Topic: Diving into an old BTC wallet from ~2014 and found a nice surprise - what next? (Read 484 times)

Update: I've exhausted all possible avenues for any further BTC recovery, of that I'm certain

On LoyceV's advice, I did spend time in recent days claiming my various BTC forks, which means I now own ~0.5 in each of BCH, BSV, BTG and BCHA

For anyone who happens to discover this thread in future, please do follow Loyce's guide here - the original post is a little outdated in terms of which currencies are worth pursuing, but much of it still holds up. If you can tolerate a few hours of tinking with various wallets, it might be well worth your time: https://bitcointalksearch.org/topic/loycevs-bitcoin-fork-claiming-guide-and-service-2836875

You guys are amazingly helpful, thank you. I'll update back in here when I can. Cheers

You'll find the "bitcoin-wallet.exe" in the same location as "bitcoin-cli.exe" and "bitcoind.exe" etc... on Windows, if you have used the Bitcoin Core Windows installer, that should be:

So, using "Command Prompt" (press the Windows key, then type: "cmd"  You should see "Command Prompt", then press enter)... you should be able to enter the follow commands, one at a time:

Couple of notes:
- Make a backup (or three) of your wallet file BEFORE you attempt to use the salvage... it makes permanent changes to the wallet file!
- If your bitcoin datadir is NOT the default location (ie. you set a custom location when running Bitcoin Core for the first time), you'll need to use the -datadir option as well (you can find the datadir in Bitcoin Core GUI under "Window -> Information")

You probably already know how to install Python 2 (this is important as Python 3 support is experimental) and clone pywallet from Github, so assuming you already done that, it doesn't need any programming knowledge to run.

Enter the pywallet folder first within a terminal, and then run python pywallet.py  --recover --recov_device=PATH/TO/wallet.dat --recov_size=100kB --recov_outputdir=/folder/to/place/recovered/wallet.dat. What this does is that it reads the wallet file specified by --recov_device, tries to reconstruct the wallet from the first --recov_size bytes and places the recovered wallet file in the --recov_outputdir folder using the name recovered_wallet_CURRENTTIMESTAMP.dat (CURRENTTIMESTAMP is replaced by the the time right now represented as an integer).

Note: the "B" in the size has to exactly be uppercase, and the "k" lowercase to represent kilobytes, or it won't be recognized and will throw an error.)

It will prompt you to set a password for the newly recovered wallet.dat.

Generally, wallet.dat files are only a few dozen kilobytes large so using 100kB size ensures that you can recover wallets with large numbers of private keys inside.


btcoin-wallet is also very easy to use, you just pass the name of one of your wallet files in your datadir using -wallet=WALLET_NAME, and then there's a few commands you can type after -wallet and the other options that are listed in its help text:


So the full command to run is bitcoin-wallet -wallet=WALLET_NAME salvage.

edit: typo

Yeah. I started looking into how to use PyWallet, but as a total Python noob who hasn't coded in any language in quite a few years, I soon became overwhelmed and discouraged.

Is there a straightforward guide to using PyWallet? All the stuff I unearthed online is aimed at a much more Python-savvy audience than someone like me... I would like to invest the time in understanding it, but the nature of my life at present is that I only have an hour here and there, and very few chances to sit at the PC for an extended period and really put my mind to learning something new. Sad, maybe, but that's my reality for now.

This is another dumb question perhaps, but how do I actually use bitcoin-wallet? It doesn't appear as a command line option in Bitcoin Core itself. Is there a non-GUI way I should be accessing it? I understand it's an offline tool, which I take to mean it doesn't need to sync the blockchain, but I'm clueless as to where to type those commands to interact with it. Any help appreciated.

So with a fully synced Bitcoin Core... and a fully rescanned wallet, it shows a balance but then says "0/unconfirmed, not in memory pool" if you try and send a transaction? Or are you getting that if you just open the wallet.dat file and try to send coins?

If the latter, then it's likely because the wallet itself isn't "synced"... so you're attempting to send coins which no longer exist... the transaction will be rejected and you'll end up with the "not in memory pool" type error.


That would tend to indicate that the wallet is actually empty... and the balances you're seeing when you first open were accurate when the wallet was last used, but the coins have since been spent and therefore, the wallet balance is actually zero.


