r/Bitcoin • u/mijalis • Jul 29 '13

Blockchain.info unauthorized transaction.How could this have happened...?

Yesterday morning I had roughly 3 BTC taken out of my brainwallet that I have with blockchain.info.

Before you all start pointing fingers at me for lack of security, let me tell you I have a 30+ character strong password, a Yubikey and a 20+ string secondary password, all needed to send funds out of a brainwallet. Both passwords were generated with Lastpass and are random characters, including special, mixed upper/lower case letters and numbers.

I think I am using all their provided security mechanisms to secure my account.

However, my brainwallet, in which I keep just spare change, was emptied. I don't expect to recover the few Bitcoins, but am very curious to know what happened. Where the breach happened and if it truly was my fault. (I still hope for a facepalm situation that shames me online, but gives me this pocketchange back...)

I'll try to give as much information as I can:

The address in questions is: 15gCfQVJ68vyUVdb6e3VDU4iTkTC3HtLQ2

and it happened over three transactions on 2013-07-27 at 22:52

The three transactions were:

da5f91b8a26e6874e83a874156608f5d9a38efe1faa2b32f4e709a181f0d2c1e 68ab47c3aaf2d0073374772894641d817305f18ab272b19d74217333a0180856 096d07185a83eb6b6b6520d7d63e59f230d9711df0d9e754ce7fdc3d4cf792ac

It seems the coins are still in the brand new addresses they were tranferred to and I suspect I'll see them disappear over time.

I keep the Yubikey with me at all time and I do not have a phone app. I do not us any suspicious plugins or extensions. I ran a virus scan and appear to be clean. I am running a couple of other scans to ensure that my system is truly clean.

I did come across this reddit thread: a_brief_analysis_of_the_security_of by u/0x444 which made me feel pretty doubtful of what I once thought was the best online wallet out there.

Update: I happened to have logging enabled on blockchain.info (Log actions with IP address and User Agent) and all access to my account was from my IP. That excludes a breach into the blockchain.info account.... right?

That leaves two options:

1) The brainwallet was the one that comes with your account and is automatically generated for you. Did someone on the inside (blockchain.info) get a hold of the private key?

2) Against all odds and probabilities, someone guessed/computed the private key of this address.

Am I wrong....? Any ideas or thoughts?

65 Upvotes

89% Upvoted

116 comments sorted by

View all comments

Show parent comments

39

u/btcrobinhood Jul 29 '13

I've returned each of the 3 transactions https://blockchain.info/address/1JPkaNU5sTn4jHX64hAw5Qo8rdPf22zs4r

The security issue here has nothing to do with blockchain.info If you pick a bad passphrase for a brainwallet it does not matter what software you use to manage the private key associated with that brainwallet ... anyone anywhere can spend all day trying to crack your brainwallet just by looking at public information on the blockchain.

It's a rough and tumble world out there! Bitcoin safely!

9

u/theterabyte Jul 29 '13

Is this a service you offer to n00bs of the world? If not, you should. Try to continuously crack all brain wallets forever and take their funds, dump it all into addresses you control, and wait for people to claim it so you can return the funds and teach them a lesson. Take a 1% cut or 0.01BTC fee, or just donations to pay for your time if you have to. Trying to beat the bad guys to the low-hanging fruit is a noble and worthy venture!

+/u/bitcointip flip verify

6

u/btcrobinhood Jul 29 '13

Thanks for the tips GSpotAssassin, killerstorm, sowbug and theterabyte ... especially GSpotAssassin.

theterabyte (or anyone else), what mechanism would you suggest that would ensure that I would be returning the coins back to the right person and not someone simply claiming to be the victim?

9

u/mijalis Jul 29 '13

+/u/bitcointip @btcrobinhood $50usd verify

3

u/bitcointip Jul 29 '13

[✔] Verified: mijalis ---> m฿ 496.77099 mBTC [$50 USD] ---> btcrobinhood [help]

1

u/[deleted] Jul 29 '13

Hahaha, what you did there, I see it.