I've seen that a few scams went around recently that took advantage of folks
not really knowing much about Ian Coleman's BIP39 tool that I've got here
and specifically not understanding really what they're looking at when they
look at a tool like this and the way that that causes people to lose their
money is they didn't know what they could and couldn't share and they also
didn't really clearly know what they needed to back up so that's what we're
going to look at this is what Ian Coleman's BIP39 tool looks like if you just jump
there on the web I always recommend running this offline air-gapped in
something like tails Linux and you can just download a standalone version of
that so what I've got here is a PDF where I've pretty much highlighted all
the different areas and color-coded them and what we're going to start with is
red that is if the attacker has any of these five things they can literally
steal everything the lot do not share these with anyone ever doesn't matter if
you've got a hardware wallet an or anything else like that a customer
support representative will never ask you for any of the information in these
boxes and if you have a hardware wallet the wallet software using should not be
asking you for this either you should enter your 24 word seed once when
you initialize the wallet and that is it almost every other time that a while
asks you so that is trying to rob you so firstly we've got the entropy and the
filtered entropy so these two things are basically the randomness that goes into
making your 24 word seed this raw binary is just a binary representation of these
numbers and the word indexes is just the BIP39 indexes for each word in the 24
word seed because the 24 word seed words are actually made up of a list of words
and this is just the indexed in that list so you got your BIP39 mnemonic
which is your 24 word seed I've also got your passphrase in there as well
because if you do have a passphrase that gives you a bit more protection for this
stuff but still don't go giving it out and you've also got the BIP39 seed so
all of these are essentially the same information
being expressed in different ways and again if a hacker has it they can get a
lot this is also a really important place to say that your BIP39 Mnemonic
plus the passphrase if you have a passphrase is the only backup you need
at all ever one of these scams that was going around
was basically telling people they needed to keep their 24 word seed phrase and
they also needed to keep copies of like different bits of information from here
and the attacker was trying to be helpful in getting people to identify
the different bits of information they needed to backup no this this stuff your
24 word seed your BIP39 mnemonic is the only backup you need and it's the
information from which everything else is derived and they've got here if you
think about it you know your 24 word phrase is the only thing you actually
added into the website so everything else has come out of it even if you're
maybe not clear on exactly how so the next category of stuff that I've got
I've selected as orange so if the attacker has this they can steal all of
the coins from one coin or one account so for example if you share this BIP32
root key it means the attacker can steal everything that you have from the coin
that you have selected at the time so this is the piece information that the
scammers had people thinking they needed to back up in addition to what their
head likewise if you share your account extended private key or your BIP32
extended private key with people they can steal from all of the addresses for
the selected account for the coin that you have selected
so don't share that with anyone from there we move down to yellow and things
that I've highlighted is yellow here are all of the private keys for individual
addresses that you have and what happens here is an attacker can steal all the
coins from a specific address that they have the private key for but only that
address so if someone had say this first private key here that doesn't give them
the ability to steal anything from any other addresses that you have but still
don't share this with anyone when Bitcoin cash forked and it happened in
a the big way when Bitcoin gold forked as
well you had the same set of private keys that now gave you two sets of coins
so people were encouraged to enter their private keys into these wallets to claim
their new coin or their new forked coins now the issue is that some people
entered these private keys into scamming websites or scamming wallets which stole
their Bitcoin and left them with nothing and what I won't say here is if you
really must go entering in private keys to claim a fork and airdrop a blockchain
snapshot something like that you know move the original coins like the
main crypto that you're coming from say Bitcoin off that address first
especially if the fork has already happened like with Bitcoin and Bitcoin
cache though there are some things that can mean that this can sometimes have
issues and that is why hardware wallets will generally have official split tools
for this so once you get into the space of trying to claim Forks and airdrops
and wait with private keys there are some ways you can lose your funds in
that so really pay very close attention to that and use the official tools if
they exist so those are all the different bits of information you
shouldn't really have any reason to share with anybody ever
if in doubt click that box and if what someone's asking for has disappeared
that they probably shouldn't have it I've highlighted these other bits of
stuff that you can share with someone they won't be able to steal your funds
but it may have privacy implications so first of all we've got the stuff that
I've selected in brown and this is your account extended public keys and
basically what happens if someone has these they can identify all of the
public addresses for a given coin that's the coin you had selected here and a
given account they you'll notice that every time you do receive in your wallet
it generates a new address and it will be addresses sort of like in this order
and if someone has these xpub keys they can see all of the addresses that will
be generated when you go to receive coins so there is one special case here
which is worth mentioning which is that if someone has your
xpub key and one of the private keys associated with that xpub key they can
actually then access all of the private keys for that account only so it's not
as bad as sharing say you're 24 word seed or something like that but it's
important to understand when you're giving out your xpub key that if
someone happens to get one of the private keys associated with that they
can then access all of the private keys for that account I only share this with
apps you trust so you know there are some watch only wallets that allow you
to see and receive Bitcoin at these addresses and use your ex pub for that
but don't just share with random people there's no reason anyone should need
this information from you that brings us to the last things the
stuff that I've highlighted in blue and those are things that are safe to share
so your public addresses and even your public keys that go with your public
addresses are safe to share you know these addresses can't actually be linked
to each other except through analysis of your transactions so someone can just
have one public address and that doesn't mean that they can automatically see all
of the others doesn't mean they can steal your funds or anything like that
and yeah you can be free to share those with anyone so the thing I would say is
if you do have individual addresses that might have large amounts of funds in
them and you don't want everyone to know I guess exactly how much you're worth
then you might not want to share those specific addresses with people or
addresses that are linked to them that you've either moved money in or out of
thanks for watching I hope that was helpful just hit subscribe if you'd like
to be kept in the loop about future content I make to help people stay safe
in the crypto space and to recover if they get into trouble or if there's a
question you'd like some more information about or topic you'd like me
to cover in the future just leave a reply