Two Password Attempts Away From Losing $620 Million

[I_Anime]

San Francisco based programmer Stefan Thomas has over $620 million in bitcoin locked on an Ironkey USB drive . Stefan was paid 7,002 BTC in 2011 ( during the early stage of bitcoin) for making an educational video . And he lost the password in 2012 and has used use 8 of his 10 allowed attempts , leaving only two attempts left before the device will encrypts its contents forever (permanently locks itself).
Source: https://x.com/bitcoin_teddy/status/2005287811197358238?s=46

Just as we have “Not your key, Not your coins “  same way we have “Lose your keys, lose your coins”  . Meaning once you lose your key you can never get your coins back unless the keys are recovered. Many would be like the bitcoin is still there because he could not access it, yes there’s chances of him selling before the price reaching this range there’s still chances that he would held till now , both ways is still sad .

All we can do is to learn from such , by keeping one keys safe because a time will come when others are still going to post things like this , stating (I bought a certain amount of bitcoin in the year 2023 , I misplaced the key) . So we should be careful so that won’t be us , I just hope Stefan Thomas will be able to access his coins again .

[mcdouglasx]

It's possible that this type of key could be cloned or backed up in the future, thus allowing for infinite attempts. I think it's best to leave it as is; who knows, maybe in the future it could be recovered by brute force, bypassing the attempt limit.

So Thomas just has to wait. Technology advances, and things that are secure today may be obsolete in the future.

I think there are already companies working on this: https://www.binance.com/en/square/post/27679480118153

[mikel_012]

It's possible that this type of key could be cloned or backed up in the future, thus allowing for infinite attempts. I think it's best to leave it as is; who knows, maybe in the future it could be recovered by brute force, bypassing the attempt limit.

So Thomas just has to wait. Technology advances, and things that are secure today may be obsolete in the future.

I think there are already companies working on this: https://www.binance.com/en/square/post/27679480118153

This is not possible. IronKey USB is a hardware-encrypted flash drive with AES 256-bit encryption and it has brute-force lockout. It's not possible to backup or clone a hardware so he only has 2 shots and if he misses both tries with a wrong password he will lose everything no questions asked.

To wait for that he needs to spend years and if anyone does anything wrong it's lost forever. Messing with hardware is dangerous because anything can fry the chips or break the drive. Clearly it's better than try two last times and lose the bitcoin forever, but the chances are still very low with the level of encryption that it has

[BitMaxz]

Honestly, I am against using too complicated a drive to save wallets like this with a 10-password attempt limit. I'm more confident to a hard drive that I encrypted using BitLocker with a long password and keep always offline. At least you still have many chances to brute your drive or recover it using the recovery key if the password doesn't work anymore (having a multiple copy always saves us in the future).

This is not possible. IronKey USB is a hardware-encrypted flash drive with AES 256-bit encryption and it has brute-force lockout. It's not possible to backup or clone a hardware so he only has 2 shots and if he misses both tries with a wrong password he will lose everything no questions asked.

To wait for that he needs to spend years and if anyone does anything wrong it's lost forever. Messing with hardware is dangerous because anything can fry the chips or break the drive. Clearly it's better than try two last times and lose the bitcoin forever, but the chances are still very low with the level of encryption that it has

Right now there's no way to clone that encrypted USB drive. It was a military-grade encrypted drive, but since it was created by a human, it means there's still a chance that someone could develop software that can bypass the password limitation or can clone this drive even if the drive was built to prevent those from happening.
Always remember that technology is always developing, so maybe in the future, if the owner of that drive is still alive, there's a chance that someone can develop software that could entirely take data from the drive without taking the remaining 2 attempts.

[mcdouglasx]

This is not possible. IronKey USB is a hardware-encrypted flash drive with AES 256-bit encryption and it has brute-force lockout. It's not possible to backup or clone a hardware so he only has 2 shots and if he misses both tries with a wrong password he will lose everything no questions asked.

