<p>With 4 unknown words there is around 1.76 trillion possible mnemonics and <a href="https://github.com/johncantrell97" rel="nofollow noreferrer">John Cantrell</a> was able to write and setup network of CPU and GPU solvers which successfully checked 1 trillion mnemonics in 30 hours (as part of a <a href="https://twitter.com/alistairmilne/status/1266037520715915267" rel="nofollow noreferrer">challenge to win a bitcoin</a>) by renting bunch of GPUs (it cost him less than $500).</p>
<p>The last 5th word you can just pre-calculate to reduce the number of calculations as it contains a checksum.</p>
<p>So if you are able to reproduce similar setup, you can brute-force and recover your wallet in just few days.</p>
<p>Read more at: <a href="https://medium.com/@johncantrell97/how-i-checked-over-1-trillion-mnemonics-in-30-hours-to-win-a-bitcoin-635fe051a752" rel="nofollow noreferrer">How I checked over 1 trillion mnemonics in 30 hours to win a bitcoin</a>.</p>
<p>Project repositories:</p>
<ul>
<li><a href="https://github.com/johncantrell97/bip39-solver-server" rel="nofollow noreferrer">https://github.com/johncantrell97/bip39-solver-server</a></li>
<li><a href="https://github.com/johncantrell97/bip39-solver-gpu" rel="nofollow noreferrer">https://github.com/johncantrell97/bip39-solver-gpu</a></li>
<li><a href="https://github.com/johncantrell97/bip39-solver-cpu" rel="nofollow noreferrer">https://github.com/johncantrell97/bip39-solver-cpu</a></li>
</ul>

CC BY-SA 4.0
2021-10-11T14:35:22.150Z
2021-10-11T14:46:37.143Z
2021-10-11T14:46:37.143Z
kenorb
<p>You have three options here:</p>

<ol>
<li>Using a GPU implementation of the Gurnec´s <a href="https://github.com/gurnec/btcrecover/blob/master/seedrecover.py" rel="nofollow noreferrer">Seed Recovery script</a></li>
<li>Use Hashcat / JTR, where PBKDF2-HMAC-SHA512  is already implemented.</li>
<li>Use <a href="https://github.com/ryancdotorg/brainflayer" rel="nofollow noreferrer">brainflayer</a>, similar to Gurnecs software, no multithread, no GPU.</li>
</ol>

<p>Gurnec´s script runs at aproximately 40kh/s under my i7-8700k without OC. So if you only had lost the last 4 words of your seed, it will be 2^36 hashes.</p>

<p>2^36 h / 40.000 h/s = ~ 20 days</p>

<p>So it will take roughtly 3 weeks to test every combination.</p>

<p>But to crack the last 5 words of your seed it would take 2048 * 20 days.</p>

<p>On the other side according to the <a href="https://hashcat.net/forum/thread-6391.html" rel="nofollow noreferrer">benchmarks</a> PBKDF2-HMAC-SHA512 hashes at a 4.800 kh/s under a usual 8 x 1080´s rig so it should be possible to recover in several days the 5 missing words.</p>

<p>tldr; Implement GPU in btcrecover or brainflayer or understand how to make it work under Hashcat. Up to 3 words + checksum word doable in CPU, more need GPU.</p>

CC BY-SA 4.0
2019-09-26T05:33:41.203Z
2019-09-26T06:25:59.080Z
2019-09-26T06:25:59.080Z
fran2k
<p>You can try btcrecover on github, look here: <a href="https://github.com/gurnec/btcrecover" rel="nofollow noreferrer">https://github.com/gurnec/btcrecover</a></p>

<p>it has a special feature to find missing mnemonic.</p>

<p>I also have a GPU version of it, if you need help</p>

<p>/KX</p>

CC BY-SA 4.0
2019-07-31T19:49:37.133Z
2019-07-31T19:49:37.133Z
KeychainX
<p>You may be able to find some luck writing an <a href="https://openwall.info/wiki/john/OpenCL-SHA-512" rel="nofollow noreferrer">OpenCL</a> wrapper for either <a href="https://openwall.info/wiki/john" rel="nofollow noreferrer">john</a> <a href="https://www.openwall.com/john/" rel="nofollow noreferrer">the</a> <a href="https://tools.kali.org/password-attacks/john" rel="nofollow noreferrer">ripper</a> or <a href="https://hashcat.net/hashcat/" rel="nofollow noreferrer">OCLHashCat</a>, as I'm fairly certain you can't retool ASICS (unless you get your hands on a good FPGA and gate it for ripping through the SHA512 space).  </p>

