When a client named Rusty contacted cryptocurrency recovery specialist Chris Brooks in 2021, he claimed that he had won 5,000 Bitcoin in a lawsuit — worth around $53 million at the time. Three people on a Zoom call showed a phone displaying a Bitcoin address containing that amount. They said they could withdraw up to $300,000 per week, but wanted to access the entire fortune at once. If Brooks and his son Charlie flew to Georgia to help crack the wallet, they would become millionaires. Brooks bought tickets and flew out the next day. Over lunch, Rusty, a 6-foot-3 Army veteran, pulled out his phone and showed them another billion dollars in ETH. Brooks realized that something very strange was going on. The men drove to a shopping center owned by one of them, where, in a back office, they were handed notebooks containing dozens of recovery seed phrases. The pair spent the day opening wallets. They found around $10 in Bitcoin. Brooks never established whether those wallets had previously contained the BTC or ETH Rusty claimed they did. Their travel expenses were never reimbursed. Brooks now suspects that Rusty had fallen victim to scammers who convinced him that he owned a large crypto fortune when, in reality, he did not.
Key fact: Recovery specialists do not crack the blockchain — they recover the information needed to access an existing wallet. A lost password or seed phrase does not mean the cryptocurrency has disappeared — but sometimes the money was never there in the first place.
For wallet recovery specialists, "lost cryptocurrency" can mean several very different things. They do not recover Bitcoin from the blockchain — they recover the information needed to access a wallet that already exists. While someone may have thrown away a hardware wallet, forgotten a password or lost part of a seed phrase, none of these events necessarily means that the underlying cryptocurrency is gone. Bruno Krauss, co-founder and CTO of recovery firm ReWallet, explains: "If you have a few missing words, you can often recover them." The BIP39 standard for Bitcoin seed phrases uses a list of 2,048 words, meaning that if someone knows most of the words, specialists can sometimes systematically search through the remaining possibilities. The fewer pieces that are missing, the more manageable the puzzle becomes.
Password recovery can work in much the same way. Krauss says ReWallet once recovered a 20-character password protecting approximately $3 million after reverse-engineering a flawed password generator. Other cases depend less on technical exploits than on understanding how a particular person creates passwords. This means asking clients about personal preferences such as favorite foods and places, children's names and birthdays, personal milestones or memories. In one case, he says, a client was certain she had used her children's names, only to remember that the password was actually a phone number associated with a local delivery service: "She didn't know why, but then she thought about it and realized, oh, okay, it was because on that day I had a package delivered to the store, and I thought, okay, this will be a good password."
Bennett, a Bitcoin educator who has studied wallet security, says there is another particularly confusing category: the passphrase. A passphrase is an additional piece of information layered on top of the seed. Enter a different passphrase and you do not necessarily get an error message. You may simply get a different valid wallet. He tells Magazine: "An incorrect passphrase doesn't throw an error; it succeeds and shows you a zero balance." This means you can have the correct seed phrase and enter it correctly, yet still think your BTC has disappeared. "Passphrases also don't have any features to protect users from themselves; there's no list of 2,048 valid words, no checksum. So if you forget the passphrase, it's basically the same question again: how random was your passphrase? If it's random enough, there's often no way to recover it." With lost or broken hardware wallets, even having the damaged device does not always help much. If the wallet's backup seed phrase survives, the keys can usually be restored on another device. That is why recovery specialists do not necessarily need the original hardware, but rather enough information to restore access to the keys. Recovery can also mean fixing mistakes rather than restoring a lost wallet. Cryptocurrency sent to the wrong blockchain, for example BNB sent to Ethereum, can sometimes be recovered if the receiving wallet is under the user's control. Brooks says Crypto Asset Recovery has contracted to crack more than 3,000 wallets belonging to around 1,500 people and has cracked passwords for approximately 63% of them.
There is, however, a hard limit. Bennett says: "If your seed is truly random and you've lost it completely, your Bitcoin is gone." This is one of the fundamental trade-offs of self-custody. A Bitcoin wallet has no bank-style recovery system or central administrator who can verify your identity and restore your account. Lucien Bourdon, a Bitcoin analyst at hardware wallet maker Trezor, puts it even more bluntly. If the wallet backup is lost and the wallet containing the keys is inaccessible, "no recovery company can help." He warns: "If they could, the wallet could be hacked, and self-custody would be fundamentally compromised." Thanks to randomness, crypto wallets make guessing a private key effectively impossible. In a recent case involving the Coldcard Bitcoin hardware wallet, a firmware bug weakened seed randomness on some wallets, making the seeds brute-forceable without physical access.
