another cold wallet and then send from that secondary cold wallet to an online address? That way my original cold wallet isn't connecting to the internet or being directly exposed?

Years ago I used to use a USB stick between offline and online computer. Then I read somewhere that its not perfectly safe because if the online computer has some worm, it can jump onto the USB key, and then when you connect the USB key to the offline computer it can infect that computer and steal coins. This was far fetched but it made me worry. So I searched for a full proof method.

Basically my old laptop had a crappy camera. However this camera sucked and couldn't read large QR codes. It also had a SD card reader. So what I did was use an old camera from 1995. And I would take photos of the QR code on ONLINE computer, put that SD card into the OFFLINE computer and read it and sign it. That SD card NEVER was connected to the online computer.

Once I signed the transaction, you can take your iPhone, go to Camera and point at QR code and it will display the signed raw transaction that you can later just go to an online block explorer and push it.

This way there is an "AIR GAP". This is probably even safer than hardware wallets however its a ton of work.

[NotATether]

Not trying to joke around or anything.  But could this be a 'lost my Monero in a boat accident' kind of 'hack'?  I can not wrap my head around how this could have happened.  Unless lukedashjr's way of storing his balance was mediocre.

The only way I can think of this happening is in a non-standard storage configuration:

- PGP key is used to encrypt multiple Bitcoin private keys
- To spend the bitcoins, the password of the key is entered, and a transaction is made (by hand??)
- Hacker steals PGP key and message, and places a keylogger to get the password. Then they can swipe the coins.

Keep in mind I am still assuming at this point, this is probably NOT how he actually set up his cold wallet.

[adaseb]

Can someone that knows him tell him to post something on his Mastodon or Bitcointalk account. People are asking him to post on another social medium to prove its him but he refuses. Normally he posts first to Mastodon and then Twitter, however now he doesn't post anything on Mastodon.

When a Bitcoin OG posts something such as

"How do I download it and know it's not infected?"

its very strange because we all know you are suppose to verify the checksum after the download to confirm its legit.

This is like Satoshi making a post and saying something like "How can I mine Bitcoins on my Cell phone".

[Hispo]

Can someone that knows him tell him to post something on his Mastodon or Bitcointalk account. People are asking him to post on another social medium to prove its him but he refuses. Normally he posts first to Mastodon and then Twitter, however now he doesn't post anything on Mastodon.

When a Bitcoin OG posts something such as

"How do I download it and know it's not infected?"

its very strange because we all know you are suppose to verify the checksum after the download to confirm its legit.

This is like Satoshi making a post and saying something like "How can I mine Bitcoins on my Cell phone".

Exactly what I think.
All this is horrible news and only fuels my paranoia, still before jumping into conclusions, I will wait for an official statement, because we all know that hacking Twitter accounts is possible, and I want to assume a Core developer would know how to take care their Bitcoin in a proper manner.

Also, is there any way to know whether he revoked his PGP keys or not? I have seen many comments on this thread mentioning he has not done so yet.

Fingers crossed all this is just a Ruse.  

[darkangel11]

Can someone that knows him tell him to post something on his Mastodon or Bitcointalk account. People are asking him to post on another social medium to prove its him but he refuses. Normally he posts first to Mastodon and then Twitter, however now he doesn't post anything on Mastodon.

When a Bitcoin OG posts something such as

"How do I download it and know it's not infected?"

its very strange because we all know you are suppose to verify the checksum after the download to confirm its legit.

This is like Satoshi making a post and saying something like "How can I mine Bitcoins on my Cell phone".

I also think it's strange. He said he has no time for Mastodon right now or something like that...
He wants FBI to help him, says they got his cold storage Cold storage isn't really cold if you can hack it.
I have a cold storage that's on an unplugged computer with a clean system that was never used to browse sites or download any software, which I'll turn on only when I decide to move my bitcoins.
This is incredible that a dev who uses a specialized hardware (Talos) with linux, doesn't secure his coins better and wants the FBI to help him.

[fillippone]

Can someone that knows him tell him to post something on his Mastodon or Bitcointalk account. People are asking him to post on another social medium to prove its him but he refuses. Normally he posts first to Mastodon and then Twitter, however now he doesn't post anything on Mastodon.
<...>

All I can tell is someone else has been trying to contact him and while someone had confirmation of all this (Peter Todd, he confirmed over Twitter the story is original), other haven't been able to contact him directly (Giacomo Zucco confirmed he messaged him on Telegram, but he hasn't got any answer so far.).