Claiming to Have $1 Billion in Crypto Assets, Expert Discovers Only $10 After Cracking Wallet

Author: Christina Comben, Cointelegraph

Compiled by: Deep Tide TechFlow

Deep Tide Overview: In 2021, a client named Rusty told wallet recovery expert Chris Brooks that he and two others had won a lawsuit, obtaining 5,000 BTC (worth about $53 million at the time) and $1 billion in ETH. Brooks and his son flew to Georgia overnight, only to spend an entire day in a back office of a mall, uncovering about $10. This seemingly absurd case reveals the core contradiction in the crypto asset recovery industry: people think they’ve lost money, but often, the money never existed in the first place. This article breaks down the "recoverability" of seed phrases, passwords, passphrases, and hardware wallets, and reminds readers that hiring a recovery expert is also a gamble on security.

Losing Crypto Assets Doesn’t Always Mean Money is Gone {#article-toc-33762-2}

For wallet recovery experts, "losing crypto assets" can refer to several distinctly different situations.

They are not retrieving Bitcoin from the blockchain but rather finding the information needed to access an already existing wallet.

Someone might have thrown away a hardware wallet, forgotten part of their password or seed phrase, but these do not necessarily mean that the underlying crypto assets have disappeared.

Bruno Krauss, co-founder and CTO of ReWallet, told Magazine: "If you miss a few words, it’s usually recoverable."

Bitcoin’s BIP39 seed phrase standard uses a list of 2,048 words, which means if someone knows most of the words, experts can sometimes recover it by systematically searching the remaining possibilities. The fewer missing pieces, the easier the puzzle is to solve.

The principles of password recovery are similar.

Image: Bitcoin’s BIP39 standard uses a list of 2,048 words. Source: GitHub

Krauss said that ReWallet once recovered a string of 20-digit passwords protecting about $3 million by reverse-engineering a flawed password generator.

Other cases rely not on technical vulnerabilities but on understanding how a person set their password.

This means asking clients about personal preferences: favorite foods and places, children’s names and birthdays, life milestones or memories.

He said that once, a client was convinced she used her child’s name, only to later remember that the password was actually a local courier’s phone number: "She didn’t know why, but after thinking about it, she realized, oh, that day I delivered a package to the store, and I thought, hmm, that’s a good password."

Passphrases Add Another Layer of Complexity {#article-toc-33762-3}

Bitcoin educator Bennet, who has studied wallet security, mentioned another particularly confusing element: passphrases.

A passphrase is an additional layer of information layered on top of the seed phrase. Entering a different passphrase doesn’t necessarily result in an error; you just open another valid wallet. He told Magazine: "Entering the wrong passphrase won’t throw an error; it will succeed and then show you a zero balance."

So it’s entirely possible to have the correct seed phrase and input yet still believe your BTC is missing.

"Passphrases also have no mechanism to protect users from their own mistakes: no list of 2,048 valid words, no checksum. So if you forget the passphrase, the problem essentially goes back to square one: how random is your passphrase? If it’s random enough, it often becomes impossible to recover."

On lost or damaged hardware wallets, even having the broken device may not be much help. As long as the wallet’s backup seed phrase is intact, the keys can usually be recovered on another device.

For this reason, recovery experts don’t necessarily need the original hardware but rather enough information to reconstruct access to the keys.

Recovery sometimes also means correcting mistakes rather than finding lost wallets. Crypto assets mistakenly sent to the wrong blockchain (like sending BNB to Ethereum) can sometimes be recovered as long as the receiving wallet is still under the user’s control.

Brooks stated that Crypto Asset Recovery has been commissioned to crack about 3,000 wallets for around 1,500 people, successfully cracking passwords for about 63% of them.

Sometimes You Really Are Completely Lost {#article-toc-33762-4}

But there is a hard boundary. Bennet said: "If your seed phrase was truly randomly generated and you’ve completely lost it, then your Bitcoin is gone."

This is one of the fundamental trade-offs of self-custody. Bitcoin wallets do not have a bank-like recovery system, nor is there a centralized administrator to verify identity and help you recover your account.

Lucien Bourdon, a Bitcoin analyst at hardware wallet manufacturer Trezor, put it more bluntly: if the wallet backup is lost and the wallet containing the keys is inaccessible, "no recovery company can help you." He warned: "If they could, then the wallet could be cracked, undermining the foundation of self-custody."

Thanks to randomness, crypto wallets make guessing private keys practically impossible. In a recent incident involving the Bitcoin hardware wallet Coldcard, a firmware vulnerability weakened the randomness of some wallets’ seed phrases, allowing the seed to be brute-forced without physical contact.

Image: Weak random number generation is not a new problem. Source: Jameson Lopp

But if a truly random seed phrase or private key is completely destroyed, the possibilities are just too many.

Krauss said that recovery experts occasionally find technical paths to wallets that "the owner thought were permanently inaccessible"; outdated wallet software, corrupted files, poorly generated passwords, and hardware vulnerabilities can create unconventional opportunities: "Don’t give up hope on extreme cases."

Recovery Experts May Be Scammers Themselves {#article-toc-33762-5}

There is a disturbing irony in this industry.

The person who might help you regain your crypto assets often needs access to all the information about the assets.

Seed phrases are not like passwords; once seen, they cannot be changed. Anyone who has the necessary wallet backup can often control the money.

This makes selecting a recovery expert itself a security choice. Bourdon said: "If you decide to go this route, do your homework first. Look for companies with real records and reviews traceable to real customers. Ensure they charge based on success, not upfront fees. Once you recover your assets, immediately transfer the money to a new wallet with a new backup."

He said users should also be wary of anyone who privately messages them claiming they can help recover funds.

Krauss mentioned other warning signs include: pushing users to WhatsApp, contacting them via personal emails like Gmail, asking for upfront payments, or requiring them to open accounts at certain exchanges.

Recovery companies charging based on the percentage of recovered amounts are not uncommon; however, prepaying someone who promises to help you recover your wallet should raise red flags.

Brooks learned another lesson from the Rusty case.

Although crypto asset recovery sounds like a technical task, a person who firmly believes they possess millions or even billions may also pose a security risk.

Crypto Asset Recovery no longer flies out to meet clients face-to-face like they did with Rusty. The company now handles cases remotely, with sensitive wallet information processed through automated, air-gapped systems.

Brooks said that about 71% of the wallets they cracked contained less than $100, and the company does not charge for recovering such assets.

If there’s one thing crypto users should know, it’s this: "Understand what seed phrases really are and why they are important. This is the simplest way to ensure you never have to find us."

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.