I\u2019ll start with what set everything in motion, because I think it helps understand the choices I made\u200a\u2014\u200aboth technical and\u00a0ethical.<\/p>\n
Someone close to me lost access to a Bitcoin wallet in 2018\u200a\u2014\u200anot a small amount. The seed phrase had been carefully saved on paper, or so they believed. When the time came to access it, eight of the twelve words were legible. The remaining four were completely unreadable because the page had been damaged by moisture.<\/p>\n
I started looking for existing tools. What I found was either Python scripts abandoned for years that no longer compiled, or commercial services asking you to send them your seed phrase which is absurd from a security standpoint or forums simply saying \u201cit\u2019s gone,\u00a0sorry.\u201d<\/p>\n
In this article about the ten recovery modes the software contains, I\u2019ll focus on Mode 1, which is seed phrase brute force. It\u2019s the most common and easiest to understand. For the other modes, don\u2019t hesitate to consult the software documentation.<\/p>\n
I named the software: wrecover<\/strong>.<\/p>\n Before going into the details of the software, I want to make sure you understand the problem you\u2019re facing, because the mathematics entirely determine whether your situation is recoverable and with what hardware.<\/p>\n BIP39 is the standard that defines how your seed phrase works. Each word comes from a fixed list of 2,048 words. The phrase is converted into a seed via PBKDF2-HMAC-SHA512 with exactly 2,048 iterations\u200a\u2014\u200aa deliberately slow operation designed to make brute-force difficult. Then BIP32 and BIP44 take over for hierarchical key derivation. I won\u2019t dwell too long on these steps for more detailed information you can read the excellent articles that explain this process in\u00a0depth.<\/p>\n When words are missing, you are searching through all valid combinations of those 2,048 words at the unknown positions:<\/p>\n \u2022 1 missing word:<\/strong> 2048 candidates<\/p>\n \u2022 2 missing words:<\/strong> 2048\u00b2 (~4.2 million) candidates<\/p>\n \u2022 3 missing words:<\/strong> 2048\u00b3 (~8.6 billion) candidates<\/p>\n \u2022 4 missing words: <\/strong>2048\u2074 (~17.6 trillion) candidates<\/p>\n \u2022 5 missing words:<\/strong> 2048\u2075 (~36 quadrillion) candidates<\/p>\n These are raw figures before the BIP39 checksum filter I describe below. But even with that filter, the jump from 3 to 4 missing words is where CPU alone becomes insufficient. That\u2019s precisely what pushed me to do the GPU\u00a0work.<\/p>\n wrecover is a command-line tool available on Linux and Windows, and a graphical interface available exclusively for the Pro version on Windows\u200a\u2014\u200awritten in C++20, with a full CUDA backend and a portable OpenCL backend. It runs entirely locally. Nothing leaves your machine. No telemetry, no license server, no network component of any kind. Your seed phrase never leaves your hardware.<\/p>\n This is a decision I made from day one and that has never changed. A wallet recovery tool that makes network calls is a wallet theft\u00a0tool.<\/p>\n Full documentation is available at wrecover.github.io<\/a>\u200a\u2014\u200aeach mode has its own page with complete parameters, realistic performance estimates for different configurations, and example commands.<\/p>\n One of the first things I realized while building wrecover is that losing access to a wallet is not a single problem. It\u2019s a family of distinct problems each requiring a different approach. I implemented ten.<\/p>\n Mode 0\u200a\u2014\u200aModel File <\/strong>is for cases where you have partial knowledge that\u2019s difficult to express simply. You know some words but not their exact positions. You have several candidates for certain slots. You encode your constraints in a text file and wrecover systematically tests every valid combination that satisfies them. It\u2019s the intelligent version of brute force\u200a\u2014\u200ayou apply what you know before computing anything.<\/p>\n Mode 1\u200a\u2014\u200aMnemonic Brute Force <\/strong>is what most people need. You mark unknown words with x and wrecover tests all 2,048 BIP39 words at each position. The free version includes GPU acceleration for up to three missing words. Four or more require the Pro\u00a0version.