<p>From what you've stated, there is no way to recover those private keys.</p>
<p>Bitcoin Core's wallet does not store xpubs, or even xprvs. It derives the private keys as needed from the seed. Furthermore, for the type of wallet you are using, Bitcoin Core uses exclusively hardened derivation, so the vulnerability you are referring to does not apply.</p>
<p>Additionally, it sounds like your wallet is in a state that should not occur. The wallet encryption for Bitcoin Core was specifically written to avoid having both encrypted and unencrypted data in the wallet. If encryption fails, it's supposed to crash which should force the database to revert to its previous state with nothing encrypted. It may be that you are looking at only the database file and not also with the database journal which can contain additional data (although it's supposed to be that the journal contains the encrypted data and the db only what is committed, and if it crashed, then the data was not committed).</p>
<p>However if you are looking at the database with it's journal, then you might also be looking at it in the uncommitted state and unencrypted keys are not actually deleted, just hidden as they are marked for deletion, but not yet actually deleted.</p>

CC BY-SA 4.0
2022-08-27T01:07:45.600Z
Thank you Andrew for taking the time to answer my questions so precisely, I do not have the database of this wallet having no knowledge of cryptographic blockchain at the time. The branch paths are m/0'/0'/n+'. The software version was 0.18. The wallet crashed because there was a maxrpctime argument of 10 seconds I think. I found the tool https://gist.github.com/fivepiece/e3293733d99c4935332f8c5959d7472b
Maxbird
CC BY-SA 4.0
2022-08-27T01:19:40.410Z
I had another wallet.bak in the directory, and the encrypted mkey matches that wallet in my main wallet.dat. It is as if the two wallets had merged. I will look for another solution and try to find out why some keys are not uncrypred. I saw that it was impossible to find the masterkey (Key) with all the other informations (IV, cipher, plain text) in AES-256-CBC. I am not optimistic about recovering the wallet. But again thank you for answering with all your knowledge
Maxbird
CC BY-SA 4.0
2022-08-26T19:23:57.113Z
2022-08-26T19:23:57.113Z
Ava Chow
<p>I've looked through the various questions and answers regarding this topic but I can't find the answers to mine.</p>
<p>I lost access to my wallet since calling <em>encryptwallet</em> which crashed the bitcoin software.
I did many scans with all the tools available on github and also some that I wrote.</p>
<p>My wallet contains 4 masterkeys (<strong>m path</strong>) of which 2 can be decrypted with the password of the wallet and contains more than 1500 addresses. Only around 200 can be decrypted with the password.</p>
<p>I found the xpriv for these two decrypted masterkeys by importing them into bitcoin core with the <em>sethdseed</em> function.</p>
<p>I found in the hexadecimal chains of the portfolio 20 addresses which have not been encrypted and of which I therefore know the private key, the encrypted key, the pub key, the derivation.</p>
<p>I can't find any way to find the xpub of the other two mastrkeys which will have allowed me to find all the other private keys. The Chaincode is missing and can't find it in wallet.dat.</p>
<p>I tried to modify the Bitcoin code to convert according to the same logic as for the WIF key import but without success.</p>
<p>My questions are:</p>
<ul>
<li>Is there a way to convert the public key like I did for the private key?</li>
<li>Can I find the sibling keys with the amount of private keys that I have recovered?</li>
<li>Do you see another way to recover my funds?</li>
</ul>
<p>I anticipate a generous reward.
Thank You</p>

CC BY-SA 4.0
2022-08-26T11:16:57.733Z
You seem to know what you are doing but don't mention backups. Is there some problem with backup recovery we need to know about to avoid the same issue?
RedGrittyBrick
CC BY-SA 4.0
2022-08-26T11:22:21.133Z
I only have the wallet.dat and the end of the debug.log, to avoid the same problem, never start encryptwallet without having a local copy of your wallet. Also the crash occurs when a large number of keys are present in the wallet. I don't know this so well, I've been trying to recover my wallet for 1 year, I've read a lot of subject since all this time. Thanks for your help
Maxbird
CC BY-SA 4.0
2022-08-26T14:10:26.770Z
how would finding the xpub allow you find all other private keys?
Mike D
CC BY-SA 4.0
2022-08-26T16:16:37.260Z
I invite you to consult this post where everything is much better explained than I could do. https://bitcoin.stackexchange.com/questions/56916/derivation-of-parent-private-key-from-non-hardened-child?noredirect=1&lq=1
Maxbird
<bitcoin-core><bitcoind><private-key><bip32-hd-wallets><bip44>
Retrieve extended private key from child keys or sibling keys
Maxbird
# Retrieve extended private key from child keys or sibling keys

(Asked by: username_0 on 2022-08-26)

I've looked through the various questions and answers regarding this topic but I can't find the answers to mine.

