Topic: [SOLVED] Mystery! How to recover the coins? (Read 190 times)

Can you see past transactions?

And what is your Electrum balance, zero?

If you can see past transactions and your balance is zero, someone spent your coins. You might have been hacked..

Where did your coins go? Is it a 1, 3 or bc1 address?

Very possible. Supposing you use passphrase (extended word) of BIP39, there is a space below iamcoleman you will need to input the passphrase. If you do not input the passphrase, the result will be another seed that will be generated, this will result to another addresses to be generated entirely. You will need the passphrase if you use it, to generate the address for you.

I could not be sure whether the address truly belonged to the seed phrase, because there is infinite possibility of derivation path. If we assume the derivation path to be the common and normal ones, no, I was unable to find my receiving address in the list generated by the BIP39 script

One side question: Could it be that I had added a passphrase/password somehow?



===========================


There is ANOTHER MYSTERY HERE

When I recover my seed on Electrum - I can see my past transactions. xPub: X

When I recovered using the same seed on the MyCelium app v2.7.1, I cannot see any transaction at all (probably the same as what I had experienced in mid 2016). XPub: Y

MYSTERY: The xPub for both are different!

When I run xPub X on https://blockpath.com/wallets/local/101?action=appxpub , I could see those coins post 2018.

But when I run xPub Y on the same, it shows No Used Addresses Found

Can anyone explain why?  <<<------ Update: It seems like when my seed was created, the MyCelium version I was using used m/0' as the derivation path. By Mid 2016, the app seems to use m/44'/0' as default path. The different xPub is due to different derivation paths.



P.S: One more possibility - I could have used a passphrase (which MyCelium supports)

Have you tried iamcoleman.io to verify if the address is truly belonging to the seed phrase? Also, you can extract out the private key directly linked to the address so far you know its derivation path to be m/44'/0'/0'/0 which is the first legacy address. If you see the private key, download electrum, verify its signature, open it and click on 'next', click on 'import bitcoin addresses and private keys' and paste the private key. But, if you did not see the address on iamcoleman, that means you are using another seed phrase which you think it is the one which your mycelium wallet used to store the funds you are looking for, but not.

The checksum rule is not always obeyed with all of the wallets. There is also still a chance that your mistyped or mis-copied phrases still matches the checksum even with the error.
It's more likely that you are actually restoring the wrong seeds. I can't think of anything if you have tried loads of deviation path and increased the gap limit.

Yeap, tried that before too. Balance 0 BTC

I was going through various hypothetical possibility.

1) Maybe when I tried to recover from my seed , I mistyped or misentered the phrase, causing myself to recover to a new but empty wallet?
But this is not possible because there is a checksum on the pass phrase. If any word is wrong, or even the sequence of the word is wrong, the checksum fails and cannot go through.

2)  I might have accidentally created a new wallet instead of restoring? I installed the old version of MyCelium on a simulator, after creating a new wallet the screen will not prompt me to back up my seed. However, under "Accounts" there'll be a red-font warning that no backup was created, and if I had tried to create a PIN Lock (which I usually do), it would require me to backup my seed first before allowing a PIN lock to be created. So, it is almost impossible for me to have created a new wallet plus having a set of new seed without myself remembering anything about it.

So the mystery remains - where are my coins lying in now if it cannot be in a new wallet yet not in my usual wallet?

Can you try this.

Get your master public key or xPUB, zPUB, or yPUB you can use that Electrum under wallet>information and copy the master public key.

Now use this tool https://blockpath.com/wallets/local/101?action=appxpub
Paste the master public key and let it scan. Let's hope it can find the right derivation path of your wallet. It will only work if your wallet has some balances if it doesn't have any balance then it won't show any result.

It means your wasting time trying to find your Bitcoins from your seed which doesn't have any funds. Or maybe it's not actually the seed that you generated from Mycelium?

The original coins were in m/0'
The missing coin can't be found , I tried many m/44'/0 to 4, and also m/1'

What do you mean "check change addresses" ?

I doubt it if the seed phrase did not work on mycelium, it will not also likely work on electrum. If it did not work on mycelium, likely the seed phrase belongs to another wallet which also may not support BIP39 derivational paths. Although, he can try using electrum too but it will be good if he tries iamcoleman to verify if truly the seed phrase has BIP39 suppoted derivation paths. If the seed phrase is from mycelium, it ought to have worked successfully with mycelium.

So all your coins are in Legacy Addresses, which starts with 1. Right?

I would download Electrum, and insert the seed (check BIP39 box).

Then try a few "accounts" inside the this derivation path (You might have accidentally created some other wallet inside your mycelium).

m/44'/0'/0'/0
m/44'/0'/1'/0
m/44'/0'/2'/0
m/44'/0'/3'/0

Use a high gap limit and check change addresses as well.

You don't have to try any other derivation path, just importing it back into MyCelium should suffice. You have to know both of them in order to recover the funds. Gap limits should be unchanged on MyCelium, derivation path should follow BIP44. Is there a problem with just importing it in MyCelium?

If it isn't there, then you might have the wrong seeds.

What happened

Mid 2016, my cellphone broke down.
I recovered using my seed phrase. 0 BTC - coins missing.
Mid 2018, cellphone stolen.
Recovered again using seed phrase, now wallet showed missing coins before Mid 2016, but coins between Mid 2016 to Mid 2018 missing now.
Eventually I managed to find my coin.