<\/p>\n Mode 2\u200a\u2014\u200aFull Passphrase Brute Force <\/strong>is for cases where you know your seed phrase perfectly but have completely forgotten the passphrase. You define a minimum and maximum length and wrecover tests every combination of printable ASCII characters in that range. The search space is 95 to the power of the passphrase length\u200a\u2014\u200athis mode is only tractable with GPU beyond 5 to 6 characters.<\/p>\n Mode 3\u200a\u2014\u200aPassphrase Mask <\/strong>is the most elegant mode in my view. If you remember your passphrase was something like \u201cBitcoin\u201d followed by three digits, you write -mask \u201cBitcoin?d?d?d\u201d and wrecover tests only the 1,000 combinations matching that pattern. Available wildcards:\u00a0?l for lowercase,\u00a0?u for uppercase,\u00a0?d for digits,\u00a0?s for special characters,\u00a0?a for all,\u00a0?b for hexadecimal. When you have any structural memory of your passphrase, this mode reduces the search space by several orders of magnitude.<\/p>\n Mode 4\u200a\u2014\u200aSubstitution <\/strong>handles the leet-speak problem. You put base words in a dictionary file and wrecover automatically generates all possible substitution variants\u200a\u2014\u200ap@ssword, passw0rd, P@55w0rd, and every other combination of common substitutions.<\/p>\n Modes 5 to 9 <\/strong>are combination modes. Mode 5: model file for seed recovery combined with a passphrase list. Mode 6: missing words combined with a passphrase list. Mode 7: testing a file of complete seed phrase candidates. Mode 8: testing a passphrase list against a known complete seed phrase. Mode 9\u200a\u2014\u200athe most exhaustive\u200a\u2014\u200afull Cartesian product of a seed phrase file and a passphrase file. Modes 7, 8 and 9 are CPU-only. Modes 0 to 6 support\u00a0GPU.<\/p>\n A technical detail that many recovery tools miss entirely, and that has a real impact on performance.<\/p>\n BIP39 integrates a checksum into the seed phrase. The last word encodes the final entropy bits plus a checksum of the entire phrase\u200a\u2014\u200a4 bits for a 12-word phrase, 8 bits for 24 words. wrecover validates this checksum before performing any address derivation.<\/p>\n In practice, for a 12-word phrase with one unknown last word, about 7 out of 8 candidates are eliminated immediately\u200a\u2014\u200ayou test ~256 real candidates instead of 2,048. On a large brute-force run, filtering invalid candidates before the expensive PBKDF2 computation significantly reduces the actual workload. Tools that skip this step do unnecessary work on every\u00a0run.<\/p>\n The core operation of wrecover is PBKDF2-HMAC-SHA512 with 2,048 iterations. This dominates the runtime. And it is embarrassingly parallel: each candidate is completely independent of the others. No shared state, no communication between threads. This is exactly the type of workload GPUs were designed\u00a0for.<\/p>\n Here are the real measured figures for different configurations in Mode\u00a01:<\/p>\n The measured speedup ranges from 650\u00d7 to 6,000\u00d7 depending on the hardware and mode. This is a direct consequence of mapping a parallel workload onto hardware designed for it\u200a\u2014\u200anot an optimistic rounding, but real measurements.<\/p>\n To put it concretely: three missing words in a 24-word phrase takes 9 hours on 8 CPU threads. On an RTX PRO 6000, it takes 1 minute. Four missing words in a 24-word phrase takes 2 years on CPU. On an RTX PRO 6000, it\u2019s 18 hours recoverable overnight.<\/p>\n I ran tests on 8\u00d7 RTX PRO 6000 Blackwell and achieved speeds of 2.02 Gseeds\/s. With this configuration I can scan the entire 4-missing-word range in just 2 hours 30\u00a0minutes.<\/p>\n Imagine renting 200\u00d7 RTX PRO 6000 Blackwell on vast.ai\u200a\u2014\u200ayou could scan the entire 5-missing-word range in less than 8 days: (2,048\u2075 \/ (200 \u00d7 264,000,000)) \/ 3600 = 190 hours (< 8\u00a0days).<\/p>\n Linux (sm_60 to\u00a0sm_120):<\/strong><\/p>\n \u2022 Pascal: GTX 1060\/1070\/1080\/1080 Ti, Tesla\u00a0P100<\/p>\n \u2022 Volta: Titan V, Tesla\u00a0V100<\/p>\n \u2022 Turing and above: all RTX 20, 30, 40, 50 series, professional and datacenter cards<\/p>\n Windows (sm_75 to\u00a0sm_120):<\/strong><\/p>\n \u2022 Turing: GTX 1650, RTX 2060\/2070\/2080\/2080 Ti, Titan\u00a0RTX<\/p>\n \u2022 Ampere: RTX 3060 to 3090, A100,\u00a0A30<\/p>\n \u2022 Ada Lovelace: RTX 4060 to 4090, L40S, RTX 6000\u00a0Ada<\/p>\n \u2022 Hopper: H100,\u00a0H200<\/p>\n \u2022 Blackwell: RTX 5070 to 5090, B100, B200, RTX PRO\u00a06000<\/p>\n The OpenCL backend covers AMD cards and other OpenCL-compatible devices, using the same algorithm as the CUDA\u00a0backend.