Part of the CustodyStress archive of observed Bitcoin custody incidents
CS-01195
Thomas holds 7,002 BTC (worth approximately $244 million at the time) on the drive
IndeterminateCase description
On 25 October 2023, crypto recovery firm Unciphered published an open letter to former Ripple CTO Stefan Thomas, claiming to have developed a method to bypass the IronKey S200's 10-attempt password limit. Thomas holds 7,002 BTC (worth approximately $244 million at the time) on the drive, stored in a Swiss vault, and had used 8 of his 10 allowed password attempts since 2011. Unciphered demonstrated their technique to Wired magazine using 200 trillion brute-force attempts on an identical device model. Thomas declined the offer, citing an existing handshake deal with two other recovery teams made a year prior.
Custody context
| Stress condition | Passphrase unavailable |
| Custody system | Hardware wallet (single key) |
| Outcome | Indeterminate |
| Documentation | Unknown |
| Year observed | 2023 |
| Country | Switzerland |
Structural dependencies observed
What this illustrates
The seed phrase was there, but the passphrase that unlocked it was gone. Both are required. It's not clear whether anyone ever regained access.
Outcome interpretation
Not enough information is available to determine the outcome.
Source
Publicly Reported
Evidence type
News article
Related cases involving passphrase unavailable
217 cases involve passphrase unavailable
274 cases involve hardware wallet (single key)
View archive statistics →
This archive documents observed custody survivability failures. It does not attempt to document all Bitcoin losses or security incidents.
Submit a case
← All cases
Framework references
Where Bitcoin Custody Intersects Legal and Fiduciary Authority
Where custody creates gaps in estate planning, fiduciary duty, and professional responsibility.
Professional Scope Boundary Matrix
What each professional or product covers, what they do not, and where gaps form between them.
The Independent Assessment Layer in Bitcoin Custody
How independent diagnostic layers emerge when multiple parties depend on shared infrastructure.
Translate