Replication Data for: The Bitcoin Brain Drain: Examining the Use and Abuse of Bitcoin Brain Wallets

In the cryptocurrency Bitcoin, users can deterministically derive the private keys used for transmitting money from a password. Such “brain wallets” are appealing because they free users from storing their private keys on untrusted computers. Unfortunately, they also enable attackers to conduct unlimited offline password guessing. In this paper, we report on the first large-scale measurement of the use of brain wallets in Bitcoin. Using a wide range of word lists, we evaluated around 3.9 trillion passwords and passphrases. Surprisingly, after excluding activities by researchers, we identified just 1,730 brain wallets worth around $261K in use from July 2011 to February 2017. We find that all but 21 wallets were drained, usually within 24 hours but often within minutes. We find that around a dozen “drainers” are competing to liquidate brain wallets as soon as they are funded. We find no evidence that users of brain wallets loaded with more bitcoin select stronger passwords, but we do find that brain wallets created with passwords rather than passphrases are cracked more quickly.在加密货币比特币（Bitcoin）系统中，用户可通过密码确定性地推导得到用于转账交易的私钥。这类「脑钱包（brain wallets）」极具吸引力，因为用户无需将私钥存储于不可信的计算机中。但遗憾的是，这类钱包也为攻击者提供了开展无限制离线密码猜解的途径。本研究首次针对比特币系统内脑钱包的使用情况开展大规模测量分析：我们借助多套词表，对约3.9万亿组密码及口令短语进行了评估测试。令人意外的是，在剔除研究人员自身的操作后，我们发现在2011年7月至2017年2月期间，仅有1730个处于使用状态的脑钱包，总价值约为26.1万美元。我们发现，除21个脑钱包外，其余全部被清空；通常清空耗时在24小时以内，多数情况下仅需数分钟。另有约十余名「盗提者（drainers）」相互竞争，以期在脑钱包获得资金后第一时间将其中的加密货币套现。我们未发现持有更多比特币的脑钱包用户会选用更强密码的证据，但确实观察到，使用单密码而非口令短语创建的脑钱包，其私钥被破解的速度更快。