<\/p>\n The -grid and -gblock parameters (default: -grid 256 -gblock 256) allow tuning the GPU configuration for different architectures. For my tests I used -grid 2048 -gblock 256 and obtained excellent results.<\/p>\n This is probably the most important feature for difficult cases.<\/p>\n Five missing words in a 24-word phrase means 2,04\u2078\u2075 (~36 quadrillion) candidates. Even across 200\u00d7 RTX PRO 6000, that\u2019s nearly 8 days to scan the full range. But the Pro version includes -startp and -endp parameters that allow splitting the search space across multiple independent machines on completely different systems.<\/p>\n The principle: you create a work file describing the job, then launch multiple instances with different assigned\u00a0ranges.<\/p>\n Machine 1\u200a<\/strong>\u2014\u200afirst\u00a0third<\/p>\n wrecover -m 1 -ms “abandon x able x x absent x abstract x accuse accident account” Machine 2<\/strong>\u200a\u2014\u200asecond\u00a0third<\/p>\n wrecover -m 1 -ms “abandon x able x x absent x abstract x accuse accident account” Machine 3<\/strong>\u200a\u2014\u200alast\u00a0third<\/p>\n wrecover -m 1 -ms “abandon x able x x absent x abstract x accuse accident account” Each machine works its segment independently. In this example, three machines with decent GPUs divide the total time by three. Rent multiple GPU instances on vast.ai for 24 hours and what was a multi-day job becomes an afternoon\u2019s work.<\/p>\n I want to be direct on this point because it\u2019s a conscious decision that goes against what most tools in this space\u00a0do.<\/p>\n The Pro version of wrecover does not send you a compiled executable. It sends you the complete source\u00a0code.<\/p>\n The reason is simple: a wallet recovery tool is, by construction, exactly the type of software a malicious actor would want to distribute. You\u2019re running something on a machine that potentially contains other sensitive files. You\u2019re often in a stressed state, not in the best conditions to calmly evaluate the security of a downloaded executable.<\/p>\n The only honest way to solve this trust problem is to give you the code. You read it. You have someone else audit it if you want. You verify that every line does what it\u2019s supposed to do. And when you\u2019re satisfied, you compile it yourself on your own\u00a0machine.<\/p>\n The code is well-commented, well-documented, and without any form of obfuscation. No encrypted segments, no embedded binary blobs, no runtime decompression, and no external libraries other than the standard C++, OpenCL, and CUDA libraries are used. What you read is exactly what\u00a0runs.<\/p>\n On Linux, <\/strong>a preconfigured Makefile handles the entire compilation. One make command and it\u2019s compiled from your local\u00a0source.<\/p>\n On Windows, <\/strong>a preconfigured Microsoft Visual Studio project file is included. You open it, review the code, and compile. The Pro Windows version produces both a CLI executable and a GUI application\u200a\u2014\u200asame code, same algorithms, two interfaces according to your preference.<\/p>\n Personal compilation support is included with the Pro license. If you get stuck on the CUDA configuration or the Visual Studio project, I\u2019ll help you through\u00a0it.<\/p>\n Some of you will still hesitate to run the free binary directly on your main machine. That\u2019s a reasonable position, and there are clean alternatives.<\/p>\n Google Colab <\/strong>gives you free GPU access in a notebook environment isolated from your machine. Upload the Linux binary, generate a test wallet whose parameters you fully control, simulate the loss of a few words, and verify that wrecover finds them. You prove the tool works without your real seed phrase ever being involved.<\/p>\n vast.ai <\/strong>is a marketplace for rented GPU compute. You spin up an Ubuntu instance with an NVIDIA card for a few cents to a few euros per hour, upload the Linux binary, run your job, terminate the instance. Your sensitive data only touches an ephemeral session you control. This is actually the approach I recommend even without specific security concerns\u200a\u2014\u200arenting GPU compute for a one-time recovery is often more economical than buying hardware.