Quote from: Cricktor on Today at 10:12:47 AM

Quote from: CrunchyF on Today at 06:38:44 AM

~

Why is BIP38 involved here? From what I remember a password protected wallet.dat basically encrypts more or less only the private key stuff with AES. I may lack knowledge here though as cracking wallet.dats is not my business. I'm more just curious and have fun to broaden my crypto knowledge.

It's true Bitcoin Core use AES, although it's more than encrypt private key with AES[1-2].

Quote from: Cricktor on Today at 10:12:47 AM

Has anyone tried to load this wallet.dat into Bitcoin Core to check which addresses claim to hold the funds and if a blockexplorer actually shows these funds? I admit, I haven't tried yet because I don't believe this is a legit and valid wallet.dat (well, likely 99.999% of publicly available wallet.dats are manipulated scams).

Since you asked, i just did it on VM. Looking at it's transaction history, 1NUW3z5z6cNs8Ltd2cN2BnxP92dySdcuG8 is the only receiving address. According to mempool.space[3], it has ~3.5BTC. But there's no way to know whether the encrypted part of the wallet is manipulated or not[4].

[1] https://en.bitcoin.it/wiki/Wallet_encryption
[2] https://bitcoin.stackexchange.com/a/1714
[3] https://mempool.space/address/1NUW3z5z6cNs8Ltd2cN2BnxP92dySdcuG8
[4] https://bitcointalk.org/index.php?topic=5130929.msg50566174#msg50566174