ETH recovery

💎 Recover Ethereum wallet · keystore + MetaMask

Ethereum wallets come in several formats: keystore JSON (Geth/Parity), MetaMask vault, hardware wallets (Ledger/Trezor). Each has its own protection system and recovery workflow. This guide covers the 4 most common types and viable cases for each.

⚡ Complex case? Professional service /wallet-recovery/ · USD 35 diagnostic, success fee only if we recover.

Ethereum wallet types and how to identify them

1) Keystore JSON (UTC--*): Geth, Parity, MyEtherWallet file. Contains private key encrypted with scrypt + AES-128-CTR. Hashcat module -m 15600.

2) MetaMask vault: in browser localStorage or vault.json file in extension. Encrypted with AES-256 + scrypt. Hashcat module -m 26600.

3) Hardware wallet (Ledger/Trezor): PIN protects device. If you have seed on paper, recovery is trivial without GPU. If you lost seed AND PIN, basically bricked.

4) Custodial (exchanges): Binance, Coinbase, etc. Recovery goes through their KYC flow, not crypto recovery.

Keystore JSON: most common case

If you have a file named UTC--2017-...--0xABCD..., it's standard Ethereum keystore JSON.

Extract hash + crack:

ethereum2john.py UTC--xxx > hash.txt

hashcat -m 15700 hash.txt wordlist.txt   # scrypt N=262144

RTX 3090 throughput: ~700 attempts/sec on scrypt-128. It's SLOW compared to other encryptions because scrypt is designed to be memory-hard (GPU resistant).

Wordlist + mask are still viable if you remember patterns. Random 12+ chars: impossible single-cluster.

MetaMask vault: location and recovery

MetaMask saves your seed encrypted in vault. To extract:

Chrome/Edge:

%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\

kbihfbeogaeaoehlefnkodbefgpgknn\\

Firefox: %APPDATA%\\Mozilla\\Firefox\\Profiles\\xxx\\storage\\default\\moz-extension+++xxx

Inside you'll find LDB files with vault. There are open source tools (metamask-extractor) to parse and extract encrypted JSON.

Then hashcat -m 26600 with your wordlist:

hashcat -m 26600 vault_hash.txt rockyou.txt

Throughput: ~100,000 a/sec. Faster than keystore due to fewer scrypt iterations. RockYou processes in 2 minutes.

Recovery via seed phrase (without needing password)

If you have your BIP39 seed phrase (12 or 24 words) somewhere (paper, old screenshot, email, password manager), you DON'T need to recover wallet password. You import the seed in a new wallet and done.

Method:

Install MetaMask (or any HD wallet)
Click "Import existing wallet"
Paste 12-24 words
Define new password

Works because BIP39 seed = deterministic master key. Generates same private keys always, regardless of wallet used.

If your seed is incomplete (missing words), apply brainwallet recovery methods or professional AI Scan.

Hardware wallets: Ledger / Trezor

Trezor (One/T model): PIN brute-forced with incremental limit (10s, 1m, 10m, 1h, etc.). After 16 failed attempts: automatic device wipe. Without seed phrase = total loss.

Professional Trezor service: exists (Kraken Security Lab demonstrated T1 exploit in 2020). Costs: $$$$. Only viable for balances >$50K.

Ledger (Nano S/X): PIN protect + after 3 failed attempts device wipe. Without seed = total loss. Specialized physical services (chip flashing) cost $5K-50K, ~60% success rate.

Recommendation: if you only lost PIN but have seed, recovery is trivial (import in another wallet). If you lost BOTH, the path is specialized service like Wallet Recovery Services or KeychainX for hardware-specific extraction.

Comparison: which service for Ethereum

For keystore JSON: hashcat alone on your PC works if you have patterns. Paid GPU cluster if you remember little.

For MetaMask vault: similar, hashcat if you have patterns. Easier than keystore due to weaker algorithm.

For hardware wallets: Wallet Recovery Services (US) charges 20% of balance, no upfront. Specialists in chip-level extraction. Only real path for hardware without seed.

Our service: ideal for keystore JSON + MetaMask + brainwallets. We DO NOT offer hardware wallet chip extraction. Pricing: USD 35 diagnostic, USD 2000 AI Scan, 30-40% success fee.

Frequently asked questions

What if I have multiple accounts in MetaMask?

Single BIP39 seed + multiple derived accounts. Recovering vault gives you ALL accounts (default 5 ETH addresses + tokens in each).

Do you recover ERC-20 tokens?

Yes. Once wallet recovered, all tokens (USDT, USDC, DAI, NFTs, etc.) are at same addresses. You'll see everything automatically when importing.

Does it work with centralized exchange wallets (Binance, etc)?

No, those are custodial. Recovery goes through their KYC flow. You need ID + original email + account data. Not our area.

Do you recover wallets that had NFTs?

Yes. NFTs are tied to Ethereum address, not wallet software. Once wallet recovered, you see NFTs on OpenSea/Rarible normally.

And if my keystore is from a fork (Polygon, BSC, etc)?

Same technical format, same recovery. Address works for all EVM chains. If you recover the key from Ethereum file, works for Polygon/Avalanche/BSC too.

Complex case? We can help

5×RTX 3090 GPU cluster + ML engineer. USD 35 diagnostic, USD 2000 AI Scan, success fee 30-40% only if we recover.

🔐 Wallet Recovery →