Bitcoin Forum

Hello there! Asking on behalf of a friend here.
My friend had around 0.08 BTC sent to him half a year ago. He wrote down the 12 words of the wallet, but probably in the wrong order as the wallet cannot be imported (I checked and all the words exist in the possible list).
We sadly don't have the receiving address of the wallet, we only know how much BTC is in it, and have the 12 words in the wrong order.
What can be done to recover the BTC?
Thank you very much in advance!
Aquatic

Your friend needs to come to forum and write for himself, because it is not easy to answer this question.
What wallet he exactly used for generating 12 seed words, something like Electrum, some other software or hardware wallet, and what error he receives when he tries to import words?
Order of words is very important but maybe he used different standards that is not compatible with his wallet.

He's not very comfortable with the English language.
I found a receiving address of the wallet, and I have the 12 words, although not in the correct order.
He created it in Blue Wallet.

Common mistake:
Writing down like this:
1 7
2 8
3 9

Entering reading like this:
1 7 2 8 3 9

Or something similar.

Are you sure he created that wallet with bluewallet?
Because, afaik, bluewallet generates 24 words seeds by default not 12 words!
Maybe the problem is in the derivation path not in the word order!

---

My old wallet has 24 words seed (doesn't allow me to take screenshots on mobile) and I also found this:
Weird!

Blue wallet provides numbers in front of every word for a good reason, but he can try to follow instructions (https://bluewallet.io/docs/import-wallet/) on their website for importing backup seed and check out list of words (https://github.com/bitcoin/bips/blob/master/bip-0039/english.txt), because maybe he made some spelling mistake.
This is one example of how Blue wallet is generating mnemonic words for default bech32 option, it is six horizontally written words in two rows, so you can tell your friend to check his paper and compare it with that:

https://i.imgur.com/SSc4qO5.jpg
words shown here are just an example

I can confirm that Bluewallet does generate 12 seed words by default, and you can see that in example above.

Derivation paths:

BIP44
BIP49
BIP84
https://bluewallet.io/docs/recover-wallet/

When trying to recover, I get "Checksum Failed".
The guy is sure these are the words, he has them printed. I have the wallet receiving address. I understand there's a BTC recovery tool but can't figure how to use it

The only instance which the checksum will fail given a correct BIP39 seed is if it was generated with Electrum.

If not, here's a guide on BTCrecover and trying to unscramble the seed phrase: https://github.com/3rdIteration/btcrecover/blob/master/docs/BIP39_descrambling_seedlists.md.

Adding this from ranochigo post above.

If you don't know how to use BTCrecover I suggest, try to learn first from video tutorials on how to recover the backup seed.

Here are some videos

- https://www.youtube.com/watch?v=Rp9n53XM3RI
- https://www.youtube.com/watch?v=XXw6dP7OPR4

And also check this BTCrecover documentation https://btcrecover.readthedocs.io/en/latest/Seedrecover_Quick_Start_Guide/

I have a Bluewallet wallet and my recovery phrase also consists of 24 words, but that's from a version from about 1 or <2 years ago.
Newly created wallets by the updated version only contains 12 words.

If it's the derivation path, you'll be able to restore the wallet but the restored addresses will be different.

To which wallet?
Because Bluewallet wont show a "Checksum Failed" when you paste a seed phrase with invalid checksum.
It will just fail to import the wallet with a different error.

If it's in Electrum with BIP39 seed option ticked, and if the next button isn't clickable while it's not ticked, then you may be correct that it's not in the correct order.

This is easily solved using btcrecover. Depending on your hardware and assuming all the words are indeed correct but just in the wrong order, you can descramble this in a matter of hours.

You will first need to download and install btcrecover by following the instructions here (and also download and install Python first if you don't already have it): https://btcrecover.readthedocs.io/en/latest/INSTALL/

Since you don't know the receiving address, you will need to use an address database by following the instructions here: https://btcrecover.readthedocs.io/en/latest/Creating_and_Using_AddressDB/. There is a link on that page to pre-made databases if you don't want to create your own. The most recent bitcoin one is from 13th March, so if the wallet received funds prior to this date, it will be fine to use. Download it.

You will then need to create a tokenlist and run the necessary command by following the instructions here: https://btcrecover.readthedocs.io/en/latest/Usage_Examples/2020-05-02_Descrambling_a_12_word_seed/Example_Descrambling_a_12_word_seed/

Your tokenlist will be a text file containing the 12 words from your seed phrase, one per line. Since it is a BIP39 seed phrase you are trying to recover, and you are using an address database, then your final command will look something like this:


You can narrow down your search and the time it takes if you or your friend can remember if the address was legacy, nested, or native segwit (began with a "1", "3", or "bc1"), and if you can be sure that the address you sent coins to was the first address generated by the wallet.

