What makes HD wallets resistant to brute force attacks?

Question

To be more specific, let's consider wallets that use 12 words as a seed.

Total bit width is 132, with 4 bits used as a checksum, so the actual seed size is 128 bits. I know 2^128 allows for LOTS of combinations.

I don't have a formal background in security, but here's what makes me think, as an amateur, that my bitcoins are not secure.

• the attacker is not bruteforcing a specific password/seed - there is no username associated with the seed - all the attacker needs is a seed that is being used by someone who hasn't spent all of his bitcoins

• with the bitcoin network and HD wallets becoming more popular, there would be more seeds that lead to non-empty addresses. Consider that if the BTC/fiat exchange rate goes through the roof with widespread adoption, even if bruting takes a lot of compute power, the rewards for successful bruting go up

Where did I go wrong with my thinking?

Answer 1

You don't have access to all of a HD wallet's private keys and their corresponding addresses immediately and can't check them for funds immediately.

When generating the 128 bit seeds and then generating the first few addresses of those HD wallets, you will encounter duplicates. Even if we ignore this and assume every private key and every corresponding address to be unique (which makes the math easier so more people can understand it), it's an unfeasible endeavor.

There currently are about 4.67*10^7 UTXOs. The best-case scenario for stealing at least some money is that every UTXO is held by a different private key in a different address. Instead of thinking about how our chances of success are worse than that, let's just assume it to be true.

HD wallets only use their seeds after 10^5 rounds of sha256. We neglect the additional effort of creating a private private key, creating a public key from that, creating an address from that, praying to the Flying Spaghetti Monster that the user actually used the very first address in their HD wallet and the funds in that first address are still unspent, and doing the actual lookup. Because those are harder to determine the cost for and as it will soon turn out, it's infeasible even if we literally have zero cost for that.

Given the numbers above and our very generous assumptions, we have to calculate 2^128÷(4.67*10^7)*10^5 = 7.28656032*10^35 sha256 hashes to get access to 1 UTXO.

The current hash rate of the entire Bitcoin network is about 3*10^18 hashes per second. Of course, in reality we can't just use miners because those 10^5 hashes we need to calculate per seed aren't independent of each other. In fact, they all (but the very first) depend on the one before them. That's the worst possible scenario for calculating a lot of hashes.

But even if we assume that we have access to all of the world's Bitcoin miners, magical new means of running purely sequential calculations in parallel (which is impossible, of course), and get all of the electricity those miners for free because our uncle just happens to barely use his nuclear power plant, recently, anyways, we still need to wait 7.28656032*10^35 / (3*10^18) = 2.42885344*10^17 seconds per UTXO to be able to steal it.

Luckily for us, that's only 7'701'843'734 years which is hardly more than half the age of the universe. I think we got that 1 UTXO. Then, again, our assumptions were pretty generous. It might take us a little longer to get hold of that 1 UTXO. Most of the big UTXOs probably aren't even stored in HD wallets but in cold storage instead, so we have even less hope to get hold of them, but whatever.