<p>1) If you generate your paper wallet on your computer, you have to fully trust your computer</p>

<p>2) If you use a website for generating your paper wallet, <strong>a)</strong> you need to trust that website (hopefully its local javascript) <strong>b)</strong> your browser and its random number generator and <strong>c)</strong> eventually your network provider(s) (depending on the transport layer security)</p>

<p>3) If you generate your paper wallet on your computer and it was compromised, the generated paper wallet was accessible at least during the time of your generation.</p>

<p>My recommendation</p>

<h2>1. Never ever use a online paperwallet generator</h2>

<h2>2. Hardware wallets are eventually not super secure, but they offer great security, maybe use them instead of a paperwallet</h2>

<h2>3. The BIP39 24 word seed can be restored even if the vendor of your HWW disappears</h2>

<p>Conclusion:</p>

<h2>Use an old offline computer with Bitcoin Core or any other semi-trusted software to generate your private keys or seeds, keep it offline all the time!</h2>

<h2>Or... use multiple hardware wallets from different vendors in a multisig setup if you want maximal security (but comes with minimal user experience)</h2>

CC BY-SA 4.0
2019-03-03T22:21:28.620Z
I said "old" computer because we can assume that older computer have less risks of included hardware based backdoors (like the intel management engine, etc.)
Jonas Schnelli
CC BY-SA 4.0
2019-03-03T23:19:55.350Z
Another possible attack vector is the printer, especially if it is a network printer.
Nate Eldredge
CC BY-SA 4.0
2019-03-06T05:58:35.643Z
Also your printer may store a lot of info in it's memory. Including the private key :(
Josh
CC BY-SA 4.0
2019-03-03T22:19:24.793Z
2019-03-03T22:19:24.793Z
Jonas Schnelli
<p>The site bitcoinpaperwallet.com was sold in April 2018 <a href="https://github.com/cantonbecker/bitcoinpaperwallet" rel="nofollow noreferrer">https://github.com/cantonbecker/bitcoinpaperwallet</a></p>

<p>And after this time many people wrote that their bitcoins were stolen:</p>

<p>1) <a href="https://www.reddit.com/r/Bitcoin/comments/cs68ri/my_paper_wallet_generated_on/" rel="nofollow noreferrer">https://www.reddit.com/r/Bitcoin/comments/cs68ri/my_paper_wallet_generated_on/</a></p>

<p>2) <a href="https://www.reddit.com/r/Bitcoin/comments/bjz1r9/my_private_key_from_my_paper_wallet_was_hacked/" rel="nofollow noreferrer">https://www.reddit.com/r/Bitcoin/comments/bjz1r9/my_private_key_from_my_paper_wallet_was_hacked/</a></p>

<p>Draw your own conclusions!</p>

<p>P.S. To use hardware bitcoin wallet - <a href="https://trezor.io" rel="nofollow noreferrer">https://trezor.io</a> . It's safe way to keep and send bitcoins</p>

CC BY-SA 4.0
2019-12-16T10:54:20.650Z
2019-12-16T10:54:20.650Z
Perlover
<p>The scam was most likely on the paper wallet creation tool. But don't give up fast and try to get the funds back. 
With high likelihood the thief sent part of the funds to his kraken.com account. If he did a KYC verification at kraken or cashed out then kraken might know the id or a bank account number. Or if withdrawn again then kraken should know to what address.
I assume that kraken is a cooperative company to hand over information if police asks or if you get a court order. Especially because the stolen amount seems to be high.
I'd report this information to police and if the thief wasn't too smart (fake id or temporary used bank account) you might have a chance to get the funds back.</p>

<p>This is how the funds got to kraken (I have access to non public forensic tools)</p>

<ol>
<li>February 27 the funds were sent from 193jdrxMKoUjWLyKm2UCGNXLGGvK1x3FDV to 15mUHhJ2ZvFvmKKKGtgd5otygsTrMqWCca with transaction <a href="https://www.blockchain.com/btc/tx/4f9fc1f57de81c32841c6e41febd610f4d1477f106a84012e4a5acab77cad542" rel="nofollow noreferrer">4f9fc1f57de81c32841c6e41febd610f4d1477f106a84012e4a5acab77cad542</a></li>
<li>At same time in same block s/he resent it to address 1EkazEZe98eCFsbFQ8vsRQicemHLNkq1oE with transaction <a href="https://www.blockchain.com/btc/tx/21796cae9e80a4eef8ca565e507ac62d0e2cb9b7b09b97437145a6eb256e9b77" rel="nofollow noreferrer">21796cae9e80a4eef8ca565e507ac62d0e2cb9b7b09b97437145a6eb256e9b77</a></li>
<li>About two hours later the thief sent BTC 2.96009354 from 1EkazEZe98eCFsbFQ8vsRQicemHLNkq1oE to 3PMw63UXmoG2w8Su3yL4DtScmCNpGRKRpd in transaction <a href="https://www.blockchain.com/btc/tx/90d095850d5bd9a6942b3e8fb71ea3f96aca8c50a7bf8d57c0818ca5d8706a3d" rel="nofollow noreferrer">90d095850d5bd9a6942b3e8fb71ea3f96aca8c50a7bf8d57c0818ca5d8706a3d</a>
This address 3PMw63UXmoG2w8Su3yL4DtScmCNpGRKRpd belongs to kraken.</li>
</ol>

