Part of the CustodyStress archive of observed Bitcoin custody incidents
Mobile or software wallet
Cases in this category involve mobile apps and desktop software wallets. Recovery depends entirely on whether a seed phrase backup was made and stored independently of the device.
Mobile and software wallets are the most frequently observed custody system in this archive, reflecting their widespread use. The structural risk is consistent: where a seed phrase backup was created and stored independently of the device, recovery was possible. Where no backup existed, loss of the device meant permanent loss of access.
572 observed cases
Blocked
405 (71%)
Constrained
44 (8%)
Survives
118 (21%)
Indeterminate
5 (1%)
The wallet app had no PIN protection separate from the device lock.
Mobile or software wallet
A user who kept their Bitcoin wallet on a smartphone left the device in a taxi. By the time they reported the loss, the device had been factory-reset and resold
Estate access failure — software wallet (2017)
Mobile or software wallet
An early Bitcoin adopter died in April 2017 with no estate planning that mentioned cryptocurrency. The estate found references to Bitcoin in old emails but no w
Passphrase unavailable — software wallet 2017
Mobile or software wallet
A user who had set their Armory wallet passphrase to the name of their first pet combined with a number found in April 2017 that they could not remember whether
By 2017 they could not fully reconstruct the algorithm from memory.
Mobile or software wallet
A software engineer used a self-written key-stretching algorithm to generate a wallet passphrase in 2013. By 2017 they could not fully reconstruct the algorithm
The victim transferred approximately 15 BTC before the attackers were identified
Mobile or software wallet
A prominent Bitcoin trader was targeted in May 2017 by attackers who had identified their holdings from public social media posts. The attackers obtained the tr
A developer had their laptop stolen from a coffee shop in May 2017.
Mobile or software wallet
A developer had their laptop stolen from a coffee shop in May 2017. The machine contained the only copy of a wallet holding Bitcoin accumulated through developm
Device lost — software wallet 2017
Mobile or software wallet
A Bitcoin user stored their wallet backup exclusively on a cloud service that suffered a data loss incident in May 2017. The service provider acknowledged the l
By 2017 they could recall only approximate phrasing.
Mobile or software wallet
A forum post from May 2017 describes a user who set their passphrase to a line of poetry they had written themselves in 2012. By 2017 they could recall only app
Seed unavailable — software wallet (2017)
Mobile or software wallet
A user who encrypted and stored their BIP39 seed phrase as a file in cloud storage found in May 2017 that the cloud account had been compromised and all data de
The USB drive's NAND flash was damaged and could not be read.
Mobile or software wallet
A Bitcoin user who had stored their wallet backup on a USB drive kept in a drawer found in June 2017 that the drawer had been exposed to a strong magnetic field
The service was acquired and shut down in early 2017, deleting all user data.
Mobile or software wallet
A forum case from June 2017 describes a user who had encrypted their wallet with a passphrase they stored only in an online note-taking service. The service was
Passphrase unavailable — software wallet 2017
Mobile or software wallet
A user whose wallet passphrase was based on their then-partner's name and a shared memorable date found in June 2017, following the end of the relationship, tha
They discovered the password manager had not synced their latest notes before they
Mobile or software wallet
A user stored their seed phrase in a password manager as part of a secure note. In June 2017 they discovered the password manager had not synced their latest no
Device lost — software wallet (2017)
Mobile or software wallet
A Bitcoin investor sent their old PC to a refurbisher in July 2017 without wiping the drive. The wallet.dat file on the drive contained funds from 2012. The ref
They had used a TOTP code from the YubiKey as the suffix of their passphrase.
Mobile or software wallet
A Bitcoin user who relied on a hardware security key (YubiKey) as part of a passphrase scheme lost the YubiKey in a move. They had used a TOTP code from the Yub
Passphrase unavailable — software wallet 2017
Mobile or software wallet
A forum post from July 2017 describes a user who had used a combination of their blood type and a childhood pet's name as a passphrase. Medical records were che
The attacker used the SIM swap to bypass 2FA on the victim's exchange account
Mobile or software wallet
An August 2017 documented incident describes a Bitcoin holder SIM-swapped by an attacker who had obtained their phone number from an exchange data breach. The a
Device lost — software wallet 2017
Mobile or software wallet
A Bitcoin holder whose primary wallet was on an older Android phone found in August 2017 that the phone had been permanently damaged by water while at the beach
Passphrase unavailable — software wallet 2017
Mobile or software wallet
A user who had used a combination of two foreign language words as their passphrase found in August 2017 that they had forgotten which language or which words.
Passphrase unavailable — software wallet 2017
Mobile or software wallet
A Bitcoin investor who had generated a high-entropy passphrase using a dice-rolling method in 2013 could not locate their character conversion table in August 2
The wallet had been stored in the user's home directory without a Time Machine backup
Mobile or software wallet
A Bitcoin investor's MacBook failed in September 2017 due to a GPU failure that also corrupted the SSD. Apple confirmed the SSD was unrecoverable. The wallet ha
Passphrase unavailable — software wallet (2017)
Mobile or software wallet
A September 2017 forum case describes a retired teacher who had set a wallet passphrase in 2014 and recorded it in code in the margin of a book. When they retri
Seed phrase unavailable — software wallet 2017
Mobile or software wallet
A forum user reported in September 2017 that they had their 24-word seed tattooed on their body in a private location, using modified spellings to obscure each
Destroyed in flood — software wallet (2017)
Mobile or software wallet
An early Bitcoin miner's old desktop computer, which had sat powered off in a storage unit since 2013, was discovered in October 2017. The storage unit had floo
A forum case from October 2017 describes a user whose phone was stolen during a mugging.
Mobile or software wallet
A forum case from October 2017 describes a user whose phone was stolen during a mugging. The thief was able to bypass the phone's PIN using a known Android vuln
Translate