Successful recovery from invalid MetaMask seed phrase in Czech language
<!-- SC_OFF --><div class="md"><p>This post was removed by the moderators of the MetaMask subreddit, so I am reporting it here. </p> <p>TL;DR</p> <p>Client&#39;s seed phrase got auto-translated from English to Czech by the Edge browser, when displayed by the MetaMask browser extension. It was not that easy to reverse this auto-translation and recover the original English seed phrase that allowed recovery. Read below for the details.</p> <p>Long version </p> <p>A Client contacted us for a recovery, after they lost access to their BSC account (which contained a sizeable amount of USDT and USDC tokens) even though they had their seed phrase (they provided a photo of MetaMask displaying the seed phrase).</p> <p>Client was using Windows 11 configured in Czech language, and installed MetaMask on their Edge browser. Their recovery seed phrase (aka SRP = Secret Recovery Phrase) displayed by MetaMask was indeed formed of 12 Czech words, as we could see on the photo they took. In general taking a photo or screenshot of the seed phrase words is not advised, but in that case, it was helpful. See their <a href="https://www.reddit.com/media?url=https://preview.redd.it/successful-recovery-from-invalid-metamask-seed-phrase-in-v0-43asijvzhdyg1.jpeg?auto=webp&s=d70ff150d6b44a1158c60aaf8bfe1dd5533151a4">Metamask screenshot</a> .</p> <p>After resetting / reinstalling their browser, they needed to restore access to their BSC wallet. But their seed phrase (formed of Czech words they took the photo of) was invalid.</p> <p>The BIP39 standard does indeed have a 2048-word word list in Czech language, but many of the Czech words our Client had were not in the BIP39 Czech word-list. Also, strangely, some words in Client&#39;s seed phrase were capitalized, and some were not.</p> <p>We concluded that most likely, MetaMask displayed the seed phrase as 12 English words, that were somehow auto-translated by Edge browser, which translated in Czech any webpage using another language, in that case, the MetaMask SRP page with English words.</p> <p>So, for each Czech word we had, we looked at what was the most likely English words before the automatic translation happened. To get the candidate English words, we reversed-translated the Czech words to English, and to used AI to help figure what English words were the most likely candidates, to reduce the number of possible combinations.</p> <p>Some words like &quot;voda&quot; had a single likely candidate (&quot;water&quot;), but some other words like &quot;náboj&quot; had many possible candidate, like (&quot;charge&quot;, &quot;cartridge&quot;, &quot;load&quot;, &quot;nave&quot;, &quot;round&quot;, &quot;shell&quot;, &quot;bullet&quot;, &quot;potential&quot;, &quot;hub&quot;, &quot;bush&quot;, &quot;punch&quot;, &quot;impact&quot;, &quot;momentum&quot;). Same with &quot;vĕc&quot;, we got many candidates (&quot;thing&quot;, &quot;object&quot;, &quot;item&quot;, &quot;article&quot;, &quot;matter&quot;, &quot;subject&quot;, &quot;issue&quot;, &quot;point&quot;, &quot;business&quot;, &quot;fact&quot;, &quot;case&quot;, &quot;cause&quot;, &quot;stuff&quot;, &quot;affair&quot;, &quot;concern&quot;).</p> <p>We then used brute-force to test programmatically the several thousands of combinations (after eliminating the English words not in the BIP39 word-list, and the eliminating the seed phrases that had an invalid checksum), to check is any valid seed phrase lead to the account address that Client provided. No luck!</p> <p>Then, we decided to \*not\* eliminate phrases with an invalid checksum, but rather to do a brute-force search on each 12-word candidate phrase assuming that one of the 12 words (at unknown position) was incorrect (i.e. we tried the 2048 words at each of the 12 positions). We ran this on each of the 12-word combinations formed by the translation candidates.</p> <p>This brute-force search rapidly found the correct seed phrase! Recovery was successful.</p> <p>The BIP39 English word that got translated to &quot;náboj&quot; was &quot;surge&quot;, which was not in any English candidates that the AI and translators suggested to us for &quot;náboj&quot;.</p> <p>The conclusion is that it is very problematic when a browser auto-translates the seed words that are displayed by MetaMask (or any other wallet app for that matter). In this case, we were lucky that only one word was not among the candidate English words that we gathered using AI and translators.</p> <p>I believe that MetaMask (and all other browser extension and browser wallets) should add meta-tags to instruct browsers that the SRP / seed phrase words should not auto-translated (even if not all browsers respect those meta-tags). Here is an example, with the BIP39 word &quot;surge&quot; that should not be auto-translated:</p> <p><em>&lt;!-- Using a class (Common for Google Translate) --&gt;</em></p> <p>&lt;span class=&quot;notranslate&quot;&gt;surge&lt;/span&gt;</p> <p><em>&lt;!-- Using the HTML5 attribute --&gt;</em></p> <p>&lt;div translate=&quot;no&quot;&gt;surge&lt;/div&gt;</p> </div><!-- SC_ON --> &#32; submitted by &#32; <a href="https://www.reddit.com/user/loupiote2"> /u/loupiote2 </a> <br/> <span><a href="https://www.reddit.com/r/CryptoCurrency/comments/1t05eww/successful_recovery_from_invalid_metamask_seed/">[link]</a></span> &#32; <span><a href="https://www.reddit.com/r/CryptoCurrency/comments/1t05eww/successful_recovery_from_invalid_metamask_seed/">[comments]</a></span>
