In 2021, a client named Rusty reached out to crypto recovery specialist Chris Brooks, claiming that he and two others had won 5,000 Bitcoin in a court case — worth roughly $53 million at the time. A Zoom call was arranged immediately.

"There were three guys on the call, and one of them holds up a phone. It has like $53 million in a Bitcoin address," recalls Brooks, founder and chief executive of CryptoAssetRecovery.com.

The men said they were able to withdraw as much as $300,000 per week but wanted to extract the entire fortune. If Brooks and his son Charlie flew out to Georgia to help them crack the wallet, the men promised, they would make the pair millionaires. Brooks and his son bought plane tickets and departed the next day.

At lunch, Rusty — a 6-foot-3 Army veteran — revealed the wallet supposedly held more than 5,000 BTC. "Rusty pulls out his phone, and he shows us a billion dollars in ETH. And that's when I was like, okay, something very odd is going on here."

The group then drove about an hour to a strip mall owned by one of the men, where, in a back office, Brooks and his son were handed notebooks containing dozens of recovery seeds. They spent the day opening wallets.

They found about $10 in Bitcoin.

Brooks never established whether the wallets they were given had ever held the BTC or ETH Rusty claimed to own — and the pair were never reimbursed for the flights.

Brooks now suspects Rusty had been scammed by people who convinced him he possessed a large crypto fortune that never existed. The episode became an early lesson for the recovery business: sometimes crypto is lost, sometimes the wallet is lost, sometimes the password is lost — and sometimes the money was never there in the first place.

Related: Do the Coldcard attacks mean all hardware wallets are now insecure?

Losing your crypto doesn't always mean it's gone

For wallet recovery specialists, "lost crypto" can mean several very different things. They aren't recovering Bitcoin from the blockchain; they are recovering the information needed to access a wallet that already exists. A discarded hardware wallet, a forgotten password, or a partial seed phrase does not necessarily mean the underlying crypto has vanished.

"If you have some missing words, then you can often recover them," Bruno Krauss, co-founder and chief technical officer of recovery firm ReWallet, tells Magazine.

Bitcoin's BIP39 seed phrase standard draws from a list of 2,048 words, meaning that if someone remembers most of the words, specialists can sometimes systematically search the remaining possibilities. The fewer pieces missing, the more manageable the puzzle. Password recovery works in much the same way.

Krauss says ReWallet once recovered a 20-character password protecting roughly $3 million by reverse-engineering a flawed password generator. Other cases depend less on technical exploits than on understanding how a particular person constructs passwords — asking about favorite foods and places, children's names and birthdays, personal milestones or memories.

In one case, a customer was convinced she had used her children's names, only to realize the password was actually a phone number connected to a local delivery service: "She didn't know why, but then she thought about it, and she realized, oh, okay, it was because on this day I got the package delivered to the store and I thought, okay, this would be a nice password."

Passphrases add another layer of complexity

Bennet, a Bitcoin educator who has studied wallet security, points to a particularly confusing category: the passphrase. A passphrase is an additional piece of information layered on top of a seed. Enter a different passphrase and you don't necessarily get an error message — you may simply get another valid wallet.

"A wrong passphrase doesn't throw an error; it succeeds and shows you a zero balance," he tells Magazine. Users can therefore enter a correct seed phrase correctly and still believe their BTC has vanished.

"Passphrases also don't have any features to protect users from themselves; no list of 2,048 valid words, no checksum. So if you've forgotten a passphrase, it's basically the same question again: how random was your passphrase? If it's sufficiently random, there's often no way to recover it."

With lost or broken hardware wallets, even the broken device itself isn't always much help. If the backup seed phrase survives, the keys can generally be restored on another device — which is why recovery specialists don't necessarily need the original hardware, just enough information to reconstruct access to the keys.

Related: Irish police open Bitcoin wallet years after keys were apparently lost

Recovery can also mean fixing mistakes rather than retrieving a lost wallet. Crypto sent to the wrong blockchain — such as BNB to Ethereum — may sometimes be recoverable if the receiving wallet is under the user's control.

Brooks says Crypto Asset Recovery has been contracted to crack more than 3,000 wallets belonging to around 1,500 people and has cracked passwords for about 63% of them.

Sometimes you really have lost it

There is, however, a hard boundary. "If your seed is truly random and you lose it completely, your Bitcoin is gone," Bennet says.

That is one of the fundamental trade-offs of self-custody. A Bitcoin wallet has no bank-style recovery system and no central administrator who can verify identity and restore an account. The scale of the problem is significant: blockchain analytics firm Chainalysis has estimated that several million Bitcoin — a substantial share of all that will ever exist — sit in wallets whose keys are effectively out of reach, which is part of why a niche recovery industry has grown around lost credentials.

Lucien Bourdon, Bitcoin analyst at hardware wallet maker Trezor, puts it even more starkly: if the wallet backup is lost and the wallet containing the keys is inaccessible, "no recovery company can help." He warns: "If they could, the wallet could be cracked, and self-custody would be fundamentally compromised."

Thanks to randomness, guessing a private key is effectively impossible. In the recent case of Bitcoin hardware wallet Coldcard, a firmware bug weakened seed randomness on some wallets, making the seeds brute-forceable without physical access — though weak random number generation is not a new problem.

But if a genuinely random seed or private key has been completely destroyed, the number of possibilities is simply too large. Krauss notes that recovery specialists can occasionally find technical paths into wallets owners assumed were permanently inaccessible, and that old wallet software, corrupted files, poorly generated passwords and hardware vulnerabilities can all create unusual opportunities: "Don't give up on edge cases."

Recovery specialists can sometimes be scammers

There is an uncomfortable irony in the recovery business: the person who may help you regain access to your crypto needs the very information that grants someone access to it. A seed phrase isn't like a password that can be changed after being seen; anyone possessing the wallet backup can often control the funds. Choosing a recovery specialist is therefore itself a security decision — a point regulators have flagged as well. California's financial regulator, for example, has warned the public that advance-fee "crypto recovery" scams have proliferated, with fraudsters posing as asset-recovery experts and charging upfront fees for services never delivered.

"If you decide to do it, do the homework. Look for firms with a real track record and reviews you can trace to actual customers. Check that they charge on success rather than up front. And move your funds to a fresh wallet with a new backup as soon as you're back in," Bourdon says, adding that users should be wary of any unsolicited messages claiming someone can recover their funds.

Krauss cites other warning signs: people pushing users onto WhatsApp, contacting them from personal email addresses such as Gmail, demanding upfront payments, or asking them to open accounts at an exchange. Recovery firms charging a percentage of successfully recovered funds are not unusual, but paying money upfront to someone promising wallet recovery should set alarm bells ringing.

The Rusty case taught Brooks another lesson: while crypto recovery might sound like a purely technical job, a person who believes they are sitting on millions or billions of dollars can also be a security risk. Crypto Asset Recovery no longer flies out to meet clients in person; the company now handles cases remotely, with sensitive wallet information processed through automated and air-gapped systems.

Brooks says around 71% of the wallets they crack contain less than $100, and the company does not charge a fee for asset recovery under that amount.

If there is one thing he wishes crypto users understood about asset recovery, it is this: "Learn what in the world a recovery seed is and why they're important. That's the simplest way to make sure you never have to talk to us."

Magazine: Mystery surrounds why an OG burned $1M in Bitcoin