To wait for that he needs to spend years and if anyone does anything wrong it's lost forever. Messing with hardware is dangerous because anything can fry the chips or break the drive. Clearly it's better than try two last times and lose the bitcoin forever, but the chances are still very low with the level of encryption that it has

According to what I read, the company Unciphered, which demonstrated the ability to recover data from a USB drive of the same model Thomas used, was supported by Wired magazine, which sent them a USB drive locked with a secret phrase. They were able to extract the phrase to prove their method works.

However, it helps that Thomas rejected their offer due to contracts with other recovery services, probably.

Remember that this USB drive is over a decade old; the technology isn't the same as today's. Back then, the chips were larger compared to current ones and much easier to manipulate.

[Josefjix]

That time around 2011, were there no decentralized wallet that gives out seed phrase or PK, and why password?
If the only entry key is through password, then there should be need to click forget password while recovering it through the mail used.

Unless you might be meaning that the PK is misplaced, seed phrase is nowhere to be found, while the only app available to access his Bitcoin is only via the ones in the OP, where he needs password to access it and then also access his PK.

[mikel_012]

This is not possible. IronKey USB is a hardware-encrypted flash drive with AES 256-bit encryption and it has brute-force lockout. It's not possible to backup or clone a hardware so he only has 2 shots and if he misses both tries with a wrong password he will lose everything no questions asked.

To wait for that he needs to spend years and if anyone does anything wrong it's lost forever. Messing with hardware is dangerous because anything can fry the chips or break the drive. Clearly it's better than try two last times and lose the bitcoin forever, but the chances are still very low with the level of encryption that it has

According to what I read, the company Unciphered, which demonstrated the ability to recover data from a USB drive of the same model Thomas used, was supported by Wired magazine, which sent them a USB drive locked with a secret phrase. They were able to extract the phrase to prove their method works.

However, it helps that Thomas rejected their offer due to contracts with other recovery services, probably.

Remember that this USB drive is over a decade old; the technology isn't the same as today's. Back then, the chips were larger compared to current ones and much easier to manipulate.

If you think about, sometimes him missing the password can be a good thing. If they get his seed in 5 years bitcoin could be worth a lot more and he could be worth billions and not $620 million like today. In 2011 the price was a lot lower so he would have cashed out for less than millions

I'm only worried what this can do to the bitcoin price if he gets and now has $10 billion to sell in the market and get set for life

[coinrifft]

He has been offered by security firm (https://www.unciphered.com/) to unlock it.

Now, after months of work, Unciphered's hackers believe they can open Thomas' locked treasure chest, and they're ready to use their secret cracking technique to do it. “We were hesitant to reach out to him until we had a full, provable, reliable attack,” says Smith, who asked WIRED not to reveal his real name due to the sensitivities of working with secret hacking techniques and very large sums of cryptocurrency. “Now we’re in that place.”

But he refuses, citing:

Thomas had already made a “handshake deal” with two other cracking teams a year earlier, he explained. In an effort to prevent the two teams from competing, he had offered each a portion of the proceeds if either one could unlock the drive. And he remains committed, even a year later, to giving those teams more time to work on the problem before he brings in anyone else—even though neither of the teams has shown any sign of pulling off the decryption trick that Unciphered has already accomplished.

https://www.wired.com/story/unciphered-ironkey-password-cracking-bitcoin/

[Darker45]

This is worth a documentary or perhaps even a movie. The plot seems better than Jennifer Garner's "One Attempt Remaining", which is also focused on a forgotten password that would unlock millions worth of crypto. Plus it's true to life.

It seems Stefan isn't desperate. He's probably optimistic that the teams he's partnered with will be able to recover the password for him. It's been more than a year with no positive result yet, but he's still refusing Unciphered's offer to get onboard. Perhaps the confidence is still there. Once lost, he still has remaining options. It seems he'll get his coins back, or so I hope. This is also a test to IronKey's security features.

[buwaytress]

Don't think I'd ever wait to 8 attempts before contacting experts haha. Probably 3, maybe 5 at most. If I don't get it right the first two or three times, I'm then pretty sure I'm far from being correct.

That time around 2011, were there no decentralized wallet that gives out seed phrase or PK, and why password?

