by Ben Mezrich
As the young woman moved out of the scanner and Megadeth moved in, Cameron wondered if his brother had suffered through the same mental anguish. Tyler had left their office a couple of hours before Cameron, so by now, he might already be in Detroit, heading toward his connecting flight. By this point, his matching backpack would be safely on his shoulder, well past the prying eyes of any TSA agents.
Megadeth was through the scanner, and it was now the businessman’s turn to show off his diving form. Then Cameron was inside, arms up, imagining the tiny microwaves flitting through his skin and bones and organs. Finally, he was through too and back to the conveyor belt. He forced himself to go for his shoes and laptop first, then the backpack. Once he had it in hand, he started breathing normally again. Still, it wasn’t until he was halfway to his gate that his heart rate started to settle down.
He wondered if it was going to be like this the whole three-day trip. Would he freak out at every airport, in front of every TSA agent, until all twelve pieces of paper reached their final resting place? He chided himself as he checked the information screens by the gate; his flight to Milwaukee was still on time, which meant everything was right on schedule. He’d have no problem making his connection to Madison. From there, it would be less than twenty minutes from the airport to the first bank. And when he was finished there, another twenty minutes back to the airport. Assuming the airlines didn’t let him down (always a possibility), he’d soon be on the next leg of his journey.
Tyler had planned everything out to the minute: the flights, the connections, even the taxis in between. Left-brained Tyler was good at planning; he’d been in charge of putting together itineraries for their family vacations since he was in his early teens.
Heading toward the gate agent, phone out to show her the barcode of his e-ticket, Cameron realized a simple truth; fuck it, both he and his brother were built for this sort of thing. High pressure, high stakes. For Cameron, the next seventy-two hours were going to be some of the longest hours in his life. But they were a walk in the park compared to an Olympic starting line.
* * *
“I think you’re going to be very satisfied with our service, Mr. Winklevoss. We might not look as corporate as the banks you’re used to, but we pride ourselves on our professionalism. We’re sure we’ll meet all of your local banking needs.”
The customer service rep had a beehive hairdo that bounced as she walked. Her gray pantsuit swished with each step, in concert with the clack of her platform shoes against the tiled floor. She was a pleasant lady in her midforties, with round glasses that sat precariously on a button of a nose, and a bubbly smile to go with the hairdo. Everything about her personality seemed peppy, which was good, because Cameron needed the infusion of energy. She was the third bank manager he had met that day, and there were still two more to go, with multiple flights in between.
Following her down the long corridor that led past the teller windows of the Davenport, Iowa, branch of the Northwest Bank and Trust, Cameron had to slow his long legs and New York gait to keep from passing her. But he was thankful for the calmer, midwestern pace; at the moment he was fighting true exhaustion. Getting to the bank in Davenport hadn’t been as easy as the ones in Madison and Minneapolis. Madison and Minneapolis were small cities compared to New York City, but compared to Davenport, with a population under 100,000 people, they felt enormous.
“At the moment,” Cameron said as they reached the door to the vault, which the woman dutifully attacked with a set of keys, “my needs are pretty minimal.”
The woman smiled back at him as she managed to swing the door open, then ushered him into a room with safety-deposit boxes stacked floor to ceiling on two walls.
“You never know. Just a safety-deposit box today, maybe an IRA tomorrow? We’re here for you, Mr. Winklevoss.”
She certainly liked saying his name. Cameron wasn’t sure if the woman recognized him, but unlike some of the other banks he’d visited, she hadn’t asked him any questions about the movie or about Facebook. Which he took as a very good sign. He wasn’t wearing a baseball hat down low over his eyes, he hadn’t painted on a mustache or dyed his hair, but he was certainly trying to keep as low a profile as possible. Renting a safety-deposit box in some small-town bank in the middle of Iowa wasn’t suspicious on its own. Maybe he had family in the area, maybe he had met a girl on a business trip and wanted a place nearby to store an engagement ring, maybe he was thinking of opening a rowing boathouse on the nearby Mississippi River. People rented safety-deposit boxes all the time for all sorts of reasons.