<\/p>\n RunPod, Lambda Labs, Paperspace\u200a\u2014\u200aall valid alternatives in the same category.<\/p>\n For Pro users who want maximum confidence: read the source, compile it in a cloud environment, run it there. You go from \u201ctrust an executable\u201d to \u201ccompile and run code you personally audited in an isolated environment.\u201d That\u2019s a fundamentally different security position. And above all, avoid trusting tools or so-called cracked versions\u200a\u2014\u200ago to the official GitHub page and download the free version yourself, or order the Pro version from the official\u00a0website.<\/p>\n I added this system after seeing too many recovery attempts fail not because of the search space, but because of a simple interruption. You start a 3-day job, the computer restarts, you lose everything and start over. Twice. You give\u00a0up.<\/p>\n Every recovery job in wrecover creates a\u00a0.wrec file with -ws -wf your_job.wrec. This file captures the complete state: configuration, parameters, progress counter. An interruption? You resume with -wi -wf your_job.wrec and the counter picks up exactly where it\u00a0stopped.<\/p>\n Work files are encrypted with a password you choose via -wp\u200a\u2014\u200abecause a work file by definition contains sensitive information about your seed phrase and target\u00a0address.<\/p>\n They\u2019re also portable. A job started on your desktop can be transferred to a rented GPU instance on vast.ai and resumed there at full speed. The binary format is compatible across all CPU and GPU\u00a0systems.<\/p>\n The -save-only flag creates the work file without starting recovery\u200a\u2014\u200auseful for preparing multiple distributed segments and launching them simultaneously on different machines.<\/p>\n With the right hardware and distributed recovery, here\u2019s what\u2019s feasible:<\/p>\n 1 to 3 missing words: <\/strong>recoverable quickly on any NVIDIA card from the last five years. Minutes to hours depending on the card. Even feasible on a good\u00a0CPU.<\/p>\n 4 missing words: <\/strong>tractable with GPU. From 6 days on an RTX PRO 6000 for a 12-word phrase, to 18 hours for a 24-word phrase. Run it on a machine with multiple GPUs or distribute across machines and the times divide linearly.<\/p>\n 5 missing words: <\/strong>feasible but computationally expensive. On one RTX PRO 6000, about 33 years for a 12-word phrase, ~4 years for a 24-word phrase. With multiple GPUs in parallel it\u2019s much faster, as shown in the previous\u00a0example.<\/p>\n 6 or more missing words with no constraints: <\/strong>the search space becomes astronomical. I won\u2019t promise you that wrecover solves that in a reasonable timeframe on standard hardware. This is where the model file (Mode 0) becomes crucial\u200a\u2014\u200aif you have the slightest partial constraint on what the missing words might be, you can reduce the search space by several orders of magnitude before a single hash is computed.<\/p>\n The tool is most powerful when you combine its computational speed with everything you know. Even a vague memory can make the difference between a search of a few days and one of several\u00a0weeks.<\/p>\n I published a demonstration video on YouTube showing the software in real operation\u200a\u2014\u200athe launch, configuring a session, the live speed counter, the output format. No written description replaces seeing the terminal running and millions of seeds scrolling in real\u00a0time.<\/p>\n The channel is dedicated to wrecover: mode-by-mode tutorials, GPU setup guides, comparative benchmarks between different hardware configurations. If you\u2019re trying to evaluate whether the tool fits your situation, start by watching the\u00a0demo.<\/p>\n https:\/\/medium.com\/media\/abb88a5692038a167706b9bbbebfea47\/href<\/a><\/p>\n Where to\u00a0start<\/strong><\/p>\n If you have a concrete recovery problem, here\u2019s the approach I recommend.<\/p>\n Go to wrecover.github.io and consult the \u201cWhich mode to use?\u201d decision table\u200a\u2014\u200ait maps your exact situation (what you know about the seed phrase, what you know about the passphrase) to the appropriate mode.<\/p>\n Download the free version and test it on a wallet you control. Generate a new wallet, note everything, simulate the loss of one word, verify that Mode 1 finds it. Five minutes of testing that proves the tool works on your hardware before any commitment.