<p>I recently fell victim to an inferno contract that took a significant amount of my ERC-20 coins. I realize that this is a Bitcoin site, but a white hat hacker approached and offered to help, and told me that I am able to recover my funds, but I first needed to create a signature transaction by sending 0 ETH to myself but placing my BTC derived BIP32 root key that was converted into the hexidecimal form into the hex data portion of the Metamask transaction.</p>
<p>I first responded that I did not see how I could recover the funds, and secondly, if I place the converted root key in the data field, anyone could view the Tx, convert it back, and steal my private keys. He then said that this is not possible anymore due to the way elliptic curve keys are now, and directed me to this taproot link: <a href="https://cronokirby.com/posts/2021/08/taproot-and-bip32/" rel="nofollow noreferrer">https://cronokirby.com/posts/2021/08/taproot-and-bip32/</a>.  This is all way above my head and if anyone is able to provide some information, I would greatly appreciate it.  Is giving out your BIP32 irrelevant now like he said and is there such thing as creating a signature transaction? I know that my tokens likely cannot be recovered, but of course, there is always a small hope that something may be able to be done.</p>
<p>Thank you.</p>

CC BY-SA 4.0
2023-11-20T21:24:49.197Z
Never, under any circumstances, give anyone else a private key of yours. In many cases the root private key can be computed back from the derived key. This is almost certainly a scam. Citing BIP32 itself: "One weakness that may not be immediately obvious, is that knowledge of a parent extended public key plus any non-hardened private key descending from it is equivalent to knowing the parent extended private key (and thus every private and public key descending from it)."
Pieter Wuille
CC BY-SA 4.0
2023-11-20T21:39:50.860Z
Thank you so much Pieter for the quick response.  You confirmed my suspicions and will definitely  keep from giving the root key out.  But this shows how much I need to learn besides just buying BTC.  Sorry, can I ask is the non-hardened private key the regular private key, and is the parent extended private key the BIP root key?
rnaka
CC BY-SA 4.0
2023-11-20T22:05:42.890Z
That really depends on the context. The root key is the root from which all other keys are derived, directly on indirectly (there is a hierarchy). Derivations can be hardened or non-hardened; which one is used depends on the standard/wallet/software/setting.
Pieter Wuille
CC BY-SA 4.0
2023-11-20T22:27:26.180Z
I see, thank you so much Pieter.  Sorry, if I could ask I more question as I was trying to learn more about the signatures.  He mentioned that I needed to create a transaction to myself.  Is this even closely how it is performed?  It just does not make sense to me.
rnaka
CC BY-SA 4.0
2023-11-21T03:17:33.537Z
I know nothing about ERC-20 or Ethereum
Pieter Wuille
CC BY-SA 4.0
2023-11-21T05:40:16.803Z
Ok, thank you Pieter, I really appreciate it!!
rnaka
<private-key><bip32-hd-wallets><signature><taproot><fraud>
Bip32 Root Key in Metamask Signature?
rnaka
# Bip32 Root Key in Metamask Signature?

(Asked by: username_0 on 2023-11-20)

I recently fell victim to an inferno contract that took a significant amount of my ERC-20 coins. I realize that this is a Bitcoin site, but a white hat hacker approached and offered to help, and told me that I am able to recover my funds, but I first needed to create a signature transaction by sending 0 ETH to myself but placing my BTC derived BIP32 root key that was converted into the hexidecimal form into the hex data portion of the Metamask transaction.

I first responded that I did not see how I could recover the funds, and secondly, if I place the converted root key in the data field, anyone could view the Tx, convert it back, and steal my private keys. He then said that this is not possible anymore due to the way elliptic curve keys are now, and directed me to this taproot link: <https://cronokirby.com/posts/2021/08/taproot-and-bip32/>. This is all way above my head and if anyone is able to provide some information, I would greatly appreciate it. Is giving out your BIP32 irrelevant now like he said and is there such thing as creating a signature transaction? I know that my tokens likely cannot be recovered, but of course, there is always a small hope that something may be able to be done.

Thank you.

**Tags:** private-key, bip32-hd-wallets, signature, taproot, fraud

> **Comments:**
> **username_1**: Never, under any circumstances, give anyone else a private key of yours. In many cases the root private key can be computed back from the derived key. This is almost certainly a scam. Citing BIP32 itself: "One weakness that may not be immediately obvious, is that knowledge of a parent extended public key plus any non-hardened private key descending from it is equivalent to knowing the parent extended private key (and thus every private and public key descending from it)."  
> **username_0**: Thank you so much username_1 for the quick response.  You confirmed my suspicions and will definitely  keep from giving the root key out.  But this shows how much I need to learn besides just buying BTC.  Sorry, can I ask is the non-hardened private key the regular private key, and is the parent extended private key the BIP root key?  
> **username_1**: That really depends on the context. The root key is the root from which all other keys are derived, directly on indirectly (there is a hierarchy). Derivations can be hardened or non-hardened; which one is used depends on the standard/wallet/software/setting.  
> **username_0**: I see, thank you so much username_1.  Sorry, if I could ask I more question as I was trying to learn more about the signatures.  He mentioned that I needed to create a transaction to myself.  Is this even closely how it is performed?  It just does not make sense to me.  
> **username_1**: I know nothing about ERC-20 or Ethereum  
> **username_0**: Ok, thank you username_1, I really appreciate it!!  

---

## 0 answers

