Forgot Your Bitcoin Password? That Could Be a Problem

Summary

---

WSJ Your Money Briefing: "Forgot Your Bitcoin Password? That Could Be a Problem"

Date: December 25, 2017
Host: Annemarie Fertoli
Guests: Alison Seider and Stephanie Yang, Wall Street Journal reporters

---

Episode Overview

In this episode, the Wall Street Journal explores one of the often-overlooked risks of investing in Bitcoin: what happens if you forget your password? With Bitcoin reaching record values and its decentralized nature eliminating any chance of password resets via customer support, many early investors are finding themselves locked out of fortunes. Host Annemarie Fertoli is joined by Alison Seider and Stephanie Yang to discuss real-life stories, password security challenges, and the extreme measures some take to recover their digital assets.

---

Key Discussion Points & Insights

1. The Unique Risk of Forgetting a Bitcoin Password

• No Authority for Resets: Unlike bank accounts, there’s no central authority or “forgot password” link for Bitcoin wallets. If you forget your password or lose your private key, your bitcoin is effectively gone.
  • Quote: “It’s like losing a bank password, but there’s no bank to contact.” (Annemarie Fertoli, 00:54)
• Appeal vs. Risk: The lack of middlemen is part of Bitcoin’s appeal, but it also places all responsibility on the individual.
  • Quote: “You sort of have to become your own bank.” (Alison Seider, 01:34)

2. Password Complexity and Multiple Security Layers

• Private Key Security: To move Bitcoin, users must know their public key and especially their private key – a randomly generated, impossibly complex string.
  • Quote: “What you really want to protect is that private key, which is just a long string of incoherent letters and numbers... I just would never be able to remember that.” (Stephanie Yang, 02:07)
• Layers of Protection: Users often add extra passwords or recovery tools, increasing the risk of forgetting a crucial code.

3. Soaring Bitcoin Value and Painful Consequences

• Early Adopters Stranded: Many who bought Bitcoin as a lark now find themselves unable to access sizable investments as values soar.
  • Quote: “We talked to a lot of people who maybe forgot they even bought bitcoin... Now that prices are so high, people really would love to get back into those accounts.” (Alison Seider, 02:58)
• Real-World Example: The infamous story of the man in Wales who discarded a hard drive containing thousands of bitcoins – now worth over $100 million.
  • (Stephanie Yang, 03:31)

4. Desperate Recovery Attempts

• Extreme Measures: Some have tried hypnosis or hired hackers; one person built a supercomputer immersed in mineral oil to brute-force passwords.
  • Quote: “He’s built a really large supercomputer... It’s almost like a fish tank full of this mineral water so it disperses the heat.” (Alison Seider, 04:36)
  • Quote: “It could take hundreds of years even with a computer that powerful.” (Alison Seider, 05:10)
• Bootstrapped Recovery Services: Enter “Dave Bitcoin,” an anonymous password cracker who helps recover wallets for a 20% fee — and has a growing list of desperate, satisfied clients.
  • (Stephanie Yang, 05:57)
  • Quote: “If you have some sort of memory of what may have been in your password, he can help you crack it for 20% of whatever he recovers.” (Stephanie Yang, 06:40)

5. Social Fallout: Paranoia and Privacy

• Security Concerns: Bitcoin holders wary of scams and theft are often reluctant to share details, even with reputable journalists.
  • (Stephanie Yang, 05:57)

6. The Scope of the Problem

• Estimated Lost Bitcoins: Chainalysis estimates 2.8 to 3.8 million bitcoins — nearly a quarter of all in existence — are lost and likely unrecoverable.
  • Quote: “Anywhere between 2.8 million to 3.8 million bitcoin are lost; about a little less than a quarter of the total supply.” (Stephanie Yang, 08:36)

7. Advice and Prevention

• Modern Security Practices: Hardware wallets and mnemonic recovery phrases are essential, with experts suggesting physical, geographically dispersed storage.
  • Quote: “He keeps those 24 words stored on these little metal tiles and keeps one of them several states away... Maybe it sounds a little paranoid, but this is real money that we’re talking about.” (Alison Seider, 09:46)
• Third-Party Custodians: Exchanges can store private keys for the user, but this centralization opens new hacking risks.
  • (Stephanie Yang, 10:34)
• Self-Awareness Required: If you frequently press “forgot password,” think twice before buying and self-storing Bitcoin.
  • Quote: “I’d think really carefully about how you want to store something like this.” (Alison Seider, 10:57)

