Making a custom Hashcat module to solve a decade-old puzzle challenge

The One Bitcoin Heist: Making a Custom Hashcat Module to Solve a Decade-Old Puzzle Challenge

Speakers: Joseph Gabay

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=74_4Q329PH8

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Joseph%20Gabay%20-%20The%20One%20Bitcoin%20Heist%20Making%20a%20custom%20Hashcat%20module%20to%20solve%20a%20decade-old%20puzzle%20challenge.pdf

Overview

About ten years ago, an anonymous person posted a puzzle challenge to the internet. The prize: one Bitcoin, locked in a "brain wallet." To claim it, a solver would need to work through 20 cryptographic clues and reconstruct a passphrase. Over eleven years, as Bitcoin's price climbed dramatically, the puzzle sat unclaimed. Joseph Gabay, a security researcher and former robotics engineer, decided to finish what the internet started — and ultimately claimed the Bitcoin, doing so by writing a custom Hashcat module capable of cracking brain wallets.

This talk covers three interconnected topics: the puzzle itself and who created it, how Bitcoin brain wallets work under the hood, and the mechanics of building custom Hashcat modules. It is simultaneously a cryptography primer, a practical guide to GPU-accelerated password cracking tooling, and a narrative adventure story about solving an internet-famous challenge.

The talk is an ideal entry point for anyone who wants to understand what a brain wallet is and why they are cryptographically dangerous, as well as for developers who want to understand how to extend Hashcat for non-standard target formats. It was the first talk of DEF CON 33.

Background

▶ Watch: Brain wallet cryptography: secp256k1 and Bitcoin key derivation mechanics (0:29)

Brain Wallets

A Bitcoin "brain wallet" is a method for generating a Bitcoin private key deterministically from a passphrase rather than through random key generation. The basic process is:

1. Take a passphrase (any string of text)
2. Apply SHA-256 to produce a 256-bit value
3. Interpret that value as an ECDSA private key on the secp256k1 curve
4. Derive the corresponding public key and Bitcoin address

The appeal is memorable key storage — if you can remember the passphrase, you can always recover the private key. The danger is that human-chosen passphrases have far less entropy than randomly generated 256-bit keys. Dedicated cracking with wordlists and GPU hardware can test millions or billions of passphrases per second, making any passphrase that a human might plausibly memorize vulnerable to exhaustive search.

Brain wallets were popular in early Bitcoin history and have been systematically drained over the years. Researchers demonstrated as early as 2013–2015 that virtually any dictionary word, literary quote, or moderately common phrase would be cracked almost immediately after funds were deposited. By the time Gabay's puzzle was created, brain wallets were already known to be dangerous — the puzzle's creator chose one deliberately, presumably with a passphrase hard enough to resist casual cracking but solvable by someone who worked through all 20 clues.

The Puzzle

The puzzle was posted anonymously to an internet forum approximately a decade before the talk (circa 2014). It consisted of 20 clues, each requiring a solve step that yielded part of the final passphrase. The clues ranged across programming, cryptography, and general knowledge domains. Solving all 20 produced the passphrase that, when used as the brain wallet seed, unlocked a Bitcoin address containing one Bitcoin.

Gabay describes working through the earlier clues over time, with the final few proving the most technically challenging — requiring not just puzzle-solving skill but the ability to crack the brain wallet itself, since the passphrase derived from the clues was intended to be fed to the SHA-256-based key derivation process.

Key Findings

▶ Watch: Decision: writing a custom Hashcat module for GPU-accelerated key search (7:00)

The Puzzle's Structure and Author

Through his research, Gabay was able to make inferences about who created the puzzle, based on stylistic analysis of the clues, the technical knowledge required to construct them, and context from the original forum post. He presents what he believes is the identity or at least the profile of the creator, although he handles this with appropriate care given that the person acted anonymously. The puzzle's construction showed deep technical knowledge across cryptography, Bitcoin's early ecosystem, and several programming domains.

