Quote from: DamienBlack on June 19, 2011, 05:27:14 PM

Well they aren't in any rainbow tables, so they must be pretty long. Judging by the high reward on this, he probably used 15-20 characters. Enough that you might as well keep your computers mining bitcoins, it could be months even for a very powerful group of computers.

Rainbow tables != reverse lookup tables.

It's stupid as fuck banking on MD5 - either the plaintext for those hashes is really long and/or not actually alphanumeric, or he's going to be some 80BTC poorer in a couple weeks. If they really are <16 chars, unsalted and alphanumeric, I'd be willing to bet the 80BTC is probably worth more than what you'd spend on some Amazon EC2 instances to break it in a hurry...

It's also stupid as fuck chaining multiple rounds of MD5 together, particularly without changing the salt each time. - I believe you actually make it weaker to rainbow table attacks by doing that... but I'm absolutely no expert in cryptography by any stretch of the imagination.

Regardless, if there's any evidence at all that the DB is taken, assume the passwords are broken. Now where's the credible evidence the DB was taken?