ERIC MICHAUD▊
One of the best-known lockpickers in the scene — the man with a Mul-T-Lock attack named after him, a co-founder of TOOOL’s US chapter, the builder of two of America’s early hackerspaces, and the founder of a physical-security outfit that trained red teams to get through doors. Then he ran a crypto-recovery company whose secret co-founder turned out to be Morgan Marquis-Boire — the researcher DEF CON had already banned in 2017 over sexual-assault allegations. In 2025 DEF CON banned Michaud too, and put the reason in its own transparency report: “based on reporting of the Washington Post, including enabling Morgan Marquis-Boire.” He is charged with no crime. He has said nothing. This one is a fight about what it means to have vouched for the wrong man, and it is presented from both sides.
You want something that’s easily frangible but not going to break by accidental use… particularly ones that have a lot of glitter in it, because it’s going to be very difficult to replicate that.
Eric Michaud, on glitter nail polish as tamper-evidence for hardware — Vice, Jan 2, 2014. Speaker bio: HITBSecConf 2016
- WHO
- Eric Michaud — lockpicker and physical-security entrepreneur; founder/CEO of Rift Recon; later co-founder & CEO of the crypto-recovery firm Unciphered FACT
- RECORD
- Originator of the “Michaud Attack” on Mul-T-Lock (2005, named by Matt Blaze); co-founder & board member, TOOOL US; founder of the HacDC and Pumping Station: One hackerspaces; co-author, ACCESS PROHIBITED FACT
- THE DRAMA
- Led Unciphered while Morgan Marquis-Boire — banned from DEF CON in 2017 over sexual-assault allegations — held an undisclosed co-founder role; per reporting Michaud resigned when it surfaced; DEF CON banned him in 2025 (see Morgan Marquis-Boire, DEF CON) ATTRIBUTED
- DISPOSITION
- No criminal charge. No conviction. DEF CON’s stated basis is “reporting of the Washington Post, including enabling Morgan Marquis-Boire” — a quote from its own report, not an adjudicated finding. No public response from Michaud was found FACT
- STATUS
- BANNED (2025) — NOT CHARGED, NO PUBLIC RESPONSE — per reporting he resigned and ceased public communication
This file is not an accusation. Michaud is charged with nothing and convicted of nothing, and the one serious word attached to him — “enabling” — is DEF CON’s, quoting the Washington Post, not ours. What is documented is narrow: he built a real career in locks and physical security, then led a company whose hidden co-founder was a man already exiled from the scene, and a private conference drew a line. The misconduct alleged in the background belongs to Marquis-Boire, not to Michaud. The through-line here is vouching — the distance between who you did the work with and what they were accused of — and a man who, when the connection surfaced, went silent instead of answering it.
the drama timeline
ACT I — THE LOCKSMITH OF THE SCENE (2005–2014)
Before any of the drama, there is the work — and the work is real. A first-rank locksport figure and physical-security teacher, on the record for a decade.
-
2005
The “Michaud Attack”
Michaud becomes the first to pick Mul-T-Lock’s stacked-pin set, a technique cryptographer Matt Blaze names the “Michaud Attack.” He co-founds and joins the board of TOOOL US, the American arm of the Dutch lockpickers’ organization, and becomes a fixture of the locksport-village circuit.
-
2007–2014
Hackerspaces, then Rift Recon
He helps start HacDC (Washington) and Pumping Station: One (Chicago), writes a “How To Start A Hackerspace” series, and founds Rift Recon, a physical-security firm that sells red-team kits and trains professionals to defeat doors, safes, and tamper controls. He co-authors ACCESS PROHIBITED and preaches the ethics of the sport — don’t pick a lock you don’t own or have permission to open.
ACT II — UNCIPHERED, AND A HIDDEN NAME (2020–2024)
He moves from locks to locked coins — and, per the reporting, into business with a man the scene had already shown the door.
-
~2020–2024
CEO of a crypto-recovery firm
Michaud co-founds and serves as CEO of Unciphered, a company that cracks forgotten passwords to recover locked Bitcoin and other crypto for a share of the proceeds. It draws serious names — former NSA general counsel Stewart Baker, security veteran Chris Wysopal — and coverage from Wired, Fortune, and the Washington Post.
-
2024
The undisclosed co-founder
Per the reporting, a secret co-founder of Unciphered was Morgan Marquis-Boire — the once-celebrated spyware researcher accused of repeated sexual assaults and banned from DEF CON in 2017. Staff and contractors, several with CIA/NSA/FBI backgrounds, say they were not told. As the objections mounted, Michaud resigned as CEO and Marquis-Boire left; the company says his shares were bought out in February 2024 and his involvement fully severed.
ACT III — THE REPORT AND THE BAN (2025)
A newspaper prints the connection; a private conference draws its line; and the man at the center of it says nothing at all.
-
MAR 14, 2025
The Washington Post story
The Washington Post (Joseph Menn) reports that intelligence-community veterans had helped Unciphered soar “unaware of the infamous hacker behind it” — the undisclosed Marquis-Boire role and its fallout. ATTRIBUTED The article is live but bot-blocks automated readers; its substance is confirmed here against DEF CON’s own report and resolving secondary coverage, and the original was not independently machine-resolved.