The puzzle had remained unsolved for over eleven years not necessarily because of cryptographic hardness — Gabay notes the passphrase space was not astronomically large — but because the combined effort required to: (a) solve all 20 clues correctly, (b) correctly derive the brain wallet address, and (c) perform the cracking computation was significant enough to deter casual attempts.

Brain Wallet Cryptographic Mechanics

Gabay provides a thorough technical walkthrough of the brain wallet construction:

Key Derivation:

• Input passphrase → SHA-256 → 32-byte private key scalar
• The scalar is used as the private key for Bitcoin's ECDSA signing on the secp256k1 elliptic curve
• The public key is derived by scalar multiplication of the generator point: public_key = private_key × G
• The Bitcoin address is derived via RIPEMD-160(SHA-256(public_key)) followed by Base58Check encoding

Why cracking works:

• The passphrase space for human-memorable phrases is vastly smaller than the 2^256 space of valid private keys
• Existing Hashcat targets (WPA passwords, NTLM hashes, bcrypt) don't directly support the brain wallet derivation chain
• A custom module is required to implement the full SHA-256 → secp256k1 → address derivation pipeline in GPU-accelerated code

Custom Hashcat Module Architecture

The most technically instructive part of the talk is the walkthrough of how to write a custom Hashcat module. Hashcat's module system allows researchers to implement new hash types or key derivation functions in C, with the GPU-accelerated computation handled by OpenCL or CUDA kernels.

Key components of a Hashcat module:

• Module metadata — declaring the hash type, attack mode compatibility, and expected plaintext/hash formats
• Kernel implementation — the OpenCL/CUDA kernel that runs on the GPU, implementing the hash or KDF
• Host-side code — C code for parsing hash files, encoding/decoding candidates, and post-processing results

For the brain wallet module, the kernel needed to:

1. Compute SHA-256 of the candidate passphrase to produce the private key
2. Perform secp256k1 scalar multiplication to derive the public key
3. Compute RIPEMD-160(SHA-256(public_key)) to derive the address hash
4. Compare the result against the target address hash

The secp256k1 scalar multiplication in a GPU kernel is the most technically demanding step, requiring an efficient implementation of elliptic curve point multiplication that runs well in the massively parallel GPU environment.

Technical Deep Dive

▶ Watch: The long grind: iterating on the solution over 15 days of compute time (12:59)

Implementing secp256k1 in OpenCL

The secp256k1 curve parameters are defined in Bitcoin's codebase and are publicly known. However, implementing scalar multiplication efficiently in an OpenCL kernel — where each work item handles one candidate passphrase — required careful attention to:

• Field arithmetic — modular addition and multiplication over the 256-bit prime field underlying secp256k1
• Point doubling and point addition — the fundamental ECC operations, implemented using projective (Jacobian) coordinates to avoid expensive modular inverse operations in the inner loop
• Scalar multiplication algorithm — double-and-add, or more efficient variants like windowed NAF, to minimize the number of expensive point operations per candidate

Gabay notes that writing this from scratch in OpenCL was the primary technical hurdle. Existing Bitcoin implementations (libsecp256k1) are optimized for CPU execution with SIMD intrinsics and are not directly portable to GPU kernels. He describes the process of "bodging together" the implementation — a pragmatic approach that got the computation correct even if not maximally optimized.

SHA-256 and RIPEMD-160 in Hashcat

Hashcat already contains GPU-optimized implementations of SHA-256 and RIPEMD-160 (both are used in existing hash modes), so the module could reuse these rather than re-implementing them. The novel work was exclusively in the secp256k1 layer.

The complete pipeline per candidate:

Performance Characteristics

Gabay reports the cracking throughput of his module on available GPU hardware. The secp256k1 multiplication dominates the computation time — it is orders of magnitude more expensive than the hash operations. On a modern consumer GPU, the module achieved meaningful throughput, though substantially lower than pure hash cracking speeds. This made wordlist and rule-based attacks practical, while exhaustive search of large keyspaces was not feasible.