<p>More can be investigated in case this one trace isn't successful (looks like the thief emptied many more paper wallets).</p>

<p>This is the output of the forensic tool:</p>

<p>"<strong>Forensic analysis BTC address 1EkazEZe98eCFsbFQ8vsRQicemHLNkq1oE</strong>
The BTCtester analysis tool found that address 1G14RygU7NmsZjp3vVHvkzuvVczvgy1BY3 belongs with high likelihood to the same entity.</p>

<p>The BTC address 1EkazEZe98eCFsbFQ8vsRQicemHLNkq1oE sent funds to BTC address 3PMw63UXmoG2w8Su3yL4DtScmCNpGRKRpd which belongs to the exchange Kraken.com.</p>

<p>This result is a snapshot at 2019-12-27 16:48:32.891217 (UTC+1).</p>

<p>With appr. 300,000 new BTC transactions per day there is a good chance that future transactions will bring new insights about the analysed BTC address. Therefore we recommend a regular repetition of the analysis.</p>

<p>Your BTCtester team"</p>

CC BY-SA 4.0
2019-12-27T16:49:00.923Z
2019-12-27T16:49:00.923Z
tempo
<p>I've been accumulating bitcoin into a paper wallet for a couple weeks. It's all been stolen. I'm trying to figure out what I did wrong:
<a href="https://www.blockchain.com/btc/address/193jdrxMKoUjWLyKm2UCGNXLGGvK1x3FDV" rel="noreferrer">https://www.blockchain.com/btc/address/193jdrxMKoUjWLyKm2UCGNXLGGvK1x3FDV</a></p>

<p>I've been very careful with this wallet. I purchased bitcoin on Bisq. Over time I was sending them to a paper wallet that I generated on bitcoinpaperwallet .com. I printed this paper wallet on a piece of paper hidden inside my house. I never saved the private key anywhere on my computer.</p>

<p>As I transferred funds into the wallet, I would verify they arrived by checking blockchain .com. They always did.</p>

<p>A week ago I transferred a lot more bitcoin to this same paper wallet. Today I checked and the wallet was completely drained, hours after the last transfer and soon after I verified they arrived (using blockchain .com). The bitcoins seem to have been instantly transferred to a bunch of wallets downstream and scrambled.</p>

<p>I'm completely baffled as to what I've done wrong. I searched my computer to make sure I didn't accidentally save the private key somewhere, it's nowhere to be found. But I knew that I didn't do this. I was very careful when generating the paper wallet. The only place the private key is on this piece of paper.</p>

<p>No one in my house knows anything about bitcoin, and anyway, this paper has been kept concealed.</p>

<p>What did I do wrong? Any clues?</p>

<p>P.S. Since I know someone will ask, the reason I didn't use a hardware wallet is that I was going to save this paper wallet on multiple encrypted USB sticks. I don't trust the hardware wallets to be secure and recoverable ~10 years from now when those companies may be gone and their software may be outdated.</p>

CC BY-SA 4.0
2019-03-04T00:42:36.283Z
Can you elaborate on how you generated the paper wallet? Did you do so in a web browser? Did you save the .html file and then run it while offline? Did the computer that generated the keys ever go online again later? What sort of printer did you use, is it connected to your network? Your answers to these questions may provide clues. Sorry you were robbed :(
chytrik
CC BY-SA 4.0
2019-03-04T06:23:50.147Z
I use Chrome as my daily browse so I bitcoinpaperwallet .com in Safari and printed out a few copies of the wallet on my printer. It is a network printer but it's just on my local wifi. I did leave Safari open on my Mac for a few days with the paper wallet still open in the tab, but minimized it in the background. I'm 99% certain no one saw it on my screen as Chrome is always in the foreground and my computer locks after a few minutes of inactivity. I didn't save the HTML file, my only guess is somehow leaving this open something scrapped it? But browser tabs are pretty well isolated processes.
sucks1717171
CC BY-SA 4.0
2019-03-04T06:40:52.920Z
I just read about CookieMiner and now I'm wondering if I possibly have malware on my computer. I'm very careful about things like this. However, I just tried one malware scanner just now and it found nothing. I'm not sure if CookieMiner is being picked up by current malware scanners.
sucks1717171
CC BY-SA 4.0
2019-12-16T10:53:16.927Z
The site bitcoinpaperwallet.com was sold in April 2018
https://github.com/cantonbecker/bitcoinpaperwallet
And after this time many people wrote that their bitcoins were stolen. Draw your own conclusions.

