I have managed to lose 5 words of my 24 word Ledger Nano S recovery phrase. I have words 1-19 but I am missing words 20-24. I have significant holdings on the wallet so would very much like to recover it if possible. The passphrase is a BIP39 mnemonic (see https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki). I have the bitcoin and ethereum public addresses for this mnemonic. I am wondering if it's feasible to brute force the passphrase.

Each word is 11 bits (2^11 = 2048 possible words). The last (24th) word of the passphrase is of the following form [3 random bits][8 bit checksum]. Therefore I only have to check 2^(55 - 8) = 2^47 = 1.4x10^14 combinations. I would have to compute SHA-512-HMAC with an iteration count of 2048. As far as I understand, that means I'd have to compute 1.4*10^14 * 2048 = 2.87*10^17 hashes in total.

Is there any hardware out there designed for this? I am aware of ASICs that compute sha-256 hashes but not sha-512 hashes. Perhaps I could tweak one to work with sha-512 since they are very similar.

Assuming a fairly typical ASIC hashrate of 1TH/s (10^12 hashes per second), I could exhaust the search space in 2.87*10^5 = 287000 seconds = 3.3 days. I'd probably get there sooner, of course (expected 1.65 days). Time is not something I am worried about. Even if I have to wait months, I don't mind - so if I can get 10GH/s at a reasonable price, that would be great.

I would really appreciate any help/information you could provide to help me out and make sure I haven't missed anything. I could also use GPUs for this (I calculate I can run them at roughly \$1 / 10TH - so it would cost me \$28.7k to exhaust the search space, which I will do if there are no cheaper options).

Many thanks, James

  • $\begingroup$ I am sorry, but 2^47 combinations which then have to be passed into further SHA512 and THEN this has to be converted into BTC address which has to be checked on the actual blockchain to see if such address is actually valid - this is a no-no. If you had the last word, it would severely simplify the problem. But this is unrealistic $\endgroup$ – michnovka Apr 26 at 22:46
  • $\begingroup$ @michnovka If you read the entire post, I have the BTC address so it would not have to be checked on the "actual blockchain". It would be helpful if you could provide the reasons you think this is the case (e.g. my math is wrong). Thanks. $\endgroup$ – JGoodwin10 Apr 27 at 19:44
  • $\begingroup$ ok, so assuming you have the public BTC address: the 2^47 combinations is true. This many times you will need to calculate SHA256 to get the checksum 8 bits. Then lookup this many times the words from dictionary, since BIP0039 works with the string, not bytes. After you have this, then you do SHA512 with 2048 iterations - but problem is you are hashing the UTF-8 "sentence", so the hashes/seconds is sth you will have to figure out experimentally. But after that, you will also have to do BIP0032 to get the actual BTC address and this I believe is another SHA512. $\endgroup$ – michnovka Apr 27 at 19:59
  • $\begingroup$ @michnovka I appreciate your help, however I think I need someone with more experience/expertise to answer my question. Do you have any suggestions for who I could contact? $\endgroup$ – JGoodwin10 Apr 27 at 20:46
  • 1
    $\begingroup$ no matter who you ask for help, the problem is that ASIC sha512 is not where your journey ends. as I said, first you need sha256 to get checksum 8 bits. then lookup to translate bip0039 to words. even tho simple task, there is no ASIC for that. then sha512 to get seed. and then another sha512 to get the final private/public keypair. The main issue will be connecting the 4 tasks and this is where I see potential bottleneck. and while my experience/expertise may be low, I can guarantee you will not get anywhere near 10GH/s with 30k USD budget. Good luck. I feel the despair with you $\endgroup$ – michnovka Apr 27 at 21:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.