Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“My PGP key is compromised, and at least many of my bitcoins stolen”

twitter.com

Post reply on HN
Print view View original

111–120 of 564 posts

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#111

Post by paulpauper »

nextaccountic wrote: post #16
mccorrinall wrote: post #4

Would be interesting to know how his BTC were stolen. Because he is a BTC core developer, I believe he followed the best practices, like not writing down his password. So infection or keylogger?

he should been using a hardware wallet and the bulk of it should be on a paper wallet, in the vault of a bank or another real world institution. the hardware used to generate this key should be wiped out. so if he followed best practices, he didn't lose this money edit: just found out that the btc was stolen from a dedicated server on ColoCrossing. this makes no freaking sense. no server connected to internet should…

Yes, he likely made a fundamental rookie error. Large sums should be stored completely offline.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#112

Post by bbbbb5 »

vorpalhex wrote: post #89
CyberDildonics wrote: post #79

Just for a little context luke jr was infamous on cryptocurrency forums for being adamant that the sun revolved around the earth, all religions other than catholicism are evil, there is an "ethical aspect to slavery" and that bitcoin's 1 KB/s throughput was too much and should be cut down even further. https://archive.is/sS5Ml https://archive.is/DrP83 https://np.reddit.com/r/Christianity/comments/36w6nw/why_did... ht…

I'm not going to comment on his overall opinions, but it does seem like his judgement is severely compromised. I wonder if that led to the negligent behavior which allowed the coins to be compromised and stolen - a discount server host with a history of being compromised seems like the absolute wrong place to store large sums of value.

Inclined to agree here. Luke is going on about Intel ME backdoors on Twitter, but in reality there will be a far less crazy explanation for how he got owned.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#113

Post by nemo44x »

wereallterrrist wrote: post #78

This all stinks. Between the bio, the vague tweets about server hacks (implying Intel ME or a physical server compromise is at fault, really?), the vague tweets about this situation... Something fishy is going on or wow, really proof that sometimes it's just about being in the right place at the right time because wow dude does not have the first clue about security. Hot wallet, compromised, unrotated servers, come o…

Luke Jr is rather famous in the crypto world and has been for over 10 years. This isn’t a rando posting something.

It could be his Twitter has been hacked? We don’t know the whole story.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#114

Post by sureglymop »

phphphphp wrote: post #33

Apparently his servers keep getting hacked, which doesn’t reflect well on his security practices: https://twitter.com/LukeDashjr/status/1606885577843957762

Probably bad security practices. Maybe he has accessed a compromised server over ssh and used agent forwarding or something. Anyhow, looks like a pretty bizarre profile...

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#115

Post by georgyo »

paulpauper wrote: post #100
samwillis wrote: post #42

Context now that the editorialised title has changed, this is a core Bitcoin developer. These things happen every day, but happening to a core developer (if confirmed!) who has a deep understanding of the systems and security indicates just how fragile crypto can be (in my opinion)

Experts make mistakes all the time, fail to see hidden risks, like Challenger explosion. This will never see mainstream adoption at this rate. If the hacker is smarter, being smart is not good enough.

This is not quite the same.

Experts did make mistakes for the challenger explosion, but they did much better than the average person. Put 1000 people at complete random into a room and say design and build a rocket, I suspect they won't even get to the build phase after several years.

When it comes to something everyone should be able to do, an expert making a mistake is a bad omen for the rest of us.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#116

Post by MonkeyMalarky »

SkyMarshal wrote: post #106
samwillis wrote: post #42

Context now that the editorialised title has changed, this is a core Bitcoin developer. These things happen every day, but happening to a core developer (if confirmed!) who has a deep understanding of the systems and security indicates just how fragile crypto can be (in my opinion)

Looks like possibly a supply chain attack targeted specifically at Luke Jr's server: https://twitter.com/naka_frodo/status/1609655813789949959/ph...

The salty posts about his hosting provider are confusing to me. He is paying $55/month and is expecting aid in forensics and audits? Is that normal for a low cost provider?

Edit: Also it sounds like he didn't immediately shut down the server after the first hack? That is completely insane. I understand you want to investigate but you are leaving yourself wide open leaving the system running. It's been compromised. End of story.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#117

Post by nibbleshifter »

wereallterrrist wrote: post #78

This all stinks. Between the bio, the vague tweets about server hacks (implying Intel ME or a physical server compromise is at fault, really?), the vague tweets about this situation... Something fishy is going on or wow, really proof that sometimes it's just about being in the right place at the right time because wow dude does not have the first clue about security. Hot wallet, compromised, unrotated servers, come o…

The mans a halfwit, basically.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#118

Post by krisoft »

Alex3917 wrote: post #28
jtchang wrote: post #18

If you hold a large amount of bitcoin your threat model should be way above the average person. It sounds like his infrastructure was specifically targeted. It can be very difficult to protect against targeted attacks from adversaries.

> It can be very difficult to protect against targeted attacks from adversaries. Not really. The device used to sign transactions should never be connected to the Internet.

Not really?

“Targeted attack” can mean many things. If you have control over wast sums of hard to trace treasure a determined attacker might just kidnap you and/or your loved ones, and win your cooperation using threats of violence.

Your suggested safety precaution is a sensible start, but far from enough if you have a lot of bitcoin.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#119

Post by nemo44x »

kristianc wrote: post #59
TedDoesntTalk wrote: post #5

> What the heck @FBI @ic3 why can't I reach anyone??? Uh, because it’s New Year’s Day? Don’t get injured or become a crime victim on a holiday, if possible.

Every crypto hack is followed by a swift call for a centralised authority to intervene.

Why is that inconsistent? There’s a lot of people that believe governments only legit purpose is to protect people and their property.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#120

Post by doodlesdev »

perihelions wrote: post #84
sosodev wrote: post #27

https://bitcoinhackers.org/@lukedashjr his mastodon feed indicates that one of his servers was physically compromised multiple times. Seems like he should have been more paranoid about securing his coins with that knowledge?

Speaking of paranoid, that link you've posted, isn't that a link to a server that's known to be compromised, and also an apparent watering hole for crypto wallet holders? Am I unreasonable in thinking that's a very scary link?

1. Disable JavaScript.

2. Access (almost) any website in the internet

3. ?????

4. Profit

edit: Mastodon doesn't work without JavaScript, holy hell. We truly are living in a dystopia. Thankfully you can still access his profile from another trusted instance such as mastodon.social at https://mastodon.social/@lukedashjr@bitcoinhackers.org

Post reply on HN