Thread by @mononautical

The signature checks out, @83_5BTC apparently controls the key that paid that 83.7 BTC fee.

1/🧵

https://twitter.com/83_5BTC/status/1728873072349069352

2/ They say they sent the coins to a fresh cold wallet, which was instantly swept by a third party.

The attacker managed to steal almost 56 BTC while paying 83.7 in transaction fees.

So the victim lost not only the fee, but their entire 140 BTC stack 😭

https://x.com/83_5BTC/status/1727996658758058120

3/ The most likely explanation is that the wallet was generated from bad entropy - perhaps a brainwallet, or too few dice rolls/coin flips, or an insecure PRNG.

Let this be a reminder not to take shortcuts with your entropy, and ideally to use multisig for very large sums.

4/ It's unclear why the transaction was quickly fee-bumped using RBF.

If it was a low-entropy wallet, perhaps multiple attackers were competing to steal the funds?

https://x.com/mononautical/status/1727629348113715687

5/ This might also explain the initial high fee.

It could make sense for automated low-entropy wallet sweeping scripts to be configured to spend a high percentage of the value in fees to hinder competitors (or victims) trying to broadcast replacements.

6/ Since the wallet is compromised, this message could have been signed by either the victim or attacker (or anyone else who brute-forced the bad entropy).

If @AntPoolofficial returns the fee, they'll need another way to verify the victim's identity.

https://x.com/83_5BTC/status/1728873072349069352

7/ Should @AntPoolofficial return the stolen coins?

@AntPoolofficial

https://x.com/niftynei/status/1728971001860624799