Warning for Bitcoin developers on AI testing

[BlackHatCoiner]

Just for the record for Bitcoin developers who test things with AI:

I was working on a Bitcoin wallet and considered automating my testing with Claude, so I instructed it to test X, Y, and Z on regtest.

It created wallets A, B, C, and D, and ran the tests fine. After it finished, it ran some tests on mainnet as well (because I wanted to test mainnet functionality as well). Without thinking twice, I sent 12k sats to one of those MAINNET wallets.

The funds were drained instantly.

DO NOT ever use an AI-generated wallet for mainnet testing. You will lose your funds. I am not sure what specifically went wrong (it likely generated a deterministic seed phrase that had already been used by others instead of using a secure system RNG).

Under any circumstances, DO NOT use AI for mainnet. Better yet, don't even use it on the same system where you keep your hot wallet.

[Cookdata]

DO NOT ever use an AI-generated wallet for mainnet testing.

Sorry for the loss but was there not a warning like "Do not deposit real Bitcoin into these wallets". If they are confidence in what they built, let it go public and this happened, then the company can be sued.

This is why I never believed the other day when a person posted on X claiming Claude helped him to recover password to his long lock wallet.dat and was able to move his Bitcoin.

[RGBTC]

DO NOT ever use an AI-generated wallet for mainnet testing. You will lose your funds. I am not sure what specifically went wrong (it likely generated a deterministic seed phrase that had already been used by others instead of using a secure system RNG).

I'm reminded of the Morse Code-based Prompt Injection exploit against Grok that ended up draining Bankrbot's wallet^(*). I believe some AIs still have similar vulnerabilities; with a little prompt trickery, anyone can extract all the keys in an AI's documentation, whether self-generated or user-submitted.


*) https://cyberpress.org/steal-200k-from-grok-and-bankrbot/

[hmbdofficial]

This a good warning actually, but I would also be careful about attributing the loss specifically to a “deterministic seed phrase that had already been used.”
I think the most important distinction to note is that an LLM (Large language  model) should never be trusted to generate anything in the like of entropy or key materials in the first place. A seed phrase isn’t just secure because it looks random, but it’s because it security comes from cryptographically secure randomness generated by a trusted CSPRNG (cryptographically secure pseudorandom number generator).

If an AI generated wallet used a hard-coded seed, predictable entropy, exposed private key or some other implementation mistakes, that wallet should never have been considered safe for mainnet fund in the first place.

I think if the wallets was generated using proper BIP39 or BIP32 procedures with OS-level CSPRNG entropy and the private key never got leaked your 12k sat would probably have not been drained.

It’s better to use retest/signet for experiments even though AI could help write or test wallet software, I think it’s important to keep security boundaries outside the model.

[Karl_3000]

AI generated wallet? I can not use it.

This is why I never believed the other day when a person posted on X claiming Claude helped him to recover password to his long lock wallet.dat and was able to move his Bitcoin.

With the image the person showed, the person was right, but Claude did not do the work, it was BTCrecover (an application that is well know to people on this forum for coin recovery) that Claude used to recover the coin. But I can not trust Claude with my money, I will prefer to use BTCrecover manually but the person may not know the recovery tool and Claude helped the person with it.

[Antidote47k]

I’m particularly interested whether Claude actually generated the seed phrases itself or it relied on the operating system’s cryptographically secure Random number generator. I don’t think LLMs should be treated as a source of entropy but if the code used a proper CSPRNG then maybe the problem lies elsewhere. I can think of several possibilities but none conclusive, it may be that it reused an example mnemonic, or probably a bug in the generated wallet code or something unintentionally exposed the private key, also did the generated address have any transaction history before you funded it?
If at some point you learn what really happened, I’d really appreciate it if you could update the thread. I believe it will be beneficial for anyone trying out AI and Bitcoin development, as it is significant to know the why as well as the lesson.

[ABCbits]

Did you ever check the security vulnerability created by the AI? My guess would be either weak RNG as entropy source or k nonce (when signing the TX).

[AB_Rahman]

Just for the record for Bitcoin developers who test things with AI:

I was working on a Bitcoin wallet and considered automating my testing with Claude, so I instructed it to test X, Y, and Z on regtest.

It created wallets A, B, C, and D, and ran the tests fine. After it finished, it ran some tests on mainnet as well (because I wanted to test mainnet functionality as well). Without thinking twice, I sent 12k sats to one of those MAINNET wallets.

The funds were drained instantly.

DO NOT ever use an AI-generated wallet for mainnet testing. You will lose your funds. I am not sure what specifically went wrong (it likely generated a deterministic seed phrase that had already been used by others instead of using a secure system RNG).

Under any circumstances, DO NOT use AI for mainnet. Better yet, don't even use it on the same system where you keep your hot wallet.

People should know by now that whatever you feed AI is out of your control and almost irretrievable. Never input any sensitive information you cannot afford to lose in AI for security and privacy purposes because it is an encyclopedia of data collection which may be processed and used as an output in many ways than one. Not just for Bitcoins, in any financial transactions you are dealing in, ensure your social security/account numbers are not given away in the process of giving a prompt to AI. Operate safely.

[gmaxwell]

You should always be using agentic AI in a VM with absolutely no access to anything you don't want it accessing, even better if its network access is confined to a VPN or Tor.  If you use a commercial service for inference you should also assume complete logs will be used against you or leaked arbitrarily or that hackers inside the inference provider may direct the actions.

crazy that the industry spent years constructing JS sandboxes to regulate code from even trusted sites and then people are YOLO giving access to their whole computer to random AI companies.

But thanks-- now I have another point to name as an example of why 'seed word' based wallets blow--  LLMs may generate them and will generate predictable ones.  Bitcoin Core user not impacted.

[BlackHatCoiner]

Sorry for the loss but was there not a warning like "Do not deposit real Bitcoin into these wallets". If they are confidence in what they built, let it go public and this happened, then the company can be sued.

The AI models do and can make mistakes. It's up to the developer to control them. In this case, it was completely my fault.

A seed phrase isn’t just secure because it looks random, but it’s because it security comes from cryptographically secure randomness generated by a trusted CSPRNG (cryptographically secure pseudorandom number generator).

Correct, but theoretically an LLM can call a function that uses a CSPRNG; it simply chose not to. In any case, never trust your guts with it. It may simply skip it.

Did you ever check the security vulnerability created by the AI? My guess would be either weak RNG as entropy source or k nonce (when signing the TX).

It does not have to do with k nonce, because I did not make any transactions spending from the wallet. I only sent BTC to the wallet, and they were immediately drained. I did not check exactly what the issue is, but I'm certain Claude simply guessed the seed phrase (as in "guessed the next word") when I asked to generate the wallets. It did not use a CSPRNG or a standard way to create the wallet (such as with bitcoin-cli).

Considering the technology behind the LLM is stochastic, it's entirely plausible some kid out there (or 35-year old loser who stays in his mom's basement) has gathered millions of seed phrases the AI is likely to "guess" and is just waiting for his bots army to collect the money of the unfortunates.

Edit: Let me share you the TXID of the drain: f825ac515b8e1f1a3c93975bb445bb9ffd095be6e98aca70052b548678b5ab20. The attacker's address is bc1q5mran5zu4rdzv4ced58hxmk6jldm28hkpj8888 and apparently, there are a few other people who've lost money too.