Crypto Recovery Services Explained

What gets called lost crypto is often lost keys. Imagine forgetting the combination to a safe. You might say the money is gone and in a sense you’d be correct, but it's still sitting inside, untouched. You haven't lost the money. You've lost your way in.

Crypto works almost the same way. The funds stay on the blockchain, at the same address, visible to the public. What's missing is the key that proves they're yours. That is what wallet recovery is about and you could compare it to locksmithing in a way.

One disclaimer upfront: if your coins or tokens were stolen or you fell victim to a scam, that’s a different story. To stay with the safe: you wouldn’t call a locksmith if the safe had been carried off or if you opened it and found its contents stolen. A wallet recovery service can’t reverse a transaction or pull funds back from someone else’s wallet. What you can do in that case, and how to avoid a second scam on top of the first, is covered in “What If Your Crypto Was Stolen?” below.

A locksmith does not treat every job the same. Opening a safe with a forgotten combination is different work from opening one whose lock has seized. Wallet recovery works the same way. No two cases are identical and the smallest detail often decides the outcome.

In that sense crypto wallet recovery services are the locksmiths of the crypto industry. We are called when something has gone wrong with the keys that grant access to the funds. That covers a lot of ground and the specifics differ enormously. If we break it down, there are five reasons why users generally cannot access their wallet, in no specific order:

This is one of the most common cases and the chances of success vary tremendously. Some people have lost all memory of it. Others have a good intuition of what their password might have been.

Memory is not the only variable. The type of wallet, whether the wallet file is intact, whether a password manager was in use and what the original device was all play an important role. That is the difference between a strategic password recovery and simply brute-forcing in the hope of a miracle.

If you have lost or forgotten your password, do not give up yet. There are a few things worth trying before you contact anyone:

• Write down every password you have already tried without success and keep the list.
• Write down any fragment you still remember. A half-remembered password is worth far more than none.
• Search old password managers, browsers, notebooks and emails from that period.
• Think about what your password habits were when the wallet was created rather than what they are now.
• Check whether the original device or an old backup still exists somewhere.

Sometimes one click changes everything. The good news is that deleting a file doesn’t have to mean it is destroyed instantaneously. The data itself can stay on the drive until something writes over it. We don’t want to raise any false hopes here, as the medium the wallet was stored on does play a huge role but in general this scenario is a race rather than a puzzle.

With a forgotten password time may be on your side, as more hints can come up. With a deleted wallet file it works against you. Every photo saved, every update installed and every hour the machine stays in use reduces what can still be recovered. The type of drive matters as well. A traditional hard disk holds deleted data far longer than a modern SSD, which actively clears freed space in the background.

So our advice here is the opposite of the previous scenario. We suggest doing nothing at all. That includes:

• Stop using the device. Shut it down if you can.
• Do not install recovery software onto the same drive. Every install writes new data.
• Do not reformat, defragment or run cleanup tools.
• Look for older backups on other drives, in cloud storage or in old email before touching the original.
• Set the device aside and leave it untouched until you know which steps to take.

A seed phrase is a list of words that can rebuild an entire wallet from scratch. It is the master key. Losing all of it usually ends the story. Losing part of it very often doesn't.

The difference is arithmetic. Seed words aren’t arbitrary. They come from a fixed list of 2048 words and the phrase carries a built-in checksum, which means most possible combinations are invalid by design. Two missing words out of twelve leaves a few hundred thousand valid candidates if you know which positions are missing. Ten missing words run into numbers no machine will finish, at least not within our lifetime. Word order behaves the same way. Having all 12 words in the wrong sequence is usually a solvable problem. Having 24 in the wrong order is practically unsolvable unless part of the order is known.

This is where people give up too early. A seed phrase that is smudged, torn, partially missing or written down in the wrong order still contains very valuable information. The backup might look ruined. The math however is still intact for the available part.

