Stay away from Voltz \ stacker news ~bitcoin

pull down to refresh

475 sats \ 37 comments \ @Haiku7336 16h bitcoin

I am writing here to inform everyone about my recent experience with Voltz (https://lnvoltz.com/).

I have been using their cashu mint with Mibinits wallet (balance of ca 20000 sats) and after at some point I just started getting errors and nothing including resetting my wallet helped, I decided to contact the Voltz support.

They informed me that they indeed had just frozen some funds due to vulnerabilities on their side and that I should provide them with some information about my wallet so they can burn my balance and create a new one.

However, since I had reset my wallet I did not have this information, just the seed. Now I know that the seed is enough to restore entire cashu wallets, as I have done a few times before. So them not being able to use my seed to detect which frozen funds belong to me, just speaks of technical incompetence from their side.

After I informed them that I have just the seed, they stopped replying to me even after multiple mails. So it looks like my funds are gone.

Hope this information can spare other users the same experience.

TLDR:

Voltz randomly has frozen my funds
Lacks the technical competence to unfreeze my funds
Stopped replying to my messages

Also please spare me any comments about it being well deserved for using a custodial service. I am aware of the risks and it is a tradeoff I am willing to take for small amounts. Still this doesn't justify such unprofessional behavior from the wallet operators.

view all related items

1000 sats \ 4 replies \ @Haiku7336 OP 1h

Update:

Voltz just contacted me with this email:

Hello!

I saw your post on Stacker News through Calle's notice, who helped me understand how to recover your funds from an old keyset.

What happened is that there was no censorship; the issue was due to the incompatibility of a deactivated keyset. This is very different from censorship—it was disabled for security reasons. But anyway...

After running a separate mint in a controlled environment, we managed to retrieve the proofs of your eCash and recover them. So, I’m sending you a token of 20,015 sats from the recovery, which you can withdraw at any time.

We apologize for any inconvenience caused so far. See you!

-------cashu token string-------

With this I was able to recover the funds.

Big thanks again to this forum and to @calle for supporting in the recovery. I decided to donate the recovered funds to @calle.

To summarise the situation with Voltz:

I would have appreciated if they had disclosed somewhere publicly, or at least on their website, that they disabled the keyset. If I had known what was going on, I would not have reset my wallet and the recovery would have been much easier.
I would also have appreciated if they had taken some initiative themselves in contacting the Cashu team in what can be done about this issue, instead of just deciding to ignore me until I created this forum post.

0 sats \ 3 replies \ @ek 1h

I would have appreciated if they had disclosed somewhere publicly, or at least on their website, that they disabled the keyset. If I had known what was going on, I would not have reset my wallet and the recovery would have been much easier.

Just to clarify, I think keysets can be disabled without impact when enough time has been given to wallets to rotate to the new keyset and wallets are opened regularly enough or can run in the background. See this message in the telegram group by @gandlaf21.

0 sats \ 2 replies \ @Haiku7336 OP 1h

What does this mean in practive for wallet users? That they should rotate their cashu tokens every few weeks? I think in this case my funds were max 6 months old.

21 sats \ 1 reply \ @ek 1h

It should happen automatically in the background afaik

0 sats \ 0 replies \ @Haiku7336 OP 1h

Then something else must have gone wrong in this case. I definitely used the wallet and spent money from this mint a few times within these 6 months.

100 sats \ 0 replies \ @morata_voltz 1h

Hello buddy, i think you may see your email

26 sats \ 1 reply \ @DarthCoin 16h

I have been using their cashu mint with Mibinits wallet

I think the issue is on that side... and not on Voltz side. ecash cashu and minibits are still in early phase and use it only as testing purposes. I think that Voltz operators didn't know how to help you because they also depend on how cashu and minibits devs are responding to this issue.

I also had some technical difficulties with Minibits app, I contacted directly the dev to identify where is the problem. I always considered those funds as "testing funds".

0 sats \ 0 replies \ @Haiku7336 OP 15h

I have been using their cashu mint with Mibinits wallet

I think the issue is on that side... and not on Voltz side. ecash cashu and minibits are still in early phase and use it only as testing purposes. I think that Voltz operators didn't know how to help you because they also depend on how cashu and minibits devs are responding to this issue.

I also had some technical difficulties with Minibits app, I contacted directly the dev to identify where is the problem. I always considered those funds as "testing funds".

Could be, but the point is they even confirmed that they froze some funds and it coincided with that. What I found the most unprofessional is that they just disabled some funds and didn't post anywhere about it. They just waited for users to contact them after they started having errors. If you compare it to other wallet operators, like Coinos, they immediately made it public here, when they discovered a vulnerability.