---

Notable Quotes & Memorable Moments

• “It’s like losing a bank password, but there’s no bank to contact.” (Annemarie Fertoli, 00:54)
• “You sort of have to become your own bank.” (Alison Seider, 01:34)
• “He built a really large supercomputer... in a fish tank of mineral water... could take hundreds of years even with a computer that powerful.” (Alison Seider, 04:36 - 05:10)
• “If you have some sort of memory... [‘Dave Bitcoin’] can help you crack it for 20%.” (Stephanie Yang, 06:40)
• “Anywhere between 2.8 million to 3.8 million bitcoin are lost; about a little less than a quarter of the total supply.” (Stephanie Yang, 08:36)
• "Maybe it sounds a little paranoid, but this is real money that we’re talking about." (Alison Seider, 09:46)
• “If you hit the password reset link on your email or Facebook or bank account a couple times a month, I’d think really carefully about how you want to store something like this.” (Alison Seider, 10:57)

---

Timestamps for Key Segments

• 00:54 — The irreversible risk of lost Bitcoin passwords
• 02:07 — Complexity of private keys and multi-layered password systems
• 03:31 — High-profile losses and motivation for desperate recovery
• 04:36 - 05:10 — Supercomputers and brute-force attempts
• 06:40 — "Dave Bitcoin" and third-party recovery services
• 08:36 — Chainalysis estimates on lost Bitcoin
• 09:46 — Hardware wallets and best security practices
• 10:34 — Third-party custodians vs. self-storage
• 10:57 — Know yourself: Are you a good candidate for DIY Bitcoin security?

---

Takeaways

• Bitcoin’s decentralization is both its strength and Achilles’ heel; there’s no safety net for carelessness.
• Strong, multilayered security is critical—but must be balanced with personal ability to remember/retrieve keys.
• Many bitcoins are lost forever, a costly lesson for early adopters.
• Would-be investors should carefully consider their security savvy and risk tolerance—or use regulated storage solutions.

---

Transcript

[A]

This episode is brought to you by Charles Schwab. Decisions made in Washington can affect your portfolio every day. But what policy changes should investors be watching? Washington Wise is an original podcast from Charles Schwab that unpacks the stories making news in Washington right now and how they may affect your finances and portfolio. [e-mail] WashingtonWise.

[B]

This is yous Money Matters from the Wall Street Journal.

[A]

Welcome to youo Money Matters. I'm Annemarie Fertoldi in New York. Bitcoin is notorious for its volatility. The cyber currency plunged nearly 25% last week after soaring to record new heights in November and December. That has investors watching closely. But imagine this. You want to cash in or get out, but you can't remember your password. We've all had the experience of forgetting a password to an online account, but for Bitcoin, it's very different because there's no official authority to contact to help you reset it. Joining me now in our studio to talk about this particular challenge are Wall Street Journal reporters Alison Seider and Stephanie Yang. So, Alison, there's a great phrase in the piece you both wrote for the Wall Street Journal that really gets to the crux of it's like losing a bank password, but there's no bank to contact. It's not like you can just call someone for help or click a forgot password link and get an email to reset it.

[B]

Yeah, and the interesting thing is that's really, that was part of the appeal to a lot of people who bought Bitcoin. They wanted to sort of get away from financial institutions and sort of cut the middlemen, the banks, out of transactions. But that puts a lot of responsibility on the individual person who owns Bitcoin. You sort of have to become your own bank.

[A]

Stephanie Typical password requirements seem to be getting more and more complex, but bitcoin passwords are in a league of their own. Can you explain the password requirements?

[C]

Right, so to move Bitcoin around, as we wrote in the story, you need a public key and a private key. And so what you really want to protect is that private key, which is just a long string of incoherent letters and numbers. Like, I've looked at them or, you know, examples of them, and I just would never be able to remember that. So basically what people do is they make up passwords to protect their private key, and then passwords on top of that, and then recovery tools, and then you have all these layers of security that you have to get through. And most of the time, it seems like with a lot of people who bought bitcoin when, you know, it was worth, I don't know, 10, 15, $20, they've forgotten at least one, maybe more of those codes that they originally had needed. Right.

