BIP38 paper wallet encryption

[TheGavaz]

Hello Everybody guys.
I have a paper wallet opened with a very small amount of money in 2018. We are talking about 0.10 bitcoin or so, and never touched from that time.
No I would like to tackle more seriously the cryptocurrencies, starting from the amount in this paper wallet.
I have tried to import the wallet through private key qr code to an exchange wallet, but at the time of the wallet creation I have marked the encryption BIP38, and now no way to get the password.

Any chance I could recover it? Or should I condider it lost and start again from scratch?

Thanks for you support!

[1714688165]

1714688165

[1714688165]

1714688165

[LoyceV]

encryption BIP38, and now no way to get the password.

Any chance I could recover it?

BIP38 encryption is very difficult to brute-force, it requires a lot of CPU power for each try. See I'm BIP38 curious, please help me out! for instance, where a 1 Bitcoin reward (I think up to $1000 at the time) wasn't enough to crack a wallet with 6 random characters, even after giving a few hints.

Since then, CPU power got cheaper and Bitcoin got more expensive, but if you used any serious password, the only way to recover your funds is if you can somehow remember the password. Maybe start with common passwords you've used at the time, possibly with small variations?
You can use bitaddress.org (download it and run it from an offline LIVE Linux DVD) to securely try passwords without risking them to any possible malware on your system.

[TheGavaz]

Unfortunately the second one you wrote...
I assume, considering the relatively small amount, I should consider it lost...
I'll give a try using some typical passwords I have been using, but I'm not that optimistic :/
Thanks for the support!

I'm a bit confused, do you can't find software which support BIP38 or you don't remember the password?

If you can't find software which support BIP38, you can use https://github.com/pointbiz/bitaddress.org and run it offline. You just need to scan the QR code and copy the encrypted private key previously, example of BIP38/encrypted private key

Code:

6PnZJPfF27sYN7TfJT7hmvr4uKMtTMHFd5QPmRH5Yg2GdJHT7ujwDmsdYb

If you forget the password, your only choice is only to brute force. But obviusly it's possible if the password isn't too long and you remember characteristic of the password (such as only uses lowercase and the last character is "%")

Since then, CPU power got cheaper and Bitcoin got more expensive, but if you used any serious password, the only way to recover your funds is if you can somehow remember the password. Maybe start with common passwords you've used at the time, possibly with small variations?

Things would be different if someone would make BIP38 brute-force tools which support GPU.

[LoyceV]

I assume, considering the relatively small amount, I should consider it lost...

Even if you consider it lost: keep it anyway

[HCP]

I concur, do not dispose of this wallet... it's entirely possible that the value of Bitcoin will increase to such a level that even 0.1 BTC will be so valuable that the costs involved in bruteforcing your BIP38 password will be outweighed by the value of the recovered coins.

Bruteforcing "scrypt" is slow today... but that may change in the coming years.

[pooya87]

Things would be different if someone make BIP38 brute-force tools which support GPU, but since BIP38 is designed to resist brute-force, i doubt there's significant performance increase.

Using GPUs is mostly about parallelization and generally speaking brute forcing is the most parallelizable operation. additionally brute forcing BIP38 has a couple of parts, mainly the AES computations and the scrypt. Both of them exist separately as mining algorithms in different altcoins for instance brute forcing scrypt is basically mining Litecoin with the difference that in BIP38 you can run it on 8 cores in parallel and it uses slightly more memory (1024 bytes instead of 128) per round.
I believe with a well written code the speed gain over GPU can be significant.

[crypto-recovery]

>I'll give a try using some typical passwords I have been using, but I'm not that optimistic :/
Last I checked, you can test 5-6 password variations / second on a BIP38 wallet using btcrecover (https://github.com/3rdIteration/btcrecover) on a late model Macbook Pro. You're not going to brute force any serious passwords with that -- but, if you have 5-10 passwords that you've used regularly in the past, you could try a pretty good range of variations of those passwords in a few hours of testing.  (Figure 3600 seconds / hour x 5 variations / second = 18,000 variations / hour).

[LoyceV]

>I'll give a try using some typical passwords I have been using, but I'm not that optimistic :/
Last I checked, you can test 5-6 password variations / second on a BIP38 wallet using btcrecover (https://github.com/3rdIteration/btcrecover) on a late model Macbook Pro. You're not going to brute force any serious passwords with that -- but, if you have 5-10 passwords that you've used regularly in the past, you could try a pretty good range of variations of those passwords in a few hours of testing.  (Figure 3600 seconds / hour x 5 variations / second = 18,000 variations / hour).

Any reason why you're bumping 2 old BIP38 topics with your own fork instead of the original on Github?

[o_e_l_e_o]

Any reason why you're bumping 2 old BIP38 topics with your own fork instead of the original on Github?

The original btcrecover (https://github.com/gurnec/btcrecover) has long been abandoned. The fork he is linking to (https://github.com/3rdIteration/btcrecover) is indeed the most actively maintained and developed fork, and the same one which is linked to here: https://btcrecover.readthedocs.io/en/latest/. I don't think this user is the developer of the 3rdIteration fork.

Doesn't explain the pointless bumps, though.

[Cricktor]

Doesn't explain the pointless bumps, though.

He's likely shilling his cryptoassetrecovery.com site, which hardly has any page without some errors.

© 2077 CryptoAssetRecovery.com, LLC. All rights reserved.

Sounds legit...