Then again, if the woman had seen his entire itinerary, if she had known that his identical twin brother was, at that very moment, at a bank in a city two states away, renting a similar-sized safety-deposit box, she might have had some questions.
Even without that knowledge, if she really recognized Cameron’s last name, she, or the bank’s risk officer, might have had reservations about taking his business. The twins had already been turned down by a few banks over the phone when they’d called inquiring about opening an account and renting a safety-deposit box. Those banks were even smaller banks that didn’t feel comfortable taking the twins’ business because they were worried that whatever the hell the twins planned on depositing with them would be incredibly valuable—making the bank a target for bank robbers and other bad actors.
Most small bank branches did not keep much cash on hand in their vaults; some as little as $20,000 at a time. This branch probably didn’t even have that much, and why would they? Cash went digital the minute anyone made a deposit. Why go to the trouble of hiring multiple guards, getting them bonded, and building hardcore security systems to protect what was ultimately a Microsoft Excel spreadsheet? But the safety-deposit boxes were different. The risks of holding something incredibly valuable, not just personal effects, but something liquid and fungible far outweighed the potential rental fees.
But if this particular bank manager was concerned, she wasn’t showing it. If push came to shove, Cameron could try to put her at ease by reaching into his backpack and saying that all he was storing in the plastic envelope destined for this bank was his Harvard diploma, or transcript, or some original family portraits of his ancestors. If pressed further, he could show her the actual piece of paper inside the plastic envelope and explain that it contained secret intellectual property for a computer program he had written back at school, or something along those lines. Not that she would actually ask. Instead, he waited until she showed him to his deposit box, a rectangular one, halfway up the easterly wall, and handed him his key. Only when she’d gone back out through the door of the vault, locking it behind her, did he unzip his backpack.
Taking one of the remaining plastic envelopes out, he carefully placed it inside the box. As he did so, he contemplated the contents printed on the piece of office paper from Staples inside—the random letters and numbers that to the human eye were indecipherable. To a computer, with the right software client installed, this paper contained one-third of a bitcoin private key—a shard.
This shard, referred to as “alpha,” when combined with two others, “bravo” and “charlie,” formed a private key—the private key that controlled all of the twins’ bitcoin. This meant that all three shards had to be separated from each other. Storing all three shards in one safety-deposit box would mean a thief could get control of all of the twins’ bitcoin by stealing a single safety-deposit box—a single point of failure. And storing them in safety-deposit boxes at different branches of the same bank wasn’t enough. An unscrupulous employee of that bank could pull off an inside job by accessing the vaults at different branches—another single point of failure. As a result, alpha, bravo, and charlie had to be stored in different safety-deposit boxes at different banks. With this security design, a thief would have to rob three different banks—or bribe employees at three different banks—or pull off some combination thereof to gain control of the twins’ bitcoin. Either way, it would be a logistical n
ightmare—Mission Impossible shit that only worked in the movies—to get ahold of the three shards that made up the bitcoin private key.
Moreover, the twins had replicated this model four times across different geographic regions, to build redundancy into their system—removing the final single point of failure—and improving their overall fault tolerance. This way, if a natural disaster like a major tornado decimated the Midwest, there would still be other sets of alpha, bravo, and charlie spread across other regions in the country (the Northeast, Mid-Atlantic, West, etc.) that could be assembled to form the twins’ private key. If a mega tsunami—or hell, Godzilla—hit the eastern seaboard, or a meteor hit Los Angeles, the twins’ private key would still be safe.
A total of twelve safety-deposit boxes, held across three different banking institutions, and spread across four distinct regions in the United States, completed their security design. The twelve pieces of paper in these twelve safety-deposit boxes would make up the only four copies of the twins’ private key in the world. No other copy would exist anywhere else, not on their laptops, not anywhere online, nowhere, only in twelve bank vaults spread out across the country. Cameron and Tyler’s homemade, off-line or “cold” storage system, built of paper and metal lock boxes, was ironically state-of-the-art; it rooted the security of the twin’s bitcoin in the physical world, outside the reach of online hackers.
