RarityCheck VIBGYOR gilded #12 swept yesterday.

[raritycheck]

Looks like the issue is with the way private keys were generated.

you use an airgapped system correct? if you are using a system that is online, then all your coins are at risk and you need to cease selling any coins and recall all of them - I hope it is not this serious and I am not sure if it was, that you would say so.

Considering your statements on how your keys are generated when previously asked:

Following all the suggestions, we are buying a one time only Printer for printing keys (wired) and one time use-only computer for creating keys.

Thanks
Team RC

so if it is a one use system, was it online? did you lose control of it?

We still posses all the hardware used.
We will share exact details of what we think has happened.
None of the used hardware has ever been connected to the internet.
And the computers  used are also wiped out.

As this is a widespread issue(beyond our collectibles) this means this is an issue with the private key generator we used for VIBGYOR.

We will share the details at 9 pm UK time today.

[raghavsood]

Looks like the issue is with the way private keys were generated.

you use an airgapped system correct? if you are using a system that is online, then all your coins are at risk and you need to cease selling any coins and recall all of them - I hope it is not this serious and I am not sure if it was, that you would say so.

Considering your statements on how your keys are generated when previously asked:

Following all the suggestions, we are buying a one time only Printer for printing keys (wired) and one time use-only computer for creating keys.

Thanks
Team RC

so if it is a one use system, was it online? did you lose control of it?

We still posses all the hardware used.
We will share exact details of what we think has happened.
None of the used hardware has ever been connected to the internet.
And the computers  used are also wiped out.

As this is a widespread issue(beyond our collectibles) this means this is an issue with the private key generator we used for VIBGYOR.

We will share the details at 9 pm UK time today.

Is there a reason you are unable to share the details of the keygen software used immediately?

[cygan]

✂
As this is a widespread issue(beyond our collectibles) this means this is an issue with the private key generator we used for VIBGYOR.

We will share the details at 9 pm UK time today.

why did you come up with the idea of using a different key generator for the VIBGYOR series and why not always the same as for the previous editions?
unfortunately, that doesn't make sense to me

i am very curious about the further details...

i can say from personal experience how stressful the whole thing is for raritycheck now and i hope that he can refund all victims and present/clear up everything completely

[raritycheck]

✂
As this is a widespread issue(beyond our collectibles) this means this is an issue with the private key generator we used for VIBGYOR.

We will share the details at 9 pm UK time today.

why did you come up with the idea of using a different key generator for the VIBGYOR series and why not always the same as for the previous editions?
unfortunately, that doesn't make sense to me

i am very curious about the further details...

i can say from personal experience how stressful the whole thing is for raritycheck now and i hope that he can refund all victims and present/clear up everything completely

It was pure luck. We wanted to try creating vanity addresses (1O) for VIBGYOR coins so we looked at multiple options.
In the end we didn’t end up creating vanity addresses
But still went with the software we trying to generate vanity addresses

We are currently trying to help every impacted customer.
Please note that we aim to reach out to every single one by Sunday evening.

[raritycheck]

i can say from personal experience how stressful the whole thing is for raritycheck now and i hope that he can refund all victims and present/clear up everything completely

Hi Cygan

Thank you for the kind words. Indeed very stressful. As we are also working with version 2 of the hole coin series.
Please share your experience. Or pm if possible.

[cygan]

✂
Please share your experience. Or pm if possible.

i better make it public, so that the whole procedure here remains transparent, because i think that among all the collectibles makers there should also be a certain cohesion and you should also support each other (up to a certain point, because in some cases the whole thing can turn out to be a scam in the end).

so at the beginning of last year i started to refind all of coldkey's victims, i created this extra thread to make the whole thing visible to everyone and also to present it according to a certain procedure. this way i was also able to identify/fix certain ambiguities but also scammers (who then wrote to me via pm) more quickly

[Jambo USA]

Any info on if the hole coins were generated using the same method? Looks like only 5 or 6 of em were funded to begin with and it seems one person has already swept their funds.

Mainly curious because I just landed in Switzerland for work and am wondering if I should be calling the wife or one of my buddies and trying to walk them through the process of redeeming a coin or not 😂

[raritycheck]

✂
Please share your experience. Or pm if possible.

i better make it public, so that the whole procedure here remains transparent, because i think that among all the collectibles makers there should also be a certain cohesion and you should also support each other (up to a certain point, because in some cases the whole thing can turn out to be a scam in the end).

so at the beginning of last year i started to refind all of coldkey's victims, i created this extra thread to make the whole thing visible to everyone and also to present it according to a certain procedure. this way i was also able to identify/fix certain ambiguities but also scammers (who then wrote to me via pm) more quickly

Oh sorry to hear this.

