On top of this, Griffith supposedly planned to streamline Ethereum exchanges between North and South Korea while knowing this would violate US sanctions. He apparently called on other Americans to visit North Korea (including for the crypto conference) and signaled plans to renounce his US citizenship while buying citizenship elsewhere.

Griffith is charged with violating the International Emergency Economic Powers Act and, if convicted, could face up to 20 years in prison.

Whether or not the allegations hold up, it doesn’t look good for Griffith. There have been multiple reports of North Korea stealing billions in cryptocurrency and conventional money to help fund its nuclear program — Griffith couldn’t feign innocence about what the country might want from him. And with an explicit warning to avoid going, he was in trouble regardless of what he said.

The exchange encouraged community members to block deposits from the offending wallet, but didn’t have leads to identify the owner. There’s a wide range of potential candidates. It could be typical online criminal organizations, an inside job, or nation states hoping to pad their funds when sanctions leave them cash-strapped.

This isn’t the largest crypto theft to date. Coincheck lost $400 million in NEM tokens to a hack at the start of 2018, for instance. However, it’s still doing significant damage. It also suggests that exchanges may need to do more to lock down transfers to prevent large-scale theft like this.

When UNICEF receives a cryptocurrency donation, it won’t cash it out for a national currency. Rather, it will hold onto the bitcoin or ether and send the funds to a charitable cause in that same tender. This method will maintain a transparent chain of custody across the donation process and will ensure that the recipient gets a larger percentage of the original contribution compared to cash.

Of course, cryptocurrencies are infamous for their volatility. To avoid losing value between the time of a donation and a disbursement, UNICEF will only leverage bitcoin and ether for short-term programs such as purchasing mosquito nets to prevent ebola or sending food and water to areas struck by famine.

The Ethereum Foundation will be the first contributor to UNICEF’s Cryptocurrency Fund. The donations will help fund three grantees, as well as GIGA, an organization working to connect every school to the internet. UNICEF may have to rely on similar foundations for cryptocurrency donations; individuals who are fascinated by bitcoin and the like don’t frequently part with their hard-earned coins. But hopefully this new donation model will boosts funding for children in need and motivate more charities to accept cryptocurrency.

The bank is likewise considering proposals to count cryptocurrencies toward international reserves that have plummeted in recent years.

It’s not certain where Petroleos got the bitcoin and ethereum, let alone how much it has. There’s also no guarantee that companies would accept such a move when crypto’s relative anonymity and the potential for money laundering leads many other banks to hold off. That’s not even including the potential for further trade restrictions. This is a Hail Mary effort to sustain Venezuela’s economy (and thus the Maduro government), and it may ultimately amount to a risky experiment even if it goes ahead.

Cryptocurrency security relies on hashing algorithms that transform a traditional password, such as “banana$123,” into a unique string of numbers and letters, called a hash. To get specific, Ethereum wallets use a password-based key derivation function, meaning users input a unique password they can (theoretically) remember, and in return, they receive a key that serves as a unique, secure authorization code. The idea is that it’s impossible to reverse-engineer the hash to unlock a user’s base password, though a handful of algorithms have been compromised over the years, including MD5 and SHA1. However, as Dougherty’s clients have discovered, Ethereum’s security system is tight.

“With Ethereum, because it’s decentralized, you actually do all this on your own computer and it doesn’t even touch the internet,” Dougherty told Engadget. “You say, I’m creating a wallet with the password ‘banana’, and it turns into this mess of a key. And because there’s no company interface, there’s no one that can help you reset that password if you forget it. So the only way to fix that problem, I guess, is to find clever ways to try using that same hash to try and reproduce the complicated output.”

Essentially, you go phishing. In a phishing attack, a hacker attempts to gather information about someone without their consent, commonly through compromised email links and official-looking forms. Ethereum’s security protocols may be solid on a technical level, but they can’t stop someone from figuring out a password simply by asking the owner what it is, or tricking them into dropping clues.

Only, Dougherty isn’t tricking anyone. People come to him and willingly answer personal questions about their password habits. Do they usually capitalize letters or change some to numbers? Do they use their birth year, a favorite location or special symbols?

“Maybe, instead of choosing your favorite city, you chose your favorite movie or an actor or your name, or something like that,” Dougherty said. “Over email I just repeatedly ask the person and help massage it out of them where it’s not clicking, to break down why the things that they think their password might be, are.”

Dougherty then uses a mix of the password-cracking software hashcat and a program he built, called expandpass, which runs through varying, controlled permutations of specific words and symbols, but on a massive scale. On GitHub, he describes expandpass as, “useful for cracking passwords you kinda-remember.”

These programs are free and publicly available, but most folks don’t have the hardware or the programming expertise to put them to use. Dougherty happens to have the practical knowledge, and his rig is significant: It’s running a 1080 Ti graphics card with a 16-core CPU and 64GB of memory. Still, it can take months to crack a password.

If he’s successful, the client pays him. In Ethereum, of course. Sometimes, however, Dougherty cuts a project off after a few months, before finding the proper password, and he and the client go their separate ways. He doesn’t call this failing.

“There is no fail state, right?” he said. “I could keep trying indefinitely on anything. It’s more of a give-up state where it’s no longer worth my time or their time to keep iterating on this, to keep my cracking rig running. Because it does consume power. So, there’s an interesting negotiation that takes place.”

Dougherty got his start in cryptocurrency cracking in 2017, after reading a Reddit post from someone who wanted to brute force their way into their own Ethereum wallet. The Redditor remembered part of their password and generally what it looked like, handing Dougherty a puzzle perfectly suited to his interpersonal coding skills. He and five other programmers ended up racing to crack this user’s password. Dougherty won.

“I successfully unlocked that guy’s password, and then straight from that post I started getting, ‘Well wait, hey, could you try to help me with that?'” Dougherty said. “Things organically grew from there.”

Cryptocurrency looks a little less complicated from the perspective of a phisher. From this lens, it doesn’t matter how robust the technical protocols are, when humans are much more predictable. Dougherty has encountered a handful of common, inherently human crypto-password quirks that are also potential security risks. For one, a lot of people use words that pertain to the actual function of the password, like “Ethereum” or “wallet.”

“I’d say 90 percent and up use their birth year or the last two digits of their birth year,” Dougherty said. “And another funny thing is, there is a demographic of people who use cryptocurrency, so they all tend to be born around the same time. These years are a pretty narrow range, which is like, that’s a security consideration. Knowing just that isn’t sufficient to break in or anything, but it’s a start.”

Luckily, Dougherty is using this knowledge for good. He normally works with Ethereum, but his method should apply the same way across other wallets and half-forgotten-password scenarios. With potentially game-changing cryptocurrencies on the horizon, such as Facebook’s Libra, Dougherty’s services should be in high demand. At least, until Zuckerberg and friends enter the cryptocurrency customer service business themselves.

“The thing that’s particularly rare about it, actually, is that it’s collaborative and consensual,” he said. “Because cryptocurrency is so new, I think that this is the first instance where it’s useful to have a person in my position, where I can work with a client, consensually, to come to these conclusions.”

Images: Phil Dougherty (expandpass); SOPA Images / Getty Images (Ethereum)

E*Trade wouldn’t comment on the report.

While trading in virtual currencies certainly isn’t a novelty, E*Trade’s involvement could give it legitimacy among mainstream investors who might not want to venture beyond familiar names or are skittish given the occasional scandal. The influx of more conventional traders might also help stabilize a crypto market that has been prone to volatility over the years. If nothing else, it could make investment easier for newcomers who are curious about digital money but might not be sure where to start.