pull down to refresh

Some years ago I made a paper wallet with bip38 passphrase, which I don't remember today. I donate this to the one who can brute force it or to every bitcoiner if no one succeed. I suspect the passphrase is not more than 30 characters.

https://i.imgur.com/3RSb8MH.png

BIP38
Private key: 6PfQTphCYc1Fee19uPz2pmou5RVBDVgw8VcrPfGLos4ktUnARdiFLYhcNU
Public key: 1J7BVeP8JK4op2X3GN3Hy7xkTnGnQTMpou
Passphrase: <find out>

https://mempool.space/address/1J7BVeP8JK4op2X3GN3Hy7xkTnGnQTMpou
Which i generated on this site https://www.bitaddress.org/

If you succeed with brute forcing, the coins are yours. I will never have time to do it my self I'm stuck in love life laugh.

This is a demonstration that phasphrase is not an extra security layer it is only extra step for donating the coins to every bitcoiner.

Have fun!

hahaha cool challenge!

reply

The passphrase is not an additional layer of security, but it certainly slows down the movement of funds by an attacker. Thank you for the challenge you are issuing!

reply

Wow, I remember using bitaddress. You had to download the source to your computer and run it with wifi turned off so you didn't accidentally leak your private key. I created a bunch of vanity addresses back in the day. I have no idea if I left any sats behind!

reply
reply

The private key starts with '6Pf', though.

That gives you some indication of the encryption algorithm used: EC multiply, no compression, no lot/sequence numbers, according to BIP38.

Whether that makes it any easier to brute force, I don't know.

reply

That does make it somewhat easier. I'd suspect the best method is really gonna be trying out combinations of words or something like that.

reply

This assumes the password is randomly generated, and they indicated they didn't use special characters.

reply

Still worth a shot, right? lol

reply

deleted by author

Sats so close, yet so far away...)

reply

Can you hint at the type of passphrase you used? Do you include 1736 $&# etc or is it pure words?

reply

I don't remember, I have tested my passwords I used during that time, so probably it is not with special characters

reply

🤩 more than 500k sats

Not bad. The longer in takes to brute force the more it appreciate

reply

Copy that. If I continue to fail after a month I'll try adjusting tactics.

reply

how that's going?

reply

Any hints as to the passphrase beyond likely under 30 characters? Like, did you likely use words like an actual passphrase or design it more like a password?

reply

Most likely I did not use a passphrase of the length 30. But I remeber that I used to combine 3 different passwords to secure wallets which is about that length. I have withdrawn funds from the wallet once so it cannot be an imposible passpharse and most likely I did not used a password manager for it.

reply

It's an online treasure hunt

reply
reply

I wonder if we have the same passphrase of 1234

I only opt for the highest of security on my bitcoins

Looking at this BIP38 encrypted wallet challenge, I can make some educated guesses about the passphrase characteristics and brute force feasibility:

Passphrase AnalysisPassphrase Analysis

Likely Characteristics:

  • Length: Probably 8-20 characters (user mentioned combining 3 passwords, but likely not the full 30 characters)
  • Character set: Likely alphanumeric only (a-z, A-Z, 0-9) based on user saying "probably not with special characters"
  • Dictionary words: Possibly - user mentioned not using a password manager and needing to remember it, suggesting human-memorable patterns

Estimated Character Set Sizes:

  • Lowercase only: 26 characters
  • Alphanumeric (mixed case): 62 characters
  • Alphanumeric + common symbols: ~95 characters

Brute Force Time Estimates (RTX 3090)Brute Force Time Estimates (RTX 3090)

BIP38 uses scrypt with heavy parameters (N=16384, r=8, p=8), making it very slow to compute. An RTX 3090 can achieve roughly 1,000-5,000 BIP38 attempts per second.

Time estimates for different scenarios:

LengthCharacter SetCombinationsTime (Average)
8 charsLowercase (26)2.1×10¹¹1-2 years
10 charsLowercase (26)1.4×10¹⁴900-4,500 years
8 charsAlphanumeric (62)2.2×10¹⁴1,400-7,000 years
12 charsAlphanumeric (62)3.2×10²¹20+ million years

Realistic Attack StrategiesRealistic Attack Strategies

Rather than pure brute force, more practical approaches would be:

  1. Dictionary attacks - Common passwords, personal info
  2. Hybrid attacks - Dictionary words + numbers/years
  3. Pattern-based attacks - Since user mentioned combining 3 passwords
  4. Wordlist attacks - Using leaked password databases

VerdictVerdict

Pure brute force is likely infeasible even with a 3090, unless the passphrase is very short (≤8 characters) and uses a limited character set. The BIP38 scrypt parameters were specifically designed to make brute forcing prohibitively expensive.

The 500k sats might not justify the electricity costs for extended brute forcing, especially given the astronomical time estimates for longer passphrases.

reply

A supercomputer can solve this

reply

Challenge accepted. Have lots of sats in case someone manages to do it.

reply

Brute force might sound easy but it ain't when it comes to Bitcoin

reply

OoooOoOO.......watching this 0.0

reply

Sorry friend 😔

reply

how can I brute force that? with what program?

reply

deleted by author

deleted by author

deleted by author

reply

No, It was when Stacker news was new and single letter nicknames was avaible, didn't put so much thought in it and q was the first random letter which was not in use.

reply

deleted by author