But if a genuinely random seed or private key has been completely destroyed, the number of possibilities is simply too large. Krauss says recovery specialists can sometimes find technical ways into wallets that owners believed were permanently inaccessible, and that old wallet software, corrupted files, poorly generated passwords and hardware vulnerabilities can all create unusual opportunities: "Don't give up on edge cases." Recovery specialists can also sometimes be scammers. There is an uncomfortable irony in the recovery business. A person who can help you regain access to your cryptocurrency needs the very information that gives someone access to it. A seed phrase is not like a password that can be changed after someone has seen it. Anyone who possesses the necessary wallet backup can often control the funds. This makes choosing a recovery specialist a security decision in itself. Bourdon says: "If you decide to do it, do your homework. Look for firms with a real track record and reviews you can trace back to real clients. Check that they charge for success, not upfront. And move your funds to a fresh wallet with a new backup as soon as you get back in."
He says users should also beware of any unsolicited messages claiming that someone can recover their funds. Krauss says other warning signs include people pushing users onto WhatsApp or contacting them from personal email addresses such as Gmail, demanding upfront payments or asking them to open accounts on an exchange. Recovery firms that take a percentage of successfully recovered funds are not unusual; but paying money upfront to someone promising to recover a wallet should raise alarm bells. Brooks learned another lesson from the Rusty case. Although crypto recovery may sound like a technical job, a person who believes they are sitting on millions or billions of dollars can also pose a security risk. Crypto Asset Recovery no longer flies out to meet clients in person as it did with Rusty. The company now handles cases remotely, with sensitive wallet information processed through automated and air-gapped systems. Brooks says around 71% of the wallets they crack contain less than $100, and the company does not charge a fee for asset recovery below that amount. If there is one thing he wishes crypto users understood about asset recovery, it is: "Learn what recovery seeds are and why they're important. It's the easiest way to make sure you never have to talk to us."
Critical limitation: If a seed is truly random and completely lost, the cryptocurrency is gone forever. This is a fundamental trade-off of self-custody — there is no bank or administrator that can restore access based on proof of identity.
Choosing a recovery specialist is a security decision that requires careful verification. A seed phrase provides full control over funds, and sharing it with anyone creates significant risk. Scammers often pose as recovery experts, promising to restore access to wallets in exchange for an upfront payment, then disappearing with the information or stolen funds. Bourdon from Trezor emphasizes the importance of due diligence: look for firms with a verifiable track record, read reviews from real clients, make sure the company charges a percentage-based fee only after successful recovery rather than demanding upfront payments. Legitimate recovery firms typically work on a contingency basis — they receive payment only if they succeed in restoring access.
Warning signs include unsolicited contact through social media or email, demands to transfer funds to a "safe" wallet for "verification," the use of personal communication channels such as WhatsApp instead of secure platforms, and pressure to make quick decisions without proper verification. Brooks from Crypto Asset Recovery changed his business model after the Rusty case — the company no longer meets clients in person, handling all cases remotely through automated and air-gapped systems to minimize security risks. Around 71% of the wallets they crack contain less than $100, and the company does not charge a recovery fee below that threshold, reflecting the economic reality of recovery work — complex technical efforts are often not justified for small amounts.
Rusty's story and the experience of recovery specialists offer several critical lessons for crypto users. The first and most important: understand what a recovery seed is and why it is critical. A seed phrase is the only way to restore access to a wallet if the hardware device is lost or broken, or the password is forgotten. Brooks puts it simply: "Learn what recovery seeds are and why they're important. It's the easiest way to make sure you never have to talk to us." Proper backup practices include storing the seed phrase in several secure locations, using fireproof and waterproof containers, and never storing the seed in digital form or online.
The second lesson: beware of too-good-to-be-true claims about crypto fortunes. Rusty's story demonstrates how scammers can convince victims that they have massive crypto holdings when those holdings do not exist. This creates a psychological vulnerability that recovery scammers exploit by promising to "unlock" these imagined fortunes for a fee. The third lesson: if you need a recovery specialist, conduct thorough due diligence. Check credentials, read independent reviews, make sure fee structures are transparent, and never provide the full seed phrase before verifying the firm's legitimacy. The fourth lesson: understand the technical limitations of self-custody. If the seed is completely lost and there is no backup, the funds are gone forever — this is a feature, not a bug, providing security through the impossibility of unauthorized access, but it also means that the user bears full responsibility for backup management.
Preventive principle: The best way to avoid needing a recovery specialist is proper seed management from the beginning. Store backups in several secure physical locations, never in digital form, and regularly verify that you can restore access.
The crypto recovery industry remains a niche but important service for users who have lost access to their funds. Success rates vary — Crypto Asset Recovery reports a 63% success rate for cracking passwords, but this number does not include cases where the seed was completely lost or the funds had been moved before the company was contacted. The economic viability of recovery work depends on asset values — complex technical efforts to brute-force passwords or analyze corrupted wallet files are justified only for significant holdings. For the majority of users, prevention through proper backup practices remains vastly more effective and less costly than relying on recovery services after losing access. Rusty's story serves as a reminder that in crypto, as in life, if something sounds too good to be true — perhaps it simply does not exist.
“In the world of self-custody, you are your own bank, support service and security team. Losing your seed phrase is not a technical problem, but a fundamental limitation of the system that makes prevention the only reliable strategy.”
— Andreas Antonopoulos, Bitcoin educator and author