[A]

And as you mentioned in the article, there was actually an episode of the Big Bang Theory where this happened. And you both talked to investors who had bought in years ago and are now watching bitcoin soar and are unable to do anything to get their money.

[B]

Yeah, it's really frustrating for a lot of people. We talked to a lot of people who maybe forgot they even bought bitcoin. And now that the prices are so high, bitcoin at one point almost hit $20,000 per bitcoin. Now that prices are so high, people really would love to get back into those accounts. And they're finding that for a lot of different reasons, they can't. You know, maybe they wrote their password down and they had a typo and it's off by one digit and they can't remember it. Or maybe their hard drive that it was stored on has been corrupted or thrown out. There's just a lot that can go wrong.

[C]

And especially as, you know, prices have been going higher and higher, I think, you know, we found people are more willing to do kind of out there, drastic things in order to get it back because the stakes are so much higher. So, for example, you know, we wrote in this story that there was this guy in Wales who threw away his hard Drive in 2013. And you know, at that time he thought, well, I'd really like to get this back, but if there's nothing I can do, then, you know, I'm kind of stuck. And now the value of that hard drive and that private key is upwards of $100 million. And so as you see that value keep climbing, you think, okay, well, it's worth it to try and do something really big now in order to get it back.

[B]

Yeah, I think some of the people we talk to are very seriously thinking about hypnosis, hiring hackers to get into their accounts. Just thinking it's either I trust this guy and he might clean me out or he'll take a 20% cut or I've got nothing, so I might as well try it.

[C]

And there was this guy who built a supercomputer. Ali you know more about that. But it was very interesting.

[B]

Yeah, one of the people he talked to, he bought 15 bitcoin. He had an E. Commerce site a couple years ago and was sort of thinking about whether to accept bitcoin. As payment. So he bought a couple just to try it out. And, you know, eventually he just sort of moved on to other business ventures, you know, didn't give it a whole lot more thought. But now those 15 Bitcoin, I mean, their value has climbed towards $300,000. And, you know, it was worth it for him to try and do something. So he's built a really large supercomputer. It's like 5ft tall by 2ft wide and it sits in a, a huge. It's almost like a fish tank full of this mineral water. So it disperses the heat that the supercomputer gives off. And it's just trying millions and millions of potential passwords that he could use to get in. And I mean, it could take hundreds of years even with a computer that powerful.

[A]

So is it basically in a cooling tank so that it can cool down as it's trying out all these different passcodes?

[B]

Yeah, that way it can run 24, seven, you know, just constantly churning through various passcodes. I mean, he told me that he, that the password he used was probably like upwards of 25 characters because he wanted to make it secure. So it's really long and it's gonna be really hard to crack it.

[A]

Wow. But as you say, when this much money is at stake, it makes sense that people would take extreme measures to try to get it.

[B]

Yeah.

[C]

And you know, one of the things that we kind of encountered is that these are people who are very secretive and worried about security because, you know, if your Bitcoin gets stolen again, there's no bank to contact. It's not like when your debit card or your credit card gets stolen and the bank says, you know what, it's fine, we'll take care of it. There's just no one to go to. So a lot of people that we reached out to were very suspicious. You know, they thought we might be hackers. They didn't want to give their full names. But you know, more people are getting desperate and turning to, you know, we talked to this service, you know, this guy that goes by Dave Bitcoin, you know, he doesn't give out his real name and he will help you try out new passwords. And basically if you have some sort of memory of what may have been in your password, he can help you crack it for 20% of whatever he recovers. And this guy has, I don't know, like a four year track record or so. And it seems really risky, but we talk to a lot of people who are willing to Take that risk, because otherwise it's just sitting there forever and you can't get any of it.

[A]

Wow. And he's had success cracking some codes for people.

[C]

Yeah, we talked to a lot of satisfied customers who just thought they had no other option.

