Over the next few months, I regularly checked the balance to see if the endowment had been sent, and each time, the wallet balance was zero. However, upon checking again one day in early 2016, I noticed something odd — the balance was still zero, but there was a new outgoing transaction, and an earlier incoming transaction, for the amount the Ethereum Foundation specified would be sent. After some digging, I realized what had happened: on November 24 2015, the endowment was quietly sent, without a confirmation message. And just a few weeks later, in mid-December, the wallet was drained of its entire balance by an unknown party.

The grant had been sent, I realized. But it was now gone.

The address containing the grant had been drained.

When I saw the transaction that had drained the wallet, my stomach immediately sunk, and I started racking my brain for the answers. How could this be? I hadn’t moved the funds. Nobody else ever had access to the private key. I’m generally very secure with my wallets, and follow all standard practices — at a minimum — to make sure nothing like this would be an issue.

What possibly could have happened?

I decided to find out for myself, and downloaded BrainFlayer, an open source wallet cracking tool. I started it up, attempting to break into the endowment wallet — and sure enough, within a few hours, I was in. And then I realized:

I had made a huge mistake.

The very first address on my list had been a test wallet, where I had inputted an incredibly simple and easily cracked seed phrase when prompted for one with Vitalik’s pyethtool script, and then securely saved the public and private keys. Unfortunately, I was not fully aware of how the tool actually worked. Unlike other cryptographic security tools asking for a seed phrase to generate a login keypair or to use as two-factor authentication (such as the Ethereum pre-sale wallet generator), choosing a particular seed pass phrase always resulted in the same Keccak/SHA-3 derived public and private key.

To understand how this security model would be problematic, consider if Gmail only required a password to login, and logged you into the email account for the first user who had previously signed up with that password. You only would ever want to use a security model like this if your password was a completely unguessable string, and not a relatively simple password.

Unfortunately, Ethereum was still using this system when I generated my first wallet in 2014, and saved its public and private keys. Being on the cutting edge has its benefits, but in the rapidly evolving world of blockchain tech, it can also mean the seemingly minor mistakes can have huge consequences.

This insecure wallet was the first address recorded to my secured list of public/private keypairs I owned, and simply because it was first, I chose that address to send to the Foundation. Like all wallets made with the 2014-era Ethereum wallet generation script using a seed pass phrase, it was vulnerable to being hacked — especially without a very complex pass phrase.