DEF CON 33 - Making a custom Hashcat module to solve a decade-old puzzle challenge - Joseph Gabay
Source: YouTube · DEFCONConference · published Oct 10, 2025 · 48:24
The speaker discusses solving a decade-old Bitcoin puzzle challenge involving 20 cryptographic clues that unlock a brain wallet containing one Bitcoin 0:57. After solving 16 of the 20 clues, they explain how they created a custom hashcat plugin to brute-force the remaining combinations and successfully "stole" the Bitcoin 14:00, highlighting the security vulnerabilities of brain wallets.
Key Takeaways:
• The Bitcoin puzzle was created in 2014 by Spencer Lucas with 20 clues that needed to be solved to unlock a brain wallet containing one Bitcoin 1:04
• Brain wallets convert a passphrase into a Bitcoin address through SHA256 hashing, elliptic curve cryptography, and additional hashing to generate the final address 11:38
• After solving 16 clues, the speaker created a custom hashcat plugin to brute-force the remaining combinations, which required learning OpenCL and GPU programming 27:00
• Brain wallets are fundamentally insecure, as demonstrated by both this hack and previous security vulnerabilities 8:11
The speaker successfully cracked the puzzle but cautions against using brain wallets for storing cryptocurrency due to their inherent security flaws.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
So this is our first talk today. Um the talk is basically the one Bitcoin heist with Joseph Joseph Gabay. Um and here he is and give him a big round of applause. This is the first talk of the con. All right. All right. There you go, buddy. >> Thank you very much. Hello everyone. Good morning. Uh thank you all for coming. Uh, my name is Joseph Gabbe and I stole a bitcoin from the internet and uh, I'm going to tell you how I did it and how you can do it too, but not really. So, before I get into this talk, I want to give a basic disclaimer. This is a personal project. It's not affiliated with my employer, with my friends, with anyone. Just don't don't call my employer asking about this. I've had that happen before. It's an awkward conversation. Uh, I'll have my email address at the end. If y…