Hacker News Reader

Comment by gruez | Hacker News Reader

but why would you need to rotate a cold wallet (presumably) key? Key rotating makes sense for your password or tls keys, because they're used on a regular basis on networked computers that can possibly be compromised. But if the private key is stored on an airgapped computer (or paper wallet) there would be no advantage. If anything pulling the computer out to do the signing presents more danger because there's opportunity for your house to be raided (by police or rival criminals) while you're doing the signing.

View on HN

many people have the encrypted key pair and have been trying to brute force access for years.

so either someone succeeded, or it got rotated by simply moving the coins to literally any other address. of course, both of these outcomes are indistinguishable which is part of the beauty of the system, especially if someone was actually trying to ride out statute of limitations or something else.

they can still obfuscate their destination either way. if the source is illicit its money laundering, if the source is not illicit its just obfuscation, if done right the illicit source is never discovered having been replaced with a licit source.

I don't think the statute of limitations applies once you've been found guilty. That applies to the time limit for prosecution, not the time limit for executing asset seizure that was declared forfeit. It is always forfeit, you don't get to protect your ill-gotten gains if you manage (or someone receiving them manages) to hide them long enough. They still have a seizure order on them if, presumably the FBI, can figure out how to get them.

And now we know that's what happened for certain: The DOJ seized these coins. https://www.vice.com/en/article/akdgz8/us-feds-seize-1-billi...

How would you obfuscate anything? The blockchain tracks every transaction. Not only can that money be traced forever the feds can claw it back from anyone who received it if they wanted to do that. Or follow it to the exit points if the owner tries to launder it via other means and apply pressure there.

There are services called tumblers which take bitcoins from multiple people (often multiple sources per person); mixes them up with bitcoins from lots of other people, transfers them about a lot randomly etc, then at the end spits out a series of transactions which add up to not quite the amount you submitted (different by a random amount).

Each of these transactions can be traced, but it can be difficult to track which output bitcoins relate to which input bitcoins.

How did the encrypted keys leak?

I don't know

from this article and other articles I've seen:

> A file that some claimed was an encrypted bitcoin wallet containing the keys to the funds has been circulated in cryptocurrency communities for the past year, and – if it is what it was claimed to be – then a combination of brute computing power and good luck could have successfully decrypted the wallet.

It likely didn’t really leak. It’s a trick/scam they play on the naive. One can replace the cleartext section in the wallet with a unrelated tx reference that doesn’t match the actual encrypted private key. The wallet will act like the real one (it will show the referenced tx in the UI) but even if you could decrypt the encrypted private key, it would be for the wrong pubkey.

And then claim someone else stole them, when in reality they are just moving it to another address of their own

that's hilarious

Someone might want to take more precautions generating keys for $1 billion vs $1 million. I'm betting this person (or persons) generated keys in a more secure manner (potentially a sharded key, or using hardware wallets) than the original keys, which may have been generated on a non-airgapped device.

Iunno, if I had $1b sitting around, I’d like it to be in 1000 different wallets each containing $1m.

With $1b, I’d rather risk losing 10% than having a 10% chance of losing all of it.

That sounds like such a pain to access, though. Better to just have it in 10 wallets of $100m, plus one wallet with a few mil that you use for actual transactions.

Well, but you don’t.

I don't have a mansion but I can reasonably assert, in a productive conversation, how I might secure such a property.

> Key rotating makes sense for your password or tls keys, because they're used on a regular basis on networked computers that can possibly be compromised.

Surely key rotation only makes sense if the time between each rotation is much much less than the expected time between compromise and theft.

In high value situations, an attacker is highly motivated to ensure they steal Bitcoin very quickly after compromise. Especially becaus the clock is ticking until the compromise is discovered and mitigated.

Might just be a change of key infrastructure. If this was generated a long time ago, perhaps the owner wants something a bit more modern, like a HD wallet on hardware, something like that. More ergonomic and elegant than possibly holding on to a load of different keys.

Agree with most, except the last bit: now they're managing the keys for their bitcoin, bitcoin cash and bitcoin gold (and maybe other forks?)

But with the HD wallets you can switch a field in the derivation path for each coin. Then one seed can give you different looking addresses for each chain, from the same device.

Could you explain what key rotation is? First time I’ve seen this term.

Very briefly, secrets should have maximum lifetimes. This is for multiple reasons - someone could be brute-forcing it; algorithms are regularly found to be less secure than initially thought; keys leak over time.

Any secret protecting anything you care about should be rotated. The schedule is dictated by specifics.

In general, just generating a new key to access the secure data.

Reply on news.ycombinator.com