A case that started with a claim of 5,000 Bitcoin ended with about $10.
Crypto recovery specialist Chris Brooks said that in 2021, a client named Rusty contacted him and claimed that he and two other people had won 5,000 BTC in a court case, worth around $53 million at the time.
They quickly set up a Zoom call. Brooks, the founder and CEO of Crypto Asset Recovery, said there were three men on the call, and one of them held up a phone showing what appeared to be a Bitcoin address with roughly $53 million in it.
The group said they were able to withdraw as much as $300,000 a week but wanted to access the entire fortune. They told Brooks that if he and his son Charlie flew to Georgia to help crack the wallet, they would make them millionaires.
Brooks and his son bought plane tickets and left the next day.
During lunch, Rusty said the wallet did not just contain 5,000 BTC. The men then drove for about an hour to a strip mall owned by one of them, went into a back office, and handed over notebooks containing dozens of recovery seeds. Brooks and Charlie spent the day opening wallets.
They found about $10 in Bitcoin.
Brooks said he never established whether the wallets they were given had previously held the BTC or ETH Rusty claimed to own. The pair were never reimbursed for the flights. He now suspects Rusty may have fallen victim to scammers who convinced him he had a large crypto fortune when he did not.
For Brooks, it became an early lesson in the crypto recovery business: sometimes crypto is lost, sometimes the wallet is lost, sometimes the password is lost, and sometimes the money was never there at all.
Losing access does not always mean the crypto is gone
For wallet recovery specialists, the phrase “lost crypto” can describe very different situations.
They are not pulling Bitcoin back from the blockchain. What they recover is the information needed to access a wallet that already exists.
A hardware wallet may have been thrown away, a password may have been forgotten, or part of a seed phrase may be missing. None of that automatically means the underlying assets have disappeared.
Bruno Krauss, co-founder and chief technical officer of recovery firm ReWallet, told Cointelegraph Magazine that Bitcoin’s BIP39 seed phrase standard uses a list of 2,048 words. If someone knows most of the words, specialists can sometimes search the remaining possibilities in a systematic way. The fewer missing pieces there are, the more workable the problem becomes.
Password recovery can follow a similar pattern. Krauss said ReWallet once recovered a 20-character password that protected roughly $3 million after reverse-engineering a flawed password generator.
Some cases rely less on technical flaws and more on understanding how a specific person creates passwords.
That can mean asking clients about favorite foods and places, children’s names and birthdays, personal milestones, or memories. In one case, Krauss said a customer was sure she had used her children’s names, only to remember later that the password was actually a phone number linked to a local delivery service.
Passphrases can make a valid recovery look like a failure
Tom Bennet, a Bitcoin educator who has studied wallet security, said one especially confusing category is the passphrase.
A passphrase is an extra layer added on top of a seed. Enter a different passphrase, and the wallet may not show an error. It can simply open a different valid wallet.
That means a user can have the correct seed phrase, enter it correctly, and still believe their BTC has disappeared.
Broken or lost hardware wallets are another area that often causes confusion. Even if the device itself no longer works, the funds can usually be restored on another device if the backup seed phrase still exists.
Because of that, recovery specialists do not necessarily need the original hardware. What they need is enough information to reconstruct access to the keys.
Recovery can also mean correcting mistakes rather than opening a lost wallet. If crypto is sent to the wrong blockchain, such as BNB sent to Ethereum, it may sometimes be recoverable if the receiving wallet remains under the user’s control.
Brooks said Crypto Asset Recovery has been contracted to crack more than 3,000 wallets belonging to around 1,500 people, and it has recovered passwords for about 63% of them.
There is still a hard limit
Bennet said that limit is one of the core trade-offs of self-custody. A Bitcoin wallet does not have a bank-style recovery system, and there is no central administrator who can verify identity and restore access.
Lucien Bourdon, a Bitcoin analyst at hardware wallet maker Trezor, put it in more direct terms: if the wallet backup is lost and the wallet containing the keys cannot be accessed, “no recovery company can help.”
He warned that because crypto wallets depend on randomness, guessing a private key is effectively impossible in practice. In a recent Coldcard case, a firmware bug weakened seed randomness on some wallets and made the seeds brute-forceable without physical access.
But if a genuinely random seed or private key has been completely destroyed, the number of possibilities is simply too large.
Krauss said recovery specialists can occasionally find technical paths into wallets that owners assumed were permanently inaccessible. Old wallet software, corrupted files, poorly generated passwords, and hardware vulnerabilities can all create unusual openings.
Recovery services can also become a security risk
The industry carries an obvious tension. The person who may be able to help restore access to your crypto also needs the information that can unlock it.
A seed phrase is not like a standard password that can be changed after exposure. Anyone who has the necessary wallet backup can often control the funds.
That makes the choice of a recovery provider a security decision on its own. Bourdon said users should be cautious about unsolicited messages from anyone claiming they can recover lost funds.
Krauss said other warning signs include pushing users onto WhatsApp, contacting them through personal email accounts such as Gmail, demanding upfront payment, or telling users to open exchange accounts.
Charging a share of successfully recovered funds is not unusual in this business. Asking for money upfront while promising to recover a wallet should be treated as a serious warning sign.
How the Rusty case changed Brooks’ approach
Brooks said the Rusty episode taught him another lesson. Crypto recovery may sound like a technical assignment, but a person who believes they are sitting on millions or billions of dollars can also present a security risk.
Crypto Asset Recovery no longer flies out to meet clients in person as it did in that case. The company now handles cases remotely and processes sensitive wallet information through automated and air-gapped systems.
Brooks said around 71% of the wallets his firm cracks contain less than $100, and the company does not charge a fee for recovery below that amount.
If there is one point the story leaves behind, it is a narrow one: whether crypto can be recovered depends on what access information still exists. Sometimes the keys can be reconstructed. Sometimes they cannot. And sometimes the supposed fortune was never real in the first place.