Crypto security firm offers to recover ex-Ripple CTO’s bitcoin fortune

Unciphered says it can crack open IronKeys like Stefan Thomas’s, but the former Ripple exec isn’t on board yet.

article-image

99Art/Shutterstock, modified by Blockworks

share

Stefan Thomas, the former chief technology officer of Ripple, holds 7,002 bitcoins, currently valued at $244 million, in a hard drive he can no longer access because he misplaced the digital keys.

The programmer received these bitcoins in 2011 as payment for an educational video he created about bitcoin, only to lose the access code later that same year.

Crypto security specialists at Unciphered have now thrown Thomas a potential lifeline. 

The firm penned an open letter to him on Oct. 25, claiming they have the technical ability to outsmart Thomas’s “IronKey,” the encrypted USB device, and help him gain access to his bitcoin fortune.

Years ago, Thomas misplaced the paper containing his IronKey password, a device that permits only 10 attempts before permanently encrypting its contents. 

After fruitlessly trying eight of his go-to passwords, he’s down to his last two guesses. 

The drama gained attention in 2021, following a New York Times article detailing how the programmer had just two shots left to reclaim his crypto stash.

Unciphered has claimed it successfully recovered data from an IronKey similar to Thomas’s, also notably accomplishing this feat for digital culture publication Wired. 

They utilized a “secret cracking technique” over months, permitting them more than the standard 10 attempts, Wired reported.

Pooling their resources, the company’s founders reportedly assembled a team called Project Everest, comprising roughly 10 members, including staff and external advisors. 

Notably, several team members had previously sharpened their skills at the National Security Agency or similar high-profile government entities.

Unciphered is keeping its research methods and the specific technique used to bypass the IronKey’s guess limit under wraps, citing the potential risk associated with exposing such vulnerabilities. 

The firm says this secrecy is necessary since the outdated IronKey models they breached can’t be updated and might still hold sensitive data.

Thomas has so far declined Unciphered’s help, per Wired. 

Blockworks has reached out to the former Ripple chief technology officer for comment.

He is said to have already struck a deal with two other cracking teams — cybersecurity firm Naxo and independent researcher Chris Tarnovsky — promising them a reward for unlocking the drive. 

Yet, Naxo’s progress remains uncertain, and Tarnovsky is waiting for some payment from Thomas to continue.

Despite no success so far from the two parties, Thomas appears to be sticking to his original pact, giving the initial teams more leeway before seeking new aid.

“It’s possible that the current team could decide to subcontract Unciphered if they feel that’s the best option. We’ll have to wait and see,” Thomas told the outlet.


Start your day with top crypto insights from David Canellis and Katherine Ross. Subscribe to the Empire newsletter.

Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. Subscribe to the Forward Guidance newsletter.

Get alpha directly in your inbox with the 0xResearch newsletter — market highlights, charts, degen trade ideas, governance updates, and more.

The Lightspeed newsletter is all things Solana, in your inbox, every day. Subscribe to daily Solana news from Jack Kubinec and Jeff Albus.

Tags

Upcoming Events

Javits Center North | 445 11th Ave

Tues - Thurs, March 18 - 20, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

Brooklyn, NY

TUES - THURS, JUNE 24 - 26, 2025

Permissionless IV serves as the definitive gathering for crypto’s technical founders, developers, and builders to come together and create the future.If you’re ready to shape the future of crypto, Permissionless IV is where it happens.

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

recent research

Research Report Templates (2).png

Research

This reports analyzes the competitive dynamics of the Solana DEX landscape, identifying sustainable moats per protocol. We also find that Raydium (RAY), Orca (ORCA), and Lifinity (LFNTY) are valued very similarly on a P/S basis and what this could mean for Meteroa's (MET) valuation, which is still pre-TGE.

article-image

With $800 million now flowing to creditors, some expect a market boost — yet many remain cautious after years of waiting

article-image

There’s more to do on Solana than memecoins, but the market isn’t seeing it that way

article-image

Galaxy’s Alex Thorn said that the saga, paired with TRUMP and MELANIA, could lead to “further destruction of the memecoin complex”

article-image

Anatoly Yakovenko in 2017 embarked on the technical challenge of solving blockchain’s scalability problem

article-image

Grayscale Investments has historically had a four-stage lifecycle for its products, but there’s an indicator this could be changing

article-image

Brian Quintenz and Jonathan Gould are two recent Cabinet nominees with ties to crypto