The Bitcoin Lawyer Cracks Famous 12-Word Seed Sentence in Minutes

A systems architect cracked a seed sentence and won a 100,000 Satoshi prize, or 0.001 Bitcoin (BTC), worth $29, in just under half an hour. Cointelegraph spoke with Andrew Fraser in Boston, who emphasized the importance of keeping a Bitcoin wallet seed safe and offline.

A seed phrase or recovery phrase is a string of random words generated when a wallet is created that can access the wallet, similar to a master key. Fraser brute forced a 12-word seed phrase that Bitcoin guru “Wicked Bitcoin” shared on Twitter:

As shown, Wicked’s Tweet challenged users to decipher the correct order of the 12-word seed phrase.

“Anyone wanna try to brute force this 12 word seed phrase to secure 100,000 bet? I’ll give you all 12 words but in no particular order. Standard diversion path w/84’/0’/0’…no fancy trick. GL.”

It only took 25 minutes to unlock the 100,000 Satoshis – or just under $30. The incident serves as a timely reminder to Bitcoin users and crypto enthusiasts to take crypto security seriously.

Fraser cracked the code using BTCrecover, a software application available on GitHub. The software offers a variety of tools that can determine seed phrases with missing or encrypted mnemonics and passphrase cracking tools. Over Twitter DMs, Fraser told Cointelegraph:

“My gaming GPU was able to determine the correct order of the seed phrase in about 25 minutes. Although a more capable system would do it much faster.”

He noted that anyone with a basic knowledge of running Python scripts, using the Windows command shell, and understanding the Bitcoin protocol — especially the BIP39 mnemonics — should be able to replicate his success.

Cointelegraph asked Fraser about the security of 12-word seed keys. Fraser explained that they are “perfectly secure if the words remain unknown to an attacker or there is a ’13th seed word’ passphrase used in the derivation path of the wallet.”

Also, he emphasized the superior security of 24-word seed keys.

“Even if an attacker knew the wrong words of your 24-word seed key, they would never have a hope of finding the correct seed.”

Fraser broke down the entropy calculations to explain the difference in security between the two types of seed keys. A 12-word seed has approximately 128 bits of entropy, while a 24-word seed has 256 bits. Once an attacker knows the unordered words of a 12-word seed, there are only about half a billion possible combinations, which is relatively easy to test with a decent GPU. However, a 24-word seed has about 6.24^24 possible combinations – and that’s a lot of zeros.

Related: The Worst Places to Keep Your Crypto Wallet Seed

Even the probability of an attacker cracking a 12-word seed phrase is borderline absurd. 24-word seed phrases may be superior, but as Wicked points out in a post-mortem to the seed sentence challenge; “it’s not going to get hacked tbh.”

Ultimately, it is a timely reminder to readers to ensure that seed sentences are never published or shared online. This means that a seed phrase should not be stored in a password manager, a cloud storage solution, and that they should certainly not be typed on a phone.

Fraser also stressed the importance of keeping seed keys secret and taking advantage of a passphrase that acts as part of the diversion path. As for the 100,000 Sats Fraser took home? Fraser tweeted that he wore them to dinner that night: Chicken Marsala. Talk about circular economy.