Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Bitcoin

Crypto Startup Bankrupt After Losing Password To $38.9 Million Physical Crypto Wallet (404media.co) 77

Posted by BeauHD from the facepalm dept.
An anonymous reader quotes a report from 404 Media: A buzzy startup offering financial infrastructure to crypto companies has found itself bankrupt primarily because it can't gain access to a physical crypto wallet with $38.9 million in it. The company also did not write down recovery phrases, locking itself out of the wallet forever in something it has called "The Wallet Event" to a bankruptcy judge. Prime Trust pitches itself as a crypto fintech company designed to help other startups offer crypto retirement plans, know-your-customer interfaces, ensure liquidity, and a host of other services. It says it can help companies build crypto exchanges, payment platforms, and create stablecoins for its clients. The company has not had a good few months. In June, the state of Nevada filed to seize control of the company because it was near insolvency. It was then ordered to cease all operations by a federal judge because it allegedly used customers' money to cover withdrawal requests from other companies.

The company filed for bankruptcy, and, according to a filing by its interim CEO, which you really should read in full, the company offers an "all-in-one solution for customers that remains unmatched in the marketplace." A large problem, among more run-of-the-mill crypto economy problems such as "lack of operational and spending oversight" and "regulatory issues," is the fact that it lost access to a physical wallet it was keeping a tens of millions of dollars in, and cannot get back into it. [...] For several years, the company then took customer deposits into this address, to the tune of tens of millions of dollars. In December, 2021, "when a customer requested a significant withdrawal of ETH that the company could not fulfill [from other wallets,]" it went to withdraw it from this hardware wallet. "It was around this time that they discovered that the Company did not have the Wallet Access Devices and thus, could not access the cryptocurrency stored in the 98f Wallet."

The company then, for several months, had to "use $76,367,247.90 in the aggregate to purchase ETH to fund customer withdrawals." The money stuck in the wallet is currently worth $38.9 million as of August 22, it claimed. It is worth mentioning that the company did not tell regulators or customers about this issue for months after it discovered the problem. The company has still not solved this issue: "The Company remains unable to access the 98f Wallet," it wrote. "The investigation continues." Prime Trust swears in its filing that this was an "aberrant" event and "extremely unlikely to occur again."
This discussion has been archived. No new comments can be posted.

Crypto Startup Bankrupt After Losing Password To $38.9 Million Physical Crypto Wallet More

Crypto Startup Bankrupt After Losing Password To $38.9 Million Physical Crypto Wallet

Comments Filter:

  • I'd call 'scam' but... (Score:5, Interesting)

    by Baron_Yam ( 643147 ) on Saturday August 26, 2023 @09:08AM (#63798598)

    Normally with crypto it starts, runs, and terminates as a scam.

    In this case though, if those coins ever move some very specific people will be going to jail very quickly.

    This one actually sounds like comical incompetence.

    • Re:I'd call 'scam' but... (Score:4, Insightful)

      by The Evil Atheist ( 2484676 ) on Saturday August 26, 2023 @09:13AM (#63798610)
      Don't fall for the "I lost the password" scam.

      • If those coins ever move, the people who claimed they lost the password go to jail.

        How do they potentially get away with that once the courts have been involved?

        • 1. Wait long enough for the court to not be paying attention anymore.
          2. Non-extradition country
          3. Don't immediately start buying mansions and supercars and such, obfusticate the money while making it look like you still don't have it, and aren't the one that still had the password(or the crypto details that are supposedly lost in the hardware wallet). Basically, wait until the court decides that it's a 3rd party.
          etc...

          • Re: (Score:2)

            by chill ( 34294 )

            It is a hardware wallet, so if the court had any inkling that type of scam was occurring they could simply require the device to be placed in escrow.

            • It is a hardware wallet, so if the court had any inkling that type of scam was occurring they could simply require the device to be placed in escrow.

