Need Help Recovering Lost Part of My BIP39 Seed Phrase

[yzeb]

Hi everyone,

I’m in need of help and not sure where to ask.

The problem is that I lost part of my BIP39 seed phrase. I have the following words:

1, 2, 3, 7, 8, 9

However, I’m missing words 4, 5, 6, and 10, 11, 12.

I’ve done some research to understand how BIP39 seeds work. I know there are 2048 possible words in the wordlist, so recovering 6 missing words would result in
204
8
6
2048
6
  possible combinations, which is infeasible. But I still have hope because the last word in a BIP39 phrase is derived from the previous ones, meaning in theory, only 5 words are truly lost.

Additionally, I’ve read that the seed phrase must match a checksum, which greatly reduces the possibilities.

The main asset I had is in Ethereum (ETH), and I still have the ETH address linked to the wallet, which could help narrow things down. However, I lack the technical expertise to code custom tools or use GPU-based or distributed computing for a brute-force attack.

Given that there’s over $25 million USD in this wallet, I have a considerable budget to potentially recover the seed, and I’m willing to pay for the necessary computational resources or a solution.

Before investing heavily in brute-forcing the missing words, I want to first see if there’s any feasible way to recover the seed using computational power.

If anyone has a good solution, I’m offering a generous reward.

Thank you!

[Charles-Tim]

https://btcrecover.readthedocs.io/en/latest/ can be very helpful.

[MusaMohamed]

The problem is that I lost part of my BIP39 seed phrase. I have the following words:

1, 2, 3, 7, 8, 9

However, I’m missing words 4, 5, 6, and 10, 11, 12.

Why did it happen?

Did you split your wallet seed?
It's very terrible practice when you backing up your wallet.

Bitcoin Q&A: Why is Seed Splitting a Bad Idea?
How to back up a seed phrase?

Given that there’s over $25 million USD in this wallet, I have a considerable budget to potentially recover the seed, and I’m willing to pay for the necessary computational resources or a solution.

You can try with recovery services but you must pick high trusted service to use. If you use a scam recovery service, and they actually recover your wallet, they will steal your money in it.

https://btcrecover.readthedocs.io/en/latest/ will be very helpful.

It's not a Bitcoin wallet.

If it is a Bitcoin wallet, OP can try this, offline.
The FinderOuter, a bitcoin recovery tool (v0.19.1 2024-01-24)

[yzeb]

I ended up splitting my seed into multiple parts, which turned out to be a huge mistake. I've looked into recovery services, but it seems like 99% of them are scams.

I'm actually considering paying developers to create a powerful brute-force tool to recover my seed, but before I commit to that, I need to be 100% certain that it's technically feasible. Specifically, I want to understand if it's possible to brute-force the seed given the sheer number of possibilities and the hardware limitations.

Has anyone here done something similar, or can you provide any insights into the feasibility of this approach?

[Findingnemo]

It must be a HD wallet that is the possible way to derive privkeys for ETH with BIP39 words.

BTCrecover can be used for recovering the missing words but missing 6 words is a relatively long and almost not possible to brute force but if you known the derived ETH address from the seed it can be used to reduce the process a bit but still a long one.

Another tool: The FinderOuter, a bitcoin recovery tool (v0.19.1 2024-01-24)

[Charles-Tim]

https://btcrecover.readthedocs.io/en/latest/ will be very helpful.

It's not a Bitcoin wallet.

Go to under features, you will see ethereum listed there.

BTCrecover can be used for recovering the missing words but missing 6 words is a relatively long and almost not possible to brute force but if you known the derived ETH address from the seed it can be used to reduce the process a bit but still a long one.

I do not think it should take too much time but if it is true he has $25 million there, he can rent GPU. If he sees it taking too long.

[LoyceV]

I know there are 2048 possible words in the wordlist, so recovering 6 missing words would result in
204
8
6
2048
6
  possible combinations, which is infeasible.

I'm not sure what you're calculating here. I'd say 2048^6 is what you're looking for.

But I still have hope because the last word in a BIP39 phrase is derived from the previous ones, meaning in theory, only 5 words are truly lost.

The checksum is only 4 bits. That leaves 2048^6/2^4= 4.6*10^18 combinations. At 1 billion checks per second, that's 145 years. So, to have any chance at brute-forcing this, you'll need to be able to do about 100 billion checks per second, and keep that up for up to 18 months. I have no idea what hardware that would take.

[yzeb]

Isn't the last word generated from the others ? 2024^6 is for sure impossible

[LoyceV]

Isn't the last word generated from the others ?

Not really: as far as I know, the seed represents a 128 bit number. That number is randomly created, after which 4 bits are added as a checksum. So those last 4 bits are indeed based on the others, but that's only 4 out of the 11 bits from that word.

2024^6 is for sure impossible

Maybe it'll be feasible in your lifetime Give it 20 years, or add it to your inheritance if it comes to that. Maybe your decendents will find it centuries later.