[A]

I've been speaking with Wall Street Journal reporters Alison Seider and Stephanie Yang about Bitcoin passwords. And you're listening to youo Money Matters from the Wall Street Journal. Welcome back, everybody. Alison, the reason Bitcoin requires such complicated password keys is so investors don't need anyone in the middle. And that's as we've been talking about, one of the benefits and attractive things about Bitcoin. But in this case, it's part of the problem.

[B]

Yeah. What we've learned is that it can be really hard to keep track of your Bitcoin. You really have to know what you're getting into, you know, once you buy it. We spoke to a lot of people who bought it years ago, you know, and it was very new. And, you know, maybe they bought it on a lark as an experiment or someone paid them in Bitcoin or as a gift and, you know, they sort of lost track of it over the years. You got a new computer, you get a new phone, you wrote your password down on a piece of paper and then cleaned your room and tossed it out. It's a lot easier than you might think to lose. To lose your password. And, you know, I think most people weren't expecting the kind of run up that we've seen, you know, a 1,900% rally. A lot of people didn't see it coming and weren't that careful about storing their information.

[A]

And there's a lot more at stake here than, say, losing your email password or forgetting it temporarily and getting a reset link.

[B]

Sure. There's really no one to call to reset it. And, you know, transactions in Bitcoin can't be reversed, so you can't call up your credit card company and have them reverse the charges.

[A]

Stephanie, do we have estimates of how widespread this problem is with Bitcoin users forgetting their password? How many people are affected by this?

[C]

So we really only have estimates. And one of the organizations that we talk to, Chainalysis, has done some studies on this. But again, these are very rough numbers. What they basically do kind of when people want to look at, okay, how many Bitcoin are lost, just out of circulation, we'll never get to them again. They look at activity in digital wallets. And so if coins are sitting in a digital wallet and they haven't been accessed for a long time. You know, estimate about maybe 30 to 50% of the time. Those are lost forever. Of course, there are some people who are holding on and will just never sell. So they're just going to sit there dormant. But, you know, with some cases making educated guesses that it probably is, someone has lost their password and that's where it is. So from chainalysis, the estimate that anywhere between 2.8 million to 3.8 million bitcoin are lost, about a little less than a quarter of the total supply. That's a lot.

[A]

And we've also seen interest spiking as Bitcoin skyrockets. So I wonder if you both have any advice to offer people who are looking into it now to prevent this from happening.

[B]

Well, you know, one of the people we spoke to in the story, he takes his security very seriously. And he has stored his Bitcoin on a hardware device that has a pin. And then he has a mnemonic recovery phrase, it's 24 words. And he keeps that on a. It's a contraption called a cryptosteel. There's a couple of these on the market. He keeps those 24 words stored on these little metal tiles and he has a separate cryptosteel for a separate password, and he keeps one of them several states away. And, you know, he was telling us that maybe it sounds a little paranoid, but this is real money that we're talking about, so maybe something like that makes sense.

[A]

Yeah. And I think some people lose sight of the fact that because it's a digital currency and you're not holding it in your hand, we are talking about actual money that people are losing or maybe not able to access.

[C]

Yeah. And as you know, more people have gotten into the market or are interested in holding Bitcoin, there is the option of storing it with a third party exchange or organization in which you don't have to keep your private key handy. But at the same time, some people don't prefer that method because it opens you up to hacking. If the third party organization gets hacked, then you've lost your private key and there's nothing you could really have done about it.

[B]

Yeah, I guess if you're like me and you hit the password reset link on your email or Facebook or bank account a couple times a month, I'd think really carefully about how you want to store something like this.

[A]

I've been speaking with Wall Street Journal reporters Alison Seider and Stephanie Yang. Thank you both for joining me.

[C]

Thank you.

[A]

Thanks and thank you for listening to your Money Matters. I'm Annemarie Fertoldi in New York.

[B]

Is Alexa part of your life?

[C]

Then make your Money matters part of your flash Briefing on the Amazon Echo

[B]

the Wall Street Journal.

[A]

Listen ambitiously this episode is brought to you by Charles Schwab. Decisions made in Washington can affect your portfolio every day. Washington Wise from Charles Schwab is an original podcast that unpacks the stories making news in Washington. [e-mail] WashingtonWise.