<\/p>\n Honestly assess your search space using the performance tables. How many words are missing? Do you have any uncertainty about the passphrase? Is your situation feasible on CPU or does it require\u00a0GPU?<\/p>\n If you need GPU\u200a\u2014\u200arent via Colab or vast.ai to test, or go Pro, compile the source yourself after auditing, and run locally or on rented hardware with full knowledge of what you\u2019re executing.<\/p>\n I built wrecover because I couldn\u2019t find what I needed. I designed it to run entirely locally because it\u2019s the only ethical way to distribute this type of tool. And I chose to deliver the source rather than a binary because it\u2019s the only honest way to solve the trust\u00a0problem.<\/p>\n There are limits to what\u2019s recoverable\u200a\u2014\u200aI\u2019d rather tell you that clearly than sell you a dream. But for cases where recovery is mathematically feasible, the difference between a well-designed GPU-accelerated tool and an approximate CPU attempt is often the difference between finding the answer and never finding\u00a0it.<\/p>\n wrecover is available at <\/em>wrecover.github.io<\/em><\/strong><\/a>\u200a\u2014\u200afree version available for download, full documentation online. The Pro version includes complete source code with no obfuscation, a preconfigured Makefile for Linux, a preconfigured Visual Studio project for Windows, CLI and GUI versions, multi-GPU support with linear scaling, and personal compilation support. Intended exclusively for recovering wallets you own or are legally authorized to\u00a0access.<\/em><\/p>\n I built a GPU-accelerated Bitcoin wallet recovery tool that recovered wallet with 4 missing words<\/a> was originally published in Coinmonks<\/a> on Medium, where people are continuing the conversation by highlighting and responding to this story.<\/p>","protected":false},"excerpt":{"rendered":" I built a GPU-accelerated Bitcoin wallet recovery tool that recovered wallet with 4 missing words in just 2 hours. Here\u2019s why, how it works, and why you can trust\u00a0it. I\u2019ll start with what set everything in motion, because I think it helps understand the choices I made\u200a\u2014\u200aboth technical and\u00a0ethical. Someone close to me lost access […]<\/p>\n","protected":false},"author":0,"featured_media":144545,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-144544","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-interesting"],"_links":{"self":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/144544"}],"collection":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=144544"}],"version-history":[{"count":0,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/144544\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/media\/144545"}],"wp:attachment":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=144544"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=144544"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=144544"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Understanding the mathematical problem\u00a0first<\/h3>\n
What I built and why it takes this\u00a0form<\/h3>\n
Ten modes because recovery is not a single\u00a0problem<\/h3>\n
The BIP39 checksum filter\u200a\u2014\u200athe optimization built into the\u00a0standard<\/h3>\n
The GPU numbers\u200a\u2014\u200athis is where everything changes<\/h3>\n
GPU compatibility by architecture (free version provided for\u00a0testing)<\/h4>\n
Five or more missing words\u200a\u2014\u200adistributed recovery<\/h3>\n
-addr “1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa” -wlang en
-ws -wf job_part1.wrec -wp “password”
-startp 0 -endp 5000000000000 -gpu -grid 2048 -gblock 256<\/p>\n
-addr “1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa” -wlang en
-ws -wf job_part2.wrec -wp “password”
-startp 5000000000000 -endp 10000000000000 -gpu -grid 2048 -gblock 256<\/p>\n
-addr “1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa” -wlang en
-ws -wf job_part3.wrec -wp “password” -startp 10000000000000 -gpu -grid 2048 -gblock 256<\/p>\nWhy the Pro version delivers source code and not a\u00a0binary<\/h3>\n
Testing without installing anything locally\u200a\u2014\u200aColab, vast.ai, and the\u00a0rest<\/h3>\n
The work file system\u200a\u2014\u200abecause long jobs need reliability<\/h3>\n
What is realistically recoverable\u200a\u2014\u200aI prefer to be\u00a0honest<\/h3>\n
Watch the demo before going\u00a0further<\/h3>\n
To conclude<\/h3>\n