Topic: Recovering old Bitcoin wallet with short seed (Read 8421 times)

I invested on Platinum Futures Trading with 68,500 USDT after being convinced by the promise of lucrative returns. Little did I know, I had been lured into a scam. The initial profits were huge. But when I attempted to withdraw my funds, I encountered a disturbing reality. Their customer support were demanding more deposits before they release my funds.

I found out about ExpressHacker99 during my thorough online search for help. Skeptical yet hopeful, I reached out to them, sharing my stressful experience. The team at ExpressHacker99 responded swiftly. They outlined a comprehensive plan to trace and recover my stolen funds, explaining each step with clarity.

They communicated regularly, keeping me updated on their progress, and their dedication to my case was unwavering.
They dissected the complex web of transactions, identifying the fraudulent nodes that had entrapped my funds. Then they executed a series of strategic moves patiently until the treasure was restored in its entirety.

The moment I received the confirmation that my funds had been recovered was indescribable. The ExpressHacker99 team had not only saved me from financial ruin but also restored my sanity and wellbeing.

They proved to be the best and trustworthy. If you ever require assistance after falling victim to a cybercrime do not hesitate to contact them through;

ExpressHacker99[at]Gmail[dot]Com

Edit: What electrum version was the wallet originally created in? If you don't know the version do you know the time period it was created in?

Can't you go back to 3.0.3 and then send coins to another wallet?

I have this problem atm.

I updated Electrum to 3.0.5 from 3.0.3. I've tried using my 8 word seed to restore and no balance or history is showing.

The 2 ways I have tried are:

1. New wallet from old seed. It can create but no balance or history shows.

2. 2FA method but get stuck at enter seed (the "Next" button is grayed out after entering seed). I am using a 8 word seed. Some other people that have commented on YouTube also have my problem.

I have been looking for solution for 2 weeks now.

Just FYI, it's 13 words or less for seeds as currently generated by version 2.x (reference: http://bitcoin.stackexchange.com/questions/38011/ramifications-of-creating-electrum-2-x-seeds-which-are-not-bip39/38027#38027), however that's likely to change in a future version to 12 or less.

No. When Electrum 1.x generates a seed it's always 12 words (13 with version 2.x) even if there are many zero bytes. Some have tried to generate shorter seeds outside Electrum and then use them in Electrum, but that's a different matter.

It's simply that the first 8 bytes just happen to equal zero, no?

I was looking at an older version and assumed it's not much different in the latest. I checked version 2.2 now and now I think I know exactly what your wallet is. You created a new wallet, clicked "Restore a wallet or import keys" and then it says "Please enter a wallet seed, a master public key, *a list of bitcoin addresses*, or a list of private keys." and you entered just an address - so it is an imported address that you can watch, but the private key is not there. (In older versions it is possible to have one watch-only wallet with imported private keys in it that you can directly send from, but that doesn't seem to be the case here.)
So, you need to find the private key for that address. Perhaps the address came from a paper wallet. Perhaps you have that somewhere. Try to find it.

Note the [watching only]

You can't send from that wallet as it doesn't have the master private key.  What you are using allows you to watch and create transactions but then sign them with another computer (ideally one that is airgapped for offline signing).

Hmm, my Electrum's "receive" tab does not have a main account branch or imported branch. Maybe it's a different version, here's some screen shots: http://postimg.org/image/xf4frp3nb/
When I try to right-click then "send from" it does give me the option to (it asks for the address to send to, the description, the amount ect.) but then only gives me the option to "create unsigned transaction". I'm pretty sure that's not what I want.

It is possible I made a paper wallet then imported it to Electrum. I can't quite remember doing that but I might have forgot.

And yes, by "regular access to the wallet" I meant when it was normal.

I'm hoping the screenshots will shed some light on the problem.

1. So I should have asked you this so that we can determine for sure if this address came from Electrum or not:

Open that watch-only wallet where the address is in and click on the 'Receive' tab. Now find where exactly that address can be found. Is it under the "Main account" branch or is it under "Imported" (do you have an "Imported" there at all)? If it is under "Imported" then it must have been generated outside of Electrum, but then you most probably have the private key there in the wallet and you should be able to send the bitcoins from that address. Otherwise (if it is under "Main account"), it was generated by Electrum and you need to find the seed or the normal (not watch-only) Electrum wallet. When you create an Electrum wallet it shows you the 12 word seed and asks you to write it down somewhere. On the very next step it asks you to type it in again, to make sure you have it. So how did you get through this step? Also, are you sure the wallet you have is watch-only and not a normal wallet (find the address that you sent the coins to and try right clicking and then click "Send From" and see what shows up)?

2. You can use an address generated outside of Electrum by importing its private key. But you say you are unable to send from this address, right? This makes me think that the address is probably not imported. Otherwise it means there is some other issue at hand that we haven't determined yet (we'll go into that if the answer for point 1. above is "Imported").

3. It is possible that you went through bitaddress.org's address generation and then imported the private key that is immediately displayed there. Then you should be able to send from it and the 8-word thing remains unexplained. It is also possible that after the address generation on bitaddress.org you clicked "Paper Wallet", then "BIP38 Encrypt" (this is usually how many people generate encrypted paper wallets) and then entered a passphrase (perhaps the 8 words). Then you may (should) have printed the wallets or kept other copies. But then importing that into Electrum would have been somewhat complicated (you would have gone through something like this: http://www.thecleverest.com/importing-bitcoin-from-a-paper-wallet-into-electrum/ or you imported only the address and not the private key, which is also complicated, as far as I know) so I think this is unlikely.

