Hacker News new | ask | show | jobs
by mprime1 1285 days ago
Interesting! I suspected the attack vector was my poor use of BTC rather than someone cracking AES so quickly, I'll look into this.

I created the wallet using a popular opensource wallet app, and just moved some funds there. Don't know more than that...

Thank you for the pointers!

1 comments

Update: funds were not stolen. PortableSecret wasn't cracked (yet)!

What happened is: the wallet app I'm using automatically performs CoinJoin[1] when funds are received (In fact, this is their business model! They take 0.3% of the amount to automatically anonymize all inbound coin).

CoinJoin is a protocol that breaks up the sum received in tiny pieces and scatters them across a large number of "sub-wallets".

So my wallet still has the funds. Bt the 'receive' address I used looks drained, that's because it was only a temporary address to share with the sender. Funds were soon after scrambled/tumbled/anonymized.

This was an interesting experience. I spent all day thinking about what could have happened, researched and learned a bunch of stuff in the process.

[1] https://en.bitcoin.it/Privacy#CoinJoin

Why bother with BTC? Monero implements such protections (plus many stronger ones) with TX fees in the order of a single cent, and obviously without any fees for laundering your entire balance every time you're given money.
Not your keys, not your coins.