Researchers ‘hack time’ to recover $3 million bitcoin wallet

Support truly
independent journalism

Support Now

Find out moreClose

Our mission is to deliver unbiased, fact-based reporting that holds power to account and exposes the truth.

Whether $5 or $50, every contribution counts.

Support us to deliver journalism without an agenda.

Louise Thomas

Editor

Security researchers have cracked a password to recover over $3 million of bitcoin that had been stuck in a crypto wallet for 11 years.

Electrical engineer Joe Grand, who goes by the handle ‘Kingpin’, was hired to hack into an encrypted file holding 43.6 BTC, which had been held there since 2013. The cryptocurrency was protected by a password created by a random password generator called Roboform, however the password had long-since been lost.

The password was a series of 20 upper and lower case letters, as well as numbers, that had been designed to be as difficult as possible to crack.

“I generated the password, I copied it, put it in the passphrase of the wallet, and also in a text file that I then encrypted,” the wallet’s owner, who chose to remain anonymous, said in a video published by Mr Grand.

The password was lost after the encrypted part of his computer that held it became corrupted. At the time, the bitcoin was worth a couple of thousand euros, which the wallet’s owner described as “painful but OK”.

Over the next decade, however, the lost bitcoin grew into a fortune as the price of bitcoin rose by more than 20,000 per cent, causing its owner to reach out to Mr Grand.

After initially turning down the job, Mr Grand eventually agreed to try to recover the funds after coming up with a novel method to hack the initial password generator.

Mr Grand used a reverse engineering tool developed by the US National Security Agency (NSA) to disassemble the password generator’s code.

“In a perfect world, when you generate a password with a password generator, you expect to get a unique, random output each time that no one else has. [But] in this version of RoboForm, it was not the case,” Mr Grand said.

“While RoboForm’s passwords appear to be randomly generated, they’re not. With the older versions of this software, if we can control the time, we can control the password.”

He figured out that if he was able to trick the system that it was the moment in 2013 when the password was generated, then it would recreate the same password.

With only a rough idea of when the password was generated, Mr Grand worked with his colleague Bruno to generate millions of potential passwords in order to eventually crack it.

The RoboForm password generator has since updated its platform to improve the randomness of its tool, meaning the time-based hacking approach no longer works with passwords created after 2015.

Mr Grand hopes to now help more people locked out of their crypto wallets, though said new approaches may be needed.

He said: “If this project required hacking time, what dimension are we going to have to hack next?”

The Independent has reached out to RoboForm for comment.