Of course that txn would show up on-chain, but if you don't have possession of the private key for the first account, and no digital device has ever "seen" the hardware account then he would've been fine.
This is assuming the key piece of evidence was his private key, and he wouldn't have been prosecuted without it.
Additionally, putting your key in cloud storage sounds like the dumbest thing ever... Just memorize your seed phrase and write it down. Its 4bn for christ sake.
Memorizing a seed phrase leaves you vulnerable to a $5 wrench attack, I wouldn't recommend it.
Of course the problem is the attacker may not know what method you used and resort to the $5 wrench attack anyway :)
Not stealing $3.6B might be an even safer bet.
https://www.cnbc.com/2021/08/11/bitcoin-family-hides-bitcoin...
> Taihuttu has two hiding spots in Europe, another two in Asia, one in South America, and a sixth in Australia.
> We aren’t talking buried treasure – none of the sites are below ground or on a remote island – but the family told CNBC the crypto stashes are hidden in different ways and in a variety of locations, ranging from rental apartments and friends’ homes to self-storage sites.
I hope this is all a decoy or else it’s the worst opsec I’ve seen since about five hours ago.
> Taihuttu is trying to put a crypto cold wallet on every continent so it’s easier to access his holdings.
I hope it’s at least encrypted with an additional passphrase, otherwise it’s only as strong as the weakest bank’s security.
https://arstechnica.com/tech-policy/2020/02/man-who-refused-...
If gov got to you, it probably doesn't matter how well you got it protected.
Printing the paper wallets, putting them in a $1 glass jar with a silica packet and burying in your back yard would have been 100 times smarter.
The article mentions he had many wallets.
keyloggers for example.
This absolutely sounds like parallel construction.
I’m also curious what here looks like parallel construction to you - I thought the statement of facts was surprisingly mundane, but perhaps I missed some red flags?
With a bad choice like SHA256, a 7 word passphrase could be cracked in as little as a few months with a single ASIC. The US government probably has a bunch of them already, so I think that an 8 word passphrase is already within reach for current tech.
Of course, with a real key derivation function like Argon2id, things would look much better.
Especially since in general the likeliest failure mode would be the user forgetting the password to their millions of dollars worth of Bitcoin keys, followed by someone attacking the password.
how long are we talking?
With SHA-256 it takes about $21 to crack a 6 character password.
$1500 to crack 7 characters.
$108,330 to crack 8 characters.
$7.8 million to crack 9 characters.
$561 million to crack 10 characters.
$40 billion to crack 11 characters.
$3 trillion to crack 12 characters.
$200 trillion to crack 13 characters.
Edit Note: BTC is kinda expensive per hash right now. Usually this would all be cheaper. Past 14 characters it could be 1 cent and still outrun the usual US budget for a couple years.
But you can refer to https://hashcat.net/hashcat/
There's selection bias going on because only dumb criminals get caught, so you only hear about the dumb opsec practices of those criminals. Conversely, you'll never hear about the opsec practices of that professional crew with perfect opsec that hacked an exchange/difi contract and disappeared into thin air.
I haven't studied criminology, but I alternatively suppose someone who does that just doesn't think that far ahead. This likely also explains why the vast majority of people with these capabilities choose to live a life in accordance to their country's laws.
Or, the TLA involved have some sort of crack or acceleration procedure; the TLA say "the criminals were dumb" because the people involved can't combat that without admitting guilt, and who'd believe them. The real reason is the TLA used illegal access and tools that we wouldn't be happy they're using against the civilian population? Oh, and the people using the tools are guilty by association so they're inhibited from whistleblowing.
"Approximate Crack Time: 61,103,576,810,655,170 centuries"
Yeah, sure:)
With the Feds involved, that would be sufficient to crack the data.