I lost access to my wallet since calling *encryptwallet* which crashed the bitcoin software.
I did many scans with all the tools available on github and also some that I wrote.

My wallet contains 4 masterkeys (**m path**) of which 2 can be decrypted with the password of the wallet and contains more than 1500 addresses. Only around 200 can be decrypted with the password.

I found the xpriv for these two decrypted masterkeys by importing them into bitcoin core with the *sethdseed* function.

I found in the hexadecimal chains of the portfolio 20 addresses which have not been encrypted and of which I therefore know the private key, the encrypted key, the pub key, the derivation.

I can't find any way to find the xpub of the other two mastrkeys which will have allowed me to find all the other private keys. The Chaincode is missing and can't find it in wallet.dat.

I tried to modify the Bitcoin code to convert according to the same logic as for the WIF key import but without success.

My questions are:

* Is there a way to convert the public key like I did for the private key?
* Can I find the sibling keys with the amount of private keys that I have recovered?
* Do you see another way to recover my funds?

I anticipate a generous reward.
Thank You

**Tags:** bitcoin-core, bitcoind, private-key, bip32-hd-wallets, bip44

> **Comments:**
> **username_1**: You seem to know what you are doing but don't mention backups. Is there some problem with backup recovery we need to know about to avoid the same issue?  
> **username_0**: I only have the wallet.dat and the end of the debug.log, to avoid the same problem, never start encryptwallet without having a local copy of your wallet. Also the crash occurs when a large number of keys are present in the wallet. I don't know this so well, I've been trying to recover my wallet for 1 year, I've read a lot of subject since all this time. Thanks for your help  
> **username_2**: how would finding the xpub allow you find all other private keys?  
> **username_0**: I invite you to consult this post where everything is much better explained than I could do. https://bitcoin.stackexchange.com/questions/56916/derivation-of-parent-private-key-from-non-hardened-child?noredirect=1&lq=1  

---

## 1 answers

### Answer by username_3 on 2022-08-26. Score: 1 | Accepted answer

From what you've stated, there is no way to recover those private keys.

Bitcoin Core's wallet does not store xpubs, or even xprvs. It derives the private keys as needed from the seed. Furthermore, for the type of wallet you are using, Bitcoin Core uses exclusively hardened derivation, so the vulnerability you are referring to does not apply.

Additionally, it sounds like your wallet is in a state that should not occur. The wallet encryption for Bitcoin Core was specifically written to avoid having both encrypted and unencrypted data in the wallet. If encryption fails, it's supposed to crash which should force the database to revert to its previous state with nothing encrypted. It may be that you are looking at only the database file and not also with the database journal which can contain additional data (although it's supposed to be that the journal contains the encrypted data and the db only what is committed, and if it crashed, then the data was not committed).

However if you are looking at the database with it's journal, then you might also be looking at it in the uncommitted state and unencrypted keys are not actually deleted, just hidden as they are marked for deletion, but not yet actually deleted.

> **Comments:**
> **username_0**: Thank you Andrew for taking the time to answer my questions so precisely, I do not have the database of this wallet having no knowledge of cryptographic blockchain at the time. The branch paths are m/0'/0'/n+'. The software version was 0.18. The wallet crashed because there was a maxrpctime argument of 10 seconds I think. I found the tool https://gist.github.com/fivepiece/e3293733d99c4935332f8c5959d7472b  
> **username_0**: I had another wallet.bak in the directory, and the encrypted mkey matches that wallet in my main wallet.dat. It is as if the two wallets had merged. I will look for another solution and try to find out why some keys are not uncrypred. I saw that it was impossible to find the masterkey (Key) with all the other informations (IV, cipher, plain text) in AES-256-CBC. I am not optimistic about recovering the wallet. But again thank you for answering with all your knowledge  

---

