The bitcoin brain drain: Examining the use and abuse of bitcoin brain wallets

Marie Vasek; Joseph Bonneau; Ryan Castellucci; Cameron Keith; Tyler Moore

doi:10.1007/978-3-662-54970-4_36

The bitcoin brain drain: Examining the use and abuse of bitcoin brain wallets

Marie Vasek, Joseph Bonneau, Ryan Castellucci, Cameron Keith, Tyler Moore

Computer Science

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

In the cryptocurrency Bitcoin, users can deterministically derive the private keys used for transmitting money from a password. Such “brain wallets” are appealing because they free users from storing their private keys on untrusted computers. Unfortunately, they also enable attackers to conduct unlimited offline password guessing. In this paper, we report on the first large-scale measurement of the use of brain wallets in Bitcoin. Using a wide range of word lists, we evaluated around 300 billion passwords. Surprisingly, after excluding activities by researchers, we identified just 884 brain wallets worth around $100K in use from September 2011 to August 2015. We find that all but 21 wallets were drained, usually within 24 h but often within minutes. We find that around a dozen “drainers” are competing to liquidate brain wallets as soon as they are funded. We find no evidence that users of brain wallets loaded with more bitcoin select stronger passwords, but we do find that brain wallets with weaker passwords are cracked more quickly.

Original language	English (US)
Title of host publication	Financial Cryptography and Data Security - 20th International Conference, FC 2016, Revised Selected Papers
Editors	Bart Preneel, Jens Grossklags
Publisher	Springer Verlag
Pages	609-618
Number of pages	10
ISBN (Print)	9783662549698
DOIs	https://doi.org/10.1007/978-3-662-54970-4_36
State	Published - 2017
Event	20th International Conference on Financial Cryptography and Data Security, FC 2016 - Christ Church, Barbados Duration: Feb 22 2016 → Feb 26 2016

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	9603 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Other

Other	20th International Conference on Financial Cryptography and Data Security, FC 2016
Country/Territory	Barbados
City	Christ Church
Period	2/22/16 → 2/26/16

Keywords

Bitcoin
Brain wallets
Cybercrime measurement
Passwords

ASJC Scopus subject areas

Theoretical Computer Science
General Computer Science

Access to Document

10.1007/978-3-662-54970-4_36

Cite this

Vasek, M., Bonneau, J., Castellucci, R., Keith, C., & Moore, T. (2017). The bitcoin brain drain: Examining the use and abuse of bitcoin brain wallets. In B. Preneel, & J. Grossklags (Eds.), Financial Cryptography and Data Security - 20th International Conference, FC 2016, Revised Selected Papers (pp. 609-618). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 9603 LNCS). Springer Verlag. https://doi.org/10.1007/978-3-662-54970-4_36

The bitcoin brain drain: Examining the use and abuse of bitcoin brain wallets. / Vasek, Marie; Bonneau, Joseph; Castellucci, Ryan et al.
Financial Cryptography and Data Security - 20th International Conference, FC 2016, Revised Selected Papers. ed. / Bart Preneel; Jens Grossklags. Springer Verlag, 2017. p. 609-618 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 9603 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Vasek, M, Bonneau, J, Castellucci, R, Keith, C & Moore, T 2017, The bitcoin brain drain: Examining the use and abuse of bitcoin brain wallets. in B Preneel & J Grossklags (eds), Financial Cryptography and Data Security - 20th International Conference, FC 2016, Revised Selected Papers. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 9603 LNCS, Springer Verlag, pp. 609-618, 20th International Conference on Financial Cryptography and Data Security, FC 2016, Christ Church, Barbados, 2/22/16. https://doi.org/10.1007/978-3-662-54970-4_36

Vasek M, Bonneau J, Castellucci R, Keith C, Moore T. The bitcoin brain drain: Examining the use and abuse of bitcoin brain wallets. In Preneel B, Grossklags J, editors, Financial Cryptography and Data Security - 20th International Conference, FC 2016, Revised Selected Papers. Springer Verlag. 2017. p. 609-618. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-662-54970-4_36