If you are interested see also the entire exchange, that I posted here: #880902

15 sats \ 16 replies \ @ek 16h

Would be nice if you could share the full exchange between Voltz and you

Btw, I just saw this on their page:

Make a backup of your credentials and ESPECIALLY your User ID! This is very important for the recovery of your funds in case of credential loss…

Not sure if this was there when you signed up

1000 sats \ 15 replies \ @Haiku7336 OP 15h

Thank you for the quick reply. I attached the entire conversation:

Me

Dear Voltz team,

I am having an issue, that I can't access any more the ca 20.000 sats I had deposited on the cashu mint mint.lnvoltz.com.

The first time I noticed this issue was on Thursday, the 12.12.2024, when I tried to make a lightning payment and if failed. I am using the Minibits wallet. Since then, whenever I tried to send money from the mint, I was getting the error "Invalid Keyset". Today I tried to reset my wallet and recover the cashu tokens from the seed, but it doesn't find any tokens. With the other mints I had it worked.

Did you notice any issues from your side, that could have caused this disruption?

Thanks and best regards

Voltz

Hello, yes we are aware that some customers would have problems after we disabled this vulnerable Keyset. You can call me on Telegram t.me/EM_TLL to resolve it faster. I will help you provide me with your ecashs of your back-up only, from voltz mint.

With this, we will burn manually in our database and send you the funds returned by Lightning. All right for you? I say it, because we cannot reactivate Keyset due to its vulnerability.

So... I look forward to you on Telegram, until then!

Me

Thank you for the quick reply,

I have been having some issues with my telegram account recently, so I will try to give you the info through here:

Because I reset my wallet today, assuming it was a wallet issue, I don't have the actual key values or their backups. The only thing I have is the original seed of the minibits wallet. Since, I have emptied the wallet otherwise, I am fine in providing it here:

I hope, that it is possible to restore the funds with this seed. Please send the recovered funds to this lightning address:

Thanks and best regards

Voltz

Perhaps with SEED alone it is not possible to recover the secrets and signatures of Ecash. Are you sure you don't have any backup files? in this file contains all the secrets and signatures of the Mint that serve to burn in the database. Similarly, I will try to recover by the seeds and see if something appears. I will contact you as soon as you test.

Me

Yes, unfortunately, even the backup creation was not working, it was giving similar keyset errors. But the seed alone should also be enough. After the reset I was able to recover just with the seed the funds of the 2 others mints I had together with Voltz. I don't know the details of how it works, but I think it has some kind of function, where it goes deterministically through all possible ecash values based on the seed and checks which ones actually exist.

Voltz

Hello!

I have recovered the seed from your wallet several times but no funds have appeared. I needed the backup file with the secrets and signatures to manually check the database, add up the balance, burn the ecash bills and return the remaining balance to you via lightning invoice.

Are you sure you don't have this file?

Me

Hello!

yes, 100% sure I dont have it. I was not able to create it due to the keyset error, before I made the reset.

I dont know the technical details, but I assume that the seed based recovery queries the server for all possible secrets until it finds the existing ones. So if the keysets are disabled due to vulnerability, it doesnt find anything. For this reason it recovered the funds for the other 2 mints but didnt find anything for voltz.

Is it possible to temporary reenable the keyset to make the recovery and then disable it again? Or maybe create an offline copy of the database and perform the recovery with that?

Thanks and best regards

---Ne reply after that---

100 sats \ 10 replies \ @DarthCoin 15h

You see? Your lack of understanding how ecash works made you to lose funds and not Voltz. You are talking about Minibits app seed. That seed IT IS NOT LINKED to another mint that is not minibits. The seed is only for Minibits app.

In Minibits you have the option to backup the tokens, that RESIDE on your device and nowhere else. Voltz cannot recover your ecash tokens from Minibits app. If you erase those tokens, are gone.

The only thing Voltz can do is to dig up into your account and see the LN movements and do the math for the remaining balance and give you those sats.

Please understand that the sats are already on Voltz node, but you were playing around only with a bunch of IOUs ecash tokens.

Think about this: Voltz gave you some gift cards and you burn them. Now you complain to give you back the value of those burned gift cards. You are making them responsible for your own actions... that is not fair.

333 sats \ 0 replies \ @Haiku7336 OP 15h

You see? Your lack of understanding how ecash works made you to lose funds and not Voltz. You are talking about Minibits app seed. That seed IT IS NOT LINKED to another mint that is not minibits. The seed is only for Minibits app.

