RarityCheck VIBGYOR gilded #12 swept yesterday.

[raritycheck]

✂
Please share your experience. Or pm if possible.

i better make it public, so that the whole procedure here remains transparent, because i think that among all the collectibles makers there should also be a certain cohesion and you should also support each other (up to a certain point, because in some cases the whole thing can turn out to be a scam in the end).

so at the beginning of last year i started to refind all of coldkey's victims, i created this extra thread to make the whole thing visible to everyone and also to present it according to a certain procedure. this way i was also able to identify/fix certain ambiguities but also scammers (who then wrote to me via pm) more quickly

Oh sorry to hear this.

[LoyceV]

here you go :  https://ibb.co/2Fg4Tm5

The link isn't loading. Try Talkimg.com?

_{These private keys are garbage, awful work indeed.}

Was that printed on an old inkjet printer? That's pathetic!
I could type it correctly at first try though, so that's something. But any cheap dumb laser printer would provide a sharp font.

What I can say and speak on is that I wish he kept a copy of his keys cuz I can’t decipher SHIT from his fucking lost coin series. Holy fuck!! Use some better ink, larger letters… anything cuz this btc is probably lost. Even using a 10x magnifying glass.

Try a high-res picture (ideally on an offline camera). Note that there is no l ^{(lower case L)}, I ^{(upper case i)}, 0 ^(zero) and O ^{(upper case o)} in BASE58.

We understand that not just other coins but our wallets are impacted but even we are trying to root cause it.
We are not 100% sure how this has happened.
But we think the key gen software we used is compromised.

I've seen the question how keys were generated many times, but it hasn't been answered. I'm very curious to see this! Security creating private keys is the very basics of creating loaded coins. It's even very easy to do. Why are you not sharing how you did it?
If your own wallets are also impacted, that means you didn't use a dedicated computer just for creating private keys.

It was pure luck. We wanted to try creating vanity addresses (1O) for VIBGYOR coins so we looked at multiple options.
In the end we didn’t end up creating vanity addresses
But still went with the software we trying to generate vanity addresses

What software is that?

[raritycheck]

here you go :  https://ibb.co/2Fg4Tm5

The link isn't loading. Try Talkimg.com?

_{These private keys are garbage, awful work indeed.}

Was that printed on an old inkjet printer? That's pathetic!
I could type it correctly at first try though, so that's something. But any cheap dumb laser printer would provide a sharp font.

What I can say and speak on is that I wish he kept a copy of his keys cuz I can’t decipher SHIT from his fucking lost coin series. Holy fuck!! Use some better ink, larger letters… anything cuz this btc is probably lost. Even using a 10x magnifying glass.

Try a high-res picture (ideally on an offline camera). Note that there is no l ^{(lower case L)}, I ^{(upper case i)}, 0 ^(zero) and O ^{(upper case o)} in BASE58.

We understand that not just other coins but our wallets are impacted but even we are trying to root cause it.
We are not 100% sure how this has happened.
But we think the key gen software we used is compromised.

I've seen the question how keys were generated many times, but it hasn't been answered. I'm very curious to see this! Security creating private keys is the very basics of creating loaded coins. It's even very easy to do. Why are you not sharing how you did it?
If your own wallets are also impacted, that means you didn't use a dedicated computer just for creating private keys.

It was pure luck. We wanted to try creating vanity addresses (1O) for VIBGYOR coins so we looked at multiple options.
In the end we didn’t end up creating vanity addresses
But still went with the software we trying to generate vanity addresses

What software is that?

We didn’t say our wallets were impacted.
Our own coins (we keep some reserves for sale etc) were impacted.

[LoyceMobile]

We didn’t say our wallets were impacted.

I literally quoted the post in which you said that.

[raritycheck]

We didn’t say our wallets were impacted.

I literally quoted the post in which you said that.

Apologies. We meant our own RC VIBGYOR coins.

[raghavsood]

We didn’t say our wallets were impacted.

I literally quoted the post in which you said that.