[yzeb]

"The last word of a 12-word seed phrase can be any 128 potential words based on the previous 11.", which mean it's still less possibilities but seems like it's a lot. I deduce that 128/2048 seeds will be valid only, which represent 6.5% of 2048^6 possibilities. If there are 1 billion checks by second, it's like 141 years (or half knowing there is 50% chance the seed is at half checks). With a very huge budget what could be the maximum checks / s I could obtain and with how much GPU ? I tried to understand BTC recover benchmark but I didn't tbh.

[bulleteyedk]

If you're not into using BTC recover yourself, my best advice would be to reach out to -> https://cryptoguide.tips/recovery-services-consultations/

This dude also has this YT channel, and has a lot of knowledge of recovering funds from missing seed words
https://www.youtube.com/@CryptoGuide/videos

Good luck on the recovery

[Mia Chloe]

Maybe it'll be feasible in your lifetime Give it 20 years, or add it to your inheritance if it comes to that. Maybe your decendents will find it centuries later.

Don't you think that's a little harsh on the OP  well I wouldn't blame your words though because there are a lot of posts like this that pop up on the forum with the users claiming they lost their seed and they have a huge bounty for someone able to retrieve it for them. So it's retarding to spot those who are lieing and those that aren't.

Anyways assuming the op isn't bluffing, just like you mentioned it's to no avail making use of a recovery process for as much as 6 missing word which is literally half of a standard 12 word BIP39 seed phrase. Currently I don't think we have devices with the computational power to run such high permutation brute forcing, besides if there was any that could in a relatively reasonable and short time it would be more of a waste of computational power.

[LoyceV]

Don't you think that's a little harsh on the OP  

I can't help it if reality is harsh I'm not here to sugarcoat things.

well I wouldn't blame your words though because there are a lot of posts like this that pop up on the forum with the users claiming they lost their seed

I've seen it far too many times indeed. Maybe OP really lost his coins, maybe he didn't. If he did, I assume it's not his only stash, so he much be rich now already. At some point, once computing power is "cheap" enough, he may be able to spend a few millions on recovering his seed.

[yzeb]

Yes I guess so, I contacted few recovery services to see what power they got and if it's possible to bruteforce with very high budget but it really seems like impossible now. Thanks anyway for the reply

[BitMaxz]

Another tool: The FinderOuter, a bitcoin recovery tool (v0.19.1 2024-01-24)

I don't think FinderOuter recovery tool support altcoins according to their github altcoin is not supported yet.

Since the OP only has an ETH address, I believe he will be unable to use this tool to recover the missing phrase unless he has one of the BTC public addresses.

[pooya87]

You are missing half of your mnemonic, even ignoring the checksum which is only 4 bits that is still 62 bits missing from your entire 128-bit entropy (each word encodes 11 bits of entropy, last word encodes 7 bit entropy + 4 bit checksum). Which means the number of permutations to check is 2⁶². It is not possible to brute force this much lost entropy in reasonable time and at reasonable cost.

[nc50lc]

Yes I guess so, I contacted few recovery services to see what power they got and if it's possible to bruteforce with very high budget but it really seems like impossible now.

To be fair, the puzzle transaction outputs 62, 63, 64, 66 (those without previously exposed public key, so only solved through bruteforce)
have already been bruteforced and the puzzle number represents how many bits each private key has.
And those aren't quickly "solved", some even took years with optimized tools and expensive hardware so it's reasonable to set a high budget on it.

Your case can be similarly done by recreating the entropy from your existing words and fill up the missing 62bits and cheaply compute the checksum.
The main difference is the extra computation and derivation from the "candidate entropy+checksum->mnemonic seed->seed->master private key->>>private key->address" which will require more processes than the puzzle transaction.

[LoyceV]

(those without previously exposed public key, so only solved through bruteforce)

This reminds me: if OP ever sent a transaction from the wallet the seed phrase belongs to, that may make it much easier to find the private key. It doesn't even have to be the same coin, as long as it's derived from the seed phrase.

[ABCbits]

With a very huge budget what could be the maximum checks / s I could obtain and with how much GPU ? I tried to understand BTC recover benchmark but I didn't tbh.

I think almost can answer your question, since there's no public benchmark for BTCRecover using recent high end GPU (such as RTX 4090). But for reference, someone brute-forced 4 missing BIP 39 words where he got 143K seed/second with single RTX 2080 Ti and 11.1M seed/second with unspecified amount of GPU. Although his case aim to brute-force BIP 39 on BTC address.

[1] https://medium.com/@johncantrell97/how-i-checked-over-1-trillion-mnemonics-in-30-hours-to-win-a-bitcoin-635fe051a752

[nc50lc]

(those without previously exposed public key, so only solved through bruteforce)

This reminds me: if OP ever sent a transaction from the wallet the seed phrase belongs to, that may make it much easier to find the private key. It doesn't even have to be the same coin, as long as it's derived from the seed phrase.

It will but with quite insignificant boost, it's not as effective as divisible-by-five puzzles numbers with exposed public keys
Since in the puzzle, it's the private key with limited range and its public key pair that's taken advantage of their favorite tool's ECDLP solution.

His case on the other hand should start with the seed phrase's entropy.
The advantage he can get in that scenario is; the tool wont have to generate the address which requires quite a few processes involving hashes and encoding.