Crypto Hunter: Engineering a BIP39 Wallet Recovery Tool

Crypto Hunter is a security tool we built for a painfully common scenario: a wallet owner has their BIP39 seed phrase written down, but one or two of the words are missing or were miscopied. The funds are intact on-chain and provably theirs - and completely unreachable. This is a recovery problem, not a hacking problem, and it sits at the intersection of our security tooling and digital investigation practices.

A BIP39 seed phrase encodes a wallet's master key as words from a fixed 2048-word list. One missing word means up to 2048 candidates; two missing words, over four million combinations - each requiring checksum validation, key derivation across multiple standards, and an on-chain balance check to confirm the right one. Misspelled words add another dimension: the written word is not on the list at all, and the true word must be inferred. Done naively, this search is computationally impractical and dangerous - the tool necessarily handles the most sensitive secret in cryptocurrency.

We built a systematic search engine over the BIP39 space. For missing words, it tests candidate words in the unknown positions, discarding invalid mnemonics instantly via checksum validation - eliminating the vast majority of the space before any expensive cryptography runs. For misspelled words, a Levenshtein-distance algorithm ranks the closest valid BIP39 words and tests each permutation. Valid mnemonics then flow into multi-path address derivation - BIP44 (legacy), BIP49 (SegWit), and BIP84 (native SegWit) - with addresses derived across EVM chains, Solana, Bitcoin, Tron, and Polkadot, and balances checked across 8+ chains to positively confirm a recovery. Noise filtering skips known test vectors, developer keys, and invalid entropy. Work is parallelized with a thread pool, and a Flask dashboard tracks progress across recovery sessions.

Python 3 with ThreadPoolExecutor for parallel search; standard BIP39 mnemonic and HD wallet libraries with Web3.py and eth_account for derivation; Base58 tooling for Solana and Bitcoin addresses; a Levenshtein implementation for misspelling correction; Flask for the progress dashboard.

The defining design rule: all processing happens locally. Seed phrase material is never transmitted over the network - only derived public addresses are used for balance lookups. The tool is operated for owners recovering their own wallets, with ownership verification required before any recovery engagement; it is engineered and used as defensive tooling, not an attack capability, which is also why its design targets the specific 1-2 missing word scenario rather than general brute force.

Crypto Hunter is live as an operational tool in our recovery practice. Its architecture - checksum-first pruning, misspelling correction, multi-chain confirmation - turns a search space of millions of permutations into a tractable, verifiable process, and its local-only processing model means clients never have to hand their partial secrets to a third-party service.

Built in-house by our security engineering team and maintained as part of our digital investigation toolkit.