It is possible to recover part of Bitcoin wallet backup phrases. Computing power will never be a threat to the security of cryptocurrency wallets.

Using seed words is the most common method of generating the private keys of a Bitcoin wallet.

A mnemonic phrase, a term that refers to an ancient memorization technique, is a set of 12, 24 or 36 words that the wallet provider software randomly generates.

This cryptographic implementation was part of the Bitcoin 39 (BIP39) Scalability Proposal, which stipulated that this combination must come from a list of 2,048 words in total (2,047 conventional English words, plus the word “satoshi”).

Once the word sequence is ready, it undergoes an interpretation process through an algorithm in a 512-bit binary number sequence. This number is the resulting private key.

Next, wallet owners should write the word combination on paper. However, some people print these words on metal and wood, among other surfaces including the skin (through tattoos).

This allows users to regain access to their wallets, in case the devices on which the wallets run are damaged, lost, or destroyed. By inserting the 12 words elsewhere, they can regain control over their funds again.

For this reason, they must safeguard those words with the utmost care and caution, since they are the only way to obtain the private key of a Bitcoin wallet. Wallet owners must also ensure that nobody steals them, so they must keep them hidden from third parties, and must not write them on devices or websites.

The BIP39 Scalability Proposal allows identifying a word just by knowing its first four letters. Each word is not less than 4 letters or more than 8 letters. Also, the first 4 letters are unique and no word has the same beginning as another. By typing the correct letters directly into a spreadsheet, users can see the prediction of the word in question.

It is impossible to fully decrypt or force this cryptographic method, as with many of the simple passwords used for generic e-mails or logins. Not even the most advanced computer can discover 12, or 24 words.

Since the very beginning of Bitcoin, some developers have created tools to decipher this combination. However, they usually only work when there are between 1 and 4 words missing in the set of 12 or 24 words.

Possibility of Recovering a Seed Phrase

First of all, it is not possible to recover or generate a seed phrase in its entirety. Users can recover some words from a pre-existing incomplete phrase.

Some people usually divide the backup phrase into two or more parts and store it in different places. It seems like a valid security measure, but it poses a big risk to the user.

Similarly, although the words are easy to read and write, someone could make a mistake when writing them on paper. These kinds of mistakes could find a solution in different seed word recovery tools, which have been available for some time.

By Willmen Blanco

From prison, the creator of Silk Road said that the current Maker system emulates the bank model. He proposes a solution that would prevent a further collapse of the biggest DeFi protocol.

Ross Ulbricht, Founder of the dark web market Silk Road, predicts a collapse of MakerDAO, the protocol that enables the creation of the stablecoin DAI. From prison, where he is serving a life sentence, he suggests that a simple solution can prevent the system from failing, as on previous occasions.

On June 26^th, Ulbricht published an article in which he analyzed the MakerDAO system, launching constructive criticism and suggestions for improvement. However, his comments focused on the crisis that the platform faced in March.

As part of the general collapse that the world stock markets suffered, the rapid drop that the crypto market suffered also affected MakerDAO, with a drop of about 50% in the price of Ether (ETH).

According to Ulbricht, MakerDAO faced the crisis in March while the drop in the price of ETH occurred. At that time, the price of DAI soared by more than 10%, which led many vaults to become under-collateralized and forced them to liquidate, even with extreme discounts, thus losing almost everything.

Identifying the Problem

Ulbricht considers the Maker protocol to be similar to the model that central banks used before the dawn of the modern era. These financial institutions used to print and lend fiat money, backed by the gold in their vaults.

Banks supposedly had enough gold to back the currency in circulation. However, the financial institutions began to lend more money than they had, which forced them to go to the government for a bailout to allow them to deal with emergencies.

The founder of Silk Road adds that, as with banks, MakerDAO vault owners place Ether in their vaults as collateral for DAI. In essence, vault owners borrow Maker protocol DAI and use Ether to back the loan.

He noted that the crisis that MakerDAO faced last March stemmed from the fact that the entire system is chronically under-collateralized. He believes that not only vault owners are penalized with a stability fee to guarantee the system, but the DAI burden is also constantly increasing.

For that reason, during the crisis, no one wanted to change from stable, high-performing DAI to crashing, negative-yielding Ether at liquidation auctions. In the end, DAI had to be backed by USDC, a stablecoin backed by the cash at a bank (hardly a decentralized solution), according to Ulbricht.

Ross Ulbricht proposes that MakerDAO remove the savings contract and stabilization fee. He adds that vault owners should receive a collateral or reward rate. It would be a fee that the system would generate and that would come from DAI owners.

According to Ulbricht’s upgrade proposal, vault owners would set their rates. Then they would compete for the lowest interest rates, which would ensure that they remain low. Market forces would automatically adjust these rates in the event of collateral shortages, thus discouraging DAI hoarding.

By Alexander Salazar

Deflationary tokens STA and STONK made the attack possible. This is the third DeFi platform that has received attacks until now in 2020.

Last June 28^th, a hacker managed to steal USD 450,000 from two multi-token pools on the DeFi Balancer platform. The attacker took advantage of an exploit, which the deflationary tokens STA and STONK provided, to empty the content of the pools, in just two transactions. These operations occurred at 06:03 PM UTC, and at 06:49 PM UTC, respectively.