P.S. To use hardware bitcoin wallet - https://trezor.io . It's safe way to keep and send bitcoins
Perlover
<paper-wallet><wallet-security>
What did I do wrong that caused me to lose bitcoin?
sucks1717171
# What did I do wrong that caused me to lose bitcoin?

(Asked by: username_0 on 2019-03-03)

I've been accumulating bitcoin into a paper wallet for a couple weeks. It's all been stolen. I'm trying to figure out what I did wrong:
<https://www.blockchain.com/btc/address/193jdrxMKoUjWLyKm2UCGNXLGGvK1x3FDV>

I've been very careful with this wallet. I purchased bitcoin on Bisq. Over time I was sending them to a paper wallet that I generated on bitcoinpaperwallet .com. I printed this paper wallet on a piece of paper hidden inside my house. I never saved the private key anywhere on my computer.

As I transferred funds into the wallet, I would verify they arrived by checking blockchain .com. They always did.

A week ago I transferred a lot more bitcoin to this same paper wallet. Today I checked and the wallet was completely drained, hours after the last transfer and soon after I verified they arrived (using blockchain .com). The bitcoins seem to have been instantly transferred to a bunch of wallets downstream and scrambled.

I'm completely baffled as to what I've done wrong. I searched my computer to make sure I didn't accidentally save the private key somewhere, it's nowhere to be found. But I knew that I didn't do this. I was very careful when generating the paper wallet. The only place the private key is on this piece of paper.

No one in my house knows anything about bitcoin, and anyway, this paper has been kept concealed.

What did I do wrong? Any clues?

P.S. Since I know someone will ask, the reason I didn't use a hardware wallet is that I was going to save this paper wallet on multiple encrypted USB sticks. I don't trust the hardware wallets to be secure and recoverable ~10 years from now when those companies may be gone and their software may be outdated.

**Tags:** paper-wallet, wallet-security

> **Comments:**
> **username_1**: Can you elaborate on how you generated the paper wallet? Did you do so in a web browser? Did you save the .html file and then run it while offline? Did the computer that generated the keys ever go online again later? What sort of printer did you use, is it connected to your network? Your answers to these questions may provide clues. Sorry you were robbed :(  
> **username_0**: I use Chrome as my daily browse so I bitcoinpaperwallet .com in Safari and printed out a few copies of the wallet on my printer. It is a network printer but it's just on my local wifi. I did leave Safari open on my Mac for a few days with the paper wallet still open in the tab, but minimized it in the background. I'm 99% certain no one saw it on my screen as Chrome is always in the foreground and my computer locks after a few minutes of inactivity. I didn't save the HTML file, my only guess is somehow leaving this open something scrapped it? But browser tabs are pretty well isolated processes.  
> **username_0**: I just read about CookieMiner and now I'm wondering if I possibly have malware on my computer. I'm very careful about things like this. However, I just tried one malware scanner just now and it found nothing. I'm not sure if CookieMiner is being picked up by current malware scanners.  
> **username_2**: The site bitcoinpaperwallet.com was sold in April 2018 https://github.com/cantonbecker/bitcoinpaperwallet And after this time many people wrote that their bitcoins were stolen. Draw your own conclusions.  P.S. To use hardware bitcoin wallet - https://trezor.io . It's safe way to keep and send bitcoins  

---

## 3 answers

### Answer by username_3 on 2019-03-03. Score: 5

1) If you generate your paper wallet on your computer, you have to fully trust your computer

2) If you use a website for generating your paper wallet, **a)** you need to trust that website (hopefully its local javascript) **b)** your browser and its random number generator and **c)** eventually your network provider(s) (depending on the transport layer security)

3) If you generate your paper wallet on your computer and it was compromised, the generated paper wallet was accessible at least during the time of your generation.

