Fixed!  Thanks for bringing to my attention. 

68 - hybridsole

Thanks!

95 - hybridsole

Thanks 

44 - hybridsole

Thanks!

 6 plz - thanks and Merry Christmas

2 for me - graded via MJ.  Thanks!

0.008

For whole bean, do you know roughly how long ago they were roasted before they ship out?  I am always looking for fresh beans to make espresso. 

The Telegram bot (which is really awesome, by the way), is showing that it was redeemed for 267.999 BTC.  It seems to be double counting the change amounts after the test transactions.  So when they spent the first 1 BTC, there was 98.999 returned as change.  They sent another 30, leaving 68.999 as change.  So the bot added 100+98.99+68.99 = 267.999 or ~$16 million in value. 

I think I have noticed this on a few other alerts. At first I thought they were overfunded coins by the end user.

Any 1 if available, thanks

I remember seeing the ebay posting for this, and I think it was legitimate because the seller had some other rare Cas items, but I did not bid because it seems pretty easy for almost anyone to fake these.  There doesn't appear to be any info on how many were printed, any security features of the paper, etc.  And I doubt Mike will weigh in at this point.  So without some direct proof of the original purchase, I would not have any confidence in saying one is legitimate or not. 

Even in this thread, the two examples posted have lots of little differences.  One has a header showing "S/N", the other says "Seq #".  The fonts, spacing, and colors also appear to have some differences.

I have been playing around with Ian Coleman's BIP39 generator tool: https://iancoleman.io/bip39/.  What really makes this one stand out is that you can click "Show entropy details", and then it allows you to put in dice rolls, coin flips, etc to see it create seed phrases in real-time.  It also supports virtually all technical aspects of key generation to get a good sense of the many different options that are available.  It's kind of crazy how many types of addresses there are such as BIP44, BIP84 that wallets just choose for you (and creates all kinds of cross-compatibility issues).  You can also get things like the XPUB address to support multi-sig and all kinds of fun stuff. 

For people who do want to use this, you should use the github version and download the standalone page to use offline: https://github.com/iancoleman/bip39, as well as have a good understanding of the main concepts.  Otherwise using a Trezor like krogoth recommends is probably better if you just want a safe and user-friendly option. 

I went ahead and removed my negative trust, because I feel bad for you, and you have had to pay dearly for this mistake.  But this sentence right here proves you should never, ever make any private keys for anyone ever again.  Full stop.  You don't need a "team" to generate keys, that's the first fuck up.  If it wasn't the well known malware you used, it would have been someone in this "team" to save the keys for later.  There was so much wrong with how you went about this, that to think you can salvage your brand and make more products is astounding.   

Let this thread be an example for anyone who wants to make their own coins.  Don't.  There is zero margin for error in this business.  And without calling out this level of incompetency, we are only encouraging others to follow in your footsteps. 

I believe he is referring to the 5,000 Bits Bitcoin Savings Bond, which were issued in shrink wrapped packs of some quantity (5 I think).  This was supposed to be a less expensive version of the satoshi note.  The encrypted private key is in clear text, and the password is behind some sort of sticker or scratch off material.  I can understand why someone might have trouble with this.  The paper quality is probably not good enough to withstand something abrasive to remove whatever is covering the key.  Might require a razor blade instead? 

Here's a picture of one:

Okay I was about to remove my negative trust for this incident considering the refunds and finally revealing the software, but it still doesn't add up.  If the github repo that raritycheck cited is not vulnerable, then there is more to the story.  Surely after 7 years someone would have reported an issue on github. 


Additionally, you stated that you used this software to generate vanity addresses, but it does not support generating vanity addresses.  From what I can tell it offers no functionality above what bitaddress.org does except for supporting dead shitcoins. 

I don't want to seem like we are being overly critical, and I want to commend you for refunding people, but the fact you waited this long to even give us the name of the software tells me you are still not sharing the full story. 

Walletgenerator.net has had known vulnerabilities since at least 2019: https://medium.com/mycrypto/disclosure-key-generation-vulnerability-found-on-walletgenerator-net-potentially-malicious-3d8936485961

But one other issue is that walletgenerator does not support the creation of Vanity keys...so I'm confused why you even switched to using this software from bitaddress?

Hey I remember writing the first draft of that code for BG4.  It was sloppy but got the job done. 

As far as wiping the drive, I prefer a sledgehammer     Low capacity drives are cheap, and it's very satisfying after making a batch of keys. 

This is precisely the method I use.  A freshly loaded OS that has never connected to the internet, and the wifi drivers disabled (or disabled at the hardware level).  In addition, Samr7's vanitygen has been used for over 12 years and is likely holding billions of dollars worth of bitcoin.  The only thing that could compromise those keys would be a quantum attack or vulnerability in OpenSSL's random number generator.

There is a right way and a wrong way to do it. 


Regarding this topic, it is too bad that TeeGUMES Canary Thread (https://bitcointalk.org/index.php?topic=5290065.0) is no longer updated with working images.  That was such a great resource.  Maybe those pictures could be recovered somehow and all the info merged into this thread? 

Which vanitygen software did you use?  

Most people have used either this one: samr7/vanitygen: https://github.com/samr7/vanitygen  

Or the 10gic/vanitygen-plusplus? https://github.com/10gic/vanitygen-plusplus

Or was it some .EXE program you found somewhere?  Which operating system? How did you transfer the software to your airgapped PC?

I'm glad to hear you are willing to make your customers whole.  For transparency sake, please tell us the method of key generation and custody for compromised coins.  This could be a valuable lesson to would-be coin makers out there. 

I hope you plan to offer a full debrief of what occurred, and not just deal with it via PM for affected owners.