CC BY-SA 4.0
2019-07-09T09:37:28.337Z
2019-07-09T09:37:28.337Z
0xDEADCE11
<p>I have managed to lose 5 words of my 24 word Ledger Nano S recovery phrase. I have words 1-19 but I am missing words 20-24.
I have significant holdings on the wallet so would very much like to recover it if possible.
The passphrase is a BIP39 mnemonic (see <a href="https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki" rel="noreferrer">https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki</a>).
I have the bitcoin and ethereum public addresses for this mnemonic. I am wondering if it's feasible to brute force the passphrase.</p>

<p>Each word is 11 bits (2^11 = 2048 possible words).
The last (24th) word of the passphrase is of the following form [3 random bits][8 bit checksum].
Therefore I only have to check 2^(55 - 8) = 2^47 = 1.4x10^14 combinations.
I would have to compute SHA-512-HMAC with an iteration count of 2048.
As far as I understand, that means I'd have to compute 1.4*10^14 * 2048 = 2.87*10^17 hashes in total.</p>

<p>Is there any hardware out there designed for this? I am aware of ASICs that compute sha-256 hashes but not sha-512 hashes.
Perhaps I could tweak one to work with sha-512 since they are very similar.</p>

<p>Assuming a fairly typical ASIC hashrate of 1TH/s (10^12 hashes per second), I could exhaust the search space in 2.87*10^5 = 287000 seconds = 3.3 days. I'd probably get there sooner, of course (expected 1.65 days). Time is not something I am worried about. Even if I have to wait months, I don't mind - so if I can get 10GH/s at a reasonable price, that would be great.</p>

<p>I would really appreciate any help/information you could provide to help me out and make sure I haven't missed anything.
I could also use GPUs for this (I calculate I can run them at roughly $1/10TH - so it would cost me $28.7k to exhaust the search space, which I will do if there are no cheaper options).</p>

<p>Many thanks,
James</p>

CC BY-SA 4.0
2019-04-26T21:44:48.080Z
@Thegs I'm not following. By permuting every hash, I can find the one that matches up with my address.
JGoodwin10
CC BY-SA 4.0
2019-04-26T22:11:09.503Z
@ChrisW.Rea Thanks I've asked there now
JGoodwin10
CC BY-SA 4.0
2019-04-27T00:10:54.210Z
I doubt those ASICs exist (unless there's a coin that does exactly those hashes or maybe someone builds them just to do exactly this kind of key recovery, which i guess may one day become lucrative). You're likely gonna be doing CPU or GPU speeds (if you can make/find the right software to do it). Also I think you'll also need to do further checks every time you happen to land on a valid checksum (1 in 256).
Jannes
CC BY-SA 4.0
2019-04-27T00:11:25.903Z
I would not expect it to be possible to "tweak" an SHA256D ASIC.  They are designed in hardware to do only one thing.  If there were gates to spare, the designers would have used them for more SHA256 units instead of adding an SHA512 option.
Nate Eldredge
CC BY-SA 4.0
2019-04-27T00:23:33.927Z
You can not "tweak" the operation of an ASIC, and truly there's no mining ASIC doing a complete SHA256 hash either. It really depends how much money you have to blow on recovering the seed as to how far you can go, but I think your cost estimates are off by orders of magnitudes. You're forgetting that once every 1:256 attempts you need to do a computationally expensive bip32 dervice and see if any of the addresses match your wallet.
Claris
CC BY-SA 4.0
2019-05-01T16:01:58.573Z
https://www.xkcd.com/936/
 Obviously if you can do TH/s it gets quicker, but I still wouldn't think you'd be able to brute force what's essentially a 5 word passphrase (with the added bonus of having to hash 19 other words every time which adds to the time per hash). 4 Word passphrases are considered extremely safe at this point
xyious
CC BY-SA 4.0
2019-05-01T23:32:00.503Z
@xyious if I can do TH/s, wouldn't the calculations I showed apply? In that case, it would be brute-forceable. The issue is that TH/s are not really achievable.
JGoodwin10
CC BY-SA 4.0
2019-05-02T15:45:14.337Z
Yes, we're in complete agreement.
xyious
CC BY-SA 4.0
2019-05-21T17:57:17.087Z
@xyious It would be good to note that a _"4 Word passphrases"_ from the set of _"all words"_ is not the same as BIP39's 2048 word list.  2048^5 is "only" 36,028,797,018,963,970 possibilities compared to diceware's 7776^5 which is 789 times larger. Diceware is still a very _limited_ set of words, so the comparison to passphrase strength doesn't seem applicable IMHO.
Jonathan Cross
CC BY-SA 4.0
2020-08-17T12:33:45.907Z
Just wanted to note regarding @Jannes comment that the checksummed last word will have only 1 of 8 potentially valid checksums (the range of 256 possible checksums includes theoretically invalid ones that we dont' have to search through). In other words, once you reach 253 bits of entropy for the first 23 words, only the next three bits will need to be brute-forced, and each of those 8 options (2^3) will map to a distinct word after the checksum is computed. The last word of a 12-word mnemonic has essentially more security (as you must crack first 7 bits of last group). 2^7 = 128 combinations.
Steven Hatzakis
<passphrase><recover-private-key>
19 out of 24 words of BIP39 passphrase (brute-force last 5?)
JGoodwin10
# 19 out of 24 words of BIP39 passphrase (brute-force last 5?)

