100Bn USD in crypto "lost", can it be recovered?
TOKEN2049 London 2021 · October 2021 · 14:55
KeychainX CEO Robert Rhodin examines the estimated 100 billion dollars of crypto that is lost or locked away and asks whether it can be recovered. The keynote covers lost private keys, forgotten wallet passwords and the recovery techniques and key management practices that determine whether funds come back. Given at TOKEN2049 London 2021.
Speakers
Topics
From TOKEN2049 London 2021, hosted by TOKEN2049.
Transcript
Hello everyone. I'm going to talk briefly about uh all the Bitcoin that is supposed to be lost. Uh there is various reasons why they are lost. Uh it's not only in the clients and I'm going to explain what can be done and uh what should be done. Uh the problem um mostly it's bad user habits. People don't save their seed. They click I'll do it later. Um they write down a note that it's uh in a pocket and we received like seeds that gone through a wash machine that we have to go through the words.
Uh bad core developers, what's that? It's uh basically there are few versions of uh Bitcoin Core that has bugs. That's been That's been solved, but during the time that they were having those bugs people were unable to recover their passwords. Uh to give you an example, if someone used a Mac in 2015 and they used the pound sign and uh saved their password that password was not recoverable later on. Uh another thing that uh there is still about 4 500 uh Ethereum pre-ICO wallets that are not recovered. And uh one of the problem if you go on the
GitHub uh you will see that they changed the code during the ICO and uh nobody want to talk about that. Uh another thing is upgrade security upgrades for hardware wallets uh and the list goes on. There's also of course uh family members that pass away. Uh receive quite a lot of uh requests from wives or kids uh where their dad or or husband passed away and they have like limited information or the information that have doesn't work.
Um What else? You can go on. So, who is Kitchen X? We incorporated 4 years ago in the US. We are currently um moving to Zug in Switzerland because of the regulation in the US. Um we have over a billion in wallets currently that we work on. Um we also check new wallets that are coming out, look for bugs because whenever there is a new blockchain coming out, a new wallet, there's always some little error that will make um have the key unrecoverable.
Um we write our own tools. Um we check on the tools that are on GitHub. If you're a programmer, any of you, you probably know BTC recover, hashcat, etc., etc. But they don't cover all the wallets and they also have bugs. For example, there is a tool free tool called hashcat that is used to break wallets. Um if if you have a blockchain.info wallet from 2012, there's a big chance it will not find the password even if you have the password because it's not 100%. Um we also build hardware.
Um we have an R&D department that is working on um something that generate hashes. That is what we usually do. Um when someone has a wallet, um that password to the wallet is generating a hash and to find a password, we need to check against hashes. Um and also we have a patent pending since 2019 that we filed in both the US, Japan, Europe. Um it's going to be um pending everywhere. Um I'm going to talk about that later.
Can go through that. So, 2020, we also launched something called Kitchen X Pro, which is working with exchanges and um and the funds that let's say there is a user database that an exchange has. And when people forget their passwords, they're not able to give them because they're self-custodial. But sometimes it's possible to download the wallet. Let's say if you have a blockchain.com, it's possible to get the encrypted wallet even though they say on the webpage that your 12 words are the only one that can recover it.
So, what else? What assets do we have? We built a CPU farm because some of the wallets that we have need CPUs. We have a GPU farm, which is used to mine. So, probably when Ethereum moves from Ethereum 1 to Ethereum 2, there'll be a lot of cheap GPUs for us to buy. we also have special software that will go through mnemonic phrases. Let's say you have a mnemonic with 12 words and you two or three or four of them are wrong, then we can find the right combination to that wallet. We can also take all the 12 words and do all the combination there are.
And that would probably take a month to find, but it's possible. Uh if you have a Trezor with 24 words, we can do up to four missing words and we can also find a pass phrase for you. And we do that offline, so it's not like we need a physical Trezor. And of course, you probably also know that Uh, you can with the older Trezors you can use a something a device with electricity that will trigger the Trezor to dump the seed. So, that's also possible. Uh, so so basically we have a wallet.
Uh, it's encrypted in a file. We send it to a server. We call it the brain server which keeps all the passwords that we tried for that wallet. And if the password has been uh found, it saves it to file called the pot file. Uh, we usually use a GPU crack rig. And when we get the password, we unlock the wallet, ask the client for a new address. Because usually people when they have a wallet, they ask maybe a friend or someone on on uh Reddit to help them with the password. And uh when we find it, we sell we tell them that we probably need to use it to new one because we never know who else has that wallet.
