IronKey Lost Password Stefan Thomas

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Stefan Thomas and IronKey

Stefan Thomas was one of the earliest bitcoin proponents, and got paid in bitcoin for making an early explanation video about the bitcoin protocol back in 2011. After paying those who helped him, he put the rest of the bitcoins in an IronKey wallet and proceeded to forget the password. It was around July 11th, 2012 when he realized he may never get access to his bitcoins again. As the price of bitcoin has risen his story has been the subject of a large number of mainstream news articles.

This exchange or platform is based in United States, or the incident targeted people primarily in United States.

About Stefan Thomas

Stefan Thomas was a German programmer who lived in Switzerland in 2011.

"He had a problem with jobs as a freelancer:difficulty with payments across borders. Some of Thomas' bank accounts and international trade were closed. With the discovery of Bitcoin, making payments became easier.

He stated that before the Mt. Gox exchange, there was no website or platform where the Bitcoin price could be tracked or traded. In 2010, A relatively small Bitcoin community emerged with the Mt. Gox exchange.

Thomas said that with the emergence of the stock market and Bitcoin seeing price activity, it started to attract people's attention. “People were impressed by Bitcoin technology and were talking about the benefits it offers.

Personally, I was intrigued by Bitcoin's contribution to payments, and I worked on it in my spare time."

As of 2021, Stefan Thomas was living in San Francisco.

Animation Reward

"He did not see Bitcoin in a long-term perspective, either. But one day, he saw a community award for making an animated video about Bitcoin. The reward was 13,000 BTC. Thomas got the support of some of his friends for this and won the prize. The reward was 9,052 BTC.

He spent 2,000 of this award on those who helped him in the project and other expenses. He threw the remaining part into his crypto money wallet."

About IronKey

"Protected Bitcoins Thomas wanted to protect his Bitcoins after the amount started to increase. It established a cryptocurrency wallet system consisting of 2 backups and 1 main wallet to protect thousands of Bitcoins it owns. He set up the passwords for all of them and now felt completely safe."

The Reality

"Until July 2012. Everything has changed Stefan Thomas realized that he could not access the Bitcoins he was protecting on July 11, 2012. When he tried to enter the cryptocurrency wallet, his password was rejected and he saw that he had 2 access rights left."

What Happened

"When he lost his wallet password, the value of his Bitcoins was around $ 148,000."

Key Event Timeline - IronKey Lost Password Stefan Thomas

Date	Event	Description
July 11th, 2012	Stefan Thomas Realizes Loss	Stefan Thomas realized he couldn't access his bitcoin, work $148k at this point.
January 12th, 2021 11:10:35 AM MST	BusinessInsider Article	BusinessInsider reports on Stefan Thomas, a German programmer living in San Francisco, faces the risk of losing access to $220 million worth of bitcoins because he forgot the password to his IronKey hard drive. With only two password attempts remaining out of ten allowed, Thomas has been struggling to recall the correct password. His situation highlights a broader issue in the cryptocurrency world, where about 20% of bitcoins are reportedly in lost or inaccessible wallets. Despite bitcoin's recent surge in value, the problem of lost passwords remains a significant challenge for investors.
January 16th, 2021 10:27:00 AM MST	BusinessInsider Article	BusinessInsider reports on Stefan Thomas's situation. Stefan Thomas's bitcoin are now valued around $220 million. With only two password attempts remaining, he faced a significant personal and emotional struggle. However, after his story went viral, Thomas has come to terms with the situation, stating that "time heals all wounds" and that he has redefined his self-worth beyond financial assets. Thomas' case is covered as one of several involving lost or inaccessible bitcoins, with other cases highlighting the challenges of recovering lost crypto assets.
February 26th, 2021 1:49:25 AM MST	CurrentAffairs Article	Current affairs reports on Stefan Thomas
October 24th, 2023 4:00:00 AM MDT	Unciphered Wired Article	A Wired article reports that Unciphered has managed to crack the IronKey device and perform unlimited guesses at what the password may be. However, Stefan Thomas has not been willing to proceed with the recovery as he already had agreements with two other firms potentially.

Technical Details

"the secure hard drive, on which 7,002 bitcoins were stored, was an IronKey device. It gives owners 10 chances to guess their password before encrypting the contents. Thomas only had two attempts left to guess correctly before this situation occurred."

Total Amount Lost

Stefan Thomas had 7002 bitcoins in his wallet.

"When he lost his wallet password, the value of his Bitcoins was around $ 148,000."

The total amount lost has been estimated at $148,000 USD.

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

“When I lost, I panicked. I was very bad. Making such a mistake saddened me. I researched how I can get my Bitcoins back. I said maybe I should have given up."

Ultimate Outcome

The New York Times initially reported Thomas' plight and quoted him as saying:  "I would just lay in bed and think about it: Then I would go to the computer with some new strategy, and it wouldn't work, and I would be desperate again."

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

Ongoing Developments

Security firm Unciphered has demonstrated the ability to crack IronKey hardware devices. However, the firm has been unable to convince Stefan to hire them directly, since he reports having existing deals with two other companies to obtain the funds.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

Ensure that more than one copy of your seed phrase is kept, and that each copy is in a distinct location. For example, you may keep a backup copy in a bank vault. A common scheme is to split the 24 word seed phrase into 3 sets of 16 words each, such that any two of the sets are needed to unlock the wallet.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Wallet providers should ensure that users are well versed on the proper security of funds. Organizations or individuals can use multi-signature wallets to add redundancy in case individual keys are lost.

Never take for granted the limited knowledge of users of your service and their tendency to skip past provided information. It is recommended to design a simple tutorial and quiz for new users which explains the basics of seed phrases, strong password generation, secure two-factor authentication, common fraud schemes, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space. This tutorial and quiz should ensure their understanding and be a standard part of the sign-up or download process which is difficult or impossible to skip.

All wallets, minting functions, and critical infrastructure should be implemented with a multi-signature requirement, with a recommended minimum of 3 signatures required. This means that making important changes or approving spending will require the keys held by at least 3 separate individuals within the organization to approve. The multi-signature should be implemented at the lowest layer possible, all key holders should have security training, and all key holders should be empowered and encouraged to exercise diligence.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

Create a standard tutorial and quiz for all new cryptocurrency participants, which is required to be completed once per participant. This tutorial and quiz should cover the basics of proper seed phrase protection, strong password generation, secure two-factor authentication, common fraud schemes, how to detect and guard against phishing attacks, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.