I am sharing my experience hoping it could help someone recover their bitcoins, because I managed to recover mine.
If you found this useful please consider tipping: (BTC!) bc1qug9p4mgl2g9vsarwu4mv0k38sfl674qr7vx6p2

The Failures

Things I tried but were unsuccessful, but could be successful to you:

1. File recovery on old phone or computer for wallet.dat - I didn't manage to recover the dat file. I used file recovery softwares to scan the storage.

2. If a mystery involved something that has happened quite a while ago, do not trust yourself 100%. Meaning to say, your memory could be wrong. You could have not only remembered something wrongly, you could have also forgotten something. Recap your memory by going through your old digital "diary", such as the text messages, emails you have sent or received around that date (search gmail), or even sort your computer files by the Modification Date or Created Date to look at the files you edited/created around that date. Doing these will help you recall things. It was digging my old email that I come to know that my cellphone had broken down, because I had sent an email out informing someone so.

3. It was possible that coins received during that period were received in a different derivation path. Scan and try all major and possible derivation paths, such as m/0' , m/44'/0/0/0/ , m49'.... so on and so forth.  You can use this link here to scan for transaction history, but take note that different default derivation paths would generate a different xPub. https://blockpath.com/wallets/local/101?action=appxpub

4. It was possible that the coins were received in a "far away" receiving address, which had a huge gap between itself and the last address that had received a coin. Meaning to say, if the 5th address received a coin, a wallet usually look for coin until the 25th address (20 as the default gap limit). If someone sent you coin using the 26th receiving address, the wallet may not detect it. Set your wallet to increase the gap limit to 50 or 100 to be safe. The above were done almost immediately after I discovered the missing the coins. I spent about 50 hours cracking my brain and running checks with very weird derivation paths just to find the coins.

My advice now is to take a break, put it away for some time, accept it in your heart that if the coins are destined to be gone, then it's gone. For my case, time was not sensitive as no one could steal those coins away from me. It's either to be recovered by myself, or left untouched forever. So recently Bitcoin short up to USD 55K each, I decided to give it a shot again. Having accepted that I most likely won't be able to get it back, I see it as a treasure hunt, or a mystery to be solved.

The key question I kept on asking myself is: How could this have happened? Which led to possibility (3), (4) and (5) and eventually (6) to be looked into.

5. It was possible that I could have mistyped the seed phrase when I was recovering in mid 2016, thus those 2 years' of bitcoins received actually went into another wallet I accidentally created with a mistyped seed phrased. As I had used MyCelium android app, I downloaded the same old version to try it myself, but the app did not allow mistyped seed phrase to be submitted as there is a checksum mechanism. Your wallet might not have this checksum verification so you might want to try.

6. It was also possible that I could have remembered wrongly about recovering from the seed phrase in Mid 2016. I might have simply created a new wallet. So, with the same old version of MyCelium android app, I tried to create a new wallet instead of the Restore option. It did not show me my new seed phrase. Someone might have gone on to use a new wallet, forgetting about saving the new seed phrase. Not for me. This possibility was struck down because under the Accounts tab for this app, a red font would remind the user to do a BACK UP. I could not have missed it for using it over 2 years. Furthermore, I remembered using a PIN lock on the mobile app. When I tried to set a PIN lock, the app required me to do a BACK UP of the seed phrase before allowing a PIN lock to be set. So, my missing coins were to be in another new wallet, then I must have seen a set of new seed phrase, for which I have absolutely no memory of.

Closing on to the Winning Idea

I was using Electrum and MyCelium app to do the tests. I noticed Electrum windows program did not ask for a passphrase when you try to do a BIP39 seed recovery, but the MyCelium mobile app did. I wondered: Maybe I used a passphrase when I did a recovery? No harm trying. It was crazy because if my last recovery using the seed phrase was without passphrase, why would I use a passphrase 2 years ago? It was not even required, and I had never written down a passphrase to go along with the seed phrase.

7. Seed recovery with a passphrase you didn't think you had

A passphrase can be of any length, any combination of characters. I did not perform so many recoveries to try each possible passphrase. Because I know one receiving address (public) for which I had received coins on for the missing coins, I could generate addresses on https://iancoleman.io/bip39/ and see if that receiving address is listed as one of them. If you want to use this script, please consider the risks of exposing your seed phrase. You can save that page as HTML on your PC and disable your network connection, or download the open source script and host it locally to use it.

So I kept trying, just like a password guessing attack. I entered the seed phrase, repeatedly change the passphrase, clicking on the Ctrl+F search popup in Google Chrome to search the page for that public btc address. This went on for about 20 different passwords. Don't limit your imagination to long normal passwords. Try 4-digit or 6-digit pins you could have used.

The search function highlighted a public bitcoin address on the page, and I was so shocked I really couldn't believe my eyes!

The cause of the mystery for my case was that I must have thought the passphrase in the seed recovery process in MyCelium app referred to the PIN lock, so I had keyed in the PIN as passphrase when I recovered in Mid June, causing my wallet to not show the Pre-Mid-2016 coins. Then when the phone got stolen, the next recovery I did was done properly - without the passphrase.

Good luck!

If you find this useful, tip me!

Bitcoin address: bc1qug9p4mgl2g9vsarwu4mv0k38sfl674qr7vx6p2