6 words known from a 12 word recovery phrase

[only6ahhhhhh]

Hey

Does anyone know of a tool on GitHub perhaps that can brute force the remaining 6 unknown words from a 12 word seed.

I know the first 6 words in the correct order from memory as these were familiar words I used when creating the wallet a very long time ago. Like 2010 maybe. Was all done in CLI as BTC was in its early days.

Found plenty that can crunch 3 lost words but cant find anything that can handle 6 missing words.

Yep. I know this is still technically impossible but worth a try.

[un_rank]

I do not think there is any such tool that can do that, even 3 words will take a ridiculous amount of time to successfully crack in correct order.

Is it possible you had the recovery phrase written down somewhere or had the wallet file stored electronically? This is your best bet to recovering the coins stored in it.

- Jay -

[hosemary]

Does anyone know of a tool on GitHub perhaps that can brute force the remaining 6 unknown words from a 12 word seed.

You can't brute-force the seed phrase and take note that the main problem isn't the lack of a software that can do so, but the lack of such powerful hardware.

I know the first 6 words in the correct order from memory as these were familiar words I used when creating the wallet a very long time ago. Like 2010 maybe. Was all done in CLI as BTC was in its early days.

There was no seed phrase in 2010.
As far as I know, electrum was the first project using seed phrase and that was realeased in late 2011.

[pooya87]

You are missing half of your 128-bit entropy which is 64 bits so the search space you'd have to go through is 2⁶⁴=18,446,744,073,709,551,616 so check out the rate at which various recovery tools can check mnemonics per second. I think it is around a couple of million per second at best.

But if we assume you could check a billion permutations per second that would still take you 585 years to go through all of it.

[nc50lc]

I know the first 6 words in the correct order from memory as these were familiar words I used when creating the wallet a very long time ago.
Like 2010 maybe. Was all done in CLI as BTC was in its early days.

Interesting view of Bitcoin's early-days.
Just for trivia: On the contrary, the first release of Bitcoin (Core) already included GUI and exclusively for Windows, that's even earlier than 2010.
Also, it doesn't use mnemonic seed, even in the latest version.

Now, since you've said "I used when creating the wallet", this suggest that the client didn't provided you the seed phrase but you provided it with those words instead, no?

Perhaps you're talking about Electrum's early version (2011),
The first official release asks for a "Passphrase" which will then be used as seed by the client. (later versions use RNG)
However, it will be hard to find a specific tool that can bruteforce the rest of the words that you've used given that it should be specific for old Electrum code.
And also, if it's actually 12 words, then it will not be feasible.

Or Perhaps it's actually a "Brainwallet" which is basically a private key result from SHA256 hash of those words.

Does any of these sound familiar?

[Russlenat]

With six words missing, the chances of recovery are close to impossible. While there are tools designed to recover lost seed phrases, I haven’t seen anything that guarantees success with that many missing words. I’ve come across some posts outside the forum, you might want to explore those and see if any of them could help with your problem.

BTC Recover Crypto Guide wallet password and seed recovery tools open source
Coinplate has a BIP39 seed phrase recovery tool.

[Findingnemo]

Anything more than 3 words is impossible to brute force.

[ABCbits]

Does anyone know of a tool on GitHub perhaps that can brute force the remaining 6 unknown words from a 12 word seed.

AFAIK btcrecover by 3rdIteration[1] is best option, since it support brute-force with multi-GPU[2]. Other than that, you may want to check tool written by John Newbery used to checked over 1 trillion combination in 30 hours[3].

Yep. I know this is still technically impossible but worth a try.

Have you consider backup every data/information you know in secure manner and brute-force in the future for far faster hardware?

Anything more than 3 words is impossible to brute force.

4 words is still practical if you use lots of high-end GPU[3].

[1] https://github.com/3rdIteration/btcrecover
[2] https://btcrecover.readthedocs.io/en/latest/GPU_Acceleration/#multi-gpu-systems
[3] https://bitcoinwords.github.io/how-i-checked-over-1-trillion-mnemonics

[virasog]

Hey

Does anyone know of a tool on GitHub perhaps that can brute force the remaining 6 unknown words from a 12 word seed.

I know the first 6 words in the correct order from memory as these were familiar words I used when creating the wallet a very long time ago. Like 2010 maybe. Was all done in CLI as BTC was in its early days.

Found plenty that can crunch 3 lost words but cant find anything that can handle 6 missing words.

Yep. I know this is still technically impossible but worth a try.

If it were that easy, knowing the first few words of the seed phrases in correct format, could make you get the remaining part of the seed phrases, the bitcoin BTC would have been so secure and also not that worthy. It may be possible when you have that powerful quantum computing powers but right now this is not possible.

As an example, if we consider the 12 Word Phrase , then there are 2048^12 possible combinations. So if you know the first six words, the remaining words still represent an enormous number of possibilities.

