Author

Topic: IOS File Structure For Coinbase Wallet - Looking for my seed phrase (Read 186 times)

newbie
Activity: 5
Merit: 1
Thanks for the response! I'm not the same poster as the other post but it's the same thing that happened to him and if you search Reddit you will find many others in the same situation.

I can browse the backup file but some of the files appear to be encrypted. I'll try to find the NSUserDefaults.

Thank you
hero member
Activity: 882
Merit: 5818
not your keys, not your coins!
This story sounded familiar and I was sure I heard it before. Especially when you said that you got locked out of your wallet a year ago. I did a search and found this thread: Coinbase Wallet - Is my $ lost because I pressed this one button (dangerous)? Is that your account?

From the looks of it, OP (whoever they are) never recovered his funds. But feel free to go through the posts and see what was suggested to possibly fix the problem. Can't believe Coinbase is still offering this awful option to not write down your seed, but also that people are using it.
That other story definitely gives a lot more insight, which is very helpful. If this is the same person, I have one good news and one question:
Firstly, if updating the device cleared your seed, and it came back by restoring the backup, it means the application was not using the iOS keychain. That's a good sign since it means the seed is definitely somewhere within that phone backup file. If you've got a raw, decrypted version through a forensics company, even better.

If the application had used keychain, it would be more secure, due to storing the seed in something like a secure element, but it would have made it impossible to retrieve.

My question is why you're saying the data is encrypted. Last time I did something like this (a long, long time ago), I could just browse the file system structure of the backup file. It's definitely possible that a lot has changed, though. Other question: if you already have a trusted forensics company, why don't you ask them to extract any NSUserDefaults and other app preferences and data of the application in question?
legendary
Activity: 2730
Merit: 7065
Farewell, Leo. You will be missed!
This story sounded familiar and I was sure I heard it before. Especially when you said that you got locked out of your wallet a year ago. I did a search and found this thread: Coinbase Wallet - Is my $ lost because I pressed this one button (dangerous)? Is that your account?

From the looks of it, OP (whoever they are) never recovered his funds. But feel free to go through the posts and see what was suggested to possibly fix the problem. Can't believe Coinbase is still offering this awful option to not write down your seed, but also that people are using it.
newbie
Activity: 5
Merit: 1
Coinbase support offers 0 value and stated they will not provide the information I'm requesting. I've tried about everything by now, it's almost going on 1 year since the lockout.

mk4
legendary
Activity: 2716
Merit: 3817
🪸 NotYourKeys.org 🪸
Coinbase has customer support, it's probably best that you try contacting them and ask them directly: https://help.coinbase.com/en/contact-us?product=coinbase-wallet

Make sure you grab a hardware wallet asap.

https://ledger.com/
https://trezor.io/


Account peak value was $180,000, today it's $57,000. Sad

...
newbie
Activity: 5
Merit: 1
Hello all!

Before anyone talks poorly about my experience, I'm well aware it was my mistake and I was negligent by not generating my seed phrase and writing it down. Coinbase Wallet allows new users like myself to create a wallet and "Do later" for the seed phrase. Coinbase wallet logged me off the app randomly stating I changed my biometric login, which is not true.

Anyway, I had a forensics company scrub my phone and provide the raw data files. I'm hoping someone has more info on the IOS File Structure for Coinbase Wallet and I can search for the encrypted files. What might that look like?

Any advice would be greatly appreciated.

Account peak value was $180,000, today it's $57,000. Sad

Thank you,
Jump to: