Michael locked his Bitcoin with an encrypted password, and Joe Grand and his team got it back.
Over the years, investing in Bitcoin has become a craze. Millions have jumped on the trend, seeking better financial gains. A man named Michael locked away his Bitcoin in a password-protected digital wallet, according to Wired. In 2013, he safely stored over $3 million in Bitcoin but later couldn't access it after losing the password, Forbes reports. When this happened, Michael was desperate to recover his lost fortune. He reached out to Joe Grand, a renowned researcher, hardware expert, and hacker, for help. Initially, Grand turned him down.
Michael had stored the password in an encrypted form, but the file got corrupted. Faced with losing a huge amount, he reached out to Grand, knowing he had previously helped recover another man’s hardware wallet password. Known as “Kingpin” for his exceptional hacking skills, Grand initially refused since this involved a software wallet. Persistent, Michael asked again, and this time, with a colleague's assistance, Grand agreed to help.
The plan was to hack into the system and retrieve the password from the backup. However, there was no alternate storage for the password because Michael was paranoid about security breaches. “ At [that] time, I was really paranoid with my security,” he said. What followed were months of hacking, understanding, and brainstorming to find a flaw in the system. Finally, the team found an error that led to success. Grand shared references to his work in a post on X.
The @roboform password regeneration source code and technical notes are up! https://t.co/WbQebgksDJ
— Joe Grand (@joegrand) May 30, 2024
The team discovered that the password wasn’t random but followed a pattern. Any information about the date and time it was generated would help. Unfortunately, Michael couldn’t recall any details. Despite trying different dates and data, their efforts were initially unsuccessful. “They annoyed me because who knows what I did 10 years ago,” Michael recalled. With hard work and a bit of luck, they eventually cracked the code. “We ultimately got lucky that our parameters and time range were right,” Grand said. He also shared updates with @KimZetter in a thread about the project, explaining more about the flaw.
The flaw allowed famed hardware hacker @joegrand to turn back time and cause the RoboForm password manager to believe it was 2013 and spit out the same passwords it generated a decade ago. @roboform fixed the flaw in 2015, but it appears it never told customers about it...
— Kim Zetter (@KimZetter) May 28, 2024
Grand shared the details of his achievement in a YouTube video. Finally, the team tasted victory, restoring Michael’s lost fortune. Grand took a percentage for his work and handed over the password, making Michael a millionaire. In hindsight, Michael is glad he stored the Bitcoin, which cost around $5,000 at the time. He admitted he might have sold it when its value was just tens of thousands, but the stressful wait earned him much more. “That I lost the password was financially a good thing, ” he exclaimed.
This was a super fun project and a reminder about the lasting effects of security problems long after they're patched. https://t.co/GLhXMWRDSn
— Joe Grand (@joegrand) May 28, 2024