So, the market size we believe is a 100 billion. And where we where did we get that amount? Uh, Chainalysis says 20% of all Bitcoin is lost. Uh, so that's about 200 billion. Uh, if we look at the uh uh Ethereum uh blockchain uh and we scan them every day, we can see sometimes uh the amount of Ethereum that hasn't moved since 2017. That's probably about 7-8%. Uh, we also get a lot of requests from uh Dogecoin which has uh probably everyone know got very much up in price. And that also uh means a lot more work for us with Dogecoin wallets. We recovered a wallet for a guy in the US a couple of months
ago that had uh 10 million Doge that he bought for $1,500. And when we recovered it was worth 3 million. So, that's a that's a huge That was if very he was like very happy. And our fees are between 10 and 50%. We usually start with 20%. Uh if it's a big wallet, we can do a discount. And then over time, we increase the amount because it costs us to run the service, our time, etc. etc.
So, what what does the future mean for us? It's probably more wallets. Uh the more people use uh blockchain, the more people lose their keys. With new blockchains, we've seen recently a rise in Solana wallets, uh in other wallets. Uh a lot of people ask us with Shiba coins, etc. Uh and also uh the more people get older and they pass away, uh their families going to try to use their their wallet to recover them, and they're probably not very familiar with all the ways that you can do it. So, sometimes we even have people sending us a private key and asking, "How do I do
that to move it?" So, we have all kinds of problem. Uh the patent pending we have uses several key features. One of them is three fingers. Why do we use three instead of one? It's because with one fingerprint, you have one in 50 50,000 people have it. So, in uh 1 million, uh you get 20 people have the same fingerprint. Uh we also use GPS uh to create the private key and salt it. So, we do 50 by 50 squares.
And uh for example, you can go on your ranch, uh create that wallet, and then you can only access it from that point. Which also means uh if someone try to hack your wallet, he has to get into that your ranch uh to do that. We also have a few other parameters uh for that wallet which is uh doing depending on the height. So, it can track how high you are on location. We can add time. We can add date and basically anything with it. We also have something called social recovery that Vitalik Buterin wrote about last year.
Uh so, we really hope that we start to use that because we filed a patent a year before. Uh so, we'll see how that goes. It's It's still patent pending and it could take a a few years before it gets confirmed. So, this is uh our contact info and uh if anyone has any questions, then feel free to to ask. Shoot them away. Great. Robert, thank you so much for that awesome presentation. Big round of applause for Robert. That's excellent. Thank you so much. Um individuals like you and your company really do uh help in support um our development and it's a really key part to to have you guys
here. So, really appreciate that. Maybe I'll open the floor to some questions if anybody has anything. Gentleman here. Hi. Is the biometric wallet compatible with all the EVM compatible chains like I don't know Binance Smart Chain, Phantom, Avalanche, etc.? Uh so far we've done it for for Bitcoin and Ethereum. So, any like And any blockchain you can add it. It's just you know how you create the keys, really. Got it. Any more questions?
Any more questions? Well, Robert and his team Oh, lady at the front there. How are you? Hi. I was hoping you could expand a bit more on the keys in your wallet. How do you do that? Uh What What do you mean how I expand? How do you secure the private keys and yet allow them to be They they are created on the fly. So so when you're at the special location and it's a special time and you access your wallet, it creates the key based on the info from your fingers, the location where you are.
So it's so it's just auto generated. Cool. Well, gentleman there I can get to you. All right, you're making me work today, huh? Jesus, I haven't even had me lunch. Come on. Thanks very much. Found that very interesting. One of your solutions you mentioned that you have hardware for breaking encryption. So that's obviously uh quite interesting and has a lot of applications outside of uh Bitcoin. So can you talk a bit more about that?
How we do it or what encryption are you breaking? Of Let's say you have a Bitcoin core wallet, right? It's it's uh it's it stores the password. It's hashed. so what we do is we extract the hash. And then we either have a part of the password as hint from the client. So let's say you have a You have a password called password123 {exclamation point}.
But the client says my password is uh password 3000. So what we do is we break down the the hints and we do combinations of them. We add random characters. We remove random characters. We check against uh leaks. And then we create a hash from that password hint and compare it with the wallet. Okay, thanks very very Gentleman at the back, maybe we can How are we going to do this?
I know what we'll do. Let's have a little bit of audience participation. Hello. Thanks for that, by the way. Is it fair to say that whichever techniques you're using, they're all shortcuts through brute force? Or is there I mean, you're not going to tell me otherwise, but is that fair to say? It's fair to say because there's some light. So, the You mentioned that there's software and special hardware that you're building. Yeah. And are these all to accelerate the brute force time? Yes, yes, yes. Because depending on on the algorithm that the keys is all stored, let's say if you have a Ethereum version 3 script, which cannot use GPUs, you can only use a CPU. And if it's like salted
with the N value 264,000, you can now probably only do like 10 or 20 passwords a second on a CPU. Our idea is is I think what we're going to some other people doing as well is a basic build a custom-made ASIC. Instead of creating hashes for mining Bitcoin, it would create hashes based on that algorithm to speed up the process. I hope that answers your question. Yeah, perfectly. Thank you. Thanks.