Bitcoin

<p class="is-style-lead">American engineer Joe Grand with his friend Bruno discovered a loophole in an older version of the RoboForm password manager, enabling them to recover $3 million in BTC.</p>
<p>Hardware hacker and engineer Joe Grand together with his friend, software hacker Bruno have found a loophole in an old version of the RoboForm password manager, enabling them to recover millions worth of <a href="https://crypto.news/tag/bitcoin/" target="_blank" rel="noopener noreferrer nofollow">Bitcoin</a>.</p>
<p>In <a href="http://www.youtube.com/watch?v=o5IySpAkThg" target="_blank" rel="noopener noreferrer nofollow">a YouTube video</a> published on May 28, Grand explained that in 2022 he was reached out by Michael, a European crypto owner who sought his help to recover millions worth of Bitcoin, stuck on his computer as he lost access to his 20-character password generated by RoboForm and stored it in a TrueCrypt-encrypted file.</p>
<figure class="wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio">
 <div class="wp-block-embed__wrapper"><iframe title="I hacked time to recover $3 million from a Bitcoin software wallet" width="1020" height="574" src="https://www.youtube.com/embed/o5IySpAkThg?feature=oembed" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>
 </div>
</figure>
<p>Grand and Bruno spent months reverse-engineering the version of RoboForm Michael used in 2013, when created the password for his Bitcoin wallet.</p>
<p>They both eventually discovered that one of RoboForm’s old versions had a flaw in the way the software generated passwords, making them predictable based on the computer’s date and time. Luckily for Michael, his password was generated way before RoboForm patched the bug.</p>
<p>You might also like: <a href="https://crypto.news/unciphered-discovers-1b-vulnerability-in-bitcoinjs-built-crypto-wallets/" rel="noopener noreferrer nofollow"> Unciphered discovers $1b vulnerability in BitcoinJS-built crypto wallets </a></p>
<p>Investigative journalist Kim Zetter noted in an X post that “if any of RoboForm’s current 6 million users are using passwords generated by the RoboForm’s version prior to 2015 before the company silently fixed the flaw, they may have passwords that can be cracked in the same way.” As of press time, RoboForm made no public statements on the matter.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">This means that if any of RoboForm's current 6 million users are using passwords generated by the <a href="https://twitter.com/roboform?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@roboform</a> password manager prior to 2015, before the company silently fixed the flaw, they may have passwords that can be cracked in the same way.</p>— Kim Zetter (@KimZetter) <a href="https://twitter.com/KimZetter/status/1795441024954716501?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">May 28, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>Having generated millions of passwords based on the timeframe when Michael supposedly created his password, the two began brute forcing to find the one that would grant access to Michael’s wallet. After refining their approach, Grand and Bruno successfully discovered the password, created on May 15, 2013, at 4:10:40 PM GMT, unlocking Michael’s 43.6 BTC, currently worth around $3 million.</p>
<p>The founder of Grand Idea Studio, Joe Grand is an electrical engineer, inventor, and hardware hacker best known in the crypto community for <a href="https://www.youtube.com/watch?v=dT9y-KQbqi4" target="_blank" rel="noopener noreferrer nofollow">hacking</a> a Trezor One wallet in 2022 to help its owner recover $2 million in BTC. Grand, who goes by the hacker handle “Kingpin,” has a storied career in hardware hacking and continues to consult with companies to enhance their digital security.</p>
<p>Read more: <a href="https://crypto.news/trezor-x-account-compromised-as-hackers-push-phony-solana-token/" rel="noopener noreferrer nofollow"> Trezor X account compromised as hackers push phony Solana token </a></p>

Cyber engineers ‘hacked time’ to recover $3m in Bitcoin from password manager

crypto.news

Other articles published on May 29, 2024

Lista DAO Provides a Robust Platform for Liquid Staking and Decentralized Stablecoin Functions

Ripple Donates $25 Million to Fairshake Political Committee

Investors Monitor HBAR’s Price Movement for Key Trends

Starlink experienced service outage that affected 41,393 users early today

Shiba Inu Surpasses Cardano in Value

xAI Price Prediction: XAI Surges 8% As Cathie Wood Pumps $60M Into Elon Musk’s xAI Startup And Th...

Join our free newsletter for daily crypto updates!