Australian Police Crack Coded Crypto Wallet, Recovering $5.9 Million

[yhiaali3]

The Australian Federal Police (AFP) announced the successful decryption of a coded cryptocurrency wallet backup, unlocking AUD 9 million (USD 5.9 million) in digital assets. AFP Commissioner Krissy Barrett lauded the effort as “miraculous work,” crediting a data scientist within the agency who has earned the moniker “crypto safe cracker.”

The breakthrough occurred during an investigation into a suspected “well-connected alleged criminal” believed to have amassed cryptocurrency through the sale of “a tech-type product to alleged criminals.” AFP investigators discovered password-protected notes on the suspect's mobile phone. Subsequent examination revealed an image containing a seemingly random sequence of numbers and words, Barrett explained.

The numbers were organized into six groups, featuring over 50 different combinations. The AFP digital forensics team concluded that the data was likely connected to a cryptocurrency wallet. The suspect allegedly refused to provide the decryption keys, an offense punishable by up to 10 years in prison under Australian law.

The Decryption Process
One of the AFP's data scientists recognized that the suspect had attempted to create a complex obfuscation method. To decode the 24-word seed phrase, the data scientist deduced that the first number from each sequence had to be removed. This process unlocked the wallet, revealing assets valued at $5.9 million.

The data scientist noted that “some of the number strings felt wrong and they looked like they were not computer-generated.” He further elaborated that these strings “looked like a human had modified the sequence by adding numbers to the front of some sequences.”

https://www.markets.com/news/australian-police-crack-coded-crypto-wallet-1513-en

It seems the accused saved the wallet seed as randomly generated password-protected note on his phone and added numbers to the beginning of the words. He thought he was clever saving the seed this way, but the scientist known as the "crypto vault hacker" managed to crack the code and discover the vulnerability. This is a huge mistake.

It's worth noting that this isn't the first time this same scientist has discovered a crypto wallet seed. So, are we in danger now, or is the problem with the seed storage method itself?

Also, the article caught my attention because Australian law criminalizes refusing to disclose one's wallet seed, with a prison sentence of up to ten years. So, will we be obligated to disclose our seeds if the police request it, even if there's no criminal offense?

[Hatchy]

It's worth noting that this isn't the first time this same scientist has discovered a crypto wallet seed. So, are we in danger now, or is the problem with the seed storage method itself?

Did you not read on how he stored his keys in the first place? He obviously screwed up by trying to play smart. He manually encrypted his seedphrase by adding words to the beginning of some words, that's totally lame. Everything about his method of storing his keys was wrong so that made the job of the Australian police to be much easier and here they are claiming to be some kind of smart ass. Yet again another reason to store your keys not on your devices. Aside from legal authority going, hackers can as well get into your device and do same thing. You can imagine how much worth of crypto he had stored with his said genius encryption method.

Also, the article caught my attention because Australian law criminalizes refusing to disclose one's wallet seed, with a prison sentence of up to ten years. So, will we be obligated to disclose our seeds if the police request it, even if there's no criminal offense?

the authority requesting for someone keys is something im still trying to get my head around, it's totally wrong because we have our right and we what if the assets wasn't traced to any illegal activity, they might just use this law to take down many crypto investors forcefully without committing any crime.

[yhiaali3]

Did you not read on how he stored his keys in the first place? He obviously screwed up by trying to play smart. He manually encrypted his seedphrase by adding words to the beginning of some words, that's totally lame. Everything about his method of storing his keys was wrong so that made the job of the Australian police to be much easier and here they are claiming to be some kind of smart ass. Yet again another reason to store your keys not on your devices. Aside from legal authority going, hackers can as well get into your device and do same thing. You can imagine how much worth of crypto he had stored with his said genius encryption method.

This is truly stupid. This is what often happens: criminals are skilled at theft and fraud, but they make stupid mistakes that lead to their discovery. He has learned a harsh lesson now and will have enough time in prison.

the authority requesting for someone keys is something im still trying to get my head around, it's totally wrong because we have our right and we what if the assets wasn't traced to any illegal activity, they might just use this law to take down many crypto investors forcefully without committing any crime.

I don't know what the laws are on this point in other countries, but I assume that the police are only allowed to request the seed in criminal cases, i.e., if the person who owns the wallet is accused of fraud or money laundering.

[zasad@]

All you had to do was come up with a password phrase and keep it in your head.

