Forgotten Blockchain.info Password: 0.22 BTC Recovery Attempt via Brute-Force
IndeterminateWallet passphrase was unavailable — whether access was ultimately recovered is not known.
In October 2014, a BitcoinTalk forum user (findftp) posted on behalf of a friend who had lost the password to a Blockchain.info web wallet containing 0.22 BTC (worth approximately $110–130 at the time). The friend retained knowledge of the wallet identifier but had no backup of the encrypted wallet file and no access to the account.
Blockchain.info's architecture stored encrypted wallet files on company servers and used client-side password encryption for the private keys; critically, the platform did not offer password reset functionality and did not store plaintext passwords. This design meant that password loss equaled permanent account lockout unless the password could be recovered through computational means. The user obtained the encrypted wallet.
aes.json file via Blockchain.info's API using a Python command-line tool. Community members and a developer (btchris, GitHub: gurnec) advised two recovery paths: John the Ripper (bleeding-jumbo version with GPU acceleration) and btcrecover, a Python tool purpose-built for cryptocurrency wallet password recovery.
The user tested both approaches on dummy wallets with weak passwords ('house23tree1'), successfully cracking one within 30 seconds using btcrecover's token file method. On October 9, 2014, the user began brute-forcing the actual wallet file on a laptop without GPU acceleration. The final visible post (October 9, 8:28 PM) showed the attack still running with no resolution. The thread does not disclose whether the password was ultimately recovered, the timeframe if successful, or the final disposition of the 0.
22 BTC. This case exemplifies custody failure on a custodial platform where technical recovery is theoretically possible but operationally uncertain and undocumented.
| Stress condition | Passphrase unavailable |
| Custody system | Exchange custody |
| Outcome | Indeterminate |
| Documentation | Partial |
| Year observed | 2014 |
| Country | unknown |
Why passphrases fail years after they are set
The failure mode documented consistently across observed cases is temporal: the passphrase is set with confidence, not used for an extended period, and then cannot be reproduced exactly when needed. A single character difference — different capitalization, an added space, a slightly different special character — produces a different wallet with a zero balance. The holder may be certain they remember the passphrase while being unable to produce the exact string that was originally set.
What makes this particularly difficult is that there is no signal at the moment of failure. A wrong passphrase does not produce an error message. It opens an empty wallet. The holder sees a zero balance and typically concludes the passphrase was wrong — but without knowing which part was wrong, or by how much.
Professional passphrase recovery services can attempt permutations when the holder has partial information: they remember the general structure, typical patterns they use for passwords, the approximate length, or that it included a specific word. Recovery from total non-recollection is not feasible.
The preventive action is to store a passphrase record — not with the seed phrase, which would defeat its security purpose, but in a separate secure location accessible to the holder and potentially a designated recovery person. A passphrase that exists only in memory has a time horizon: it will eventually be forgotten, and the timing is unpredictable.
Translate