Generally, that doesn't end well PyWallet might be able to recover something

The old salvagewallet option has been removed from the "core" Bitcoin Core app... so you can't use the -salvagewallet commandline argument with bitcoind or bitcoin-qt anymore... instead, it looks like there is a "bitcoin-wallet" (or "bitcoin-wallet.exe") that is now bundled with Bitcoin Core that you can use and the command is now salvage:

Belated response: yes, the resynced wallet eventually caught up with my transaction history, and thus reported zero balance. Although interestingly when I loaded the next most recent wallet backup (created a month after the original file mentioned in OP) it began showing an "available balance" exactly the same as the ~0.5BTC sum mentioned earlier in this thread.

Any attempts to perform a test transaction to move a fraction of that amount show the same "0/unconfirmed, not in memory pool" message that I reported earlier in this thread, with the earlier wallet.dat file. I've run -dumpwallet and swept the keys into a new Electrum wallet, per the process mentioned earlier in this thread, which yielded nothing - just ~140 lines resulting in "no inputs found" in Electrum. (From reading further forum posts around that Electrum message just now, I have not yet tried the -listunspent command in that wallet, so I'll try it once that wallet finished rescanning.)

With the synched blockchain on my HDD, I've also been using Bitcoin Core to run through various other old wallet.dat files backed up more recently than the original file, and they're all empty too. Looks like I'm coming to the end of my historical treasure hunt... although one file (created in late 2015) is showing a message when I try to load it which ends: "...wallet is corrupt. Try using the wallet tool bitcoin-wallet to salvage or restoring a backup."

I've done a little research around that error message and will soon try a few things to investigate further. I doubt it'll result in any further BTC discoveries, but of course I want to be thorough here. Feel free to make any suggestions re that particular error message if you're familiar with it. And thanks for taking the time to read and reply to this random thread.

I have indeed seen such an error message in the past.

And is it showing any transaction history?

If you can see all the "ins" and "outs", you might be able to figure out where all the BTC went... and when.

Definitely no warning shown, and I downloaded the newest version of Bitcoin Core available. Might be an oversight from the developers, or maybe I'm the first idiot to have come across this self-inflicted error!

Blockchain is at 87% synced, with ~37,000 blocks remaining, and it should be done by this time tomorrow. Maybe.

To your other point: the wallet is showing an available balance of zero in the background, while resyncing.

Interesting, I was certain that Bitcoin Core displays an error/warning if you load an old wallet into a "pruned" node warning that it may not be displaying the correct history/balance etc... although I might be confusing it with the warning you get if you "unload" a wallet.


You may not even need to wait that long... if you have the wallet loaded now (while it is syncing)... it will find the transaction history as it goes along processing blocks. So, once you get past the 2015 blocks (when you think you stopped using the wallet), it should show the "correct" balance.

Obviously, that may not be the case if the wallet was used after that time.. but hopefully, you'll be able to see the transaction history/balance updating as it syncs... which should give you some idea of what happened to the coins.

In any case, once it has finished syncing fully, you can be fairly certain that the balance showing is "true and correct".

Yes, I'm in the midst of that painful process at the moment. But I've decided to turn off prune mode so that I can more easily check my other old wallets against the whole blockchain on my disk, rather than reindexing/rescanning every time. (I should have done this in the first place, rather than pruning, but hey, live and learn.)

Yes, that is what I did. And I think you've just unlocked the mystery of why the ~12BTC "available balance" was showing at all. We shall see what that same wallet shows once my rescan finishes (in ~5-7 days' time). I suspect it'll be zero.

If that's the case, then I guess the learning from this experience - for anyone who somehow finds this thread in the future - is to not do what I did, lest you get your hopes up that you've discovered non-existent BTC

Note that because of this:
Doing a "rescan" is going to be a painful experience for you... Bitcoin Core can't rescan on block data you don't have... you've pruned your wallet, so only the last 2 Gigs worth of blocks (ie. 2020-2021 data) will be available.

So a "rescan", for you, is going to trigger a full redownload of the blockchain!


Question: Did you fully sync Bitcoin Core first... and then load the old wallet.dat? If you loaded the old wallet file after your node had finished syncing, then Bitcoin Core will not have been able to update the wallet transaction history/balance correctly... as you're running a pruned node.

Strangely, no. After I swept keys to Electrum (while keeping Bitcoin Core open), the only transaction that appeared in my history was a small amount (~0.0001 BTC). Otherwise, the bulk of the "available balance" remained unchanged, ie ~12BTC. So yes, it seems a -rescan in order to see how that affects the amount. (After backing up the wallet again, as LoyceV kindly pointed out.)

Thanks for this reminder!