For the puzzle, once Gabay had the correct passphrase derived from the clues, the module was used to verify the brain wallet address and confirm ownership before he swept the funds.

Sweeping the Bitcoin

Gabay describes the process of actually claiming the Bitcoin once the passphrase was confirmed. "Sweeping" a brain wallet involves:

1. Reconstructing the private key from the passphrase using the SHA-256 derivation
2. Signing a transaction that moves the funds from the brain wallet address to a new, randomly-generated secure address
3. Broadcasting the signed transaction to the Bitcoin network

Because brain wallet addresses are known to be vulnerable, they are monitored by automated "sweeper" bots that constantly crack common passphrases and immediately drain any funded brain wallet address. Gabay describes the operational caution required: generating the sweep transaction and broadcasting it must be done carefully to avoid being front-run by these bots.

Demo / Proof of Concept

▶ Watch: Optimization: manual OpenCL tuning cuts cracking time significantly (15:00)

The talk includes a walkthrough of the Hashcat module code and a demonstration of the cracking pipeline. Gabay shows the module registering correctly in Hashcat, accepting brain wallet address hashes as targets, and processing candidate passphrases through the full derivation pipeline. He also walks through the puzzle's clues, demonstrating how the final passphrase was derived and verified.

The successful claim of the Bitcoin — documented by the blockchain transaction — serves as the definitive proof of concept.

Defensive Implications

▶ Watch: Remaining mystery: two unsolved clues, offering bounty for solutions (18:59)

Do not use brain wallets. This is the primary takeaway for anyone holding or advising others on Bitcoin security. Brain wallet derivation has been a known cryptographic antipattern for over a decade. The SHA-256 of any human-memorable phrase is not a secure private key. Hardware wallets, BIP-39 mnemonic seeds with proper randomness, or air-gapped key generation with a CSPRNG are the only appropriate methods for generating Bitcoin private keys.

For the password cracking community:

• Gabay's module represents a working implementation of secp256k1 scalar multiplication in an OpenCL Hashcat kernel, which is a useful reference for anyone building similar cryptocurrency-related cracking modules
• The module architecture walkthrough is a practical introduction to Hashcat module development that is applicable to any novel hash type or KDF

For cryptographic puzzle designers:

• Puzzles that use brain wallets with human-derivable passphrases will eventually be solved by capable researchers, as Bitcoin's price increase makes them increasingly attractive targets
• Stronger commitment schemes (multi-hash, memory-hard KDFs, time-lock puzzles) would have made the Bitcoin prize harder to claim

Key Takeaways

• A decade-old Bitcoin brain wallet puzzle, containing one Bitcoin, was claimed by Joseph Gabay after he wrote a custom Hashcat module to crack the brain wallet key derivation chain.
• Brain wallets are cryptographically insecure for any human-memorable passphrase, and this research demonstrates that dedicated GPU-accelerated cracking is effective against them.
• Writing a custom Hashcat module requires implementing the target's full key derivation or hash pipeline in GPU-compatible C/OpenCL, with the primary challenge being the secp256k1 elliptic curve scalar multiplication step.
• The puzzle's 20-clue structure was designed to require both intellectual puzzle-solving and technical cryptographic capability to claim — Gabay demonstrated both.
• Hardware wallets and properly generated BIP-39 mnemonic seeds remain the appropriate methods for securing Bitcoin private keys.

About the Speaker

Joseph Gabay is a security researcher and former robotics engineer who transitioned into security through an unconventional path. He has prior experience with Shodan-based research and has been involved in various security projects. He presented "The One Bitcoin Heist" as a personal project unaffiliated with his employer, and it was selected as the opening talk of DEF CON 33. He can be reached via email for follow-up questions on the research.