1. Objective
In this post, “One way to steal bitcoins”,
(1) I will show you how a bitcoin address and its associated private key are generated or, to be exact, picked.
(2) Then, using the mechanism, I will attempt to find an address with positive bitcoin balance by brute-forcing. Once an address is found, the bitcoin inside the address belongs to me because I already know its private key.
As the brute forcing tool, I have built a web application in ReactJS that loops through random addresses until it finds balance greater than 0.
This tool, a self-built web application, is safe and open to anyone. Please, feel free to visit and try to steal bitcoins from someone else’s wallet. All the stolen bitcoins are yours. Below is the link to the application. I named it “Bitcoin Hunter”
2. Common misunderstanding of bitcoin key pair— they are not like your google username and password.
Most people think that the bitcoin key pair is just like your username and password given by a web host like Google, Facebook or Twitter. But it is completely different. Remember that the bitcoin blockchain is decentralized or distributed, which means there is no central entity who can assign/authenticate/control/remove your credentials. The absence of a central entity is what makes the blockchain technology more secure and why people call it innovative.
3. Then, how is a pair of address and private key assigned to you?
You are probably already aware that you have to own an address and private key in order to receive/send/store bitcoins. You are right. Below is an example of a real Bitcoin Key Pair.
(Address, Private Key) = (“1BFWPSCcN35orxtVqYtgoXQkVP91uWDFsj”, “L3AQeXNZzRkh2DgLN6ndXFiPx71jgDDxChWuCayz2yfwU7PN2hEW”)
Unlike your username and password from a google account, the pair is not to be registered by a certain host. It is just out there. You just pick one for your own use. No one needs to ask the pair to be registered because there is no entity who handles the registration. It just exists. You pick one of them and use it for receiving, sending and storing bitcoins without anyone’s permission.
Let me go into a little bit more details.
First, bitcoin address’s private key is simply an integer between 1 and 115,792,089,237,316,195,423,570,985,008,687,907,852,837,564,279,074,904,382,605,163,141,518,161,494,336 (=little bit less than 2²⁵⁶) .
There is nothing easier than picking one out of the huge set of integers. The integer is your private key.
Now, someone might question why the exampled private key, “L3AQeXNZzRkh2DgLN6ndXFiPx71jgDDxChWuCayz2yfwU7PN2hEW”, does not look like an integer at all. Yes, you are right it does not. However, it is a product of multiple hashes of an integer. If you pick the same integer, you will always get the same private key while different integer results in a different private key. Therefore, it is safe to say the integer is the private key, and the private key is the integer.
OK.. it is a turn for the address. The address is also a product of complex mathematical manipulations of the private key. It is impossible for human to do the manipulations, but it can be done by computer less than a millisecond. I will not delve into that too much about the mathematical manipulation because it may blur the point of this post. All we need to know is “how to steal bitcoins”.
Keep in mind the followings.
- A private key is an integer from a very large set of integers.
- The associated address is produced by a series of mathematical tasks on the private key. It can be done very easily by computer codes.
The flow is as follows.
It is easy to go from the top to button, which means you get an address very easily from an integer by computer coding. However, it is practically impossible to go from the button to the top even by computer, which means you will never be able to find a private key from an address. It is pretty obvious why it is designed that way.
4. My way of hunting for bitcoins.
I made a web application that generates 100 random integers a second. The integers generate private keys and addresses. The web application looks up balance of each address and check if the balances are greater than 0. Once it finds a plus-balanced address, it stops searching.
It is simply brute-forcing the bitcoin blockchain.
This is the web application I have built for the tasks. Feel free to visit and try to find someone else’s bitcoins and get rich. By the way, bitcoin price is around USD 10,000 as of Aug 2019.
Here is the richest bitcoins address you might want to find as of Aug 15, 2019. Do you see billion-dollar worth addresses?
<Source: https://bitinfocharts.com/top-100-richest-bitcoin-addresses.html>
5. Estimated time of finding a plus-balanced address!
Let me make a guess about how long it would take to catch a plus-balanced bitcoin address by the tool.
Assuming the world population is about 7.7 billion or 7,700,000,000. And everyone has one bitcoin address with a positive balance, Below is how many addresses you should try to catch one address with bitcoins on average.
115,792,089,237,316,195,423,570,985,008,687,907,852,837,564,279,074,904,382,605,163,141,518,161,494,336 / 7,700,000,00 =
15,037,933,667,183,922,070,317,761,428,789,981,242,841,879,945,019,516,658,500,893,671,424 timesMy tool, the web application, generates 100 private key a second, therefore, it is takes
150,379,336,671,839,229,121,427,045,313,900,621,281,643,435,895,985,359,803,180,384,256 seconds1 year has 31,557,600 seconds so it is takes
4,765,233,625,872,665,250,064,655,325,902,596,697,972,253,261,885,404,610,560 years1 generation lives about 100 years due to medical advances, it takes
47,652,336,258,726,654,678,453,701,553,032,133,145,320,020,182,170,599,424 generations
This is average duration until you get “one” positive-balanced bitcoin address by 100 per second brute-forcing. Of course, you can shorten this by upgrading the application like making it 1,000 per seconds or 10,000 per seconds.
Start now and get rich!
Thank you for reading.