(Asked by: username_0 on 2019-04-26)

I have managed to lose 5 words of my 24 word Ledger Nano S recovery phrase. I have words 1-19 but I am missing words 20-24.
I have significant holdings on the wallet so would very much like to recover it if possible.
The passphrase is a BIP39 mnemonic (see <https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki>).
I have the bitcoin and ethereum public addresses for this mnemonic. I am wondering if it's feasible to brute force the passphrase.

Each word is 11 bits (2^11 = 2048 possible words).
The last (24th) word of the passphrase is of the following form [3 random bits][8 bit checksum].
Therefore I only have to check 2^(55 - 8) = 2^47 = 1.4x10^14 combinations.
I would have to compute SHA-512-HMAC with an iteration count of 2048.
As far as I understand, that means I'd have to compute 1.4\*10^14 \* 2048 = 2.87\*10^17 hashes in total.

Is there any hardware out there designed for this? I am aware of ASICs that compute sha-256 hashes but not sha-512 hashes.
Perhaps I could tweak one to work with sha-512 since they are very similar.

Assuming a fairly typical ASIC hashrate of 1TH/s (10^12 hashes per second), I could exhaust the search space in 2.87\*10^5 = 287000 seconds = 3.3 days. I'd probably get there sooner, of course (expected 1.65 days). Time is not something I am worried about. Even if I have to wait months, I don't mind - so if I can get 10GH/s at a reasonable price, that would be great.

I would really appreciate any help/information you could provide to help me out and make sure I haven't missed anything.
I could also use GPUs for this (I calculate I can run them at roughly $1/10TH - so it would cost me $28.7k to exhaust the search space, which I will do if there are no cheaper options).

Many thanks,
James

**Tags:** passphrase, recover-private-key

> **Comments:**
> **username_0**: @Thegs I'm not following. By permuting every hash, I can find the one that matches up with my address.  
> **username_0**: @ChrisW.Rea Thanks I've asked there now  
> **username_1**: I doubt those ASICs exist (unless there's a coin that does exactly those hashes or maybe someone builds them just to do exactly this kind of key recovery, which i guess may one day become lucrative). You're likely gonna be doing CPU or GPU speeds (if you can make/find the right software to do it). Also I think you'll also need to do further checks every time you happen to land on a valid checksum (1 in 256).  
> **username_2**: I would not expect it to be possible to "tweak" an SHA256D ASIC.  They are designed in hardware to do only one thing.  If there were gates to spare, the designers would have used them for more SHA256 units instead of adding an SHA512 option.  
> **username_3**: You can not "tweak" the operation of an ASIC, and truly there's no mining ASIC doing a complete SHA256 hash either. It really depends how much money you have to blow on recovering the seed as to how far you can go, but I think your cost estimates are off by orders of magnitudes. You're forgetting that once every 1:256 attempts you need to do a computationally expensive bip32 dervice and see if any of the addresses match your wallet.  
> **username_4**: https://www.xkcd.com/936/  Obviously if you can do TH/s it gets quicker, but I still wouldn't think you'd be able to brute force what's essentially a 5 word passphrase (with the added bonus of having to hash 19 other words every time which adds to the time per hash). 4 Word passphrases are considered extremely safe at this point  
> **username_0**: @username_4 if I can do TH/s, wouldn't the calculations I showed apply? In that case, it would be brute-forceable. The issue is that TH/s are not really achievable.  
> **username_4**: Yes, we're in complete agreement.  
> **username_5**: @username_4 It would be good to note that a _"4 Word passphrases"_ from the set of _"all words"_ is not the same as BIP39's 2048 word list.  2048^5 is "only" 36,028,797,018,963,970 possibilities compared to diceware's 7776^5 which is 789 times larger. Diceware is still a very _limited_ set of words, so the comparison to passphrase strength doesn't seem applicable IMHO.  
> **username_6**: Just wanted to note regarding @username_1 comment that the checksummed last word will have only 1 of 8 potentially valid checksums (the range of 256 possible checksums includes theoretically invalid ones that we dont' have to search through). In other words, once you reach 253 bits of entropy for the first 23 words, only the next three bits will need to be brute-forced, and each of those 8 options (2^3) will map to a distinct word after the checksum is computed. The last word of a 12-word mnemonic has essentially more security (as you must crack first 7 bits of last group). 2^7 = 128 combinations.  

