top | item 34086915

(no title)

preillyme | 3 years ago

Interesting... on 2022-12-13 the bounty has been claimed! Just a few hours after mprime1 shared the project in a comment on HackerNews, someone managed to drain the BTC.

https://github.com/mprimi/portable-secret/commit/3b22d2b42ba...

I'd love to hear more about this.

discuss

sfusato|3 years ago

See https://news.ycombinator.com/item?id=33980379

preillyme|3 years ago

Ah, that makes so much more sense. I had thought after looking at the wallet: https://www.blockchain.com/btc/address/bc1qd2jkf8lxp5d3y50gf... that it was "scrambled/tumbled/anonymized" by the attacker.

jtsiskin|3 years ago

No, they just changed it themselves? They sent from that old wallet (https://www.blockchain.com/explorer/addresses/btc/bc1qd2jkf8...) to the current wallet (https://www.blockchain.com/explorer/addresses/btc/bc1qpwq8lx...) ?

wnevets|3 years ago

I don't see any code changes in the commit history after that.

edit: oh, it looks like it wasn't actually drained.

matthewfcarlson|3 years ago

Right I'd love a post-mortem on it!

mprime1|3 years ago

Postmortem:

- Bitcoin is hard

- Wallets come with sophisticated anonymization built-in

- Don't create the bounty wallet 20 minutes before posting on HN (if that snafu had happened today while this post was on the front page, I would have looked pretty stupid)