Hey
I have already solver for the use case like yours: PERMUTATION on https://github.com/PawelGorny/lostword
I will print (save to file) all the possible seeds, you must import them into program.
There is also another solver (PERMUTATION_CHECK) if you know the address.
Let me know if you need any help with running it.

What is the format/layout of the file your program creates using PERMUTATION? To import such a file in to btcrecover for use against an address database, it needs to be in the format of a text file with one seed phrase per line.

I think just using btcrecover is going to be the better option in this case. He doesn't know the address, so PERMUTATION_CHECK is useless to him. If he uses PERMUTATION on a 12 word BIP39 seed phrase, he is going to be left with a text file with ~30 million seed phrase combinations in it. Surely simpler just to use btcrecover from the start, unless you know of another simpler program you can import 30 million seed phrases to and check against an address database?

Hm, so so say that I should add possibility to check agains a 'pool' of addresses? Hmm... doable.
If he knows how many BTC is locked, maybe he may narrow the list of addresses... in the best scenario to one ;) Just download https://gz.blockchair.com/bitcoin/addresses/ and look for his amount.

It won't really make a difference.

If he can narrow the address type to either P2PKH, P2SH, or P2WPKH, that would help massively since for each valid seed btcrecover would only need to derive one derivation path instead of three. Further, if he can be sure it is the first address in the wallet, then that would also help massively since again he would only have to derive a single address rather than the five I have given in my example above (or even more if needed). Both of these together would mean deriving 1 address instead of 15 per each seed phrase.

However, in terms of checking against the actual database, it makes very little difference whether the database has ten addresses in it or a million addresses in it. The speed increase from narrowing down the address database will be negligible.

Let's wait for @aquatic_ to see if they may find a list of potential addresses.

Hello everyone, and thanks for your suggestions.
I have found out the receiving address of the wallet, there has only been one transaction to it - the 0.08 BTC I described.
I'm having some trouble using the tool, but I will update.
Considering I have the words, an address and knowing it's the only one, I should be able to recover it!

This should make things much easier and quicker.

You can skip the address database part of my post above. Instead, you can simply search for an exact match with the address you have found. You will still need the tokenlist file containing the 12 words of your seed phrase. Your new command would look something like this:


Alternatively, since you now have an address you can now try PawGo's tool above.

How is your tool any different from btcrecover tool, and can your tool also work with electrum type seed that is not exactly using BIP39 word list?
It does look more simple to use than btcrecover, but would also be nice to run your tool without java installation.


If you used btcrecover tool then you should watch two good youtube video tutorials that @BitMaxz posted above, and just follow the steps.

Currently not, but I plan to add Electrum dictionary soon. If you really need it, it will be an extra motivation for me ;)

I prefer to use BIP39 even if it's not perfect but it is industry standard, and Electrum only made more confusion with again inventing their own system and calling it more secure.
However I do like and use Electrum wallet almost every day and I think updating your tool will be useful, so I am motivating you now to continue updating.

i don't think they call it more secure. they call it more flexible maybe because the way electrum seeds work is that they don't rely on a word list so you can create a seed with any number of words using any word list with any number of words like a list with 10k works. it also has the version in it that lets the wallet know the address type.
but security of it is the same as bip39.

BIP39, as the BIP says is "Unanimously Discourage for implementation". It is the "industry standard" solely because it is made into a BIP and no one really bothers about it as long as it is secure.

https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki

It sounds to me they clearly say that their system with twelve words has equivalent of 135 bits of entropy, compared to regular BIP39 that has 132 bits of entropy.
https://electrum.readthedocs.io/en/latest/seedphrase.html?highlight=bip39#security-implications


It is industry standard because almost every wallet that exist today is using BIP39 by default or optionally supporting BIP39 like Electrum.
I don't know how many other wallets are supporting Electrum seeds except Electrum.

Focus is on the motivation section, not the security. People think that you're decreasing the entropy by implementing a version byte at the start. You can get more entropy with BIP39 if you want, 24 words provides you with more entropy. Electrum only has 12 words with that amount of entropy. Not a deal breaker for anyone at all.

