Bitcoin developer @lukedashjr's wallet was hacked

[franky1]

i dont like the guy, but im fence sitting this one, as much as possible trying not to lean over and pick a side to fall into

he wasnt asking for help from the FBI via twitter. he was ranting that the FBI was not helpful.. it was a rant not a plea for help. he did say he contacted the authorities via the normal route and got nowhere. (got stuck in the pass the bucket of call centre hell)
to me it felt more like he was just speaking aloud thoughts in his brain "grrr fbi where are you when i need you" rant

What the heck @FBI @ic3 why can't I reach anyone???

..
but as for the 'i got hacked, and coins were mixed'
that part is seeming less inline..

first he said coins were cold. whereby its actually shown coins were hot and used in september, thus wallet was exposed to internet

secondly funds of the addresses raided in new year were legacy which he said were origin funded before seeds and multisig existed..

thirdly they dont seem to be mixed because the 1yar address is not mixing them, its hoarding them
..

im trying to keep an open mind. but to me its looking more like he moved coins to a new address he owns(1yar) and is claiming "i been hacked" for a tax dodge

[1714550975]

1714550975

[Wind_FURY]

Should he be removed from bitcoin development team? It seems this could have a negative impact on bitcoin as a whole. Just my opinion.

The person just lost his livelihood, it's not his fault/he was a target by hackers, then you want him, an experienced Bitcoin developer who has written thousands of lines of code, to be removed from Bitcoin Core development team? I believe not. If your house was robbed, I believe it would be unfair for you to be removed from the job. Plus there's no negative impact in my opinion. Bitcoin is OK, and he didn't intentionally write a nefarious line of code to break the protocol.

[casinotester0001]

1YAR6opJCfDjBNdn5bV8b5Mcu84tv92fa  216.93331465 BTC

[franky1]

Should he be removed from bitcoin development team? It seems this could have a negative impact on bitcoin as a whole. Just my opinion.

The person just lost his livelihood, it's not his fault/he was a target by hackers, then you want him, an experienced Bitcoin developer who has written thousands of lines of code, to be removed from Bitcoin Core development team? I believe not.

i think that comment was a tongue in cheek hint about the fact that gavin was removed from core when he was compromised(targetted and bribed by altcoin scammer CSW)

[Wind_FURY]

Should he be removed from bitcoin development team? It seems this could have a negative impact on bitcoin as a whole. Just my opinion.

The person just lost his livelihood, it's not his fault/he was a target by hackers, then you want him, an experienced Bitcoin developer who has written thousands of lines of code, to be removed from Bitcoin Core development team? I believe not.

i think that comment was a tongue in cheek hint about the fact that gavin was removed from core when he was compromised(targetted and bribed by altcoin scammer CSW)

"Compromised". If there was proof that Luke Dashjr was truly "compromised" and he's working for the Flat-Earthers, then remove him from Bitcoin Core. OR if he starts a public declaration that Craig Wright is the "Real Satoshi". But currently, Luke Dashjr is simply a person who had his Bitcoins stolen from him. A mere victim of a hack.

[franky1]

windfury have you seen lukes religious beliefs recently.. one way or another luke is compromised. but the threshold is.. what?
im not saying he should be removed just for religious beliefs i was making a plain comment that someone else was hinting IN A TONGUE IN CHEEK manner that gavin got removed for "keys compromised" and dubious funding/commentary..

and now in this post. i am now saying.. so whats the threshold for removal from core team?? again not saying remove him. just a comment about whats the threshold(and its rhetorical not actually requiring an answer)

if you cant get satire/rhetorical comments. then please stop pressing the reply button to go streaming into 20 rants about how you adore things and think everything else is gaslighting you

(i feel your about to take a sly-small satirical comment made by someone else, and then me highlighting the cheekiness of said comment.. to go into a massive defend a dev debate that lasts weeks.. so lets just pre-empt all your lil digs and resolve it all in one post.)

edit above comments to address windfurys responses below(ending debate before he goes left field)

firstly i didnt say he was compromised. to the same extent as gavin..
YOU were having a dig at Digaran when HE suggested in satire to remove luke
I said digaran was making a tongue-in-cheek comment(aka satire).
(i guess you didnt get the hint)
YOU then(post below) acted as if i was saying what digaran said.. without you understanding what i or digaran was saying. in short you took things too far to cause more social drama

edit above comments to address windfurys responses below(ending debate before he goes left field)
anyways (only edited below the underlines to my points about compromise)
as for decisions of doing things to defend BITCOIN against compromised devs..
requires seeing if a devs PGP keys are compromised and ensuring that no one aimlessly downloads software containing a compromised keys signature post compromise of said keys..