              I'm thinking that you'd either give the court a fake (bricked, so who can tell?) wallet, or have the information that the wallet had contained until it was bricked stored in a different location as well.

            • If someone had any clue at all, they would have saved a BIP-39 recovery code somewhere. Then, they could hand the hardware wallet over for escrow or some other thing.

              Every hardware wallet I've owned [1], either forces you to create a recovery code with large warnings to save the thing, or has some obvious warnings about doing that ASAP. In fact, it is a best practice to first set up the hardware wallet, then erase/factory reset it, and set it up again (this ensures the setup is clean.) From there, copy d

            • So? They just need the seed phrase.
        • They could move to Morocco and then make the currency transfer from there.

          Of all the countries without a US extradition treaty, by far Morocco sucks less. Although the Maldive islands compete well.

          https://www.townandcountrymag.... [townandcountrymag.com]
        • They'd have prepared some backdoor to transfer the coins without anyone noticing. And there are plenty of shady crypto stuff that they can spread their earnings.
          • There is no such thing as no one noticing on a public ledger. There is however anonymization of who moved it and where it goes. First thing they'd likely do is dump it over to Monero or another stealth blockchain. They could tumble the shit out of it and slowly exit in a country that doesn't cooperate.
        • They don't automatically go to jail. You have to prove they did know the password and helped move it. People tend to screw up at some point when exiting and leave a trail but they could also fly off to some tropical paradise with no extradition treaty and live out their days. Hiring some security would likely be a good move.
      • Obviously, before tossing the keys away, they moved the contents elewhere.

    • Re: (Score:1, Interesting)

      by blahabl ( 7651114 )

      Normally with crypto it starts, runs, and terminates as a scam.

      In this case though, if those coins ever move some very specific people will be going to jail very quickly.

      This one actually sounds like comical incompetence.

      That actually sounds like culpable incompetence. If you run a crypto exchange, then loosing the master password to everything should land you in jail, period, regardless of whether that money later mysteriously vanishes or not.

      • > If you run a crypto exchange, then loosing the master password to everything should land you in jail, period

        If you run a crypto exchange, then that should land you in jail, period

        FTFY :-)

    • You're assuming these are the kinds of coins where anyone would be able to know if they moved. The company could've just rug-pulled $39M in Monero and then claimed it's stuck on this hardware wallet.

    • The dog ate my password.

  • Sure they did. (Score:3)

    by The Evil Atheist ( 2484676 ) on Saturday August 26, 2023 @09:08AM (#63798600)
    Sure they did. I'd arrest them for fraud right now. In the crypto world, fraud is more likely than a simple mistake.

    • We can't use Fleming's famous dictum for cryptos, because there's never a second and third time.

    • It's a startup. Stupid mistakes are the norm there. Startups are not run by professionals with professional attitudes. They're often run by bros who hire their bro friends. Startups move fast and break things - smart companies on the other hand move slowly and carefully.

      Slowly and carefully means putting the asset in a safe, and they key to the asset in a different safe, and if smart you make shards of the key and spread them across more than one safe in different locations.

      Meanwhile, I imagine the CEO h

      • Most startup CEOs are in their 40s. Looking at their photos, they look to be about that. I haven't spent time looking up their actual ages.

      • I've been at about a dozen startups. There was plenty of dumb shit going on but never anything this epic.

        It was more like push untested code to production or the backups were on someone's laptop or the dns registration was always keyed to the ceo founder's personal credit cards so renewal and transfer was a pita.

        But "lose" $38 million dollars? No. That is not standard startup dumb fuckery.

  • It's "password" you idiots! Don't you remember?

    • Re: (Score:3)

      by Entrope ( 68843 )

      Dark Helmet: So the combination is one, two, three, four, five. That's the stupidest combination I've ever heard in my life! That's the kinda thing an idiot would have on his luggage!
      [President Skroob walks in.]
      Skroob: What's the combination?
      Colonel Sandurz: One, two, three, four, five.
      Skroob: One, two, three, four, five? That's amazing! I've got the same combination on my luggage!
      [Colonel Sandurz and Dark Helmet give each other a look.]

