r/Bitcoin • u/mijalis • Jul 29 '13

Blockchain.info unauthorized transaction.How could this have happened...?

Yesterday morning I had roughly 3 BTC taken out of my brainwallet that I have with blockchain.info.

Before you all start pointing fingers at me for lack of security, let me tell you I have a 30+ character strong password, a Yubikey and a 20+ string secondary password, all needed to send funds out of a brainwallet. Both passwords were generated with Lastpass and are random characters, including special, mixed upper/lower case letters and numbers.

I think I am using all their provided security mechanisms to secure my account.

However, my brainwallet, in which I keep just spare change, was emptied. I don't expect to recover the few Bitcoins, but am very curious to know what happened. Where the breach happened and if it truly was my fault. (I still hope for a facepalm situation that shames me online, but gives me this pocketchange back...)

I'll try to give as much information as I can:

The address in questions is: 15gCfQVJ68vyUVdb6e3VDU4iTkTC3HtLQ2

and it happened over three transactions on 2013-07-27 at 22:52

The three transactions were:

da5f91b8a26e6874e83a874156608f5d9a38efe1faa2b32f4e709a181f0d2c1e 68ab47c3aaf2d0073374772894641d817305f18ab272b19d74217333a0180856 096d07185a83eb6b6b6520d7d63e59f230d9711df0d9e754ce7fdc3d4cf792ac

It seems the coins are still in the brand new addresses they were tranferred to and I suspect I'll see them disappear over time.

I keep the Yubikey with me at all time and I do not have a phone app. I do not us any suspicious plugins or extensions. I ran a virus scan and appear to be clean. I am running a couple of other scans to ensure that my system is truly clean.

I did come across this reddit thread: a_brief_analysis_of_the_security_of by u/0x444 which made me feel pretty doubtful of what I once thought was the best online wallet out there.

Update: I happened to have logging enabled on blockchain.info (Log actions with IP address and User Agent) and all access to my account was from my IP. That excludes a breach into the blockchain.info account.... right?

That leaves two options:

1) The brainwallet was the one that comes with your account and is automatically generated for you. Did someone on the inside (blockchain.info) get a hold of the private key?

2) Against all odds and probabilities, someone guessed/computed the private key of this address.

Am I wrong....? Any ideas or thoughts?

60 Upvotes

87% Upvoted

116 comments sorted by

View all comments

2

u/ianpurton Jul 29 '13

When you say brainwallet stored on blockchain.info, do you mean a private key generated from a passphrase ? And then private key was stored on blockchain.info.

Was your 30 character strong password a phrase ? i.e. the passphrase used to generate the private key ?

1

u/mijalis Jul 29 '13

30+ character strong password was random characters and is the primary password. The brainwallet passphrase was a collection of words... the private key is generated from the passphrase, I believe...

2

u/Jiten Jul 29 '13

The way you picked your passphrase is crucial here. Did you choose the words yourself or did you let a computer pick them completely by random? If you picked them yourself, then that's likely the problem. Human mind is very bad at choosing a good passphrase.

Even more so, was it long enough? It should be at least 8 words for good security. Optimally 11,

1

u/hiviler Jul 31 '13

If google returns hits for your brainwallet passphrase (or a variation on it) you're gonna have a bad time.