Forgotten Password on Blockchain.info Web Wallet: 0.22 BTC Inaccessible
IndeterminateWallet passphrase was unavailable — whether access was ultimately recovered is not known.
In October 2014, a Bitcoin Forum user (findftp) sought technical assistance for a friend who had lost access to a Blockchain.info wallet containing 0.22 BTC (approximately $110–$150 USD at the time). The friend had forgotten the password protecting the wallet and had not created an export backup of the encrypted wallet file, though the wallet identifier—a UUID-based reference—remained known.
Blockchain.info operated as a custodial web wallet service, storing encrypted wallets on their servers and providing browser and mobile (iPhone) access. The platform used client-side AES encryption with the user's password as the key. Critically, Blockchain.info did not store passwords and offered no password reset mechanism—a deliberate architectural choice documented publicly. This design eliminated any recovery path through the platform itself.
The friend's password appeared to be weak and memorable (colloquially described as "easy"), suggesting it may have been a simple combination of words and numbers. No contemporaneous record of the password existed, and no encrypted wallet backup had been exported to an offline location.
Community responses from experienced developers (particularly btchris, creator of the btcrecover tool) explained the technical recovery pathway: the wallet identifier was merely a database reference; the actual encrypted wallet.json.aes file could be downloaded from Blockchain.info using that identifier, then subjected to offline brute-force decryption using tools like John the Ripper (with GPU acceleration) or btcrecover (a Python-based password recovery utility). The original poster tested both tools on known test cases and reported successful decryption within 30 seconds on simple passwords like "house23tree1." He proposed attempting brute-force recovery with a 50% bounty split and mentioned considering paid recovery services if automated tools failed.
No final outcome was documented in the thread. The case remained unresolved, with 0.22 BTC status unknown—either recovered through successful password cracking or permanently lost.
| Stress condition | Passphrase unavailable |
| Custody system | Exchange custody |
| Outcome | Indeterminate |
| Documentation | Partial |
| Year observed | 2014 |
| Country | unknown |
Why passphrases fail years after they are set
The failure mode documented consistently across observed cases is temporal: the passphrase is set with confidence, not used for an extended period, and then cannot be reproduced exactly when needed. A single character difference — different capitalization, an added space, a slightly different special character — produces a different wallet with a zero balance. The holder may be certain they remember the passphrase while being unable to produce the exact string that was originally set.
What makes this particularly difficult is that there is no signal at the moment of failure. A wrong passphrase does not produce an error message. It opens an empty wallet. The holder sees a zero balance and typically concludes the passphrase was wrong — but without knowing which part was wrong, or by how much.
Professional passphrase recovery services can attempt permutations when the holder has partial information: they remember the general structure, typical patterns they use for passwords, the approximate length, or that it included a specific word. Recovery from total non-recollection is not feasible.
The preventive action is to store a passphrase record — not with the seed phrase, which would defeat its security purpose, but in a separate secure location accessible to the holder and potentially a designated recovery person. A passphrase that exists only in memory has a time horizon: it will eventually be forgotten, and the timing is unpredictable.
Translate