I believe they were referring to the fact that the bad keygen software used has resulted in BTC from other, non-collectibles wallets potentially held by normal, regular users who have nothing to do with this forum, being moved and stolen.

I'm baffled as to why they don't share the software at this stage, given that it could save other folks.

[krogoth]

Many people who tried using a vanity gen software have been compromised. You should have stuck with your original software that worked on your first coins.

   I know you didn't end up using the vangen part but you still used their software. Did the swept funds go to any exchange? Perhaps you can reach out to them to freeze the funds. Always stick with what works. And in your case the first key generation code looks like it was solid.

   Also please post where you got that software so others do not fall in the same trap. And perhaps take legal action as well

[rsincognito]

Lost coin V1 silver #3 looks very suspicious with transactions.
Looks like it might have been hit as well, unless someone here on the boards swept it for safety.

Perhaps it was swept by a member: VIBGYOR gilded 82 was swept at the same time.

It was me,  I swept 4 coins yesterday , two  was able to read with a high-end magnifying glass with a light in a dark room, the other two even with the magnifying glass I had to reach out to Mopar for some help. it’s nice to see the creator is on here  trying to make things right. But compromised keys or not, I can’t stress enough how extremely aggravated and disappointment I am with the quality and technique used for the font, ink and printing of the private keys. Due to this HUGE ERROR in judgment, I personally will not be collecting any coins from RarityCheck and will be selling a majority of mine on the forum in the coming days. But I want to say again I’m impressed with the companies response so far in trying to make things right, I  don’t want that to be understated.  

  But at the end of the day: Compromised = Compromised

Another example of a very poor printed private key from yesterdays debacle:


I think creators should from here on out post a sample pic of what their private keys look like so buyers know what they are getting into imo

I wish everyone who was affected from this a positive outcome along with the creator.

[krogoth]

Lost coin V1 silver #3 looks very suspicious with transactions.
Looks like it might have been hit as well, unless someone here on the boards swept it for safety.

Perhaps it was swept by a member: VIBGYOR gilded 82 was swept at the same time.

It was me,  I swept 4 coins yesterday , two  was able to read with a high-end magnifying glass with a light in a dark room, the other two even with the magnifying glass I had to reach out to Mopar for some help. it’s nice to see the creator is on here  trying to make things right. But compromised keys or not, I can’t stress enough how extremely aggravated and disappointment I am with the quality and technique used for the font, ink and printing of the private keys. Due to this HUGE ERROR in judgment, I personally will not be collecting any coins from RarityCheck and will be selling a majority of mine on the forum in the coming days. But I want to say again I’m impressed with the companies response so far in trying to make things right, I  don’t want that to be understated.  

  But at the end of the day: Compromised = Compromised



I think creators should from here on out post a sample pic of what their private keys look like so buyers know what they are getting into imo

   And that's why I created this thread yesterday

   https://bitcointalk.org/index.php?topic=5505467.0

    I even loaded it with Bitcoin.  

    https://mempool.space/address/1BzYG6KmHvhi8RiLuVDCDd94FFsCGbVPet

    So be my guest everyone....please try and sweep

[raghavsood]

Given the explanation and partial information provided so far, I've removed the alerts from Rarity Check creator page and non-VIBGYOR series.

Rarity Check VIBGYOR Orange Set Gilded and Rarity Check VIBGYOR Orange Set Silver will continue to show the Compromised Keys alert on both the series page and individual item listings.

[krogoth]

 I also created a thread on how I generate my keys as well.

   https://bitcointalk.org/index.php?topic=5416519.0

   For those people who do not trust software download off of the internet or do not own a mycelium entropy...there is another way that I suggest.

   Simply....buy a Trezor...generate a new seed and place the 12 word seed instead of a private key.

    You can use it this method as many times as you wish simply by resetting the Trezor. And yes of course you have to trust Trezor as well. If not then use a hardware wallet of your choice. Coldard is also another one I would trust especially the latest Q wallet which is all done air gapped!