What you can do right now:

• Write down every word you still have and mark which positions you are certain about.
• Note the order you believe they were in even if you are not sure.
• If the paper backup is damaged or faded keep it exactly as it is. Do not try to restore, retrace or rewrite it. At best make another backup of the damaged copy to prevent any further damage.
• Check which seed standard your wallet used and compare your list and memory to the official BIP39 wordlist, SLIP39 wordlist or whatever wordlist applies to your seed phrase.
• NEVER type your seed phrase into any “recovery” website online.

The software is gone. The company shut down, the project was abandoned or the recovery tool no longer runs correctly. This is the one case where the key is usually fine. What is missing is the door.

The blockchain has no opinion about whether a company still exists. Funds sit on a public ledger and that ledger will accept a valid signature made with a valid key, whether the software that created it was retired last year, a decade ago or genuinely never existed. The work here is not cracking anything. It is reading an old format and bridging the gap to something modern.

Four examples from our work:

• TheDAO: After the 2016 fork, DAO tokens remained redeemable for ETH through the WithdrawDAO contract. That contract is still on chain and there is no deadline. However most users don’t know if they have any funds to claim and how to claim them.
• Ether.li: The service closed in 2017 and its signature is permanently unavailable. However, the wallet only ever needed two of three signatures and the recovery sheet still holds the two required.
• Ethereum presale: The 2014 presale wallets were issued as a JSON file protected by a password. The file format is ancient. The private key inside is not.
• BitGo: The official Recovery Wizard often fails for older wallets, but the backup KeyCard issued at setup still contains everything required.

What you can do right now:

• Keep every file, printout, export and backup from that era even if nothing will open them.
• Note which version of the software you used and roughly when the wallet was created.
• Look for recovery sheets, PDFs or printed documentation.
• Do not reinstall old wallet software from unofficial sources. Abandoned projects attract fake downloads.

If the key to your safe is no longer made by the manufacturer, it does not mean the safe cannot be opened. It means you need someone who knows how that lock was built.

The file is there. The software simply refuses to open it. You might see an error message, a crash on startup or the wallet is simply empty. This is neither a missing key nor a missing door. It is a damaged lock.

File corruption usually comes from something ordinary. A power cut during a save. A copy that finished halfway. A failing sector on an aging disk. An antivirus program that quarantined part of the file. A transfer between two operating systems that handled the file differently.

A wallet file is a structured database and damage to one part does not always have to imply that the rest is broken as well. The private keys inside are small pieces of data and they can often be read directly even when the file as a whole will not load. Your wallet software is not the only way to read your wallet file. It is only the way that insists on the file being perfect.

What you can do right now:

• Make a copy before anything else and work only on the copy.
• Keep every version you have including the ones that fail to open.
• Write down the exact error message. It can sometimes give a hint which part of the file is damaged.
• Look for automatic backups. MultiBit and several other wallets create them without being asked.
• Do not let the wallet software repair or rebuild the file. Some attempt this on open and it can overwrite what is still readable.

These five problems cover most of what comes through our door but the list is not exhaustive. There are also combinations, e.g. a corrupted file on a failing drive from a wallet that no longer exists. Two people can describe what sounds like the same problem and have completely different odds of successful recovery because the solution always depends on what data and information is still available.

Keep the locksmith in mind. When it is the key or the safe that is misbehaving there is usually something that can be done. When the safe has been stolen or when there is genuinely nothing left to work with, that is a different story.

Whether you’ve lost access or are being approached with offers to recover stolen funds, the same checks apply. You would check a locksmith's credentials before handing over the keys to your house. The same care is worth taking when selecting a wallet recovery service and for the same reason. At some point in the process you will share information that forms part of the path to your funds.

There are operators in this industry who take money upfront and deliver nothing or take your information and run off. The good news is that they are easy to filter out. Eight things separate a trustworthy service from a fake one and none of them require technical knowledge to check.

A company you can look up. A registered business with an address and an entry in a public commercial register. Anyone can build a website in an afternoon. Not everyone can produce a company registration, particularly in a reputable jurisdiction.

Named people. Real staff with real names and a named contact for your project. Do not rely on a website alone. LinkedIn, press coverage and social accounts are useful second sources for checking whether the people behind a company actually exist.