---

## 4 answers

### Answer by username_7 on 2021-10-11. Score: 3

With 4 unknown words there is around 1.76 trillion possible mnemonics and [John Cantrell](https://github.com/johncantrell97) was able to write and setup network of CPU and GPU solvers which successfully checked 1 trillion mnemonics in 30 hours (as part of a [challenge to win a bitcoin](https://twitter.com/alistairmilne/status/1266037520715915267)) by renting bunch of GPUs (it cost him less than $500).

The last 5th word you can just pre-calculate to reduce the number of calculations as it contains a checksum.

So if you are able to reproduce similar setup, you can brute-force and recover your wallet in just few days.

Read more at: [How I checked over 1 trillion mnemonics in 30 hours to win a bitcoin](https://medium.com/@johncantrell97/how-i-checked-over-1-trillion-mnemonics-in-30-hours-to-win-a-bitcoin-635fe051a752).

Project repositories:

* <https://github.com/johncantrell97/bip39-solver-server>
* <https://github.com/johncantrell97/bip39-solver-gpu>
* <https://github.com/johncantrell97/bip39-solver-cpu>


---

### Answer by username_8 on 2019-09-26. Score: 2

You have three options here:

1. Using a GPU implementation of the Gurnec´s [Seed Recovery script](https://github.com/gurnec/btcrecover/blob/master/seedrecover.py)
2. Use Hashcat / JTR, where PBKDF2-HMAC-SHA512 is already implemented.
3. Use [brainflayer](https://github.com/ryancdotorg/brainflayer), similar to Gurnecs software, no multithread, no GPU.

Gurnec´s script runs at aproximately 40kh/s under my i7-8700k without OC. So if you only had lost the last 4 words of your seed, it will be 2^36 hashes.

2^36 h / 40.000 h/s = ~ 20 days

So it will take roughtly 3 weeks to test every combination.

But to crack the last 5 words of your seed it would take 2048 \* 20 days.

On the other side according to the [benchmarks](https://hashcat.net/forum/thread-6391.html) PBKDF2-HMAC-SHA512 hashes at a 4.800 kh/s under a usual 8 x 1080´s rig so it should be possible to recover in several days the 5 missing words.

tldr; Implement GPU in btcrecover or brainflayer or understand how to make it work under Hashcat. Up to 3 words + checksum word doable in CPU, more need GPU.


---

### Answer by username_9 on 2019-07-31. Score: 1

You can try btcrecover on github, look here: <https://github.com/gurnec/btcrecover>

it has a special feature to find missing mnemonic.

I also have a GPU version of it, if you need help

/KX


---

### Answer by username_10 on 2019-07-09. Score: 0

You may be able to find some luck writing an [OpenCL](https://openwall.info/wiki/john/OpenCL-SHA-512) wrapper for either [john](https://openwall.info/wiki/john) [the](https://www.openwall.com/john/) [ripper](https://tools.kali.org/password-attacks/john) or [OCLHashCat](https://hashcat.net/hashcat/), as I'm fairly certain you can't retool ASICS (unless you get your hands on a good FPGA and gate it for ripping through the SHA512 space).


---