4. So one explanation for the 8 words could be that they are the passphrase for a BIP38 Encrypted private key (see 3). Another explanation could be that they are the passphrase for some encrypted Electrum wallet.

5. I assume that by "regular access to the wallet" you mean when you had the normal (not watch-only) wallet that was destroyed when you reformatted your disk, is that right?

By the way, it may be worth it to try data recovery on that reformatted disk. There are a few topics in this section that go into details about that.

I'm not sure that that is the case given that, as I understand it, you can see the address as a receiving address in Electrum and you can see its balance in Electrum but at the same time you are unable to send this balance (points 1 and 2).

Hey sorry it's taken some time to get back to you, thanks for your comment

1. I do have other addresses that link to this wallet, I can see them in them in the history tab of the "watching only" wallet.

2. I think you're right that it isn't an address generated by Electrum. Is it possible that I've been using Electrum to access the wallet in the past even if it wasn't generated by Electrum?

3. I think it might actually have been generated from https://bitaddress.org/ (I remember running my mouse all over the screen to generate a wallet a while ago), although I just tried using it again and I noticed when you do this it doesn't generate a mnemonic, just one address and a private key. What would you make of this?

4. I'm pretty sure it's not a brainwallet. Maybe an encryption password. If that's the case how would I use that to gain access to the wallet?

5. This password is just the small dialogue box that pops up when you try to send bitcoin with Electrum. I've used this in the past when I use to have regular access to the wallet.

Thanks so much for your help, I think knowing I generated it from bitaddress is useful but I'm not sure were to go from here because I can't seem to find anyway of recovering lost wallets generated there.

Try to answer these questions:

1. First think of the address you sent bitcoins to. Did you have more addresses written where you found this address? Any other context (notes, past transaction history, etc.) to this address which may help you be sure what this address is from?

2. In your first post you assumed it is an address from an Electrum wallet. If that is so then you would (or at least should) have saved/memorized what you need in order to recover the wallet - 12 word seed and/or backup copies of the wallet file. Are you sure you don't have any of this?

3. What other kind of wallet could this address you sent your bitcoins to be from? Think of what wallets you may have used on your phone. What web services/wallets have you used?

4. Now about the 8 words. It is clear that those 8 words are something other than an Electrum seed. Do you remember rolling dice, flipping coins or manually using a wordlist or something like that to get these 8 words? If so, the 8 words could be an encryption password, web service password or a brainwallet (like https://bitaddress.org/ and https://keybase.io/warp).

5.

I'm not sure I understand what you mean by that. What password is that? Is this just for the Electrum wallet you generated by entering the 8 words when you were trying to recover your bitcoins?

That's a version 1 (what the code refers to as version 0 IIRC) encrypted wallet. There have been several different encryption schemes used for this wallet version—the only way to differentiate them is to try them all, and see which one works.

The schemes have some shared attributes: the payload is stored base-64 encoded, the first 16 bytes is used as both the KDF's salt and the encryption mode's IV (and the rest is the ciphertext), the password is UTF-8 encoded (it's not normalized), and the KDF is PBKDF2-SHA1. The scheme differences, in most recent to oldest order, are:

• the KDF iteration count is 10, encryption is AES-256 in CBC mode with ISO 10126 padding (same as version 2 wallets, but with a hard-coded iteration count)
• same as the above, but the iteration count is 1
• the iteration count is 1, encryption is AES-256 in OFB mode with ISO 7816-4 padding

Likewise, the second-password encryption has gone through a number of schemes; I think they parallel the ones above, but I'm not sure and don't have the details readily available.

The second password is also stored hashed inside the wallet file, and I do have the details of the various hashing schemes (again, password is UTF-8 encoded, most recent to oldest):

• the salt is the sharedKey field (the literal string, not the underlying UUID bytes), the hash is PBKDF1-SHA256 with an iteration count of 10 (same as version 2 wallets, but with a hard-coded iteration count)
• same as the above, but the iteration count is 1
• the hash is SHA256(password) (unsalted)

You're right, but actually the secondary password was encoded by a mnemonic with ~ 8 words (assuming minimum 8(?) chars). Probably `2nd mnemonic` = `secondary password + checksum word`

This is in contrast to `primary mnemonic` = `Wallet UUID + password + checksum word`.

Again, these BCI recovery mnemonic phrases are/were NOT BIP39.

In fact, there's at least a couple different versions of wallets, I believe*.

 * And I'd be highly appreciative of any insight the JavaScript gurus here can offer into this Blockchain.info Wallet Version question over @ BitcoinSE

Okay, thanks for your help. I've jumped around to a few sites that generate online addresses and tried a few different programs like armory. Nothing seems to recognize all 8 words. I tried the oldest version of electrum too with no luck. Very strange.

If anyone else has any idea of something I haven't tried or am overlooking I'd appreciate it.

I know https://blockchain.info/wallet used to give out mnemonics to allow you to regain access to your account if you get locked out. However I believe their mnemonics are a lot longer than 8 words. It's possible it could be from some other site.

Okay, hmm. The words that don't show on the list are "rowboat", "dead", and "ukraine". If it's not an electrum seed, do you have an idea were I might have generated it? Maybe I got it online or something not with electrum, but have been using electrum to open the wallet? Electrum is the only software I've used for wallets on my computer.

I did delete the file, I had to reformat my hard-drive on this PC about a month or two ago.

If there is a word in your mnemonic that isn't in those lists, then I don't think the mnemonic you have is an electrum seed.

Did you delete the wallet file? when? it may be still recoverable if it was recently.