Originally published on reddit: https://www.reddit.com/r/ledgerwallet/comments/kz2eob/successful_recovery_story_how_we_recovered_100/

TL;DR - Don't lose your seed phrase!

This post describes the details of how we managed to recover 100 ETH from an old Ledger Nano S with firmware 1.0, of which our client had lost the seed (24-word recovery mnemonic) and only had his unlocking PIN.

Since none of the existing ETH wallet apps and Ledger Live software were able to communicate with this old Ledger, we had to use low-level command-line tools running on a bootable Linux virtual machine to sign transactions, that were then manually broadcast to the ETH network. All funds were finally recovered 2 days ago, and our client was very pleased!

After all the posts like "I got hacked" or "Lost my Cryptos" or "Cannot find my funds from my old ledger", we wanted to post a positive recovery story.

Our client had a very old Nano S, the very first version, with firmware 1.0, Ethereum app version unknown (no version in the app!!!) that was controlling 100 ETH.

If the client had their seed (24-word BIP39 mnemonic aka recovery phrase), the recovery would have been trivial: Just enter the seed in a newer ledger, and immediately regain access of the accounts. But our client lost their precious seed, so the ONLY way to recover was by using their old ledger device, which still could be unlocked with its PIN.

The firmware on those old ledger cannot be upgraded. And because just installing or updating apps on the ledger is risky (could have potentially bricked it, causing loss of all the funds), we mutually agreed that the best course was to try using the ledger as is, and not attempt to even update an app on it.

Ledger Live (LL) on the desktop does not work with those old ledgers, and the Ethereum app on the ledger was so old that it did not have "Browser Support" to communicate with web wallets like MyEtherWallet or MyCrypto.

So first we tried using Android, which sometimes works with ledgers under old firmware (it works with 1.3.1). After installing the LedgerHQ U2F extension apk from Github, we attempted to use mobile LL. It could communicate with the old ledger through a USB OTG cable, but the old Ethereum app API on the device does not support some of the requests made my the current LL, and unfortunately LL does not have any fallback code to support old ledgers, so this did not work.

Given that very old ledgers (firmware < 1.2?) have no support for web wallets like MEW or MyCrypto, there seem to be no option to do an easy recovery at that point.

Ledger engineers pointed us to some low-level tools in the Github ledgerHQ repository that "might" be helpful. Those low-level tools were mostly python scripts that needed to run on Linux, so we used a Kali (Debian) Linux system installed in virtualbox on a win10 system. After some efforts locating and installing all the required python3 packages and dependencies, we managed to get those low-level command-line tools running, and tested them with our oldest ledger with firmware 1.3.1.

We managed to communicate with our old test ledger, and to get it to sign an ETH transaction block, but strangely it would always cause an error when sent to the ETH network. Investigation and debugging showed that the signed block was in fact garbage due to a bug that had been introduced in the Ledger low-level tools years ago, when Ledger converted their tools from Python2 to Python3. We were able to locate and fix the bug and get the correct transactions signed.

We then packaged the tools in a bootable Linux virtual machine image that we compressed (13GB zip file!) and made it available to our client. After minor adjustments of the virtual image configuration, our client was able to run it on their win10 laptop. We then were able to extract the correct ETH account address from their ledger (a major step!!), but the test Tx's that we signed and manually sent to the ETH network, while causing no error, were not picked-up and executed.

After more testing and analyzing, we found that the "nonce" parameter that we were using was incorrect, and after one more evening of remote work with our client, and very careful tripled-checked operations with the low-level tools, we were finally able to successfully recover the entire 100 ETH, a value of more than $400k that our client had purchased at a time when 1 ETH was only $7 :)

This shows how important it is to not lose your 24-word seed, and it shows that despite the lack of support of this old product, it is still possible to recover funds as long as the ledger device is functional and can be unlocked.

[EDIT] Someone asked if this is a repost. No, this is the original post

Comments: you can read and post comments on reddit, even if the post was "removed by reddit filters".

In the same Recovery series: Other crypto recovery reports by loupiote2

Contact loupiote2 via chat or message from reddit profile: https://www.reddit.com/user/loupiote2/