-
2025
DEF CON bans Eric Michaud
DEF CON’s public transparency report adds Eric Michaud to its ban list with the reason quoted in full: “based on reporting of the Washington Post, including enabling Morgan Marquis-Boire.” The word “enabling” is DEF CON’s, citing the Post — a private conference’s stated basis for who it wants in its rooms, not a court’s finding. Michaud is charged with no crime and convicted of nothing.
-
2025–
Silence
Per the reporting, Michaud removed his LinkedIn profile and ceased public communication. No public response, denial, or statement from him about the Unciphered story or the DEF CON ban was found for this file. His side of it is, at present, unspoken — and that gap is noted here rather than filled.
both sides, on the record
DEF CON’s stated basis: the conference’s own transparency report bans Eric Michaud “based on reporting of the Washington Post, including enabling Morgan Marquis-Boire” — DEF CON’s words, quoting the Post [1] [2].
What the reporting establishes: per the Washington Post, Michaud led Unciphered while Marquis-Boire — already banned from DEF CON in 2017 over sexual-assault allegations — held an undisclosed co-founder role, and staff say they were not told who they were working for [2] [3].
He has not answered it: when the connection surfaced Michaud resigned, took down his LinkedIn, and stopped speaking publicly — so the ban’s stated basis stands on the record without a rebuttal from him [3].
He is charged with nothing. There is no criminal charge and no conviction against Eric Michaud. DEF CON is a private conference exercising a private ban; its report describes a basis for exclusion, not a finding of any crime [1].
“Enabling” is DEF CON’s word, not a verdict. The characterization is quoted from the conference’s report, which in turn cites the Post. It is an attributed reason for a private sanction — not adjudicated, not tested in any court, and not our finding [1].
The alleged misconduct is not his. The sexual-assault allegations in the background are against Morgan Marquis-Boire, who was accused and DEF CON-banned in 2017. Being in business with an accused man — even having vouched for him — is not the same as the conduct he was accused of [4].
When it surfaced, he stepped down. Per the reporting, Michaud resigned as CEO and the company severed Marquis-Boire’s involvement and bought out his shares — an exit, not a defense of the arrangement [3].
The career is real and undisputed. None of this is contested: the “Michaud Attack,” TOOOL US, two hackerspaces, a physical-security firm, a standard field text. His work in locks and physical security stands on its own [5].
YOU DECIDE
Scoped to the claims, never the man. Two things are settled and narrow: DEF CON banned Eric Michaud in 2025, and its own report states the basis as “reporting of the Washington Post, including enabling Morgan Marquis-Boire.” Past that, the exculpatory facts are strong and must be held at full strength. He is charged with nothing. He is convicted of nothing. The word “enabling” is the conference’s, quoting a newspaper — a stated reason for a private ban, not an adjudicated finding. The assault allegations belong to Marquis-Boire, not to him.
Weigh it honestly. A conference is entitled to decide who sits in its rooms, and to say why. A reader is entitled to remember that vouching for the wrong man is a different thing from what that man was accused of — and that the one voice missing from this record is Michaud’s own, because he chose silence over an answer.
The archive does not judge. The archive keeps the ban notice, the reporting it cites, and the silence — and lets you read all three.
evidence locker
THE 2025 BAN — PRIMARY
DEF CON — Transparency Report FACT — the conference’s own ban list; the Eric Michaud entry (2025) with the reason quoted verbatim: “based on reporting of the Washington Post, including enabling Morgan Marquis-Boire.” Also lists the 2017 Marquis-Boire ban.
defcon.org/html/links/dc-transparency.html The Washington Post — “Intel vets helped crypto firm soar, unaware of infamous hacker behind it” (Joseph Menn, Mar 14, 2025) ATTRIBUTED — the reporting DEF CON cites: the undisclosed Marquis-Boire role at Unciphered and the fallout. Live but bot-blocks automated fetches (HTTP 403 / connection reset); NOT independently machine-resolved to full content, cited as such.
washingtonpost.com/technology/2025/03/14/cryptocurrency-unciphered-morgan-marquis-boire/
SECONDARY COVERAGE — RESOLVING
CONTEXT & CROSS-LINKS
CAREER RECORD — STATED AS FACT
The standard. Everything above is sourced to DEF CON’s own transparency report, the reporting it cites, and Michaud’s own conference bio and on-record words. His lockpicking and physical-security career is stated as fact, because it is one. The ban is a fact, quoted verbatim from the conference. The word “enabling” is DEF CON’s, itself citing the Washington Post; it is presented only as the ban’s stated, attributed basis, never as our finding, and it is not an adjudicated conclusion. The sexual-assault allegations belong to Morgan Marquis-Boire and are attributed to the reporting; no victim is named and no graphic detail is given. Eric Michaud is charged with no crime and convicted of nothing — stated plainly. No public response from him was found, and that absence is noted rather than filled. The burden of proof is on us, not the subject. If a line here couldn’t survive a defamation challenge, it wouldn’t be on this page.