[Cricktor]

~~~

The situation is a "little" better. Because every word represents 11 bits, the first six words in correct order actually represent 66 bits of the seed, so there are "only" 2⁶² left to brute-force, a quarter of the proposed number. Well, still way too much.

The last word carries the remaining 7 bits of the seed and 4 bits of the SHA256(seed), so only a 1/16 of the words give a correct checksum.

Anyway, to find the correct sequence of words, you would've to perform the whole 2048x PBKDF2 rounds for every seed candidate and derive a public address to compare (you have an address to compare, haven't you?) which is all in all somewhat computationally expensive and unfeasible.

[Catenaccio]

You can't brute-force the seed phrase and take note that the main problem isn't the lack of a software that can do so, but the lack of such powerful hardware.

There are softwares for doing this like shared above and like this open-source one, The FinderOuter, a bitcoin recovery tool, but there are limitations on missing words that can be brute-forced by a software.

2 missing words is possible but 6 words are impossible and that is one of reasons to warn Mnemonic Seed Word Splitting in backup is a bad idea.
Why seed splitting is a really bad idea?

[Synchronice]

I know the first 6 words in the correct order from memory as these were familiar words I used when creating the wallet a very long time ago. Like 2010 maybe. Was all done in CLI as BTC was in its early days.

What wallet did you use to create that? Electrum was created in 2011 but Mnemonic Algorithm was introduced in 2013 and it wasn't using BIP39 wordlist, it was using its own wordlist which contained 1626 words (BIP39 contains 2048 words).
To be honest, I don't know how much combination can one good GPU, like RTX 4090 do but if or others know, you can try and calculate. If its really 12 words and you used 1626 words instead of 2048, I think that you have a chance to recover your wallet with lots of hash power.

[Cricktor]

..., I think that you have a chance to recover your wallet with lots of hash power.

To be honest, I don't think so: not feasible with even the most powerful GPU. Of course, this problem can easily be parallelized and you can always stack up more GPUs to the task. Just depends on how much the wallet is worth and if your required expenses are still profitable.

Let's assume BIP39 mnemonics, i.e. 2048 words, each represents 11bits of the entropy source. Six known words in proper sequence from the start represent the beginning 66bits of the entropy source. Your search space is thus 62bits and 2⁶² candidate words sequences.

What do you have all to compute? You pick a candidate from 62bits sequence, compute SHA256 checksum and take 4bits of it, you assemble your known 66bits + 62bits candidate sequence + 4bits checksum and convert that to 12 mnemonic words (you need the mnemonic words because the PBKDF2 rounds start from the string of words, not a bit sequence). So you have to do parts of Mnemonic Derivation as shown in below chart (initial source, was later removed: https://raw.githubusercontent.com/EAWF/BTC-Toolbox/3938785f186c76598989cc0aa017ad351483d3b1/Images/KeyDerivationTechnicalOverview.png).

Then you do all from BIP32 Root Key Derivation which includes 2048 rounds of PBKDF2 with HMAC-SHA512, then Account-Level Extended Key Derivation until final Address Derivation where you can compare if the derived address(es) match one that you know has to be in your wallet. Without this you have no idea if your partial candidate sequence belongs to your wallet.

BIB39 Key Derivation Overview


This is a lot of work for just one sample of candidate sequence in your search space. But frankly, I don't know how much time even GPU optimized code needs for one or a million or a billion candidate samples. 2⁶² alone seems an approachable search space, but with the amount of work per sample, my gut feeling says: no.

[Kwackaroo]

Hey

Does anyone know of a tool on GitHub perhaps that can brute force the remaining 6 unknown words from a 12 word seed.

I know the first 6 words in the correct order from memory as these were familiar words I used when creating the wallet a very long time ago. Like 2010 maybe. Was all done in CLI as BTC was in its early days.

Found plenty that can crunch 3 lost words but cant find anything that can handle 6 missing words.

Yep. I know this is still technically impossible but worth a try.

I might have a solution been trying to figure mine out too.  Hopefully software im getting tomorrow works.  I have 4 words missing

[nc50lc]

-snip-

I might have a solution been trying to figure mine out too.  Hopefully software im getting tomorrow works.  I have 4 words missing

Your situation may seem similar but OP's missing words are 6 which isn't as easy as 4
You'll only have to search 17 Trillion permutations (which is still a lot) while OP needs to search 73 Quintillion permutations.
That's about 4194304 times more than the time you'd take to successfully recover yours.

In other words, OP's case is impossible with any "regular hardware" including GPU rigs.

[Cricktor]

Hopefully software im getting tomorrow works.

I hope for you that this is known software from a reputable source or well-known to the crypto community. Otherwise, it's possible to infect your device with malware or maybe worse, some sophisticated trojan and/or keylogger.

Do you mind telling us what software this is and from where you got it?

You should also apply basic security (this is not an exhaustive list, I may've missed something):

•   don't run unknown software on your main computer with important files on it
•   you do have current backups, don't you?
•   run the recovery preferably on an air-gapped disposable system with no active network connection (this way it can't go rogue, at least it's somewhat contained; especially it can't steal your remaining mnemonic recovery words or all of them when it found a solution!)
•   if you don't know or aren't sure to understand what you're doing, seek assistance before you do steps that may compromise your wallet
•   if the recovery software insists on an active internet connection, that would be a red flag for me (the common public domain tools for mnemonic seed recovery don't need this)

[ABCbits]

--snip--

I might have a solution been trying to figure mine out too.  Hopefully software im getting tomorrow works.  I have 4 words missing

I think you missed my earlier post.

Anything more than 3 words is impossible to brute force.

4 words is still practical if you use lots of high-end GPU[3].

[1] https://github.com/3rdIteration/btcrecover
[2] https://btcrecover.readthedocs.io/en/latest/GPU_Acceleration/#multi-gpu-systems
[3] https://bitcoinwords.github.io/how-i-checked-over-1-trillion-mnemonics

But it's only practical when big amount of Bitcoin is involved.