however then
adoring a dev just because "they are core", ignoring their flaws as humans, treating them as gods just having a bad day.. is not good for the decentralised security of bitcoin. defending a dev above the security of bitcoin is also not a good trait to have

trying to be part of a kiss ass team wanting to break bitcoin rules to ensure bitcoin only follows a business sponsored roadmap is not good for bitcoin

and when a dev that was sponsored to implement a "feature" but is found later on not even using the feature they were highly involved in implementing.. says alot about the whole situation

you admiring luke due to a implementation involvement. yet then seeing luke himself doesnt use that feature in the last 5 years of opportunity to use it.. should make you probably want to call luke out for gas lighting you into a implementation you thought he truly wanted.. but later found out he doesnt use.. right?.. correct?
or are you still just going to kiss ass a dev as if devs never make mistakes.. as if he is a god having a bad day just because of some social drama team of dev idols you are in.

just because a dev wrote some code for bitcoin does not mean it requires blind idolism of them as gods. we actually should be critical and review devs regularly to keep them on their toes to ensure they dont keep putting trojans into the code.. not idolise them and pretend they can put anything they like in and dont need review and no one should criticise them

[fillippone]

New development:


Still shady af.
Definetly Luke is not doing everything to make it well understood.

[NotATether]

New development:

How would CVE-2019-15847 be leveraged to make completely deterministic private keys in the first place? Libsecp256k1 that is used inside Bitcoin Core doesn't even use any RNGs from any APIs - it directly seeds from /dev/urandom.

[franky1]

the bit about gentoo(linux) and "they got it all" is about that he said he found malware that was script kiddie made but made to target his system(s) specifically

this means its the same people that were hacking him since november exploring his systems and then editing their malware to follow a path they seen so that they can get deeper into his system with each attack and get more access to things
..
manually hacking and exploring takes time which means more time for victim to spot an attack. but if you make a bot do most the work and you add on new paths per attack to automate the process so that you can get deeper each time before getting spotted then you have better chance of getting valuable data sooner with less attacks needed to explore the system

[pawel7777]

This is really bad PR for Bitcoin.

If one of the most experienced devs can't keep his stash secure, how do we expect a random, way less tech-savvy users to do it?

So now, the average Joe will get the massage that self-custody is not safe and neither is holding on CEXs (i.e. because of FTX).

The first round of news coverage is out:
https://www.cryptotimes.io/bitcoin-developer-luke-dashjr-reportedly-lost-200-bitcoins/
https://beincrypto.com/early-bitcoin-developer-luke-dashjr-loses-3-6m-btc-due-supposed-key-hack/
https://www.indiatoday.in/amp/cryptocurrency/story/bitcoin-core-developer-claims-hacker-stole-more-than-200-btc-2316348-2023-01-02

Will see if any of the major news outlets pick up on that story. Peter Shiff will surely have a field day with this one.

We've been through worse though.


I feel really sorry for Luke, can't even imagine what it's like to lose that kind of amount in such way.

[darkangel11]

^^^
This guy is conveniently playing into CZ's hands. I wouldn't be surprised if this was a much bigger plot aimed to scare people away from self custody and making Binance a monopoly. They need those bitcoins to fill the gaps made by people who took money out after FTX drama.

I know Luke is a religious and a God fearing person who will never do something shameful only to avoid paying taxes. If this was Justin Sun it would be different hehehehe.

There's just too many religious murderers and thieves out there. Many of them used religion to justify what they were doing. This is by no means an argument in his favor.
By the way, isn't Richard Heart a Christian?

[nullama]

~snip~
If one of the most experienced devs can't keep his stash secure, how do we expect a random, way less tech-savvy users to do it?

So now, the average Joe will get the massage that self-custody is not safe and neither is holding on CEXs (i.e. because of FTX).
~snip~

Luke wasn't using a modern wallet, he was using old private keys, and it seems he generated those keys, or at least seems to have some kind of information about those keys in a device connected to the internet.

An average Joe that wants self-custody today will generate a seed phrase on an air-gapped device, so they will be in a more secure setup than what Luke had.

[fillippone]

An average Joe that wants self-custody today will generate a seed phrase on an air-gapped device, so they will be in a more secure setup than what Luke had.

I am afraid you are overstimating the capabilities of the average Joe. Not because generating a seed on an air gapped device is difficult "per se", but because the average Joe is lazy as fuck.

[pawel7777]

An average Joe that wants self-custody today will generate a seed phrase on an air-gapped device, so they will be in a more secure setup than what Luke had.

I am afraid you are overstimating the capabilities of the average Joe. Not because generating a seed on an air gapped device is difficult "per se", but because the average Joe is lazy as fuck.

^ I was going to post this but you beat me to it.

