Replication Data for: The Bitcoin Brain Drain: Examining the Use and Abuse of Bitcoin Brain Wallets

In the cryptocurrency Bitcoin, users can deterministically derive the private keys used for transmitting money from a password. Such “brain wallets” are appealing because they free users from storing their private keys on untrusted computers. Unfortunately, they also enable attackers to conduct unlimited offline password guessing. In this paper, we report on the first large-scale measurement of the use of brain wallets in Bitcoin. Using a wide range of word lists, we evaluated around 3.9 trillion passwords and passphrases. Surprisingly, after excluding activities by researchers, we identified just 1,730 brain wallets worth around $261K in use from July 2011 to February 2017. We find that all but 21 wallets were drained, usually within 24 hours but often within minutes. We find that around a dozen “drainers” are competing to liquidate brain wallets as soon as they are funded. We find no evidence that users of brain wallets loaded with more bitcoin select stronger passwords, but we do find that brain wallets created with passwords rather than passphrases are cracked more quickly.