WarpWallet challenges

The puzzle

WarpWallet was Keybase's answer to weak brainwallets. scrypt with a salt, usually an email address, so a passphrase couldn't be brute forced with a plain SHA-256 wordlist. To prove it, they funded challenges with short passphrases and dared people to crack them. The four small ones fell. The two 20 BTC ones didn't. They expired on schedule, and Keybase published the passphrases when they took the coins back.

What the records carry

Every WarpWallet record carries the hex key, the WIF and the passphrase, plus the salt where one was used, as .passphrase(…) and .salt(…) on the key builder. The library verifies the key against the address, not the passphrase against the key. scrypt with WarpWallet's parameters is a different package's job.

export const warpPuzzleChallenge1 = bitcoinPuzzle({
  id: "warp/challenge_1",
  address: p2pkh("1JKb1617p68H5MPkoNaMtaJCqKDU3h8qSn", "bdfe0236c752bbf8610b47c57b8c8592230dc575"),
  sourceUrl: "https://keybase.io/warp",
  startedAt: "2013-11-19 20:12:25",
  status: Status.Solved,
  pubkey: uncompressed("045f75…51af"),
  key: hex("20f5df9cba8251e90a66d3aa1ca2849b12eaca135abb837671ac4a2bc2014e2b")
    .wif("5J4oWdwA5mSCP4GVWF237zgYK4h1csD2PfrmK3uh3YcRFSWZ2H1")
    .passphrase("Je"),
  prize: 0.1,
});

A two character passphrase and it still took a scrypt run per guess. That was the argument.

Status

expired is the status for the two big challenges. The author took the prize back when the deadline passed. The keys on those records are the ones Keybase published, so they verify like any solved puzzle. The warpwallet alias resolves to this collection in every lookup.

Every puzzle

One page each: the record, the transactions and the live balance.