Blockchain.com Wallet Locked: Partial Recovery Phrase and Lost Secondary Withdrawal Password
IndeterminateWallet passphrase was unavailable — whether access was ultimately recovered is not known.
In September 2020, a BitcoinTalk user identified as sa14 reported complete inability to access a Blockchain.com wallet created on November 29, 2017, despite possessing multiple authentication factors. The wallet held Bitcoin and Ethereum holdings of undisclosed amount. The user had retained the main wallet password, email address, mobile phone number, and active Google Authenticator two-factor authentication.
However, Blockchain.com's platform required a secondary password—distinct from the main login password—to authorize cryptocurrency withdrawals. This secondary password had been lost. The user's 12-word BIP39 recovery phrase had been partially backed up: 8 words were recorded in a physical notebook, but the remaining 4 words had been written on a subsequent page that was torn and discarded by the user's child.
When the user attempted to regain access via the recovery phrase restoration mechanism at login.blockchain.com/#/recover, the incomplete phrase (8 of 12 words) was rejected. Contact with Blockchain.
com support yielded a clear architectural explanation: password recovery was impossible due to client-side encryption design, explicitly stated as "not a matter of policy" but inherent to the system's cryptography. Support offered no alternative recovery path. Community members on BitcoinTalk suggested using the btcrecover tool with seedrecover.py to brute-force the 4 missing words—a computationally feasible task (2048^4 ≈ 1.
1 trillion combinations) if the wallet's extended public key (xpub) or known addresses were supplied as verification reference. No subsequent posts confirmed whether brute-force recovery was attempted or succeeded, leaving the case outcome unknown.
| Stress condition | Passphrase unavailable |
| Custody system | Exchange custody |
| Outcome | Indeterminate |
| Documentation | Partial |
| Year observed | 2020 |
| Country | unknown |
Why passphrases fail years after they are set
The failure mode documented consistently across observed cases is temporal: the passphrase is set with confidence, not used for an extended period, and then cannot be reproduced exactly when needed. A single character difference — different capitalization, an added space, a slightly different special character — produces a different wallet with a zero balance. The holder may be certain they remember the passphrase while being unable to produce the exact string that was originally set.
What makes this particularly difficult is that there is no signal at the moment of failure. A wrong passphrase does not produce an error message. It opens an empty wallet. The holder sees a zero balance and typically concludes the passphrase was wrong — but without knowing which part was wrong, or by how much.
Professional passphrase recovery services can attempt permutations when the holder has partial information: they remember the general structure, typical patterns they use for passwords, the approximate length, or that it included a specific word. Recovery from total non-recollection is not feasible.
The preventive action is to store a passphrase record — not with the seed phrase, which would defeat its security purpose, but in a separate secure location accessible to the holder and potentially a designated recovery person. A passphrase that exists only in memory has a time horizon: it will eventually be forgotten, and the timing is unpredictable.
Translate