     Or simply roll the dice. Lol

[minerjones]

I strongly encourage the team to share details with folks who have the background and skills to help get to the bottom of this.

The refunds and efforts to make people whole are commendable and important, but based on the on-chain activity there are more wallets at risk than just collectibles.

I'm volunteering my time and effort in helping to track this down, but it is extremely important that the RC team provides the information and background for the key generation process, and how it differs from that of their other series.

I have separately dropped them a PM to ask for the same information, in the event that (for whatever reason) they are unwilling to share it publicly at this stage.

Hi raghav

We will not pull the eBay listing.
If someone orders we will send them coins with new holos and new keys.

We understand that not just other coins but our wallets are impacted but even we are trying to root cause it.
We are not 100% sure how this has happened.
But we think the key gen software we used is compromised.
Rest ensured as soon as we know we will provide details.

From the looks of it you generated keys with the computer still on-line

My recommendation is stop making keys immediately, refund everyone impacted and just send out replacement holograms

Regardless of what you are trying to do to make this right, your keys will never be trusted again... so why make it worse by offering to rekey the coins?

[hybridsole]

✂
As this is a widespread issue(beyond our collectibles) this means this is an issue with the private key generator we used for VIBGYOR.

We will share the details at 9 pm UK time today.

why did you come up with the idea of using a different key generator for the VIBGYOR series and why not always the same as for the previous editions?
unfortunately, that doesn't make sense to me

i am very curious about the further details...

i can say from personal experience how stressful the whole thing is for raritycheck now and i hope that he can refund all victims and present/clear up everything completely

It was pure luck. We wanted to try creating vanity addresses (1O) for VIBGYOR coins so we looked at multiple options.
In the end we didn’t end up creating vanity addresses
But still went with the software we trying to generate vanity addresses

We are currently trying to help every impacted customer.
Please note that we aim to reach out to every single one by Sunday evening.

Which vanitygen software did you use?  

Most people have used either this one: samr7/vanitygen: https://github.com/samr7/vanitygen  

Or the 10gic/vanitygen-plusplus? https://github.com/10gic/vanitygen-plusplus

Or was it some .EXE program you found somewhere?  Which operating system? How did you transfer the software to your airgapped PC?

[MoparMiningLLC]

I also created a thread on how I generate my keys as well.

   https://bitcointalk.org/index.php?topic=5416519.0

   For those people who do not trust software download off of the internet or do not own a mycelium entropy...there is another way that I suggest.

   Simply....buy a Trezor...generate a new seed and place the 12 word seed instead of a private key.

    You can use it this method as many times as you wish simply by resetting the Trezor. And yes of course you have to trust Trezor as well. If not then use a hardware wallet of your choice. Coldard is also another one I would trust especially the latest Q wallet which is all done air gapped!

     Or simply roll the dice. Lol

I believe you had one already - maybe several - as you have walked thru your process very clearly and meticulously several times.

as a note - many have peeled all their RC coins. When a coin maker has been compromised, one must assume all works are compromised.

we really need to hear about your key generation process and how it was different for the affected coins vs the ones you claim are safe.

and then a very detailed post on how exactly you generated keys for each project.

yes. We will provide details.
But Mopar this thread is for helping those who are impacted.

As this is a widespread issue(not only for VIBGYOR coins). This is an issue beyond our collectibles.
Please let’s use the other thread for root causing and keep this for helping those impacted.

and by widespread you mean what? if there is some larger issue, you need to state it now vs later - the sooner the better.

[DaveF]

We didn’t say our wallets were impacted.

I literally quoted the post in which you said that.

I believe they were referring to the fact that the bad keygen software used has resulted in BTC from other, non-collectibles wallets potentially held by normal, regular users who have nothing to do with this forum, being moved and stolen.

I'm baffled as to why they don't share the software at this stage, given that it could save other folks.

Many people who tried using a vanity gen software have been compromised. You should have stuck with your original software that worked on your first coins.

