Topic: Bitcoin developer @lukedashjr's wallet was hacked - page 11. (Read 12899 times)

New development:


Still shady af.
Definetly Luke is not doing everything to make it well understood.

windfury have you seen lukes religious beliefs recently.. one way or another luke is compromised. but the threshold is.. what?
im not saying he should be removed just for religious beliefs i was making a plain comment that someone else was hinting IN A TONGUE IN CHEEK manner that gavin got removed for "keys compromised" and dubious funding/commentary..

and now in this post. i am now saying.. so whats the threshold for removal from core team?? again not saying remove him. just a comment about whats the threshold(and its rhetorical not actually requiring an answer)

if you cant get satire/rhetorical comments. then please stop pressing the reply button to go streaming into 20 rants about how you adore things and think everything else is gaslighting you

(i feel your about to take a sly-small satirical comment made by someone else, and then me highlighting the cheekiness of said comment.. to go into a massive defend a dev debate that lasts weeks.. so lets just pre-empt all your lil digs and resolve it all in one post.)

edit above comments to address windfurys responses below(ending debate before he goes left field)

firstly i didnt say he was compromised. to the same extent as gavin..
YOU were having a dig at Digaran when HE suggested in satire to remove luke
I said digaran was making a tongue-in-cheek comment(aka satire).
(i guess you didnt get the hint)
YOU then(post below) acted as if i was saying what digaran said.. without you understanding what i or digaran was saying. in short you took things too far to cause more social drama

edit above comments to address windfurys responses below(ending debate before he goes left field)

---

anyways (only edited below the underlines to my points about compromise)
as for decisions of doing things to defend BITCOIN against compromised devs..
requires seeing if a devs PGP keys are compromised and ensuring that no one aimlessly downloads software containing a compromised keys signature post compromise of said keys..

however then
adoring a dev just because "they are core", ignoring their flaws as humans, treating them as gods just having a bad day.. is not good for the decentralised security of bitcoin. defending a dev above the security of bitcoin is also not a good trait to have

trying to be part of a kiss ass team wanting to break bitcoin rules to ensure bitcoin only follows a business sponsored roadmap is not good for bitcoin

and when a dev that was sponsored to implement a "feature" but is found later on not even using the feature they were highly involved in implementing.. says alot about the whole situation

you admiring luke due to a implementation involvement. yet then seeing luke himself doesnt use that feature in the last 5 years of opportunity to use it.. should make you probably want to call luke out for gas lighting you into a implementation you thought he truly wanted.. but later found out he doesnt use.. right?.. correct?
or are you still just going to kiss ass a dev as if devs never make mistakes.. as if he is a god having a bad day just because of some social drama team of dev idols you are in.

just because a dev wrote some code for bitcoin does not mean it requires blind idolism of them as gods. we actually should be critical and review devs regularly to keep them on their toes to ensure they dont keep putting trojans into the code.. not idolise them and pretend they can put anything they like in and dont need review and no one should criticise them

"Compromised". If there was proof that Luke Dashjr was truly "compromised" and he's working for the Flat-Earthers, then remove him from Bitcoin Core. OR if he starts a public declaration that Craig Wright is the "Real Satoshi". But currently, Luke Dashjr is simply a person who had his Bitcoins stolen from him. A mere victim of a hack.

i think that comment was a tongue in cheek hint about the fact that gavin was removed from core when he was compromised(targetted and bribed by altcoin scammer CSW)

1YAR6opJCfDjBNdn5bV8b5Mcu84tv92fa  216.93331465 BTC

The person just lost his livelihood, it's not his fault/he was a target by hackers, then you want him, an experienced Bitcoin developer who has written thousands of lines of code, to be removed from Bitcoin Core development team? I believe not. If your house was robbed, I believe it would be unfair for you to be removed from the job. Plus there's no negative impact in my opinion. Bitcoin is OK, and he didn't intentionally write a nefarious line of code to break the protocol.

i dont like the guy, but im fence sitting this one, as much as possible trying not to lean over and pick a side to fall into

he wasnt asking for help from the FBI via twitter. he was ranting that the FBI was not helpful.. it was a rant not a plea for help. he did say he contacted the authorities via the normal route and got nowhere. (got stuck in the pass the bucket of call centre hell)
to me it felt more like he was just speaking aloud thoughts in his brain "grrr fbi where are you when i need you" rant

..
but as for the 'i got hacked, and coins were mixed'
that part is seeming less inline..

first he said coins were cold. whereby its actually shown coins were hot and used in september, thus wallet was exposed to internet

secondly funds of the addresses raided in new year were legacy which he said were origin funded before seeds and multisig existed..

thirdly they dont seem to be mixed because the 1yar address is not mixing them, its hoarding them
..

im trying to keep an open mind. but to me its looking more like he moved coins to a new address he owns(1yar) and is claiming "i been hacked" for a tax dodge

I tend to believe more and more it's a prank.

* The story is still only on Twitter and not on Mastodon, although it tells everywhere "Mastodon preferred"
* Stealing from the cold storage would be possible only if the user would be more than incredibly sloppy/uncautious.
* I don't think that somebody for so long in Bitcoin would ask for FBI help, and also would not do it on Twitter.
* Luke Dash Jr is (proudly!) asking for donations for his work; was he indeed owning 200 BTC ?!

I *know* that Peter Todd has confirmed the story, but the things still don't add up.