Vasek, Marie ; Bonneau, Joseph ; Castellucci, Ryan et al. / The bitcoin brain drain : Examining the use and abuse of bitcoin brain wallets. Financial Cryptography and Data Security - 20th International Conference, FC 2016, Revised Selected Papers. editor / Bart Preneel ; Jens Grossklags. Springer Verlag, 2017. pp. 609-618 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{af2cc71a89cd4b85ace89b8d31169409,

title = "The bitcoin brain drain: Examining the use and abuse of bitcoin brain wallets",

abstract = "In the cryptocurrency Bitcoin, users can deterministically derive the private keys used for transmitting money from a password. Such “brain wallets” are appealing because they free users from storing their private keys on untrusted computers. Unfortunately, they also enable attackers to conduct unlimited offline password guessing. In this paper, we report on the first large-scale measurement of the use of brain wallets in Bitcoin. Using a wide range of word lists, we evaluated around 300 billion passwords. Surprisingly, after excluding activities by researchers, we identified just 884 brain wallets worth around $100K in use from September 2011 to August 2015. We find that all but 21 wallets were drained, usually within 24 h but often within minutes. We find that around a dozen “drainers” are competing to liquidate brain wallets as soon as they are funded. We find no evidence that users of brain wallets loaded with more bitcoin select stronger passwords, but we do find that brain wallets with weaker passwords are cracked more quickly.",

keywords = "Bitcoin, Brain wallets, Cybercrime measurement, Passwords",

author = "Marie Vasek and Joseph Bonneau and Ryan Castellucci and Cameron Keith and Tyler Moore",

note = "Publisher Copyright: {\textcopyright} International Financial Cryptography Association 2017.; 20th International Conference on Financial Cryptography and Data Security, FC 2016 ; Conference date: 22-02-2016 Through 26-02-2016",

year = "2017",

doi = "10.1007/978-3-662-54970-4_36",

language = "English (US)",

isbn = "9783662549698",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer Verlag",

pages = "609--618",

editor = "Bart Preneel and Jens Grossklags",

booktitle = "Financial Cryptography and Data Security - 20th International Conference, FC 2016, Revised Selected Papers",

}

TY - GEN

T1 - The bitcoin brain drain

T2 - 20th International Conference on Financial Cryptography and Data Security, FC 2016

AU - Vasek, Marie

AU - Bonneau, Joseph

AU - Castellucci, Ryan

AU - Keith, Cameron

AU - Moore, Tyler

N1 - Publisher Copyright: © International Financial Cryptography Association 2017.

PY - 2017

Y1 - 2017

N2 - In the cryptocurrency Bitcoin, users can deterministically derive the private keys used for transmitting money from a password. Such “brain wallets” are appealing because they free users from storing their private keys on untrusted computers. Unfortunately, they also enable attackers to conduct unlimited offline password guessing. In this paper, we report on the first large-scale measurement of the use of brain wallets in Bitcoin. Using a wide range of word lists, we evaluated around 300 billion passwords. Surprisingly, after excluding activities by researchers, we identified just 884 brain wallets worth around $100K in use from September 2011 to August 2015. We find that all but 21 wallets were drained, usually within 24 h but often within minutes. We find that around a dozen “drainers” are competing to liquidate brain wallets as soon as they are funded. We find no evidence that users of brain wallets loaded with more bitcoin select stronger passwords, but we do find that brain wallets with weaker passwords are cracked more quickly.

AB - In the cryptocurrency Bitcoin, users can deterministically derive the private keys used for transmitting money from a password. Such “brain wallets” are appealing because they free users from storing their private keys on untrusted computers. Unfortunately, they also enable attackers to conduct unlimited offline password guessing. In this paper, we report on the first large-scale measurement of the use of brain wallets in Bitcoin. Using a wide range of word lists, we evaluated around 300 billion passwords. Surprisingly, after excluding activities by researchers, we identified just 884 brain wallets worth around $100K in use from September 2011 to August 2015. We find that all but 21 wallets were drained, usually within 24 h but often within minutes. We find that around a dozen “drainers” are competing to liquidate brain wallets as soon as they are funded. We find no evidence that users of brain wallets loaded with more bitcoin select stronger passwords, but we do find that brain wallets with weaker passwords are cracked more quickly.

KW - Bitcoin

KW - Brain wallets

KW - Cybercrime measurement

KW - Passwords

UR - http://www.scopus.com/inward/record.url?scp=85019694551&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85019694551&partnerID=8YFLogxK

U2 - 10.1007/978-3-662-54970-4_36

DO - 10.1007/978-3-662-54970-4_36

M3 - Conference contribution

AN - SCOPUS:85019694551

SN - 9783662549698

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 609

EP - 618

BT - Financial Cryptography and Data Security - 20th International Conference, FC 2016, Revised Selected Papers

A2 - Preneel, Bart

A2 - Grossklags, Jens

PB - Springer Verlag

Y2 - 22 February 2016 through 26 February 2016

ER -

The bitcoin brain drain: Examining the use and abuse of bitcoin brain wallets

Abstract

Publication series

Other

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this