Everything up to this chapter has been the good news: a fairly chosen 256-bit key is beyond guessing, priced in sun-years. Now the autopsies. This chapter opens the case files on keys that were stolen — not because the arithmetic failed, but because the choosing did. Each case is real, each emptied actual wallets, and each one maps cleanly onto a tool you now own: a space too small to matter, a distribution too skewed to hide in, a generator that quietly repeated itself.
Watch for the pattern as you read: in every case, the thief's job shrank from "search \(2^{256}\)" to something a laptop does before lunch. The failures are never in the lock. They are always in the key-cutting.
Part III established that the only path to a fairly chosen key is brute force, and that brute force is thermodynamically closed. So the working thief never attacks the space. He attacks the process: find the keys that were drawn from a corner of it. Three shapes of failure cover nearly every case: the space was small (a human's idea), the distribution was skewed (favorites), or the generator was broken (repeats). The case files in this chapter are filed under those three shapes — the first file spans two of them — and Chapter 5's metric prices every one.
A brainwallet is a key made from a memorized phrase: take a line of a song, hash it, use the hash as the private key. The appeal is obvious — no hardware, no paper, nothing to lose but your own memory. The arithmetic is merciless.
First, the mechanism, and it is checkable right now:
That 64-character hex string could be used as a private key — and that is exactly the problem. Every bot on Earth computed this same string years ago.
Now price the defense with the book's tools. How many phrases might a human actually pick? Song lines, quotes, proverbs, jokes, names, passwords from memory — be generous and call it a billion candidates: \(10^9\). Chapter 3's arithmetic: at a million hashes per second (a laptop, no special hardware), the whole candidate space falls in \(10^9 / 10^6 = 1{,}000\) seconds — about 17 minutes. Chapter 5's metric: the real space is far worse than a billion uniform candidates, because humans converge on the same hundred famous lines — to be or not to be is the 123456 of brainwallets. Min-entropy of a human-picked phrase: not 256 bits, not 30; a handful of bits against a bot that tries the famous ones first.
The historical record matches the arithmetic to the letter. In March 2014 the security researcher who writes as palkeo published How to steal Bitcoins, describing exactly this: bots that hash every conceivable phrase and watch the resulting addresses. He documented sweeps landing seconds after coins arrived — one weak address lost 0.36 BTC two seconds after being funded — nearly ten thousand once-used brainwallet addresses found with a password dictionary, and even a comment left on-chain by one theft bot to another. The address for private key one had already seen 4 BTC flow through it. And the phenomenon never died — it industrialized. In 2023, the recovery firm Unciphered publicized its KeyBleed research on low-entropy-key sweeps still running at scale; and on today's network, watchers documented live "scorched-earth fee races" in 2024 and 2025: coins landing on a known-weak address trigger multiple bots to outbid each other's transactions in the mempool, fighting for the right to steal, within blocks.
A key that a bot is already holding is not a key. It is a tip jar on the sidewalk.
Second shape: the process had the right space but a broken mixer. In August 2013, the Android operating system's cryptographic random number generator — the component every Bitcoin wallet app used to make keys and signature nonces — was found to be faulty: on some devices it produced repeated or predictable outputs. Bitcoin.org posted a security alert; wallet apps rushed out updates; but coins whose keys had been made or used with the wounded generator were exposed, and thefts followed.
Measure it. A generator that sometimes repeats itself does not draw from \(2^{256}\) equally likely values — it draws from whatever smaller, correlated set its fault allows, and the attacker does not need to know the fault precisely to exploit it: he needs only to watch for collisions. Two signatures from one wallet that reuse the same nonce leak the key outright — Chapter 10 does that algebra — and the 2013 failures produced exactly those collisions on-chain, in public, for anyone scanning. The search cost for the thief: not \(2^{256}\), not a billion — detection only. Read the ledger, spot the repeats, compute the key.
Note what did not fail: secp256k1, SHA-256, the peer-to-peer network, the mathematics. What failed was one component's supply of fresh unpredictability — Chapter 6's well, run dry on one platform. The vault door held; the key-cutting machine slipped.