In Minibits you have the option to backup the tokens, that RESIDE on your device and nowhere else. Voltz cannot recover your ecash tokens from Minibits app. If you erase those tokens, are gone.

The only thing Voltz can do is to dig up into your account and see the LN movements and do the math for the remaining balance and give you those sats.

Please understand that the sats are already on Voltz node, but you were playing around only with a bunch of IOUs ecash tokens.

Think about this: Voltz gave you some gift cards and you burn them. Now you complain to give you back the value of those burned gift cards. You are making them responsible for your own actions... that is not fair.

Sorry, but I have to disagree here. It is true, that the created Cashu tokens are stored on the Minibits wallet. But it is also true, that the cashu Protocol provides a function, where with the seed the wallet can restore all tokens of a specific mint. Actually I had 3 different mints on that Minibits wallet, Voltz, Minibits Mint and Coinos Mint. And the tokens for minibits and Coinos get both restored just with the seed after I reset my wallet. Just for Voltz not, because they disabled my tokens.

20 sats \ 8 replies \ @ek 15h

Are you sure that a cashu seed is only for a single mint?

If I read NUT-13 right, it's a single seed for all mints. The mint only needs to support NUT-09.

100 sats \ 1 reply \ @gandlaf21 12h

correct

0 sats \ 0 replies \ @ek 11h

Thanks @gandlaf21!

reply on another page

0 sats \ 5 replies \ @DarthCoin 15h

idk what nut is supported by voltz. I didn't played out with that mint.

110 sats \ 4 replies \ @Haiku7336 OP 15h

What I can say is, that I have also done the seed recovery with Voltz in the past and it used to work. Just now not, which probably is due to them disabling my funds.

I am quite confident that it is technically possible to find out which disabled keysets my seed hits, they just dont have the interest / technical competence to do this.

view all 4 replies

0 sats \ 3 replies \ @ek 15h

when was your last reply?

100 sats \ 2 replies \ @Haiku7336 OP 15h

On 13 January I sent them the last message, I posted of the conversation, to which I got no reply. Then on 25 January I sent a follow up message, asking if they have any news here, to which again I got no reply. So now I ended up here. Before that they were quick and replied within a day.

1000 sats \ 1 reply \ @ek 15h

I see, weird. I shared your post in the cashu r&d telegram group.

0 sats \ 0 replies \ @Haiku7336 OP 15h

Thank you for the support!

reply on another page

1121 sats \ 4 replies \ @ek 2h

@Haiku7336, Voltz just reached out to me for some reason with apparently good news:

I asked them to signup and reply here.

0 sats \ 1 reply \ @ek 1h

0 sats \ 0 replies \ @Haiku7336 OP 1h

I was able to recover the funds. I posted an update here: #881432

0 sats \ 1 reply \ @Haiku7336 OP 2h

Thank you for your continuous effort!! Curious to see what they have to say.

0 sats \ 0 replies \ @ek 1h

No worries! Glad I can help.

21 sats \ 0 replies \ @kilianbuhn 2h

I didn't know they had a cashu thing but their Telegram group is FULL of complaints

I think their server is just weak or has oversensitive ddos protection or something. It seems to just constantly break

21 sats \ 1 reply \ @Butterfinger 5h

I have had problems with minibits too, but most of it was my fault then I learned how to revert and recover bad payments.

0 sats \ 0 replies \ @Haiku7336 OP 2h

I have had problems with minibits too, but most of it was my fault then I learned how to revert and recover bad payments.

Yes, minibits still has its issues, but in this case they even confirmed, that they disabled a keyset (#880902):

Hello, yes we are aware that some customers would have problems after we disabled this vulnerable Keyset

21 sats \ 0 replies \ @GregAsks 6h

The problem is that only mint know how many Satoshi they have... They don't know who owns what...

21 sats \ 1 reply \ @dingding541 14h

I have found minibits very shall we say in it's early days. I use cashu me and use the coinos mint and never had issues

0 sats \ 0 replies \ @Haiku7336 OP 2h

Coinos is definitely a good option. I also have that in the Minibits wallet and it is very reliable.

I understand that the wallet has still bugs, but in this case they even confirmed that they disabled a keyset, see this message from the entire conversation (#880902):

Hello, yes we are aware that some customers would have problems after we disabled this vulnerable Keyset

0 sats \ 0 replies \ @b291ad9285 2h freebie

You can contact t.me/EM_TLL on Telegram