Forgotten crypto passwords: Billions of USD can be recovered

    07 Sep 2021

    From 68,110 to 92,855 of lost Bitcoin, or up to $4.8 billion worth of crypto, could be recovered and returned to their owners, according to an analysis by Chris and Charlie Brooks, a father and son who run Crypto Asset Recovery.

    Chris and Charlie Brooks operate in New Hampshire, US, in the firm, specializing in recovering lost passwords to wallets that contain locked crypto.

    One of their most recent projects involved recovering USD 250,000 worth of cryptocurrency from a wallet. For a wallet comprising between 0 and 10 BTC, or an equivalent value, Crypto Asset Recovery charges a 20% commission.

    “We get a really broad spectrum of clients. We have a client who is an early-stage miner in Bitcoin, who lost all of his information, and he knows he’s got some Bitcoins somewhere … We get clients who were told in 2017 to buy into the hype-bubble and they bought $1,000 worth and they are looking for something to cover the rent,” Charlie, a 20-year-old computer programmer, told Business Insider.

    Nearly 40% of 1,000 US crypto owners in a recent survey from Cryptovantage said they had lost wallet passwords and, on average, those unable to find their passwords lost $2,134.

    Studying a thread on the BitcoinTalk forum, the father and son identified 72 posts that described the loss of at least 0.5 BTC. Their analysis showed that 14% of these are potentially recoverable, and that, based on their experience, they can decrypt some 35% of passwords. As a result, they concluded that about 2.45% of lost Bitcoin could be retrieved.

    Although many users forget the password that protects their cryptocurrency at a certain point, the majority of them succeed in retrieving it, as shown by a recent survey of some 1,021 US cryptocurrency owners by Cryptovantage. The survey showed that 39.7% of respondents had previously forgotten their passwords, but 95.6% managed to regain access to their crypto assets.

    “We get as good a list of passwords as we can from a client and then we put our heads together and spend some time extrapolating the way that they make their passwords and try to get in their mind when they are actually creating a password,” said Charlie. “That’s the most helpful thing, just seeing their practice,” he said. “That’s the cornerstone of our business, essentially.”

    The duo will run “hundreds of millions or billions of variations” of password patterns and test those against the encrypted version of the wallet, said Chris.

    “If you don’t have a very good [password] guess, there are more possible passwords than there are atoms in the universe, and I’m not being facetious when I say that,” Chris said.

    The Brookses said decrypting times vary but occasionally can take as little as five seconds. That happened with a client whose list of nine potential passwords contained the correct one. Charlie said they worked for roughly a month and a half with the client who turned out to have about $250,000 in his wallet.

    Security measures they take include having clients sign a contract stating they are the owner of the blockchain wallet being worked on. The two get paid on a sliding scale. Starting with wallets containing between zero and 10 BTC, or an equivalent value, the team will earn a 20% commission. There’s no charge to clients if they can’t recover any funds.

    However, as David Veksler of told, “there are many ‘Bitcoin recovery’ scams. Almost all of them have two things in common. First, they ask for money upfront. Legitimate services ask for a percentage of recovered funds. Second, they make impossible promises rather than trying to understand your situation and offer realistic advice.”

    Industry players working in the field of crypto recovery declare that the vast majority of popular wallets are secure, and even if you have somehow been locked out of your own wallet, there are a number of ways you can regain access. Of these, some are new, while others revolve around unglamorous detective work.

    Image source:

    Leave a Reply

    Your email address will not be published. Required fields are marked *