Any decent "decentralised" wallet (I guess you mean self-custodial) should still allow you to encrypt with a password. What he's gone and done is just store on a encrypted usb, cold storaged practically.

[SilverCryptoBullet]

San Francisco based programmer Stefan Thomas has over $620 million in bitcoin locked on an Ironkey USB drive . Stefan was paid 7,002 BTC in 2011 ( during the early stage of bitcoin) for making an educational video . And he lost the password in 2012 and has used use 8 of his 10 allowed attempts , leaving only two attempts left before the device will encrypts its contents forever (permanently locks itself).

This story is very old one and it has been repeatedly posted many times.

Just as we have “Not your key, Not your coins “  same way we have “Lose your keys, lose your coins”  . Meaning once you lose your key you can never get your coins back unless the keys are recovered. Many would be like the bitcoin is still there because he could not access it, yes there’s chances of him selling before the price reaching this range there’s still chances that he would held till now , both ways is still sad .

That's true.

We must choose storage methods and tools that allowing us to have mnemonic seeds, private keys so that we have full controls of our cryptocurrencies and we only can have it with non-custodial wallets. We must prioritize to use open-source wallets than close-source wallets.

After learning enough about wallets, choose good open-source non-custodial wallets to use, we must use them rightly and must always have wallet backups for recoveries later.

From wallets' PIN code, passwords to mnemonic seeds and wallet files, we must have all necessary backups for wallet access and wallet recoveries later.
How to back up a seed phrase?
Cryptocurrency security checklist.

[GreatArkansas]

Don't think I'd ever wait to 8 attempts before contacting experts haha. Probably 3, maybe 5 at most. If I don't get it right the first two or three times, I'm then pretty sure I'm far from being correct.

That time around 2011, were there no decentralized wallet that gives out seed phrase or PK, and why password?

Any decent "decentralised" wallet (I guess you mean self-custodial) should still allow you to encrypt with a password. What he's gone and done is just store on a encrypted usb, cold storaged practically.

I'm curious why there's a limit on password inputs to open your wallet? This is my first time seeing a wallet like this. What will happen if all password inputs fail? Like it will have self-destruct?
Or the seed phrases or private keys are inside of the usb, like stored as raw texts?

[blockman]

He's got the last two shots before he finally say goodbye to his coins forever. I don't think that he'll ever recover those coins and will be considered gone forever.

But he refuses, citing:

Thomas had already made a “handshake deal” with two other cracking teams a year earlier, he explained. In an effort to prevent the two teams from competing, he had offered each a portion of the proceeds if either one could unlock the drive. And he remains committed, even a year later, to giving those teams more time to work on the problem before he brings in anyone else—even though neither of the teams has shown any sign of pulling off the decryption trick that Unciphered has already accomplished.

https://www.wired.com/story/unciphered-ironkey-password-cracking-bitcoin/

So, there's no hope even with those techniques that they'll be able to pull that one out. No signs of being able to unlock that wallet. I guess all he can do is to maximize his exposure now and become someone as a bitcoin celebrity.

[Adbitco]

All we can do is to learn from such , by keeping one keys safe because a time will come when others are still going to post things like this , stating (I bought a certain amount of bitcoin in the year 2023 , I misplaced the key) . So we should be careful so that won’t be us , I just hope Stefan Thomas will be able to access his coins again .

Of course this is a common case we do face over here for long now and people do forget and misplaces their keys.. realistically when people are too careless about their information, their keys and seed phrase. Maybe they never had any idea about the details they were using to store and save their data. Well, who knows if that he has his way to that wallet if he could had still be holding any coin till date? No! And I don't think this is possible because there are people who hold then and when the price change a bit they also follow made huge amount as then without them knowing that bitcoin would be a global name.

[davis196]

There were many horror stories like this one and there will be more to come in the future.
Maybe the whole concept of "not your keys, not your coins" scares away many not-so-tech savvy people from Bitcoin. The responsibility tied to having your wealth in your own wallet is one of the factors, which makes Bitcoin interesting, but it also stops mass crypto adoption.
Maybe it's easier to rely on a third party to take care of your funds(bank, pension fund, hedge fund or whatever).
If this Stefan Thomas guy had access to his BTC 10 years ago, he would most likely sell everything at 400 USD per BTC, so it makes me think that he is screwed and lucky at the same time right now. The chances of him getting access to his BTC are still high.

