Successful recovery of $137k worth of cryptos from invalid seed phrase (two incorrect words!)

Originally published on reddit: https://www.reddit.com/r/ledgerwallet/comments/1cbd9f3/successful_recovery_of_137k_worth_of_cryptos_from/

TL;DR

Client bought a Nano S in 2017, and punched their recovery seed phrase on Cryptotag titanium metal plates. After their Nano S accidentally reset, they discovered that their recovery seed phrase was invalid.

They tried a number of public tools (BTCRecover, Ian Coleman tool etc) to try to locate the wrong word, to no avail.

We were able to find the correct seed phrase by bruteforcing all the possible 24-word seed phrases, assuming that there was up to two wrong words. That's 24*2048*23*2048 = 2,315,255,808 possible 24-word phrases with the bip39 words. There was indeed TWO wrong words in the client's seed phrase!

All funds were successfully recovered.

Long version:

Our client posted about their situation on Reddit:

https://www.reddit.com/r/ledgerwallet/comments/1buly21/am_i_screwed/

After their Nano S accidentally reset, they discovered that their recovery seed phrase, that they had carefully punched on Cryptotag titanium metal plates, was invalid (bad checksum).

They assumed that just one word was incorrect, which is the most common situation in such case, and they tried public-domain tools such as BTCRecover and the Ian Coleman Bip39 tool, to try to find what word was incorrect, to no avail.

After exhausting their search efforts, the client contacted us for help. They gave us all the information they had, including a photo of their punched metal plates. We checked that the words they came with were indeed matching the holes in the plates, and we confirmed that their seed phrase was invalid.

We ran simple search using common ordering mistakes, like writing the words by lines instead of columns and vice versa, no luck there.

To find the correct seed phrase using bruteforce techniques, it is very useful to have some account addresses that are known to be derived from the correct seed phrase, and to reduce the search time, it is better if the derivation paths leading to those addresses are known. Our client were able to access the withdrawal historical records one of the exchanges they were using in 2017 and found valuable information.

Our client provided an ETH address that had been created before Ledger Live existed, so we could assume it was created with the ledger chrome extension, using the so-called "legacy/MEW" derivation path m/44'/60'/0'/0, assuming they had a single ETH account at the time.

They also provided a BTC address, but since each BTC account has multiple deposit addresses, we were not sure of the derivation path, making the search more time consuming. So we decided to use the ETH account as search target.

We started by running bruteforce search of all the seed phrases using any number similar words, i.e. words with one different letter (or one added or deleted letter). There are many similar words in the BIP29 word list, so it is easy to make such mistake when writing the words, e.g.

['wash', 'cash', 'dash', 'wasp', 'wish'], ['wild', 'will'], ['ramp', 'camp', 'damp', 'lamp']
, ['vote', 'note'], ['toast', 'coast', 'roast'], ['sight', 'eight', 'light', 'night', 'right']

In the case of the seed words we had, this lead to 11520 seed phrases with similar words (found programmatically), none of them leading to the target ETH address we had.

Then we ran a bruteforce search of all the possible 24-word seed phrases, assuming that there was one totally wrong word. That's 24*2048 = 49,152 possible 24-word seed phrases. Again, none of them lead to our target ETH address, unfortunately.

So either there was at least two wrong words, or maybe the client had set-up a bip39 passphrase (incorrectly called 25th word), and forgot about doing that. Or maybe the seed phrase we were looking for was completely different from the phrase we had, due to some major user mistake!

In the next step, we decided to run a bruteforce search of all the possible 24-word seed phrases with up to two wrong words from the phrase we had. That's 24*2048*23*2048 = 2,315,255,808 possible 24-word phrases with the bip39 words.

This bruteforce search was successful at finding a seed phrase that lead to our target ETH account. There was indeed TWO incorrect words in the client's seed phrase, and we found their correct seed phrase.

From there, we had access to all the other ledger accounts of our clients, and we sent them to new accounts the client created using a new seed phrase (which this time they checked to be valid and to give access to their new accounts).

As a little bonus, we found some "free" Bitcoin Gold that they got from that 2017 BTC fork (unfortunately the BCH fork happened before they deposited their BTC, so no free BCH).

Client is of course very happy now, as they feared they had made a critical mistake causing their funds to be forever inaccessible i.e. lost.

Conclusion:

The lesson learned here is that it is critically important to check that the seed phrase you have backed-up is correct i.e. that it actually leads to your accounts, before depositing large funds on your new ledger accounts.

This can be done either by using the "Recovery Check" ledger app (which did not exist at the time), or by re-entering the seed phrase (from the recovery backup) in the device after a reset, to check that it leads to the exact same addresses where you intend to deposit. That's something our client did not do at the time. Even a simple check would have shown that their backed-up seed phrase was invalid (incorrect checksum) if they had just tried to re-enter it in their ledger.

Buying an expensive titanium metal plate to safeguard the seed phrase is great, but only if the seed phrase you punch on the plate is correct!

In this particular case, we could trace one of the wrong words to one incorrect digit punched in the plate, but the other wrong word could not be the result of one "bad punch", and it significantly differed from the correct word (also could not be the result of a simple typo / letter-error), so it's a bit of a mystery how this second wrong word got in the client's punched plate.

Comments: you can read and post comments on reddit, even if the post was "removed by reddit filters".

In the same Recovery series: Other crypto recovery reports by loupiote2

Contact loupiote2 via chat or message from reddit profile: https://www.reddit.com/user/loupiote2/