[LoyceV]

here you go :  https://ibb.co/2Fg4Tm5

The link isn't loading. Try Talkimg.com?

_{These private keys are garbage, awful work indeed.}

Was that printed on an old inkjet printer? That's pathetic!
I could type it correctly at first try though, so that's something. But any cheap dumb laser printer would provide a sharp font.

What I can say and speak on is that I wish he kept a copy of his keys cuz I can’t decipher SHIT from his fucking lost coin series. Holy fuck!! Use some better ink, larger letters… anything cuz this btc is probably lost. Even using a 10x magnifying glass.

Try a high-res picture (ideally on an offline camera). Note that there is no l ^{(lower case L)}, I ^{(upper case i)}, 0 ^(zero) and O ^{(upper case o)} in BASE58.

We understand that not just other coins but our wallets are impacted but even we are trying to root cause it.
We are not 100% sure how this has happened.
But we think the key gen software we used is compromised.

I've seen the question how keys were generated many times, but it hasn't been answered. I'm very curious to see this! Security creating private keys is the very basics of creating loaded coins. It's even very easy to do. Why are you not sharing how you did it?
If your own wallets are also impacted, that means you didn't use a dedicated computer just for creating private keys.

It was pure luck. We wanted to try creating vanity addresses (1O) for VIBGYOR coins so we looked at multiple options.
In the end we didn’t end up creating vanity addresses
But still went with the software we trying to generate vanity addresses

What software is that?

[raritycheck]

here you go :  https://ibb.co/2Fg4Tm5

The link isn't loading. Try Talkimg.com?

_{These private keys are garbage, awful work indeed.}

Was that printed on an old inkjet printer? That's pathetic!
I could type it correctly at first try though, so that's something. But any cheap dumb laser printer would provide a sharp font.

What I can say and speak on is that I wish he kept a copy of his keys cuz I can’t decipher SHIT from his fucking lost coin series. Holy fuck!! Use some better ink, larger letters… anything cuz this btc is probably lost. Even using a 10x magnifying glass.

Try a high-res picture (ideally on an offline camera). Note that there is no l ^{(lower case L)}, I ^{(upper case i)}, 0 ^(zero) and O ^{(upper case o)} in BASE58.

We understand that not just other coins but our wallets are impacted but even we are trying to root cause it.
We are not 100% sure how this has happened.
But we think the key gen software we used is compromised.

I've seen the question how keys were generated many times, but it hasn't been answered. I'm very curious to see this! Security creating private keys is the very basics of creating loaded coins. It's even very easy to do. Why are you not sharing how you did it?
If your own wallets are also impacted, that means you didn't use a dedicated computer just for creating private keys.

It was pure luck. We wanted to try creating vanity addresses (1O) for VIBGYOR coins so we looked at multiple options.
In the end we didn’t end up creating vanity addresses
But still went with the software we trying to generate vanity addresses

What software is that?

We didn’t say our wallets were impacted.
Our own coins (we keep some reserves for sale etc) were impacted.

[LoyceMobile]

We didn’t say our wallets were impacted.

I literally quoted the post in which you said that.

[raritycheck]

We didn’t say our wallets were impacted.

I literally quoted the post in which you said that.

Apologies. We meant our own RC VIBGYOR coins.

[raghavsood]

We didn’t say our wallets were impacted.

I literally quoted the post in which you said that.

I believe they were referring to the fact that the bad keygen software used has resulted in BTC from other, non-collectibles wallets potentially held by normal, regular users who have nothing to do with this forum, being moved and stolen.

I'm baffled as to why they don't share the software at this stage, given that it could save other folks.

[krogoth]

Many people who tried using a vanity gen software have been compromised. You should have stuck with your original software that worked on your first coins.

   I know you didn't end up using the vangen part but you still used their software. Did the swept funds go to any exchange? Perhaps you can reach out to them to freeze the funds. Always stick with what works. And in your case the first key generation code looks like it was solid.

   Also please post where you got that software so others do not fall in the same trap. And perhaps take legal action as well

[rsincognito]

Lost coin V1 silver #3 looks very suspicious with transactions.
Looks like it might have been hit as well, unless someone here on the boards swept it for safety.

Perhaps it was swept by a member: VIBGYOR gilded 82 was swept at the same time.

It was me,  I swept 4 coins yesterday , two  was able to read with a high-end magnifying glass with a light in a dark room, the other two even with the magnifying glass I had to reach out to Mopar for some help. it’s nice to see the creator is on here  trying to make things right. But compromised keys or not, I can’t stress enough how extremely aggravated and disappointment I am with the quality and technique used for the font, ink and printing of the private keys. Due to this HUGE ERROR in judgment, I personally will not be collecting any coins from RarityCheck and will be selling a majority of mine on the forum in the coming days. But I want to say again I’m impressed with the companies response so far in trying to make things right, I  don’t want that to be understated.  