The twins’ security system made it unlikely that a thief could physically get ahold of their private key, but none of these bank vaults prevented a hacker from guessing it. Generated correctly, a private key was impossible to guess—1 in 115 quattuorvigintillion—but the trick was generating it correctly.
To securely generate their private key, the twins had to make sure it was completely random. As it turned out, picking random numbers wasn’t as easy as it sounded; the human brain was not particularly good at creating randomness. It had an innate tendency to embed nonrandom patterns and sequences, even if it was consciously determined not to. Computers also had challenges when it came to randomness. They were deterministic machines built to return the same result for a given input—the opposite of random. You could use a random number generator on your computer, but what if the algorithm used was faulty? What if it produced what appeared to be a random number but was, in fact, merely a complex pattern that was predictable to a machine and could be reverse engineered? What if a hacker or a government was sniffing the electromagnetic fields being emitted by your computer, reading all of the information on it, including the numbers being generated?
In the world of virtual currency, paranoia had no bounds—in the end, only the paranoid would survive. And the twins were hell-bent on surviving. To ensure the security of their private key, they would have to harvest randomness from a sufficiently random and physical source that couldn’t be intercepted or easily reverse engineered.
The twins had ended up going old school, settling on a physical random number generator—a pair of sixteen-sided hexadecimal dice. Each die looked like two miniature, eight-sided pyramids glued together at their bases. These were the kind of dice that kids in high school who wear black trench coats and play fantasy role-playing games like Dungeons and Dragons might carry. In addition, the dice had to be evenly balanced and the table had to be level—so that rolls of the dice weren’t skewed to a particular letter or number, thereby defeating the randomness.
Cameron carefully placed the plastic envelope in the safety-deposit box, then slid the box back in its place, using the metal key the woman had given him to secure the lock. He placed the key to the safe onto a large ring—next to the two he’d received earlier that day—and placed the ring in the front pocket of his backpack.
And then he was back at the vault door leading to the rest of the bank. The woman opened it for him, springy and bouncy and friendly as ever.
“Are you sure you wouldn’t rather have one of our larger deposit boxes? The monthly bill isn’t much higher, and you get so much more room for your valuables.”
Cameron smiled back at her as she shut and locked the door behind him.
“This one’s more than enough for my stuff. Just some things that have sentimental value to me, but wouldn’t mean much to anyone else.”
It was true, to someone else that piece of paper wouldn’t mean much. Just random numbers, picked by the roll of plastic dice. But if that piece of paper was somehow reunited with the other pieces of paper in his bag and some of those that were already safely hidden away by him and Tyler in safety-deposit boxes in banks all around the country—well, that would be a different story.
Those pieces of paper would suddenly be worth far more than whatever cash was kept in this bank’s vault, maybe far more than all the cash in all the vaults of every branch of these local banks. Cameron couldn’t be sure, because the value of what those pieces of paper represented changed every day, sometimes every minute. He didn’t know how much they were worth, only what they had cost. And that number alone would have knocked the beehive right off his companion’s head.
Cameron’s taxi was still waiting on the street outside, ready to take him back to the airport, just in time to catch his next flight.
Efficient Tyler hadn’t factored in friendly conversation to their timetables; this wasn’t a pleasure trip, this was all business. They were on a mission.
On to the next city, the next bank, the next safety-deposit box.
* * *
“Are we really going to do this?”
Cameron grinned at his brother as he lifted the heavy sledgehammer over his shoulder, his eyes hidden behind a pair of thick plastic safety goggles. He was wearing a raincoat over his Tom Ford suit, and a pair of disposable, polypropylene galoshes over his cap-toed dress shoes. He could have changed out of his expensive suit, put on some sweats, a T-shirt, jeans, but he’d been wearing the suit that morning when they’d met with their accountant, and he’d decided it fit the moment. It wasn’t every day you got to use a sledgehammer while wearing a suit.