The cases above might read as history. They are not; they are an ecosystem. Today's mempool — the public waiting room where transactions queue before confirmation — is patrolled by bots that maintain maps of weak keys: every brainwallet phrase ever published, every key from a documented broken generator, every pattern humans love. The instant coins move to a weak address, a sweep transaction appears; if two bots spot the same prize, they fight by fee — each replacing its own bid with a higher-fee copy until one wins — which is the "scorched-earth fee race" observers logged in 2024–2025.
For the owner of a weak key, the practical sentence is this: any coin that touches a weak address is gone within blocks — not eventually, not probably. The bots' economics are Chapter 3's campaign arithmetic running in your disfavor: they play millions of raffles at once, and their expected wins are your expected losses.
There is no clever phrase. No obscure quote, no private joke, no backwards spelling, no keyboard pattern. The candidate lists are public, hashed, and watched around the clock, and they have been for over a decade. The only safe key is one no human chose — Chapter 11 shows how such keys are actually made and kept.
One case file remains, and it is the subtlest: a failure that needs no weak key at all. Bitcoin signatures carry a second secret — a per-signature random number called the nonce — and if that number is ever repeated or leaked, the key behind it falls out of the arithmetic, even when the key itself was chosen perfectly. The 2013 Android wounds exploited exactly this, Sony's PlayStation 3 signing key died of it, and the fix — removing fresh randomness from signing altogether — is one of the quiet triumphs of modern Bitcoin engineering. Chapter 10 does the algebra, with toy numbers you can check by hand.
to be or not to be years ago.Exercise 9.1 ★ The seventeen-minute wall. A botnet checks a million candidate phrases per second. How long to exhaust a generous billion-phrase brainwallet space? You should get \(1{,}000\) seconds — about 17 minutes.
Exercise 9.2 ★ Make the key no one should use. Reproduce the chapter's specimen: hashlib.sha256(b"to be or not to be").hexdigest() should print exactly 2e9d72a7…20995f54. Then change one letter and confirm the whole key changes — but remember Chapter 4's lesson: the string tells you nothing about the entropy of the process.
Exercise 9.3 ★★ Pricing the skew. Suppose the single most famous phrase is the choice of 1% of all brainwallet users. Using Chapter 5's metric: what is the min-entropy of that choice process, at most? You should get the flip-count of 100 — about \(6.6\) bits. Compare with 132.
Exercise 9.4 ★★ The collision watcher. In 2013 the exploit needed no brute force. Explain, in a few sentences, what the attacker scanned the blockchain for, why two signatures sharing a nonce value are a smoking gun (Chapter 10 has the algebra — your answer here needs only the shape), and why this failure mode is cheaper than any guessing.
Exercise 9.5 ★★★ A friend proposes a "strong brainwallet": a sixteen-word passphrase they invented themselves, interleaved with their birthday and spelled backwards. Write the response, using this chapter's ecosystem facts (candidate lists, live mempool bots, fee races) and Chapter 5's metric. Your answer should state clearly what would have to be true for their scheme to survive — and why human invention cannot supply it.
Sketches, not model answers — enough to check your reasoning against. The computational exercises embed their expected outputs in the exercise text.
Exercise 9.4. The attacker scans for two signatures made by the same key that carry the same nonce value — visible in the signature data itself, no guessing involved. A repeat means the signer ran the same secret number twice, and Chapter 10's toy algebra shows that two such equations solve for the key with school arithmetic. It is cheaper than guessing because there is no search at all: the ledger itself announces which keys are compromised. The 2013 wounds mattered precisely because a faulty generator manufactures those repeats.
Exercise 9.5. For the scheme to survive, the phrase would have to sit in a space no bot has enumerated, with no favorites the bots try first — in this book's terms, high min-entropy against the public candidate lists. Human invention cannot supply it: the lists already contain every pattern a person finds clever (birthdays, backwards spellings, substitutions, interleavings — these are generation rules, and rules are enumerable), and the mempool bots keep the lists current. The gap is not cleverness but kind: a fair die produces outcomes no list contains because no list can contain "the physical world's noise." That is why the only safe brainwallet is no brainwallet.