You can meet them in person. The internet is a perfect place to hide an identity. You may never want to travel, but the option should exist. A provider with a real office you could visit, and who would accept material handed over in person, has far less room to disappear. If travelling isn't realistic, ask for a video call with the person who would actually handle your case. Treat the call as a competence check and an identity check: specific questions about your wallet type will tell you quickly whether you're talking to someone who has done this before.

Payment on success only. A service confident in its own assessment does not need money upfront. A flat fee charged regardless of outcome moves all of the risk onto you. A good wallet recovery service is in the same boat as you.

A written contract before any work begins. Nothing should start on a handshake or an email thread. The legal agreement should detail how the success fee works, what happens to your data and what happens if the recovery is not successful.

An honest assessment including no. Ask directly what the chances are. A service that says yes to every case is either not looking properly or not telling the truth. Some wallets genuinely cannot be recovered and you deserve to hear that for free.

They never ask for key material in order to quote. No legitimate provider needs your seed phrase or private keys to assess a case. Never hand over anything that could restore access before there is an agreement in place.

A secure method for transferring data. Your wallet data should never travel unencrypted. Ask how files will be sent and returned before you send anything at all. A provider without a clear answer to that question has not thought about your security.

For what it is worth, here is how we answer those questions. ReWallet is registered in Zug, Switzerland and listed in the Swiss commercial register. Our team is named on this site and every client gets a direct contact person. You can meet us at conferences and our office is a real address where clients are welcome to visit. We work on the basis of a written legal agreement. We charge 20% of what we recover and nothing at all if we recover nothing. A project’s assessment is free. We publish a PGP key for encrypted transfers and we never ask for key material before a contract is in place. When we believe a situation is hopeless we say so.

Here the key isn’t lost. Someone else used your key or, more often, you were tricked into sending the funds yourself. Blockchain transactions are final: once they’re confirmed, no wallet recovery service, developer or “blockchain expert” can reverse them. What can sometimes help is following the money to a point where someone may be able to freeze it, usually an exchange where the stolen funds are cashed out.

What you can do right away if you have been scammed:

• Stop sending any funds. Don’t pay any “unlock fee”, “tax” or “withdrawal fee” a platform demands before releasing your balance. That is the scam continuing.
• Secure what’s left. If a wallet was compromised, move any remaining funds to a new wallet with a new recovery phrase. Revoke token approvals you no longer trust.
• Document everything: transaction IDs, wallet addresses, dates, amounts, screenshots, emails, chat logs and website URLs.
• Report it to the police in your country and to its cybercrime authority, for example the FBI’s IC3 in the US, and visit the official FTC website for more information.
• Contact the exchange. If funds were sent from or to one, the exchange can sometimes freeze funds that arrive at its platform, but only if it hears about it quickly. Only contact exchanges via their official website and do not use any links, phone numbers or emails provided by the scammers. No reputable exchange will contact you unsolicited to offer recovery of your funds.
• For larger losses: a lawyer who specializes in crypto fraud can work with blockchain tracing firms and law enforcement to pursue the funds legally. However, this can be another way to get scammed, so proceed with caution when searching for legal assistance.

We cannot stress this enough: wallet recovery services like ReWallet can’t help with stolen or scammed funds. The route there is legal, not technical. Victims of crypto fraud are a prime target for a second scam. Fake “recovery services” find people who post about their losses online, have been scammed before or appear in crypto-related data leaks and promise to get the funds back. Warning signs:

• They contact you first, by phone, email or any messaging service.
• They guarantee they can recover stolen funds or reverse transactions.
• They offer to “hack back” the scammer or call themselves ethical hackers for hire.
• They ask for an upfront fee, a “release fee”, “withdrawal fee”, “unlock tax” or any other payment in crypto or fiat.
• They claim ties to law enforcement, a government agency, wallet provider, exchange or a blockchain itself.
• They create urgency and say you need to act fast.

A legitimate firm will be honest about how rarely stolen crypto is fully recovered. If an offer sounds like it will undo the theft, it is almost certainly the next scam.