“It sure looks like we’re going to do this.”
Tyler was wearing a matching smock, but he still had his goggles up on his hair. His sledgehammer was resting on the cement wall behind him, its enormous head planted on the hardwood floor, inches beyond where the plastic tarp they’d laid out beneath the computer equipment ended. Tyler was looking at the hardware: the five laptops, already pried open, their hard drives gleaming against the tarp, the pile of USB drives, the pair of wireless routers, even the printer, up on its side to give them a better angle with the hammers.
“The routers are overkill,” Tyler said. “The printer too. Nobody’s going to be able to get anything off of a printer.”
Cameron shifted the sledgehammer, getting a better grip with his gloved hands. The gloves, smocks, goggles, tarp, and hammers had all come from Home Depot. One of the computers had been bought by Charlie, along with the USB drives. The printer was from their home office, not the construction zone they were standing in, the future headquarters of Winklevoss Capital.
The construction site had seemed the perfect place for the business at hand. They’d drawn the shades, but even if the shades had been open, nobody outside would have looked twice at two guys swinging sledgehammers in a construction site. Not even Charlie, over at his office at BitInstant a couple of blocks away, knew what they were actually up to, the extent to which they were taking their security seriously. He probably would have thought they were crazy. When he’d first walked them through the process of acquiring bitcoin, he hadn’t mentioned anything about sledgehammers.
The two clean laptops and the dozen USB drives were as far as Charlie had gotten. In the initial days, for the first $750,000 that they had Charlie purchase on their behalf, that had been enough, given the value at risk.
But when Cameron had explained to Charlie that the first $750,000’s worth of bitcoin was only the beginning, and they’d moved their purchasing into high gear—Cameron and Tyler had begun buying through Mt. Gox on their own, moving
much bigger amounts of cash into the virtual currency. And they had quickly realized that the dozen USB drives were nowhere near safe enough for what they had planned.
First off, there was no way they were going to leave any significant amount of bitcoin on Mt. Gox—a website that was once a magic card exchange and was now run by a crazy Frenchman who had made his mark putting cat videos on YouTube. Mt. Gox was a Dumpster fire waiting to happen.
The twins needed to store their bitcoin somewhere else. And with the numbers they were talking about, they’d decided to give their paranoia free rein. They’d already heard many stories about people having their digital wallets hacked, or their USB drives stolen, or people just plain losing their hard drives. Cameron had read about one guy in the UK who had actually spent months digging in vain through a garbage dump in search of a drive with a million dollars of bitcoin stored on it. The twins did not intend to dig through any garbage, or allow themselves to get hacked. Paranoia had its advantages.
So, one month earlier, in Cameron’s apartment, they’d nailed towels up across all the windows, making sure there was no way anyone could peer in and see what they were doing, and locked their iPhones away, far out of reach and in airplane mode. You never know who could be snooping through the camera or speakers of a smartphone. They then had gone to work with the hexadecimal dice, creating a new private key—different from the one they had created with Charlie.
For this new private key ceremony, they’d bought two additional clean laptops, from different suppliers, one cold and one hot. They’d placed electrical tape over both laptops’ cameras and speakers. The hot computer was used to download digital wallet software that was then transferred over via USB to the cold laptop; the twins had disabled the cold’s Wi-Fi—by physically removing its Wi-Fi card. They then had entered their new private key—the one they’d generated using hexadecimal dice—into the digital wallet on the cold laptop. Once they’d had their digital wallet set up on the cold laptop, they could generate Bitcoin addresses, controlled by their new private key, to send their Mt. Gox funds to, and attach a lightweight printer via USB cable to print out their new private key into distinct shards. They’d then inserted these shards—alpha, bravo, and charlie—into the plastic envelopes and sealed them. Then they’d laid the envelopes out on Cameron’s coffee table—ready for their backpacks and the long mission ahead.
