A cryptocurrency recovery firm that was asked to find a wallet said to contain 5,000 bitcoin later confirmed assets worth only about $10, a case that has been disclosed. The case shows that cryptocurrency recovery is not about restoring assets that disappeared on a blockchain, but a process of reconstructing lost information so a user can regain access to an existing wallet.

Cointelegraph reported on Sept. 3 that Chris Brooks, founder and CEO of Crypto Asset Recovery, received a request in 2021 from a client known as "Rusty" to restore a wallet containing 5,000 BTC.

Rusty claimed that he and two others had secured 5,000 BTC through court litigation, and that its value at the time was about $53 million. They showed, via video call, a screen displaying a large amount at a specific bitcoin address, and said they could withdraw up to $300,000 a week but wanted to take out the entire holding.

Brooks and his son traveled to Georgia the day after taking the assignment. They were handed notes listing dozens of recovery seeds and worked all day to restore the wallet, but the outcome was far from what they expected.

The assets actually confirmed were only bitcoin worth about $10. Brooks was ultimately unable to verify whether the wallet he received ever actually contained the bitcoin or ether (ETH) Rusty claimed. He did not even get reimbursed for airfare costs. He now suspects Rusty may have been a fraud victim who came to believe he held a large amount of cryptocurrency despite having no actual assets.

What this case shows is the essence of cryptocurrency recovery. Recovery firms do not find bitcoin that has disappeared from the blockchain, but restore the information needed for users to regain access to wallets they already own.

Even if a hardware wallet is lost or a password forgotten, recovery may be possible if some information remains. Bruno Kraus, co-founder and CTO of ReWallet, said that because bitcoin's BIP39 seed phrase is based on a list of 2,048 words, if most words are remembered the remaining combinations can be systematically searched.

The same applies to passwords. ReWallet introduced a case in which it reverse-engineered a flawed password generator and recovered a 20-character password protecting assets worth about $3 million.

In some cases, a user's habits or memory can be clues. Recovery firms sometimes infer past password-generation rules based on personal information such as a client's preferred foods or places, children's names, and birthdays. In one case, a client remembered using a child's name as a password, but the actual password was a phone number linked to a local delivery service.

Passphrases in particular can make wallet recovery more difficult. Security educator Tom Bennett said that even if a correct seed phrase is entered, entering an incorrect passphrase along with it may open another valid wallet rather than display an error message. That is why users can mistakenly believe assets in their original wallet have disappeared.

There are also clear cases in which recovery is impossible. Bitcoin wallets have no central administrator that can verify identity and restore an account like a bank does.

Lucien Bourdon, a bitcoin analyst at Trezor, warned that if a wallet backup is lost and access is also unavailable to the wallet containing the private key, no recovery firm can help. When a properly generated seed phrase or private key is completely gone, the number of possible combinations is so large that random guessing is virtually impossible.

By contrast, recovery may be possible when assets are mistakenly sent to a wallet under the user's control. For example, if the wrong blockchain is selected, such as sending BNB to the Ethereum network, there may be a chance to recover the assets if access to the wallet is available.

Care is also needed when choosing a recovery firm. A wallet seed phrase or private key is not information that can be changed later like a typical password. The moment backup information needed for recovery is handed to a firm, that information can translate into control over funds.

The industry advises people to be wary of firms that steer conversations to specific messaging apps such as WhatsApp, demand use of a personal Gmail account, require advance payment, or instruct clients to open a new exchange account. Charging a fee as a percentage of the amount recovered is common, but demanding an upfront deposit while guaranteeing wallet recovery is cited as a danger sign.

Crypto Asset Recovery said it has unlocked more than 3,000 wallets for about 1,500 clients so far, and recovered about 63 percent of passwords. Not all recovered wallets held large amounts of assets. About 71 percent of all requests had balances of less than $100, and the company said it does not charge fees for assets at or below that level.

After the 5,000 BTC case, Crypto Asset Recovery also stopped the practice of visiting clients in person to handle sensitive information. It now processes sensitive wallet information remotely through an automated segregation system.

Ultimately, the first thing to check in cryptocurrency recovery is not "how to find it." It is to confirm whether assets actually exist in the wallet and whether the minimum seed, password and backup information needed to access the wallet remains. That is because there is no central administrator on a blockchain that can intervene at the last moment and restore assets like a bank.