Rediscovery of a Lost Bitcoin Wallet

In a remarkable development, two hackers successfully cracked the password of a long-forgotten digital wallet, leading to the recovery of approximately US$2 million worth of Bitcoin (BTC).

NewsBTC reported that the story dates back to 2013 when an individual known by the alias Michael stored his Bitcoin holdings in a password-protected digital wallet.

Unfortunately, over time, he lost access to the wallet due to the file containing a 20-character password generated using the password manager RoboForm becoming corrupted.

Despite prioritizing security, Michael's concerns about potential hacking led him to not store the password in the manager, inadvertently locking himself out of his assets.

Entry of Two Hackers: Joe Grand and Bruno

In 2022, Joe Grand, a renowned electrical engineer and hardware hacker known as Kingpin, gained recognition for assisting another crypto wallet owner in recovering $2 million worth of digital assets after forgetting the PIN to his Trezor wallet.

Since then, many people approached Grand for his expertise, but he selectively chose his projects.

Two years ago, Michael initially approached Grand for help in recovering his lost Bitcoin. However, due to the unique challenges posed by the software-based wallet, Grand declined the request.

Nevertheless, Michael persisted, and in June last year, Grand agreed to give it another try, collaborating with another hacker named Bruno from Germany.

Months of reverse engineering led Grand and Bruno to a significant breakthrough. They discovered a flaw in the pseudo-random number generator used by the RoboForm program that Michael used in 2013.

The flaw tied the generated password to the user's computer's date and time, making it predictable. With this knowledge, the hackers devised a plan to exploit the flaw and uncover the password.

The main obstacle in this process was Michael's inability to remember the exact date when the password was generated.

However, knowing that BTC was first deposited into the wallet on April 14, 2013, Grand and Bruno configured RoboForm to generate passwords within a specific timeframe, using parameters familiar to Michael.

Persistence Leading to Success

Despite initial failures, Grand and Bruno persisted, adjusting the timeframe and parameters until they finally succeeded. On November 15, 2023, they found the correct password, a 20-character long one generated on May 15, 2013. The long-lost Bitcoin treasure was finally in Michael's possession.

However, the report noted that the success of Michael's asset recovery raised concerns about password security, especially for users generating passwords using older versions of RoboForm.

While Siber Systems, the company behind RoboForm, claimed to have fixed the flaw in 2015, questions remain about the vulnerability of old passwords.

Grand emphasized the importance of understanding the enhancements made in newer password manager versions. He advised users to regularly update their password managers and be aware of the potential risks associated with outdated software.