13.8 BTC Lost to Forgotten Wallet.dat Password: DIY and Professional Recovery Attempts
IndeterminateWallet passphrase was unavailable — whether access was ultimately recovered is not known.
A Bitcoin user created an encrypted Bitcoin Core wallet in 2013 containing 13.8 BTC. The passphrase was forgotten, rendering the wallet inaccessible. In September 2019, the original poster (username lankymanx) initiated a public forum thread requesting assistance with password recovery. At that time, Bitcoin had appreciated significantly; 13.8 BTC represented approximately $96,600–$124,200 at prevailing prices of $7,000–$9,000 per coin.
The user attempted DIY recovery using btcrecover, an open-source Python utility designed for brute-force password cracking against encrypted Bitcoin wallets. Community members provided detailed technical guidance on configuring regex expressions, token files, and command-line syntax required to execute custom character set and password length attacks. This approach required substantial technical literacy and carried no guarantee of success within a reasonable timeframe.
By November 2019, the original poster engaged Wallet Recovery Services, a commercial password recovery firm operated by an individual known as 'Dave.' The service charges a 20% recovery fee, deducted from recovered funds. A corroborating account from another forum user (UAE Seasider) documented successful recovery of 12.5 BTC through the same service, with password cracking requiring approximately three weeks.
The blockchain record for the original address shows no outbound transaction activity, indicating either unsuccessful password recovery or successful recovery with subsequent transfer to an undisclosed address. The case remains unresolved in public documentation. This incident reflects the persistent risk of single-passphrase dependency in self-custody Bitcoin holdings and the emergence of commercial password recovery services as a fallback option.
| Stress condition | Passphrase unavailable |
| Custody system | Software wallet |
| Outcome | Indeterminate |
| Documentation | Partial |
| Year observed | 2013 |
Why passphrases fail years after they are set
The failure mode documented consistently across observed cases is temporal: the passphrase is set with confidence, not used for an extended period, and then cannot be reproduced exactly when needed. A single character difference — different capitalization, an added space, a slightly different special character — produces a different wallet with a zero balance. The holder may be certain they remember the passphrase while being unable to produce the exact string that was originally set.
What makes this particularly difficult is that there is no signal at the moment of failure. A wrong passphrase does not produce an error message. It opens an empty wallet. The holder sees a zero balance and typically concludes the passphrase was wrong — but without knowing which part was wrong, or by how much.
Professional passphrase recovery services can attempt permutations when the holder has partial information: they remember the general structure, typical patterns they use for passwords, the approximate length, or that it included a specific word. Recovery from total non-recollection is not feasible.
The preventive action is to store a passphrase record — not with the seed phrase, which would defeat its security purpose, but in a separate secure location accessible to the holder and potentially a designated recovery person. A passphrase that exists only in memory has a time horizon: it will eventually be forgotten, and the timing is unpredictable.