  • The company filed for bankruptcy, and, according to a filing by its interim CEO, which you really should read in full

    This is Slashdot, right? I'll bet half the readers won't even get this far into the summary, let alone read the filing itself.

    And why exactly *should* we read it? A clue might help!

    • Re: (Score:2)

      by hawk ( 1151 )

      being a bankruptcy attorney, I, too, was wondering why.

      They are page upon page of listings of assets and sets, and some other broad financial information.

      There isn't *supposed* to be a narrative of how you got there.

      Besides, if someone wants me to read one, I expect my regular hourly . . .

      hawk, esq.

  • They guy, James Howells, accidentally threw away a hard drive containing hundreds of millions in crypto, and now wants to buy the dump so he can comb through every piece of trash, looking for the lost money.

    https://www.businessinsider.co... [businessinsider.com]

    Oops!

  • Morbidly impressive... (Score:3)

    by fuzzyfuzzyfungus ( 1223518 ) on Saturday August 26, 2023 @09:26AM (#63798642) Journal
    It's always entertaining to see just how much 'crypto' and 'defi' manage to break in their quest to create the appearance of novelty to keep the hype going.

    In this case "hardware wallet" basically just means "We decided to ignore decades of peple storing stuff in HSMs, because reasons; and half-ass it instead". The idea that 'hardware wallet' is a novel thing is somewhat more defensible for very low value stuff, since the HSM market hasn't traditionally been in the business of impulse-buy price points and nontechnical rando ease of use; but if they keys are worth $40 million and you are still faffing around with someone's kickstarter USB dongle there's something wrong with you.

    • I like that it's a "fintech" company, where the lack of common sense knowledge about the "tech" means they no longer have the "fin".

  • Or maybe someone will suggest additions?

  • And give us this day our daily scam...

  • It called a rug pull (Score:4, Interesting)

    by khchung ( 462899 ) on Saturday August 26, 2023 @09:37AM (#63798664) Journal

    "Lost" access to their wallet. Yeah, right, and might they also be selling bridges too?

    You can bet that after a few years, when nobody is watching, the wallet would be "mysteriously" accessed and the money taken away.

    This is just a thinly veiled rug pull, and that is weak point of any crypto scheme because no crypto coin can actually process transactions fast enough to be practical, crypto scammers always have to rely on "exchanges" who can just take all the money and run any time. Oh, or just "lose access" to the wallet. LOL.

    • Re: (Score:2)

      by gweihir ( 88907 )

      Indeed. I see almost zero probability this is not simply a lie to cover theft. My guess would be that wallet is already empty.

  • Think of it like a pile of cash (Score:3)

    by Tony Isaac ( 1301187 ) on Saturday August 26, 2023 @09:40AM (#63798668) Homepage

    If your company had millions of dollars *in cash*, what measures would you take to protect it? You'd probably start with a very serious vault--with multiple backup systems for its mechanisms. But you wouldn't stop there, you'd also think about risks such as fire, flood, violence, and sabotage. And you'd think about risks like, what if the guy with the combination dies, or is killed, or goes rogue?

    If you didn't think about all those contingencies, you're either incompetent or stupid, or both.

    It's probably for the best that this company is bankrupt.

    • If your company had millions of dollars *in cash*, what measures would you take to protect it? You'd probably start with a very serious vault--with multiple backup systems for its mechanisms. But you wouldn't stop there, you'd also think about risks such as fire, flood, violence, and sabotage. And you'd think about risks like, what if the guy with the combination dies, or is killed, or goes rogue?

      If you didn't think about all those contingencies, you're either incompetent or stupid, or both.

      It's probably for the best that this company is bankrupt.

      With cash, the things you do to protect it from theft (vaults, guards), also protect it from harm (fire, water).

      With crypto, the things you do to protect it from theft (strong passwords, limited access), actually make it MORE vulnerable to harm (password getting lost).