In the past, Bitcoin-qt only created a new private key when it needed one. At some point (and I'm not sure what year) it was upgraded to generate 100 and later 1000 addresses "keypoolsize" upfront, so an older backup wouldn't instantly be outdated.
My guess is those 1000 recently generated keys were meant for this.
That being said: if your current wallet.dat came from a different backup than the latest version you've actually used in 2012-2014, it might not include all your private keys.
And in case you're still going to make any transactions from this wallet.dat: you should make another backup (don't overwrite older backups), because those 1000 addresses are probably not included in your previous backup.

That does make sense if the addresses were only created recently.

Suggestion: turn on Coin Control in Bitcoin Core's settings. Then click "Send" > "Inputs" and see which address holds that balance according to Bitcoin Core. Check that address on a Block explorer.

You may have already did these things but did you try checking through your transaction history to trace in which addresses the remaining 11.5BTC is located, yours or somebody else's? Can Core see the transaction made to Electrum with 0.5BTC? Restarting Core with -rescan option?

If you have swept, or at least tried to sweep, all of the 1000 remaining keys then this wallet's transaction state is out of date and a -rescan will show the true amount. At least to me it sounds like that remaining balance is not there, assuming, again, you swept every key.

That is correct.

This is unlikely because bitcoin core is wise enough to check and update your wallet information as it continues syncing. But let's see what others think who are more familiar with bitcoin core, I'm not the best at it.

Thanks, that is interesting. I've checked a few of the bigger outputs listed under 'listunspent' on Blockchair and they're all at zero.

One other thing that I should have mentioned earlier, perhaps: I am running Bitcoin Core in 'prune mode', ie under Options I've got the checkbox ticked to prune block storage to 2GB rather than the entire ~350GB blockchain

However, my understanding is that using 'prune mode' shouldn't affect the wallet's available balance, as Bitcoin Core still has to go through and verify every historical transaction.

Could it be that the majority of the ~12BTC is caught somewhere in the past, and has actually been spent in 2012-2014 (by me), but for some reason the client thinks it's still available in 2021? How odd...

This can only happen if your node is not fully synced, in your first post you said you've already synced it so this shouldn't have happened.
Try using listunspent to see which outputs does your node thinks are unspent and then check the transaction IDs in your Electrum to see if they all exist in your history tab*. If they don't that means you haven't imported one address with a bigger balance.

* Assuming you have imported those keys in your Electrum, to search in your history tab go to that tab and press ctrl+f and paste the txid in the textbox that appears at the bottom of the window.
* You can also check the txids in a block explorer.

OK, time to provide an update. Thanks to those who have provided thoughts and feedback. I've done a whole bunch of reading since I created this thread, and finally landed on a course of action, which I'll outline below

First, just to be upfront about my original post: when I loaded my old wallet.dat file, my Bitcoin Core client was showing an available balance of about 12 BTC

This is obviously a life-changing amount of money at this time. But rather than getting carried away with early celebrations, I've been extremely cautious throughout this process as that amount seems extremely high, considering how careful I was with buying/trading/handling BTC in the past. Hence my earlier question about whether that amount is a phantom vestige, or actually able to be used/traded/sold.

So to today: after lots of reading, I decided to use 'dumpwallet' command in Bitcoin Core console to dump all wallet keys, with the intention of sweeping into a new Electrum wallet.

Interestingly, the resulting text file shows ~130 lines for the period between 2012 and 2014, and then ~1000 lines for the period in the last couple of days when I've been poking around with the old wallet.dat file, trying to figure out what to do.

After a bit of massaging, I swept those ~130 lines into my new Electrum wallet, which yielded about half a bitcoin. This is not quite the life-changing amount I had seen earlier in my Bitcoin Core available balance, but it's still, as they say, money for nothing in the scheme of things. Nice.

Of that ~0.5BTC, I have sent a small test transaction to a local crypto exchange that I've successfully used previously, and if that test is received, hooray. Good to go with whatever I do next, whether cash out or HODL.

Of the ~1000 recent lines generated by 'dumpwallet', I did a test of the first 50 to see if anything could be swept from those wallet keys. No dice. Electrum returns a 'No inputs found' message.

Here's my next question: while sweeping coins from Core to Electrum, I've kept the Core client running, and the available balance of ~12 BTC has stayed the same. Even while my Electrum client is showing a confirmed balance of ~0.5BTC

What do you think is causing Bitcoin Core to show that available balance? Is it "confused" or caught up in a transaction history that... just doesn't exist?

If anyone has any theories on why Bitcoin Core would be showing that available balance of 12 BTC, I'd love to hear it. Genuinely puzzling. As though it's stuck on a different timeline to the one I'm in.

Thanks again for your help. Today is a good day.