Point taken. Can't blame Electrum for wanting to address the shortcomings of a system like this. There really isn't any confusion between Electrum seed and BIP39s, especially when their checksum aren't compatible with one another (implemented recently). Importing an Electrum seed is unambiguous, telling you the kind of seed it is. Importing BIP39 seed leaves you questioning what kind of seed, what kind of derivation path it is. If anything, Electrum is doing people a favour by addressing the shortcomings. Perhaps more wallets should stop ignoring the obvious failure of BIP39 and be like Bitcoin Core!

This bip39 is only a tool to make your life easier.
Easy to remember words in stead of difficult and confusing lengthy, sometimes mixed case character strings as keys.
There is no security advantage in using words as some are claiming.
It can be completely omitted.
A disadvantage is that if you lost your words then you are in trouble but that goes for most lost keys.

i was mainly talking about the motivation part of the link above: https://electrum.readthedocs.io/en/latest/seedphrase.html#motivation
that points out the benefits of this design compared to bip39 which isn't mentioning more security. the explanation below is more like the mathematical proof that electrum algorithm is not weaker than bip39 algorithm just because it has a version or uses different method.

After 7 hours of running this command, it said that no seed has been found:-(
https://i.imgur.com/cwekfpM.png

You may try to run my program, with configuration like that (just an example with 6 words, not to wait too long):

it works that way:

Are you sure the address generated was the first one on the derivation path?

This means one of three things then.

1 - The address is not the first address in the wallet. You could try again but increase the limit to 5 or even 10.
2 - The address is not at the standard derivation path for P2WPKH addresses of m/84'/0'/0'. You can search other paths, but you would need to know what you are searching for otherwise the search space becomes too large.
3 - At least one of your words is incorrect or there is an additional passphrase.

Considering there are 12 words, the address starts with a bc1, and the wallet was created in November 2020, shouldn't BIP-39 be it?
I'm linking the wallet address here for your guys' reference.
https://www.blockchain.com/btc/address/bc1qdj7qlzrrsz03excwsgfgkez8madf2ng8xghst0
Also, I really appreciate you two helping out. I will reward you both if we manage to recover this btc. :)

Yes, it should be.

You are certain it was created using Blue Wallet in the standard way? He didn't import the seed phrase from or to anywhere else? Was the wallet used for anything else prior to receiving this 0.08 BTC? Does your friend remember ever setting an additional passphrase/seed extension/13th word at any point? Does he remember ever changing or interacting with the derivation path at any point?

Also just double check your tokens file doesn't have any typos in it.

He says he opened a default, normal wallet. He remembers writing the words in the correct order (he wrote them in a notepad), and says he might have made a mistake, but that is not likely as all the words he provided me with exist in the possible word list, also I tried to run the seedrecover tool with 2 potential mistakes and 2 different seed words and that didn't work out.
I'm kinda lost here, I'm running seedrecover again using your command, but I changed the address thingy to 10. Do you really think that was the problem?

There are a lot of words which differ by only one letter. "boy", for example, could be "box", or "joy", or "toy".

Didn't work out as in it didn't run properly, or it didn't find a result? There is no way you could have checked a complete scrambled seed phrase along with adding in two word substitutions since adding in two substitutions increases the number of possibilities by 276,824,064 times.

Only if he used the wallet for other things prior to receiving those 0.08 BTC.

The next command I would try would be this:


This will try the seed phrase with a bunch of different mistakes, such as typos, substituted words, or swapped words.

If that still gets no result, then things get difficult. A completely scrambled seed phrase with one or more incorrect words would require either years on your device or renting significant computing power to be able to solve, and that is assuming that there is no passphrase and we are on the right derivation path.

This is also my bet. Similar issue:
https://github.com/BlueWallet/BlueWallet/issues/1259
https://www.reddit.com/r/Bitcoin/comments/har1io/wallet_recovery_help_please_is_bluewallet_bip39/

Not only that... but there are several instances in the BIP39 list where the addition/subtraction of a letter can still result in a "valid" word... like "kit" and "kite"... or "law" and "lawn" etc

To be honest, the BIP39 list isn't that great at achieving some of it's stated goals of "distinct" words :-\

It's just the English word list though. The newer word lists that were added in the following years after the initial release were have been getting more and more strict about what kind of words they include in their list. For example they reject any word that could be turned into another word by only replacing 1 or 2 letters (ie. have small Levenshtein distance).
The problem is that for backward compatibility we can't get rid of the old English word list and also nobody has bothered coming up with a better one so far.