  But at the end of the day: Compromised = Compromised

Another example of a very poor printed private key from yesterdays debacle:


I think creators should from here on out post a sample pic of what their private keys look like so buyers know what they are getting into imo

I wish everyone who was affected from this a positive outcome along with the creator.

[krogoth]

Lost coin V1 silver #3 looks very suspicious with transactions.
Looks like it might have been hit as well, unless someone here on the boards swept it for safety.

Perhaps it was swept by a member: VIBGYOR gilded 82 was swept at the same time.

It was me,  I swept 4 coins yesterday , two  was able to read with a high-end magnifying glass with a light in a dark room, the other two even with the magnifying glass I had to reach out to Mopar for some help. it’s nice to see the creator is on here  trying to make things right. But compromised keys or not, I can’t stress enough how extremely aggravated and disappointment I am with the quality and technique used for the font, ink and printing of the private keys. Due to this HUGE ERROR in judgment, I personally will not be collecting any coins from RarityCheck and will be selling a majority of mine on the forum in the coming days. But I want to say again I’m impressed with the companies response so far in trying to make things right, I  don’t want that to be understated.  

  But at the end of the day: Compromised = Compromised



I think creators should from here on out post a sample pic of what their private keys look like so buyers know what they are getting into imo

   And that's why I created this thread yesterday

   https://bitcointalk.org/index.php?topic=5505467.0

    I even loaded it with Bitcoin.  

    https://mempool.space/address/1BzYG6KmHvhi8RiLuVDCDd94FFsCGbVPet

    So be my guest everyone....please try and sweep

[raghavsood]

Given the explanation and partial information provided so far, I've removed the alerts from Rarity Check creator page and non-VIBGYOR series.

Rarity Check VIBGYOR Orange Set Gilded and Rarity Check VIBGYOR Orange Set Silver will continue to show the Compromised Keys alert on both the series page and individual item listings.

[krogoth]

 I also created a thread on how I generate my keys as well.

   https://bitcointalk.org/index.php?topic=5416519.0

   For those people who do not trust software download off of the internet or do not own a mycelium entropy...there is another way that I suggest.

   Simply....buy a Trezor...generate a new seed and place the 12 word seed instead of a private key.

    You can use it this method as many times as you wish simply by resetting the Trezor. And yes of course you have to trust Trezor as well. If not then use a hardware wallet of your choice. Coldard is also another one I would trust especially the latest Q wallet which is all done air gapped!

     Or simply roll the dice. Lol

[minerjones]

I strongly encourage the team to share details with folks who have the background and skills to help get to the bottom of this.

The refunds and efforts to make people whole are commendable and important, but based on the on-chain activity there are more wallets at risk than just collectibles.

I'm volunteering my time and effort in helping to track this down, but it is extremely important that the RC team provides the information and background for the key generation process, and how it differs from that of their other series.

I have separately dropped them a PM to ask for the same information, in the event that (for whatever reason) they are unwilling to share it publicly at this stage.

Hi raghav

We will not pull the eBay listing.
If someone orders we will send them coins with new holos and new keys.

We understand that not just other coins but our wallets are impacted but even we are trying to root cause it.
We are not 100% sure how this has happened.
But we think the key gen software we used is compromised.
Rest ensured as soon as we know we will provide details.

From the looks of it you generated keys with the computer still on-line

My recommendation is stop making keys immediately, refund everyone impacted and just send out replacement holograms

Regardless of what you are trying to do to make this right, your keys will never be trusted again... so why make it worse by offering to rekey the coins?

[hybridsole]

✂
As this is a widespread issue(beyond our collectibles) this means this is an issue with the private key generator we used for VIBGYOR.

We will share the details at 9 pm UK time today.

why did you come up with the idea of using a different key generator for the VIBGYOR series and why not always the same as for the previous editions?
unfortunately, that doesn't make sense to me

i am very curious about the further details...

i can say from personal experience how stressful the whole thing is for raritycheck now and i hope that he can refund all victims and present/clear up everything completely

It was pure luck. We wanted to try creating vanity addresses (1O) for VIBGYOR coins so we looked at multiple options.
In the end we didn’t end up creating vanity addresses
But still went with the software we trying to generate vanity addresses

We are currently trying to help every impacted customer.
Please note that we aim to reach out to every single one by Sunday evening.

Which vanitygen software did you use?  

Most people have used either this one: samr7/vanitygen: https://github.com/samr7/vanitygen  

Or the 10gic/vanitygen-plusplus? https://github.com/10gic/vanitygen-plusplus

Or was it some .EXE program you found somewhere?  Which operating system? How did you transfer the software to your airgapped PC?