Shentu Qingchun: I cracked a Trezor wallet with 1350 BTC

Containing a Trezor cold wallet containing 1,350 bitcoins (BTC), Chinese cryptocurrency celebrity Shen Tu Qingchun described how he cracked the code a year ago. (Synopsis: ICO whale lost 250,000 ETH private keys "470 million magnesium fear evaporation"!) Eager crackers can be divided into half) (Background supplement: What is the probability of Satoshi wallet "brute force attack"? Can you become a BTC millionaire? The real calculation probability shows you First, the introduction You read it right, it's not a title party, it's not a gimmick, it's a real thing, and it will be successfully restored on September 4, 2024. I didn't want to say this with such a high profile, but a few friends guessed that I recovered it, but I didn't admit it. But now I think it's nothing, this is a happy and memorable thing, so I wrote this article to commemorate it. The client, a foreigner, bought a Trezor hardware wallet in 2016, set up a private account, set up an advanced password, and deposited 1350 BTC. In 2019, the customer forgot the password and began to find someone to recover, someone once helped him use electronic buttons to enter the password through the Trezor development kit interface to recover, but the recovery speed was extremely slow, ran for half a year without success, and finally gave up. Second, take orders In early July 2024, the customer found me through the introducer and quickly negotiated the price. We immediately determined the recovery plan, which must be disassembled to get the chip to read the data. Therefore, we purchased a lot of Trezor wallet recovery related chips, equipment and tools from Singapore and China, and purchased 10 Trezor trainers. Although I knew some chip welding technology before, after all, there are not many opportunities to do it, and there is still a big gap between theory and practice. Therefore, we have worked hard to learn welding, and after half a month of day and night practice, we are proficient in using a series of equipment and tools such as welding guns, electric guns, embedded boards, oscilloscopes, chip programmers, chip recorders, programmable transformers, etc. And through some useless boards for the practice of soldering chips, the welding craft is almost practiced, although not proficient but enough. The recovery exercise of the chip is also carried out, although we are clear about the principle and process, but the practice is still not proficient enough. Therefore, we purchased relevant chips, equipment and tools, supplemented countless voltage and circuit knowledge, made and welded circuits, conducted countless tests, and finally became proficient in reading the data in the Trezor chip. After reading the data in the chip, it takes us 2 weeks to conduct technical research, write the data decryption program and the final password recovery program, and optimize the GPU recovery algorithm, which greatly improves the recovery efficiency. At the end of July, the introducer brought 2 Trezors of the same model to test, and the PIN code, password and mnemonic phrase set by the introducer did not tell us. It took us 2-3 days to read the data, and according to the password clues provided by the introducer, we successfully recovered the password, so that the customer saw the hope of success. In mid-August, the customer set up the same model of Trezor by himself, including PIN code, password and mnemonic phrase, and the introducer did not know the content, only the password clue. The client asked the introducer to bring this Trezor to recover. This time, it only took us 3-4 hours to successfully read the data and recover the password, so the customer was completely confident in our technology. 3. Restoration At the beginning of September, according to the consultation with the customer, we took all the equipment and signed the contract with the customer and the introducer to start the recovery. Within 3 hours of getting the wallet, we got the chip data accurately. After decrypting the data, use the written GPU recovery program, according to the password clues provided by the customer, and use all our computing power to start password recovery. After 24 hours, we adjusted the password generation strategy several times, but to no avail, everyone's mood was very anxious. If we can't recover on the third day, the customer is ready to leave, we are ready to change hotels to continue to recover, and if we can't run out within half a month, we will give up the cooperation. On the 2nd and 3rd days, we repeatedly combed through the password clues with customers and introducers. On the third day, at breakfast, we discussed the password clues again, refined some changes, and continued running. After 1-2 hours of running through these clues, there is an impasse again. The customer went back to sleep, we continued to look for clues with the introducer, I think the customer clues may be redundant, should be simplified, immediately rewrote the simplified password generation procedure, on the computing power run, a few minutes later, the password came out!! We told the introducer the good news, and he went crazy with joy and even knelt down to thank us. After that, he called the customer who was sleeping, and the customer came in to confirm the matter again and again, and he was also crazy, and after 8 years of waiting, there was finally a happy result. The recovery is successful, and everyone is financially free! The customer also bought the coin price of $375 in February 2016, which has risen to $58,000, 155 times, and has already doubled. In addition, there are two domestic friends among the introducers, one of whom is a big V in the currency circle and the other is a well-known lawyer, but he is unwilling to expose it. We informed both of them and everyone was excited. The next thing is simple, we give the customer, the introducer, and ourselves the corresponding amount of bitcoin according to the contract, and then everyone says goodbye to each other. The other altcoins were sold in the agreed proportions that evening. At this point, this list ended smoothly. Fourth, experience Reviewing the list, we spent a month and a half studying technology, writing code, and restoring chips, from unskilled to proficient, which is a process that tests the patience and learning ability of technicians. With these foundations, the recovery of hardware wallets after that is very experienced. The most exciting moment of the whole process was not recovering my password, but my hands shaking when the customer handed me the wallet. This is a big wallet with 1350 bitcoins, and the customer handed it over to me to recover, what a trust. Because the recovery method is a little uncertain, although it has been successful for about 10 consecutive times, although I have signed a waiver contract, I am still a little worried that there will be an accident that will make such a large amount of money disappear, then I have a bad conscience. My blood pressure was always high when I started recovering the chip data, and I measured it with my watch: 160/110. Because I have first-degree hypertension, although I take antihypertensive drugs every day, I can't be too excited. This value has reached the second level of hypertension. After 1-2 hours, the blood pressure slowly decreased, so that when the password was restored later, the blood pressure did not change much. But after this list, wallets less than this amount will not excite me anymore. The coin circle makes your heart stronger, which is also a test in life. Because of this list, I sat in front of the computer for 12-14 hours a day for 1 and a half months, intense study, and mental tension, and I didn't feel any discomfort at that time. But when this list is over, the spirit is relaxed, the sacrum coccyx is faintly painful for 1-2 months, and it takes a lot of plaster to gradually relieve it, which is the price of success, but it is worth it. Fortunately, there were no accidents, and everything went well. V. Postscript I was admitted to the ATR National Defense Key Laboratory of Shenzhen University in 2011 to study for a doctorate in cryptography, began to study blockchain in-depth in 2013, and began to do wallet recovery in 2019, with sufficient technology and experience accumulation. At the end of 2020, we bought dozens of 8-card 3080 and 3090 servers with millions of dollars (editor's note: RMB), and only did password recovery. At the end of 2024, we dismantled 15 million yuan (editor's note: RMB) to purchase dozens of 8...