My first thought was that it wasn't possible to change the secondary password on your account. (It isn't possible, for example, to change your main password on a Blockchain.info account). That would be comforting (in a sense) because it would mean that a hacker had not changed your secondary password. Instead, you likely forgot your secondary password.
To be honest, I still think that's the most likely scenario. Here's why: to change your secondary password the hacker would have to know both your main password AND your (old) secondary password.
Here's the process they would have to follow:
- They would first login with your Wallet ID and main password
- Then, they would have to REMOVE your secondary password. (There is no "change password" option). Before you can remove a secondary password you have to enter the secondary password.
- Then, they could create a new secondary password that you don't know
If the hacker knew both your main password and your secondary password why not just send all of your Bitcoin to an address that they control? (You could imagine scenarios wherein a hacker might do this -- perhaps they are asking you to send 1/2 your balance in return for the secondary password, thinking that this breaks fewer laws. However, they presumably have contacted you if that's the case.)
That doesn't really solve your problem: you still need to crack your secondary password.
Now, let's talk about the best way to crack your secondary password. Since it is unlikely that a hacker has changed your secondary password, the likelihood is that the actual secondary password is very similar to what you expected that it was. (Does that make sense?) Let's imagine that when you created the secondary password you created it as: s3cret. However, when you went in to send Bitcoin and were prompted for your secondary password, you actually typed: secr3t
Your password guess is very close, you just need to run a bunch of variations on it. Here's an article that provides a systematic approach to finding and testing those password guesses: https://cryptoassetrecovery.com/blog/recover-lost-blockchain-password/
Hope it helps!
Take care,
Chris