[stompix]

Also, the article caught my attention because Australian law criminalizes refusing to disclose one's wallet seed, with a prison sentence of up to ten years. So, will we be obligated to disclose our seeds if the police request it, even if there's no criminal offense?

If you're under a criminal investigation, yes!
https://classic.austlii.edu.au/au/legis/cth/consol_act/ca191482/s3la.html
The moment you deny investigators access to a computer or a password-protected file, you can be charged with that.

Anyhow, they didn't really "crack" the wallet, he had the seed words in different files in his computer, it was just a matter of combinations, nothing else.

It's worth noting that this isn't the first time this same scientist has discovered a crypto wallet seed. So, are we in danger now, or is the problem with the seed storage method itself?

No danger whatsoever unless you save your seed on your computer, and you think swapping the first letters would make that impossible to crack.

[yhiaali3]

It's worth noting that this isn't the first time this same scientist has discovered a crypto wallet seed. So, are we in danger now, or is the problem with the seed storage method itself?

No danger whatsoever unless you save your seed on your computer, and you think swapping the first letters would make that impossible to crack.

Yes, this is a huge mistake. While scammers are usually very careful, this scammer made a grave error by using such a primitive method. Saving the seed on a mobile phone, even in a protected file, is a serious mistake.

Apparently, he didn't care much since he easily obtained the money through theft. Perhaps he thought that making money through fraud was much easier than saving the seed.

[Iron Fist]

Yes, this is a huge mistake. While scammers are usually very careful, this scammer made a grave error by using such a primitive method. Saving the seed on a mobile phone, even in a protected file, is a serious mistake.

I didn't see anywhere in the article that he was accused of scamming. Where did you get that from?

Anyway. He must've saved the seed somewhere, right? If he'd just jotted it down on paper at home like most people do, the cops would've found it easy. Guess he figured his digital way was safer. And it might have been, if he'd used stronger encryption.

Apparently, he didn't care much since he easily obtained the money through theft. Perhaps he thought that making money through fraud was much easier than saving the seed.

Just because he was accused of a crime doesn't mean he's a thief or a fraud. Don't judge too quickly.

[Free Market Capitalist]

All you had to do was come up with a password phrase and keep it in your head.

Relying on memory can and often leads to mistakes. It's one thing to have to cross a border and, for that temporary situation, learn your seeds and get through, which already carries a risk, but relying on your memory permanently is a recipe for disaster. It doesn't matter if you're Einstein. And Einstein himself has some very revealing sayings about this, such as don't memorize what you can read in books, or that a small pencil is better than a great memory.

[Majestic-milf]

 Well the attitude of the alleged criminal doesn't show he's " well connected" or even smart because for someone who has such dealings with criminals should have been able to come up with a better way to hide his seed phrase. Or was he trying to fool the police because to them they may feel that he might use something very difficult to crack.

 Also, I feel that that statement of refusing to disclose your wallet seed being punishable is if you're a suspect and you're trying to hide or withhold anything that could make them handle their investigation properly because it would be a breach of privacy on a normal day for the police to ask you to disclose a private information.

[zasad@]

All you had to do was come up with a password phrase and keep it in your head.

Relying on memory can and often leads to mistakes. It's one thing to have to cross a border and, for that temporary situation, learn your seeds and get through, which already carries a risk, but relying on your memory permanently is a recipe for disaster. It doesn't matter if you're Einstein. And Einstein himself has some very revealing sayings about this, such as don't memorize what you can read in books, or that a small pencil is better than a great memory.

One word is much easier to store than 12-24.
You can write it anywhere, and few people will guess it's a passphrase. Even if they do, you can add your Social Security number (or any other information you can easily recover) to it.

[FinneysTrueVision]

You are only in danger if you are using bad practices to secure your seed. If you are handling millions of dollars obtained from criminal activity, you wouldn’t want to rely on weak amateur encryption.

All you had to do was come up with a password phrase and keep it in your head.

A wallet passphrase and some decoy wallets with a small amount of funds, in case they cracked the seed but not the passphrase, should have been the bare minimum. People who resort to crime to make a living are typically not that smart however and make basic mistakes.

[Free Market Capitalist]

One word is much easier to store than 12-24.
You can write it anywhere, and few people will guess it's a passphrase. Even if they do, you can add your Social Security number (or any other information you can easily recover) to it.

I thought you were referring to the seeds, not the passphrase. I don't know, in the case mentioned in the OP, I don't think it's foolproof either if you write it down somewhere, even if you add your social security number. In this case, the seeds had also been stored in a camouflaged way; they weren't the typical paper note with the seeds written on it. But, yes, in any case, to rely on memory for a single word is less risky, although not completely risk-free.

