Wallet recovery experts cracked a wallet worth 1 billion dollars in ETH, only to find just 10 dollars inside.

Author: Christina Comben

Translation: Deep Tide TechFlow

Deep Tide Guide: In 2021, a client known as Rusty told wallet recovery expert Chris Brooks that he and two others had won a lawsuit, receiving 5000 BTC (approximately $53 million at the time) and $1 billion in ETH. The Brooks father and son flew to Georgia overnight, only to spend an entire day tinkering with the wallet in an office behind a mall, ultimately finding about $10. This seemingly outrageous case revealed the core contradiction in the cryptocurrency recovery industry: people think they lost money, but often, the money never existed in the first place. This article breaks down the "recoverability" of recovery phrases, passwords, passphrases, and hardware wallets, and also reminds readers: finding a recovery expert is itself a gamble on security.

Losing cryptocurrency does not necessarily mean the money is gone

For wallet recovery experts, "losing cryptocurrency" can refer to several distinctly different situations.

They do not retrieve Bitcoin from the blockchain, but rather find the information needed to access an already existing wallet.

Someone might have thrown away a hardware wallet, forgotten a part of their password or recovery phrase, but these do not necessarily mean the underlying cryptocurrency has disappeared.

Bruno Krauss, co-founder and CTO of ReWallet, told Magazine: "If you missed a few words, it's usually recoverable."

The BIP39 recovery phrase standard for Bitcoin uses a list of 2048 words, which means if someone knows most of the words, experts can sometimes recover them by systematically searching the remaining possibilities. The fewer missing pieces, the easier the puzzle is to solve.

The principle of password recovery is similar.

The BIP39 standard for Bitcoin uses a 2048-word list. Source: GitHub

Krauss said that ReWallet once reverse-engineered a faulty password generator to recover a 20-character password protecting about $3 million.

Other cases rely not on technical vulnerabilities but rather on figuring out how a person sets their password.

This means asking clients about personal preferences: favorite foods and places, children's names and birthdays, life milestones or memories.

He said there was once a client who was convinced she used her child's name, only to remember the password was actually a local courier company's phone number: "She didn't know why, but after thinking about it, she realized, oh, I sent a package to the store that day and thought, hmm, that's a good password."

Passphrases add another layer of complexity

Bennet, an educator of Bitcoin security, mentioned another particularly confusing element: passphrases.

A passphrase is an extra layer of information added on top of the recovery phrase. Entering a different passphrase does not necessarily result in an error; it simply opens another equally valid wallet. He told Magazine: "Entering the wrong passphrase does not result in an error; it will succeed and then show you a zero balance."

So, it is entirely possible to have the correct recovery phrase, enter everything correctly, yet still believe your BTC is missing.

"The passphrase also lacks any mechanism to protect users from their own errors: there is no list of 2048 valid words, no checksum. So if you forget your passphrase, the issue essentially goes back to square one: how random is your passphrase? If it’s random enough, it often cannot be recovered."

With lost or damaged hardware wallets, even having the broken device on hand may not help much. As long as the backup recovery phrase is still available, the keys can usually be restored on another device.

For this reason, recovery experts may not need the original hardware but rather sufficient information to reconstruct access to the keys.

Recovery sometimes also means correcting errors rather than retrieving lost wallets. Cryptocurrency assets mistakenly sent to the wrong blockchain (like sending BNB to Ethereum) can sometimes be recovered if the receiving wallet is still under the user's control.

Brooks stated Crypto Asset Recovery has been commissioned to unlock approximately 3,000 wallets for about 1,500 people, recovering passwords for around 63% of them.

Sometimes you really have lost everything

But there is a hard boundary. Bennet said: "If your recovery phrase is randomly generated and you thoroughly lost it, then your Bitcoin is gone."

This is one of the fundamental trade-offs of self-custody. Bitcoin wallets do not have a bank-like recovery system, nor is there a centralized authority to verify identity and help recover your account.

Lucien Bourdon, a Bitcoin analyst at hardware wallet manufacturer Trezor, states it more bluntly: if the wallet backup is lost and the wallet containing the keys cannot be accessed, "no recovery company can help." He warns: "If they could, the wallet could be cracked, undermining the foundation of self-custody."

Thanks to randomness, guessing a private key in a crypto wallet has become practically impossible. In a recent incident involving Bitcoin hardware wallet Coldcard, a firmware vulnerability compromised the randomness of some wallets' recovery phrases, allowing the seed to be brute-forced without physical contact.

Weak random number generation is not a new problem. Source: Jameson Lopp

However, if a truly random recovery phrase or private key is thoroughly destroyed, the possibilities are simply too many.

Krauss noted that recovery experts occasionally can find technical pathways to wallets that the owners believe are permanently inaccessible; outdated wallet software, damaged files, poorly generated passwords, and hardware vulnerabilities can all create unconventional opportunities: "Don't give up hope in extreme cases."

Recovery experts might themselves be scammers

There is a disturbing irony in this industry.

The person who might help you recover your cryptocurrency actually needs access to all the information about the assets.

Recovery phrases are not like passwords; they cannot be changed after being seen by someone. Anyone with the necessary wallet backup can often control the money.

This makes selecting a recovery expert a security choice in itself. Bourdon says: "If you decide to go this route, do your homework first. Look for companies with a real track record and testimonials that can be traced back to real clients. Confirm they charge by success, not request an upfront payment. Once you recover assets, immediately transfer the money to a new wallet with a new backup."

He adds that users should be wary of anyone who actively messages, claiming to help recover funds.

Krauss mentioned other warning signs include: pushing users to WhatsApp, contacting them through personal emails like Gmail, asking for upfront payments, or requesting to open an account at a certain exchange.

Recovery companies that charge based on a percentage of the amount recovered are not uncommon; but paying someone who promises to help recover a wallet upfront should raise red flags.

Brooks learned another lesson from the Rusty case.

Although cryptocurrency recovery sounds like a technical job, a person convinced they are sitting on millions or even billions can also be a security risk.

Crypto Asset Recovery no longer rushes to meet clients face-to-face like they did with Rusty back in the day. The company now handles cases remotely, with sensitive wallet information processed through automated, air-gapped systems.

Brooks mentioned that about 71% of the wallets they recover have amounts under $100, and for such asset recovery, the company charges no fee.

If there is anything crypto users should understand, it is: "Understand what recovery phrases are and why they matter. This is the simplest way to ensure you never need to contact us."