Thread - Nostr Hypermedia

In December 2014, I was in NYC with my wife for the Blockchain(dot)info Christmas party. We played laser tag, had a great staff BBQ dinner, and went back to our Airbnb to get some sleep. I woke up to a nightmare. The creator of the site pushed an update to the wallet, which resulted in an entropy bug. Any user who created a wallet during a specific timeframe was generating insecure addresses. This made the funds very easy to steal. ~1000 BTC were stolen, but some were returned. How?! White hat legend, Johoe, is how. He posted about it on BitcoinTalk:

Reused R values again

He would go on to "steal" funds before the hacker(s) could take all of them, and he returned them to Blockchain. We obviously paid him a bounty. We were able to make up the difference and pay everyone back who was affected by this. Who ended up having to figure all that out? Me. I had to go through each individual case, use a complicated method to make sure I was refunding funds to the actual person who lost them, and then send the funds. Yes, I was given hundreds of Bitcoin and spent the next few weeks distributing them to the people impacted by this entropy issue. I still have nightmares. The burden of responsibility weighed heavily on me at the time. I was so stressed about screwing something up, triple and quadruple checking everything before moving on to the next step. This Coldcard situation is many magnitudes worse. I feel for those immediately impacted by this - the ones who lost their funds. The hardest part of working customer service at an early bitcoin hot wallet was explaining how Bitcoin transactions couldn't be reversed, and any lost funds were gone forever. I also feel for everyone at Coinkite. It's easy to hate them right now, but those guys are true Bitcoiners. A lot of them didn't need to keep working, and may very well vanish from the space after this. It sucks. Why risk your reputation and everything you've built if one little mistake in 5 year old code can ruin you? Why keep building when you can retire and enjoy life on a beach somewhere? I suspect many are thinking this very thought right now. Can't say I blame them.

Replies (5)

npub1am6m...0vhc 3 months ago

I still have hope there may be some way to recover the funds, but it is a small hope. But I still have my family, my health, and still thankful for knowing about Bitcoin. Just time to start over, and one day become a whole coiner again.

1 replies ↓

waxwing 3 months ago

Great anecdote, thanks for sharing. I had only one such incident, a mini-incident, when working on Joinmarket. We originally used a master secret generated from a user passphrase (before shifting to the more sane model of bip39 compatibility), and the code had a bug where a null password was actually accepted instead of rejected, resulting in an easily guessable master secret. When some guy used this he noticed some (thankfully small) deposits had been made in the past. Sheesh, it was really amateur hour back then, lol. I read his post, figured out what happened, and had no choice (really) but to immediately swipe his funds - because he'd posted it all on reddit for anyone to see. So then I had the bizarre experience of trying to figure out if I should get him to sign a message with the private key of the address he'd sent funds *from* .. before eventually realizing there was no point; literally the only sane thing to do was to send funds back to that address, although I first asked him if he still had access to it. What an unholy mess. Thankfully in my case people were mostly still using play amounts, this was 2015 iirc. So only about 1% of your experience. You really can't fuck around if you're generating people's wallets and those people are *ordinary users*. At least with Joinmarket almost all of them were very tech knowledgeable back then.

sedited 3 months ago

Johoe ❤️

Humility 3 months ago

Fuck man sorry. I felt this down my spine reading it. Keep the hope, glad to see you still believe in Bitcoin

Johnny thejohnnycrypto@primal.net 1 month ago

@npub1qex7...82qk the weeks after are the half of this story i had never heard, one person matching hundreds of refunds to the right people by hand. i read the johoe thread on bitcointalk when it happened and remember the relief, and i did not know until now that the cleanup landed on a single desk.