Yes, that too; I've followed some of those transactions and it looks more a consolidation of funds than anything else.

ok so surprise to me. looking into it. i thought it was some old.. OLD stash of coins from an old.. OLD addresses (as it was said they were legacy and "seeds did not exist then")
and he was one of the biggest proponents of segwit.. yet in 2019-2022 was still using legacy.. (much like sipa stil does for donations)
(im not gonna go into the irony/hypocrisy of many debates about the whole ideational some devs had for segwit but not end up using it themselves.. ops just did)

---

however the coins that were lost were majority coins from a wallet that was shuffling and spending coins from 2019-september 2022..

so here is a short version of spends
there was a tx of 191btc UTXO in september 2022 to spend 20btc to give back change of 171btc
https://www.blockchain.com/explorer/transactions/btc/471c3bd4fc9cbaaa4dddd7f21acb070702723b2d03759066835c367d26667fd5

where the 171btc change, along with some other coins from other addresses then got raided at new years to send funds to a coinjoin(1YAR address)
https://www.blockchain.com/explorer/transactions/btc/432ded946431a9612f09d73bd15ded045d11d1095ffdfe8d68306ea9b2e78930

(im not calling it a coinjoin, luke said the 1YAR address was a coinjoin)

so its now known he did expose keys to the internet in september 2022

..
as for the supposed 'coinjoin mixer' scenario luke hints.. strange thing is his raided coins went into the 1YAR address.. but have not moved out.

which does not sound like a mixer to me, usually mixers move coins out within 24-48 hours(max) of going in.. the dont stash/hoard coins for long

That’s part of the hypothesis I was toying with, but that we can discard apparently, as he sets the two, PGP and bitcoin theft, as unrelated losses (although likely tied to the same set of events):
https://twitter.com/LukeDashjr/status/1610088091968061442

I’m not sure if I’ve skipped part of his explanations somewhere, but I don’t believe we’ve yet seen how those bitcoins private keys were protected on his (not so) cold wallet:
https://twitter.com/LukeDashjr/status/1609864852104675333

It’s possible that, believing his storage solution to be never in contact with the internet, the private keys were not really encrypted there (?).

Luke was using an old wallet(no seed). If he would have started today, he would have used an air-gapped device to generate a seed.

The specific setup he used is not the recommended as of 2023 really, although it was the best at the time.

Basically, if your private key is never ever exposed to the Internet in any way, then those Bitcoins are going to be as safe as they can be.

Should he be removed from bitcoin development team? It seems this could have a negative impact on bitcoin as a whole. Just my opinion.

All the more reason not to believe anything he says.

None of that makes sense. Many exchanges have disappeared with their users' money, and indeed, some people lose their Bitcoins on their own. But let's compare the ratio: there are much more Bitcoins in self-custody than in exchange wallets. Let's not forget that Binance can take a user's funds whenever they want.

Self-custody is difficult though, and I've never been 100% satisfied with the balance between "not losing access" and "someone else gaining access".

This is truly an unprecedented event!  From such an experienced developer in the field of blockchain, hackers managed to steal a large sum of money in Bitcoins....

At the same time, Bitcoin Core developers themselves give recommendations on the safe storage of the first cryptocurrency on their website.  Most Bitcoin users are guided by these recommendations when choosing one or another wallet to store their coins. 

In my opinion, this means acknowledging the fact that there is no completely secure way to store Bitcoins.  It is necessary to use all available methods to minimize the existing risks of losing cryptocurrency.

Never knew that. I assumed cold always mean hardware wallet and air gapped electrum setup. Didn’t expect it to mean it’s a hot wallet on its own node which you are hosting.

Because that’s obviously not safe since there could always be some exploit, even on an secure Linux system and the thief will have access to your wallet.dat file essentially.

He said that he never trusted hardware wallets or perhaps even wallets such as electrum you can run on cold storage. And I guess he figured he is better off using his online wallet for Bitcoin storage rather than a wallet created by a third party which is open source.

OG people call hot wallets a wallet that is active on a server where the public have access to it..(exchanges and service providers)
a cold wallet is one thats independent and less accessible(such as home PC that may/may not go online..)

EG
your home full node is deemed a cold wallet
compared to CEX deposit&withdrawal nodes/bitnodes.com/bitDNSseed nodes which are hot

offline wallets are deemed 'airgapped' / hardware wallets

Thanks for bringing this information, it is actually a good theory but for now I am personally interested in the fact some sources are mentioning cold wallets/addresses were involved in this theft.
Has he given any other statement about any of that? Because I am not even know how that is possible without him accidentally compromising his keys.

At first, I thought this was a Twitter hack, but now it does not seem like it...

ever since november Luke has been saying periodically how his server is being bombarded by hack attempts .. not just the PGP key compromise of november 17th but even a few times in december and on christmas day he was getting attacked.. and then on new years realising his coins had gone.

i beleive he probably backed up his server to a home PC(incase of ddos taking server down/needing to switch servers) where there was probably a virus on the server. he was also looking into a new server service so was most definitely ready to copy data from server A to a server B if he found one.. which also points to me thinking he backed up his serve at a home PC(bringing a virus along with it)

.. reading through tweens again.. and the story fits

november

december

God ordered to hide his taxes from heathen government. Also God commanded him to hack CoiledCoin as well as smear blockchain with religious ramblings.

Being religious does not make person or his action good. Crusaders are perfect example from history.

Do not attack me for this, however for the skeptical me, another argument mentioned in Luke's thread that made sense was it was done to make everything appear like a hack so Luke can use it to write off taxes. Before you shake your heads on me, I am only saying it makes sense, I am not accusing him. I know Luke is a religious and a God fearing person who will never do something shameful only to avoid paying taxes. If this was Justin Sun it would be different hehehehe.