[yhiaali3]

Yes, this is a huge mistake. While scammers are usually very careful, this scammer made a grave error by using such a primitive method. Saving the seed on a mobile phone, even in a protected file, is a serious mistake.

I didn't see anywhere in the article that he was accused of scamming. Where did you get that from?

I don't know if selling a "tech product" to alleged criminals, as mentioned in the article, constitutes scamming or not, but it is a crime under the law.
What kind of "tech product" do you think he's selling to criminals? Is it a product to help people or to defraud them?

Apparently, he didn't care much since he easily obtained the money through theft. Perhaps he thought that making money through fraud was much easier than saving the seed.

Just because he was accused of a crime doesn't mean he's a thief or a fraud. Don't judge too quickly.

I haven't judged him to be a thief or a fraudster, but the police have. I'm simply relaying what was written in the article.

[m2017]

It seems the accused saved the wallet seed as randomly generated password-protected note on his phone and added numbers to the beginning of the words. He thought he was clever saving the seed this way, but the scientist known as the "crypto vault hacker" managed to crack the code and discover the vulnerability. This is a huge mistake.

The main mistake here is storing the seed-phrase on a phone, which everyone carries with them at all times. This doesn't increase the chances of keeping the seed-phrase safe; on the contrary, it increases the risk of losing it (if lost, stolen, or confiscated).

This is the equivalent of the owner of this wallet carrying a suitcase full of cash, disguised as clothes, inside the suitcase, hoping no one would notice this wealth. It's extremely reckless and naive.

It's worth noting that this isn't the first time this same scientist has discovered a crypto wallet seed. So, are we in danger now, or is the problem with the seed storage method itself?

This scientist wouldn't have been able to do anything without the phone containing the encrypted seed-phrase, had it not been within his reach. Therefore, the wallet owner could have avoided the danger.

This story clearly demonstrates that you shouldn't think you're smarter than others and rely 100% on your encryption - it can be cracked. The only "salvation" is to ensure that the seed-phrase never falls into the wrong hands.

Also, the article caught my attention because Australian law criminalizes refusing to disclose one's wallet seed, with a prison sentence of up to ten years. So, will we be obligated to disclose our seeds if the police request it, even if there's no criminal offense?

Ten years in prison is an extremely high sentence, disproportionate to the crime.

What caught my attention in the article was that the police cited "likely criminals" from whom the wallet owner received payments. In other words, the police aren't providing 100% certainty (evidence) of the wallet's criminal origin. I believe this is a very serious matter, as every owner of a hardware wallet could effectively be subject to criminal prosecution (ignoring the wallet's right to privacy).

[PrivacyG]

What caught my attention in the article was that the police cited "likely criminals" from whom the wallet owner received payments. In other words, the police aren't providing 100% certainty (evidence) of the wallet's criminal origin. I believe this is a very serious matter, as every owner of a hardware wallet could effectively be subject to criminal prosecution (ignoring the wallet's right to privacy).

If they were 100 percent certain and honest then they would not say they 'cracked' the Wallet and it would not be a curious story to read any more.  If the title was 'Australian Police Find Bitcoin Wallet Seed In Phone' then I presume you would have lost any interest.

[yhiaali3]

Also, the article caught my attention because Australian law criminalizes refusing to disclose one's wallet seed, with a prison sentence of up to ten years. So, will we be obligated to disclose our seeds if the police request it, even if there's no criminal offense?

Ten years in prison is an extremely high sentence, disproportionate to the crime.

What caught my attention in the article was that the police cited "likely criminals" from whom the wallet owner received payments. In other words, the police aren't providing 100% certainty (evidence) of the wallet's criminal origin. I believe this is a very serious matter, as every owner of a hardware wallet could effectively be subject to criminal prosecution (ignoring the wallet's right to privacy).

(ignoring the wallet's right to privacy) is truly regrettable. This is a violation of privacy by the police based solely on suspicion. It reminds me of a video that circulated some time ago where a police officer displayed a seed phrase on camera to a suspect he had arrested. The suspect was carrying the seed in the form of scraps of paper. He was merely a suspect, yet his privacy was violated, and his seed was displayed on camera.
https://cointelegraph.com/news/police-body-cam-leaks-suspect-s-seed-phrase-during-vehicle-inspection
Therefore, carrying a seed whether on a mobile phone or on paper is a big risk.