Recovery Firm Recovers $1B in Crypto Wallets, Finds $10 Usable

A case involving a supposed “lost fortune” in Bitcoin has become a cautionary tale about how often crypto recovery isn’t just a technical challenge—it can also be a problem of scams, misunderstandings, and missing context about what exactly is stored in a wallet.

In 2021, Chris Brooks, founder and chief executive of Crypto Asset Recovery, was contacted by a client identified as “Rusty.” Rusty and two other men claimed they had won roughly 5,000 Bitcoin in a court case (worth about $53 million at the time) and said they could withdraw up to $300,000 per week. Brooks and his son traveled to help crack the wallet, only to find that the information provided pointed in a very different direction.

Key takeaways

• Crypto “recovery” often means reconstructing access information (seeds, passwords, or missing words), not recovering funds from the blockchain.
• A correct seed phrase can still lead users to think funds are gone if a passphrase was forgotten—wrong passphrases may not trigger errors.
• If a seed is truly destroyed and truly random, there is no practical recovery path—self-custody has a hard limit.
• Recovery firms can be targeted by scammers, and choosing a provider is itself a security decision.
• Unsourced promises, upfront payments, and pressure to move quickly or through nonsecure channels are major red flags.

When “millions in crypto” turns out to be something else

Brooks recounted that Rusty initially presented what he described as a Bitcoin address containing about $53 million. During the first call, Brooks says he realized something was off when Rusty showed another balance—presented as about $1 billion in ETH.

Rusty then drove Brooks and his son to a strip mall office and handed them notebooks containing dozens of recovery seeds. The work involved opening wallets throughout the day, but Brooks says they ultimately found only around $10 in Bitcoin.

The record of what the notebooks represented—and whether they corresponded to any of the claimed balances—was never clarified. Brooks was also not reimbursed for travel costs. With the benefit of hindsight, he suspects Rusty was likely misled by scammers who convinced him he had a large crypto holding that didn’t exist.

Brooks described the episode as an early lesson for his business: sometimes crypto is lost, sometimes the wallet or password is lost, but sometimes the money was never there to begin with.

What wallet recovery specialists actually do

For firms that focus on recovery, “lost crypto” can mean several distinct scenarios. According to Bruno Krauss, co-founder and chief technical officer at recovery firm ReWallet, specialists generally aren’t “undoing” transactions on-chain. Instead, they aim to regain the information required to access an existing wallet—information that may be incomplete, forgotten, or corrupted.

In many cases, missing access material can be reconstructed. Krauss explained that Bitcoin’s BIP39 standard uses a list of 2,048 words, so if someone remembers most of the seed phrase, recovery work may involve systematically testing the remaining unknown words. The fewer elements missing, the smaller the search space becomes.

Password recovery can follow similar logic, including reconstructing likely characters when users recall patterns or context around how they created a password.

Krauss also described a behavioral approach: understanding how individuals tend to choose secrets. In one example, a customer believed her password used her children’s names. Eventually, she realized the password was actually tied to a phone number connected to a local delivery service—an association she remembered when she thought about when a package was delivered to a store.

Passphrases: the part that can hide funds without any warning

Even when users have the correct seed phrase, forgetting a passphrase can effectively make funds inaccessible. Tom Bennet, a Bitcoin educator who has studied wallet security, said that passphrases add a layer of information on top of the seed: enter the wrong passphrase and you can end up with another valid wallet rather than an explicit error.

“A wrong passphrase doesn’t throw an error; it succeeds and shows you a zero balance.”

That means users may reasonably conclude their Bitcoin has vanished when the underlying issue is simply that they entered the wrong passphrase. Bennet also argued that passphrases do not provide the same built-in protections as seed phrases—no fixed word list and no checksum equivalent. If the passphrase was sufficiently random and is fully forgotten, recovery can be effectively impossible.

There are also practical nuances with hardware wallets. Even if a device is broken, the keys may still be restorable if the seed backup survives. In other words, recovery specialists may not need the original hardware, but they do need enough information to reconstruct access to the keys.

Recovery can even involve repairing mistakes. Brooks said the firm has been contracted to crack more than 3,000 wallets for around 1,500 people, and that it has cracked passwords for about 63% of them. Some cases may depend on understanding what chain assets were sent to and whether the receiving wallet is under the client’s control.

The hard limit: when randomness is gone, recovery may be impossible

While many cases are solvable in some form, there is a boundary beyond which recovery becomes unrealistic. Bennet said that if a wallet seed is truly random and is completely lost, the Bitcoin is gone.

Bitcoin’s self-custody model is built around that trade-off: there is no centralized account recovery system, no bank-style mechanism to verify identity and restore access. If the information needed to derive keys is irrecoverably destroyed—and the wallet containing those keys is inaccessible—then no recovery service can help.

Lucien Bourdon, a Bitcoin analyst at hardware wallet maker Trezor, put it bluntly: if both the backup and the wallet are lost or inaccessible, “no recovery company can help.” He warned that if it were feasible to recover such wallets, the concept of self-custody would be fundamentally compromised.

That said, technical reality sometimes creates unusual opportunities. In the recent Coldcard hardware wallet context, for example, a firmware bug was reported to have weakened seed randomness on some wallets, making seeds brute-forceable without physical access—an example of how hardware and implementation flaws can change what’s recoverable. Broader historical issues with weak randomness were also cited as not being new.

Still, Krauss emphasized that specialists sometimes find technical “edge cases,” such as recoveries enabled by old wallet software, corrupted files, poorly generated passwords, or hardware vulnerabilities. But those are exceptions; the baseline remains that truly destroyed, truly random secrets can’t be brute-forced in practice.

Recovery as a security risk: scammers can move first

The Rusty story highlights a difficult irony: the information needed to recover someone else’s funds is the same information that can control those funds. That means selecting a recovery specialist is not just an administrative decision—it’s part of the security model.

Bourdon said users should do due diligence. He recommended looking for firms with a verifiable track record and reviews tied to actual customers. He also advised confirming that the provider charges on success rather than requesting money upfront, and to move funds to a new wallet with a fresh backup after recovery is completed.

He further warned users to be skeptical of unsolicited messages claiming someone can recover their crypto. Krauss echoed this concern, pointing to red flags such as pressure to communicate via WhatsApp, contact from personal email addresses, demands for upfront payments, and requests to open accounts on an exchange.

Percentage-based fees tied to recovered assets are common in the industry, but Brooks’ account makes clear why upfront payment promises should trigger alarm bells—especially when the “recovery” story is built around inflated balances.

What users should focus on before reaching out

After moving away from in-person processing for high-sensitivity cases, Brooks said Crypto Asset Recovery now handles investigations remotely and processes sensitive wallet information through automated and air-gapped systems. He also noted that many of the cracked wallets involved far smaller balances than clients expect: around 71% contained less than $100, and the company does not charge for asset recovery below that threshold.

In Brooks’ view, the simplest way to avoid needing recovery services at all is understanding what a recovery seed is and why it matters—because the biggest vulnerabilities often come from human gaps rather than cryptographic weaknesses.

Going forward, readers should watch for more public discussions of wallet randomness and hardware implementation issues, as those technical details are often what determine whether “recovery” is feasible at all—or whether the most important step is preventing loss in the first place.

This article was originally published as Recovery Firm Recovers $1B in Crypto Wallets, Finds $10 Usable on Crypto Breaking News – your trusted source for crypto news, Bitcoin news, and blockchain updates.