[ColdLava40]

Over time we realise that losing of keys is something that will continue to occur in the crypto space. Many big investors have been through these case scenario and to me they are the types that would do anything to make sure their seeds are very safe.

At some point they just have to let go and move on because there's nothing they can do. The more you ponder over lost coins the more time you've wasted instead of getting back on your feet..

[Charles-Tim]

All we can do is to learn from such , by keeping one keys safe because a time will come when others are still going to post things like this , stating (I bought a certain amount of bitcoin in the year 2023 , I misplaced the key) . So we should be careful so that won’t be us , I just hope Stefan Thomas will be able to access his coins again .

Good advice, this will be a lesson to some people.

But the coin was worth just $2000 when he received it, but now the coin is worth over $600 million. It is very possible that he did not know that bitcoin price can increase significantly like how it happened.

Most people that lost bitcoin have such experience also. It is good not to see anything as not that relevant.

[Catenaccio]

But the coin was worth just $2000 when he received it, but now the coin is worth over $600 million. It is very possible that he did not know that bitcoin price can increase significantly like how it happened.

Most people that lost bitcoin have such experience also. It is good not to see anything as not that relevant.

Nobody can predict about the future but this story of Thomas gives us some valuable messages not only about security, backup importance but also how we should plan our take profit actions.

If we believe that market prediction is impossible to do it accurately, and we never can be sure about the future, with taking profit, it's nothing bad to do that. However, we should reserve like 10% or 20% of an asset for unpredictable future and we can take profit 80% or 90% of our bitcoin portfolio, while the remaining part will be stored and reserved for far future taking profit.

[retreat]

Knowing that he had used 8 out of 10 attempts to open the USB, I knew how he felt, he must have felt frustrated and anxious, because he was so close to failure and his encryption key could be destroyed at any time and make it useless. But that's the risk of choosing such a complicated and very secure storage like that USB, but maybe he used to see that Bitcoin should be stored in such a secure storage, even though it ended up being a burden for him.

[Alone055]

He has been offered by security firm (https://www.unciphered.com/) to unlock it.

Now, after months of work, Unciphered's hackers believe they can open Thomas' locked treasure chest, and they're ready to use their secret cracking technique to do it. “We were hesitant to reach out to him until we had a full, provable, reliable attack,” says Smith, who asked WIRED not to reveal his real name due to the sensitivities of working with secret hacking techniques and very large sums of cryptocurrency. “Now we’re in that place.”

But he refuses, citing:

Thomas had already made a “handshake deal” with two other cracking teams a year earlier, he explained. In an effort to prevent the two teams from competing, he had offered each a portion of the proceeds if either one could unlock the drive. And he remains committed, even a year later, to giving those teams more time to work on the problem before he brings in anyone else—even though neither of the teams has shown any sign of pulling off the decryption trick that Unciphered has already accomplished.

https://www.wired.com/story/unciphered-ironkey-password-cracking-bitcoin/

Unciphered will have to wait until the other two teams or companies get tired trying to decrypt the device and fail, because if they have been trying for a year or more already and see no progress, it will probably not be done by them, and then Thomas will have to make a deal with Unciphered and allow them to try, and who knows? They might be able to unlock it, and even if he gives away a few million dollars, he will still have a lot of money after that.

Imagine having 600 million and losing it because of a piece of paper, this is why I keep my seeds in like three different places, but even then I get paranoid I will forget where I hid them haha

Having multiple backups for your seed phrase is always a good idea, but one must make sure that the places where they save those backups are safe and will at least keep them safe for a few years and then they could change the locations if necessary. The problem with Thomas probably is that he doesn't have a copy of his seed phrase, so his only way to access his bitcoins is by unlocking the USB device, which is why he has no other option than to get the wallet or device decrypted.