My recommendation

## 1. Never ever use a online paperwallet generator

## 2. Hardware wallets are eventually not super secure, but they offer great security, maybe use them instead of a paperwallet

## 3. The BIP39 24 word seed can be restored even if the vendor of your HWW disappears

Conclusion:

## Use an old offline computer with Bitcoin Core or any other semi-trusted software to generate your private keys or seeds, keep it offline all the time!

## Or... use multiple hardware wallets from different vendors in a multisig setup if you want maximal security (but comes with minimal user experience)

> **Comments:**
> **username_3**: I said "old" computer because we can assume that older computer have less risks of included hardware based backdoors (like the intel management engine, etc.)  
> **username_4**: Another possible attack vector is the printer, especially if it is a network printer.  
> **username_5**: Also your printer may store a lot of info in it's memory. Including the private key :(  

---

### Answer by username_2 on 2019-12-16. Score: 3

The site bitcoinpaperwallet.com was sold in April 2018 <https://github.com/cantonbecker/bitcoinpaperwallet>

And after this time many people wrote that their bitcoins were stolen:

1) <https://www.reddit.com/r/Bitcoin/comments/cs68ri/my_paper_wallet_generated_on/>

2) <https://www.reddit.com/r/Bitcoin/comments/bjz1r9/my_private_key_from_my_paper_wallet_was_hacked/>

Draw your own conclusions!

P.S. To use hardware bitcoin wallet - <https://trezor.io> . It's safe way to keep and send bitcoins


---

### Answer by username_6 on 2019-12-27. Score: 1

The scam was most likely on the paper wallet creation tool. But don't give up fast and try to get the funds back.
With high likelihood the thief sent part of the funds to his kraken.com account. If he did a KYC verification at kraken or cashed out then kraken might know the id or a bank account number. Or if withdrawn again then kraken should know to what address.
I assume that kraken is a cooperative company to hand over information if police asks or if you get a court order. Especially because the stolen amount seems to be high.
I'd report this information to police and if the thief wasn't too smart (fake id or temporary used bank account) you might have a chance to get the funds back.

This is how the funds got to kraken (I have access to non public forensic tools)

1. February 27 the funds were sent from 193jdrxMKoUjWLyKm2UCGNXLGGvK1x3FDV to 15mUHhJ2ZvFvmKKKGtgd5otygsTrMqWCca with transaction [4f9fc1f57de81c32841c6e41febd610f4d1477f106a84012e4a5acab77cad542](https://www.blockchain.com/btc/tx/4f9fc1f57de81c32841c6e41febd610f4d1477f106a84012e4a5acab77cad542)
2. At same time in same block s/he resent it to address 1EkazEZe98eCFsbFQ8vsRQicemHLNkq1oE with transaction [21796cae9e80a4eef8ca565e507ac62d0e2cb9b7b09b97437145a6eb256e9b77](https://www.blockchain.com/btc/tx/21796cae9e80a4eef8ca565e507ac62d0e2cb9b7b09b97437145a6eb256e9b77)
3. About two hours later the thief sent BTC 2.96009354 from 1EkazEZe98eCFsbFQ8vsRQicemHLNkq1oE to 3PMw63UXmoG2w8Su3yL4DtScmCNpGRKRpd in transaction [90d095850d5bd9a6942b3e8fb71ea3f96aca8c50a7bf8d57c0818ca5d8706a3d](https://www.blockchain.com/btc/tx/90d095850d5bd9a6942b3e8fb71ea3f96aca8c50a7bf8d57c0818ca5d8706a3d)
   This address 3PMw63UXmoG2w8Su3yL4DtScmCNpGRKRpd belongs to kraken.

More can be investigated in case this one trace isn't successful (looks like the thief emptied many more paper wallets).

This is the output of the forensic tool:

"**Forensic analysis BTC address 1EkazEZe98eCFsbFQ8vsRQicemHLNkq1oE**
The BTCtester analysis tool found that address 1G14RygU7NmsZjp3vVHvkzuvVczvgy1BY3 belongs with high likelihood to the same entity.

The BTC address 1EkazEZe98eCFsbFQ8vsRQicemHLNkq1oE sent funds to BTC address 3PMw63UXmoG2w8Su3yL4DtScmCNpGRKRpd which belongs to the exchange Kraken.com.

This result is a snapshot at 2019-12-27 16:48:32.891217 (UTC+1).

With appr. 300,000 new BTC transactions per day there is a good chance that future transactions will bring new insights about the analysed BTC address. Therefore we recommend a regular repetition of the analysis.

Your BTCtester team"


---