But there's also an ugly truth, that unless you possess relevant skills yourself, there's always some trust involved. For hardware wallets - you have to trust that manufacturers are competent and that they have not put anything malicious there. For offline generated wallets, you have to trust that address generating software is legit and that address is truly random and nor generated according to some easy-to-replicate pattern etc.

"Freedom ain't free" I guess.

[OgNasty]

It seems a little hard to believe that so much BTC could have been left available for hackers to access. My first thought was that this was a lost my private keys in a boating accident type of incident. The timing of it along with him publicly messaging the FBI… Just seemed almost like theater. I hope for lukedashjr that this is some sort of cautionary tale, but everyone seems to be taking it as a legitimate loss, which is absolutely terrible.

[pawel7777]

It seems a little hard to believe that so much BTC could have been left available for hackers to access. My first thought was that this was a lost my private keys in a boating accident type of incident. The timing of it along with him publicly messaging the FBI… Just seemed almost like theater. I hope for lukedashjr that this is some sort of cautionary tale, but everyone seems to be taking it as a legitimate loss, which is absolutely terrible.

Heh, I knew that someone will make a "boating accident" reference here. I agree his tweets looked a bit off - the one you mentioned + that "Help please" part, that just didn't sound like him. But I take into account that those funds might have very likely been a majority of his life savings, so losing that would put anyone into despair and make them act irrational/unusual.

Speculating on him pulling the "boating accident" - there would have to be some sort of trigger, say he's in debt and creditors are on his back, or wife announced she want's a divorce etc. I don't think we have anything like that here, so would rule that out (for now).

[harlequininja]

I hope the community will be able to come up with a proper report of the events once @lukedahjr's is capable of explaining what actually has happened since this is probably a lesson that should be taken very seriously, IMHO. I've been following the developments of Bitcoin for some time and I was never convinced by this bold claims like "Bitcoin fixes this", "In code we trust" or "not your keys, not your Bitcoin". As long humans are involved there will be no way to create a trust-less system. BitcoinMaxis would be well advised to accept this and act accordingly.
Today I've read an article by Jameson Lopp about the Death of SMTP

https://blog.lopp.net/death-of-decentralized-email/

My fellow Bitcoiners: we must remain vigilant and we must push back against the creeping advance of tyranny. If we become complacent, if we settle for convenience over security, we can expect this elegant protocol to morph into a monster.

Although I couldn't agree more, I'm really surprised that Lopp himself didn't take notice of the current events in his twitter timeline although this is a crucial example how decentralization in Bitcoin could evaporate in no time.

More tutorials and best practice examples are needed apart from other opensource wallets like Electrum or ArmoryWallet that provide the basis for a full node.

[bbc.reporter]

I tend to believe more and more it's a prank.

* The story is still only on Twitter and not on Mastodon, although it tells everywhere "Mastodon preferred"
* Stealing from the cold storage would be possible only if the user would be more than incredibly sloppy/uncautious.
* I don't think that somebody for so long in Bitcoin would ask for FBI help, and also would not do it on Twitter.
* Luke Dash Jr is (proudly!) asking for donations for his work; was he indeed owning 200 BTC ?!

I *know* that Peter Todd has confirmed the story, but the things still don't add up.

as for the supposed 'coinjoin mixer' scenario luke hints.. strange thing is his raided coins went into the 1YAR address.. but have not moved out.

Yes, that too; I've followed some of those transactions and it looks more a consolidation of funds than anything else.

This is another skeptical me argument hehehe. This might also be a way to prepare for an exit from holding bitcoin without being persecuted by the community? Claim he was hacked, mix the coins, keep the coins then sell on the next bull market when he has 10x of the present value. This is $20 million and very much enough for his retirement.

[Wind_FURY]

-Snip-

There was literally nothing in what you said that proves Luke Dashjr was compromised. LITERALLY NOTHING.

You merely said his religious beliefs, which many people already know, is very conservative to put it mildly. But that doesn't prove he is compromised. You continue with Segwit and start to try and gaslight everyone again with one long, senseless post. The franky1 we know. Haha.

[larry_vw_1955]

This is really bad PR for Bitcoin.

it certainly is. it makes people mistakenly think that maybe bitcoin is not secure.

If one of the most experienced devs can't keep his stash secure, how do we expect a random, way less tech-savvy users to do it?

very simple.someone can be good at one thing but terrible at another. it doesn't take an expert or a genius to keep their bitcoin secure. just someone that cares. cares to follow best practices.

I feel really sorry for Luke, can't even imagine what it's like to lose that kind of amount in such way.

well if it really did happen then it is likely his fault that it happened. onlyperson to blame is himself. that's bitcoin for you. that's how it was designed to work. you are your own bank. so you have to step up to the plate and keep your money safe.  maybe next time he'll set up an HD wallet and keep the seed offline on a titanium plate.