      Even if you're competent, that's a hard balance to strike. Give multiple people the password and one of them might be a crook. Give no one the password and secure it with some fancy key that requires multiple signatures and a configuration err

      • I don't really see the strong passwords and limited access as being different with physical cash. Instead of a strong password, you have a combination lock that is difficult to pick. It's just as much of a problem if your combination gets lost, as if your password gets lost. There are ways to mitigate the risk of losing a strong password, or losing a combination. For example, you might entrust each to more than one person. And if you don't want one rogue person to be able to access the money, you could entr

        • I don't really see the strong passwords and limited access as being different with physical cash. Instead of a strong password, you have a combination lock that is difficult to pick. It's just as much of a problem if your combination gets lost, as if your password gets lost.There are ways to mitigate the risk of losing a strong password, or losing a combination. For example, you might entrust each to more than one person. And if you don't want one rogue person to be able to access the money, you could entrust only part of the password, or combination, to multiple people, making it necessary for people to work in concert to steal the money.

          If the safe combination is lost you can hire a safe cracker. It costs a bit of money but is hardly lost.

          If you lose a password that crypto wallet is effectively gone.

          And remember, anyone who wants to access the vault, including the safe cracker, needs physical access. And that access can easily be controlled by people who themselves to not have the password.

          Such a system cannot be enforced with crypto. You can try, but people can copy files and exploit firewalls much easier than they can break into a guarde

      • Baloney.

        Secure key management practices have been around forever, in computer years. Specifically in fintech. Go read PCI-DSS to get started on what industry practices are like. There's a whole section or two on key management practices. That's just financial industry self-regulation, so it's actually really common sense stuff, but not common enough that outsiders or startups think about.

        Financial networks aren't secured like the internet, they're OLD, they're private networks and they were doing crypto for

    • Ever notice that for cash, people use a lot of measures, be it safes thick enough to deal with explosives, guards, and many other items. However, when it comes to crypto, even the president of El Salvador, from what I read, used his smartphone to buy Bitcoin.

      Problem is that we have zero (that I know of) devices that are rated to store cryptocurrency. At least it would be on the level of a HSM with multiple levels of tamper resistance, and multiple backup paths, on par with something like the DNSSEC root k

  • This cryptocurrencies are scam first, scam in the middle and scam at the end. This is probably just some lie to hide the fact they stole it all. Or lost it gambling. Or something. But odds are that wallet is empty.

  • The value of the currency in that wallet will go to zero eventually
  • This is simple to call BS on, either they put the password in a password manager, or committed an act of purposeful stupidity and negligence by forgoing common sense password management practices.
  • If you had 38 million dollars in a "physical wallet", you'd probably have a hard time fitting it in your pocket.

  • Ho hum, (Score:3)

    by fredrated ( 639554 ) on Saturday August 26, 2023 @11:52AM (#63798944) Journal

    Another day another cryptastrophe.

  • Only three words (Score:3)

    by quonset ( 4839537 ) on Saturday August 26, 2023 @12:55PM (#63799096)

    Jesus fucking christ.

  • The passwords they need were stamped on what amounts to 6 steel business cards. They need 3 of the 6. I am surprised that the court is not insisting on the details of how exactly these cards were handled. What was the chain-of-custody, or at least what was attempted to discover the chain of custody? Why hasn't each of these persons been deposed under oath as to how they handled these cards: CEO-2019) Scott Purcell, COO-2019) Whitney White, CCO-2019) Aja Heisse, GC-2019) George Georgiades? Who was the
  • What the fuck is 404 media and why is it suddenly cited a whole fuckload?

  • "So sad, too bad. Bye now!" And nobody is held accountable because it's a Company? No, it's because they robbed a bunch of plebes, not other rich folk.

Slashdot Top Deals

Somebody ought to cross ball point pens with coat hangers so that the pens will multiply instead of disappear.

Close