The attacker reportedly saw an attack vector to drain balances on the DeFi platform in conjunction with the Balancer model and the availability of deflationary tokens in its pools. The supply of these tokens decreases over time and is therefore limited.

The decentralized exchange (DEX) aggregator, 1inch, gave an account of the attack. They explained that the hacker “used a smart contract to automate multiple actions in a single transaction” when stealing the funds.

Anatomy of Attack

First, the attacker obtained a FlashLoan from DEX dYdX for 104,000 WETH, which he traded for STA tokens and returned to WETH twenty-four times in increasing amounts. In each exchange, STA has a transfer fee and the pool expects to receive a balance with no fee. This finally drained the STA balance of the pool, in which only 1 weiSTA (0.000000000000000001 STA) remained.

Given that the STA balance was close to zero, its price compared to other tokens increased dramatically. This allowed the attacker to exchange STA for other tokens in the pool at a very low price.

In that sense, the second step was to change the excess weiSTA to WETH multiple times. Due to the implementation of transfer fees for STA, the pool never received the STA token even though it released WETH. The hacker repeated this same procedure to drain the WBTC, SNX, and LINK balances from the pool.

As last the steps, the attacker paid for the FlashLoan that came from dYdX. He deposited some weiSTA in the Balancer pool, traded the tokens for 136,000 STA that he received as an incentive from the Balancer platform through the DEX Uniswap V2, and finally traded those STA for 109 WETH. It is possible to see the funds drained at this address.

Balancer and Attacks on DeFi Platform

The complexity of the procedure leads to the intuition that the attacker is a great connoisseur of yield farming and DeFi platforms. He used the private transaction tool, Tornado Cash, on Ethereum to obtain the initial funds. Therefore, it is unlikely to find the attacker’s identity and the origin of initial ethers.

Mike McDonald, Balancer Labs Co-founder, himself admitted that they were unaware of the possibility of conducting an attack like this. However, they have warned of the collateral risks of ERC20 with transfer fees such as STA and STONK. As Balancer is a permissionless protocol, McDonald states that it is possible to add any malicious or poorly designed token to protocol contracts without them having control over it.

Although so-called yield farming has proven to be quite lucrative for some, the DeFi platforms that make it possible have not stopped showing risks. In addition to the attacks on bZx and Lendf.Me, Balancer would be the third DeFi platform attacked so far in 2020.

Users have also noted the risks, at least of these transfer fee tokens. At the time of writing this article, Statera’s STA token has dropped by 71.8%, trading at USD 0.01293. Meanwhile, STONK fell by 28.2% to USD 0.00994, according to data from CoinGecko.

By Alexander Salazar

Spain would be the first country in Europe to test this technology. The blockchain platform will store unalterable data on the health of the tourist.

Blockchain technology would provide new opportunities not only during the quarantine time but also during the post-coronavirus time. One of the projects in which this technology will have important participation is in supporting tourism, a sector that the quarantine time strongly impacted.

According to data from the World Tourism Organization (UNWTO), international tourism lost around USD 195,000 million between January and April this year, due to the mandatory isolation for the situation. A UNWTO report indicated that international tourist arrivals decreased 44% worldwide, with a 97% drop in international tourist arrivals during April.

To prevent the spread of respiratory disease, many countries had to suspend flights and tourism. For this reason, different companies proposed creating a “health passport”. This plan would be possible thanks to blockchain technology.

In this sense, the Hotel Business Federation of Ibiza and Formentera (Fehif) reported that they will implement a blockchain technology health passport project called HI + CARD. Users can use these passports in the tourist region of Ibiza. The main objective is to promote tourism in post-coronavirus times.

According to the announcement, the Hotel Business Federation expects Ibiza to receive flights with health passports in July. This tourism project is part of the pilot test that the World Tourism Organization (UNWTO) promotes, called ‘Ibiza Safe’.

The Ibiza delegation of the Spanish Association of Hotel Directors (AEDH), the Spanish technology companies Tourism Data-Driven Solutions (TDDS), and Neobookings, as well as the Nuestra Señora del Rosario Polyclinic, also support this initiative.

HI + CARD will work as a mobile application, using blockchain technology. In this way, Ibiza seeks to reduce the risks of contagion and give an immediate response to possible outbreaks of coronavirus.

How Does It Work?

This application will store medical records about the patient’s health. Thanks to the fact that the application will work with blockchain technology, it will be able to store this health data so that the user cannot modify it. In this way, the airlines will know more about the health of the tourist who wishes to board a tourist flight, as part of the efforts to avoid the spread of coronavirus.

One of the direct advantages of this project is that it would allow the reopening of commercial flights but safely. Thus, Europe will be able to resume tourism. Spain would be the first country to test this technology.

The application uses a legal digital ID to create a unique profile for each user. In each country, a health entity accredited by the Ministry of Health may upload the patient’s medical information, according to Antonio López de Ávila, CEO and Co-founder of TDDS.

Some of the data that this application will be able to store are the PCR test to discard Covid-19 up to all kinds of certificates and health records such as vaccines, allergies, chronic diseases, among others.

Using this application will allow passengers to feel safer when traveling. It is also expected to help recover tourism, which is an essential economic activity for Spain.

“It is vital that the restart of tourism is a priority and is managed responsibly, protecting the most vulnerable ones and with health and safety as the main concern of the sector,” said UNWTO Secretary-General, Zurab Pololikashvili.

By María Rodríguez