   I know you didn't end up using the vangen part but you still used their software. Did the swept funds go to any exchange? Perhaps you can reach out to them to freeze the funds. Always stick with what works. And in your case the first key generation code looks like it was solid.

   Also please post where you got that software so others do not fall in the same trap. And perhaps take legal action as well

Yes and yes, there are 2 well known pieces of vanity address generating software.

VanitySearch: https://bitcointalk.org/index.php?topic=5112311.0
And the older Vanitygen: https://bitcointalk.org/index.php?topic=25804

They are well known and people have been using them for YEARS with no issues.

Heck in 8 minutes on my old work laptop with NO GPU I got 3 keys for an address starting with "1V1BG" with a decent video card it should take no time at all.

Without a lot more detail we are all just guessing what happened here.

-Dave

[Amax16]

RC refunded me .001 btc for the swiped silver #49 for the record.

[rsincognito]

RC needs to dox the key-gen software.

I suspect it's backdoored with pregenerated rolling codes or pregenerated private keys.

It's not vanitygen or vanitysearch.

Prob some small-time dinky key-gen.

Why he has not doxxed it yet is beyond me. A real headscratcher.

makes me feel he's not doing it because he know something else happened that wasn't the software, but the longer he takes the more shady it looks. there is ZERO reasons not to share the name of the software for some of the professionals  on here to investigate further, news flash:  you don't have to say its was the softwares fault or even figure out if its secure or not for you to be able to take the time to share the softwares name and URL.    

[raghavsood]

An update from James @ S&B: All upcoming/ongoing Rarity Check lots have been withdrawn.

As before, the affected lots are:

https://auctions.stacksbowers.com/lots/view/3-1BAYV9/unfunded-2022-rarity-check-lost-coin-0001-bitcoin-serial-no-079-zinc-alloy-proof-68-deep-cameo-pcgs
https://auctions.stacksbowers.com/lots/view/3-1BAYX2/unfunded-2022-rarity-check-diy-lost-coin-0001-bitcoin-zinc-alloy-proof-69-deep-cameo-pcgs
https://auctions.stacksbowers.com/lots/view/3-1BAYAN/2022-rarity-check-lost-coin-0001-bitcoin-loaded-serial-no-100-zinc-alloy-ms-68-pl-icg
https://auctions.stacksbowers.com/lots/view/3-1BAYWK/unfunded-2022-rarity-check-diy-lost-coin-0001-bitcoin-zinc-alloy-proof-69-deep-cameo-pcgs
https://auctions.stacksbowers.com/lots/view/3-1BAYVO/unfunded-2022-rarity-check-diy-lost-coin-001-bitcoin-silver-proof-69-deep-cameo-pcgs
https://auctions.stacksbowers.com/lots/view/3-1BAYW5/unfunded-2022-rarity-check-diy-lost-coin-001-bitcoin-silver-proof-69-deep-cameo-pcgs
https://auctions.stacksbowers.com/lots/view/3-1BAYUE/unfunded-2022-rarity-check-vibgyor-0001-bitcoin-serial-no-8-orange-variety-silver-ms-70-pcgs
https://auctions.stacksbowers.com/lots/view/3-1BAYTX/unfunded-2022-rarity-check-vibgyor-001-bitcoin-serial-no-8-orange-variety-gilt-silver-ms-70-pcgs
https://auctions.stacksbowers.com/lots/view/3-1BAYUU/unfunded-2022-rarity-check-lost-coin-001-bitcoin-serial-no-79-silver-proof-69-deep-cameo-pcgs

[MoparMiningLLC]

maybe he had yogg create them for him...

[tweetious]

Hi raghav

We will not pull the eBay listing.
If someone orders we will send them coins with new holos and new keys.

We understand that not just other coins but our wallets are impacted but even we are trying to root cause it.
We are not 100% sure how this has happened.
But we think the key gen software we used is compromised.
Rest ensured as soon as we know we will provide details.

Since you "are not 100% sure how this has happened", how are you 100% certain that the newly generated keys will be 100% safe? (even if you use a different key generation method for creating the key pairs)