Need help recovering BTC from a 2018 Coldcard Mk1 setup — 12 words, PIN and USB

[rahulkumar123]

(Took help of ChatGPT to make it more readable)
 
Hello everyone,

I’m new to this forum and would really appreciate some guidance from experienced Bitcoin users, particularly anyone familiar with the earliest Coldcard hardware wallets from around 2018.

I’m trying to help a friend recover Bitcoin that he stored back in 2018. He isn’t technically knowledgeable, and the original setup was done using someone else’s first-generation Coldcard (possibly Mk1).

He remembers that a USB flash drive was involved in storing or backing up the wallet, but he doesn’t remember the exact process.

Here’s what we know:

1. The wallet was set up around 2018 using an early Coldcard device belonging to someone else.
2. He still has the USB flash drive associated with the original setup.
3. He has a piece of paper containing 12 words written in sequence.
4. He also has a handwritten 6-digit PIN.
5. He previously checked the Bitcoin balance using a public address, most recently around 2020.
6. He hasn’t accessed or made any transactions from the wallet since the original setup.
7. We’re currently unsure whether the original Coldcard device is still available.

Unfortunately, he’s now dealing with a medical emergency in his family and urgently needs access to these funds. He’s asked me to help him because I’m more comfortable with computers and newer hardware wallets, although I don’t have experience recovering older Bitcoin wallets.

What I’ve researched so far:

From what I understand, Coldcard supported encrypted wallet backups protected by a separate 12-word password. This makes me wonder whether the 12 words he wrote down are actually the password to an encrypted backup rather than the BIP39 seed phrase itself.

I also understand that Bitcoin isn’t literally stored on a USB drive, so I’m trying to determine whether the drive contains an encrypted backup, wallet file, or something else.

My questions:

1. Did the original Coldcard Mk1 support encrypted .7z backups in 2018?
2. Is there a way to determine whether the 12 words are a BIP39 seed phrase or a Coldcard backup password without exposing them?
3. How should I safely inspect the USB drive to identify its contents? Should I be looking for particular filenames or extensions?
4. If the USB contains an encrypted Coldcard backup, can it be restored on a newer Coldcard without the original device?
5. Is the handwritten 6-digit PIN relevant to recovery, or would it only unlock the original Coldcard?
6. Could there be complications because someone else’s Coldcard device was used during the original setup?
7. What would be the safest recovery process, including verifying that we’ve recovered the correct wallet and transferring the BTC to a newly initialized hardware wallet?

Our goal:

We want to recover access to the original wallet, confirm the balance, and transfer the Bitcoin to a new hardware wallet under my friend’s exclusive control.

We haven’t entered the 12 words into any websites or shared the PIN, recovery words, or backup files with anyone. We don’t intend to do so.

I’m not looking for anyone to handle the funds or provide a paid recovery service. I’m hoping to learn the correct technical procedure so that I can assist my friend safely.

If anyone here has experience with Coldcard Mk1 devices, especially their backup and recovery mechanisms from 2018, I’d be extremely grateful for your guidance or links to relevant documentation.

I’ll update this thread as we identify the files on the USB drive and make progress, so the information might help others in a similar situation.

Thank you for reading and for any assistance you can provide!

[DaveF]

The Coldcard only had a mico SD for storage not a USB.
The 12 words are the probably the recovery seed for the wallet.

100% guessing here:

The USB drive is the wallet file from the PC / MAC app that they used to access the cold card. Probably from https://electrum.org/

They might be able to recover with just the 12 words if that is all they used. The pin is for the coldcard to gain access to it.

But, without more info we really can't be sure.

Take a look at: https://bitcointalk.org/index.php?topic=4959742.0 in the seed words section.

-Dave

[DireWolfM14]

LoyceV's tutorial on seed phrase recovery (linked by DaveF) is a good place to start.  If you don't have a dedicated off-line computer, a quick and easy way to safely recover the wallet using your seed is to use Tails OS: https://tails.net/

Create a bootable USB with the Tails iso, and boot your computer to it.  It'll start your computer with all networking features turned off, and it'll have Electrum preinstalled.  You can use Electrum to recover your wallet from the seed (12 words) and extract the master public key to use on an online device to create a watch-only wallet and check for the funds you want to recover.

[nc50lc]

2. Is there a way to determine whether the 12 words are a BIP39 seed phrase or a Coldcard backup password without exposing them?

You can try to restore that seed phrase on an Air-Gap machine with a wallet capable of Cold-storage setup. (Wiki: Air Gap | e.g.: Electrum Cold Storage)
Then with its xpub, you can create a watch-only wallet on a separate online machine to check for transactions.
That setup can also be used to spend from that wallet safely.

You can try this multiple times with different standard derivation paths and script types since it's not limited to one.
And doing this should skip most of your concerns including testing the Coldcard device if it's still functional.
Plus it's completely safe if the air-gap machine is isolated from any external connection correctly.

The issue is if he used a non-standard derivation path or used a forgotten BIP39 passphrase (not the wallet password) on any of his wallet.

3. How should I safely inspect the USB drive to identify its contents? Should I be looking for particular filenames or extensions?

Most Coldcard users at that time suggested to use Electrum as their interface.
Normally, Electrum wallet file shouldn't have an extension but if it's an "skeleton wallet" exported by Coldcard for Electrum, it should have a ".json" extension.
But that doesn't contain any data that'll enable you to spend, you'll need the paired Coldcard device to spend from it. It's comparable to a watch-only wallet.

5. Is the handwritten 6-digit PIN relevant to recovery, or would it only unlock the original Coldcard?

Did he left a note? There's a high chance that it's indeed just the PIN.
But it wouldn't hurt to try to use it as the BIP39 passphrase if none of the standard derivations paths result with the correct wallet when restoring the seed phrase.

6. Could there be complications because someone else’s Coldcard device was used during the original setup?

If it's paired to Electrum, it shouldn't overwrite existing wallets since it supports multiple wallet files.
But, it's not a concern if you'll just use the 12-words seed phrase to restore the wallet.