user95042: I have managed to lose 5 words of my 24 word Ledger Nano S recovery phrase. I have words 1-19 but I am missing words 20-24.
I have significant holdings on the wallet so would very much like to recover it if possible.
The passphrase is a BIP39 mnemonic (see https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki).
I have the bitcoin and ethereum public addresses for this mnemonic. I am wondering if it's feasible to brute force the passphrase.
Each word is 11 bits (2^11 = 2048 possible words).
The last (24th) word of the passphrase is of the following form [3 random bits][8 bit checksum].
Therefore I only have to check 2^(55 - 8) = 2^47 = 1.4x10^14 combinations.
I would have to compute SHA-512-HMAC with an iteration count of 2048.
As far as I understand, that means I'd have to compute 1.4*10^14 * 2048 = 2.87*10^17 hashes in total.
Is there any hardware out there designed for this? I am aware of ASICs that compute sha-256 hashes but not sha-512 hashes.
Perhaps I could tweak one to work with sha-512 since they are very similar.
Assuming a fairly typical ASIC hashrate of 1TH/s (10^12 hashes per second), I could exhaust the search space in 2.87*10^5 = 287000 seconds = 3.3 days. I'd probably get there sooner, of course (expected 1.65 days). Time is not something I am worried about. Even if I have to wait months, I don't mind - so if I can get 10GH/s at a reasonable price, that would be great.
I would really appreciate any help/information you could provide to help me out and make sure I haven't missed anything.
I could also use GPUs for this (I calculate I can run them at roughly $1/10TH - so it would cost me $28.7k to exhaust the search space, which I will do if there are no cheaper options).
Many thanks,
James

user84072: You can try btcrecover on github, look here: https://github.com/gurnec/btcrecover
it has a special feature to find missing mnemonic.
I also have a GPU version of it, if you need help
/KX

user99471: You have three options here:

Using a GPU implementation of the Gurnec´s Seed Recovery script
Use Hashcat / JTR, where PBKDF2-HMAC-SHA512  is already implemented.
Use brainflayer, similar to Gurnecs software, no multithread, no GPU.

Gurnec´s script runs at aproximately 40kh/s under my i7-8700k without OC. So if you only had lost the last 4 words of your seed, it will be 2^36 hashes.
2^36 h / 40.000 h/s = ~ 20 days
So it will take roughtly 3 weeks to test every combination.
But to crack the last 5 words of your seed it would take 2048 * 20 days.
On the other side according to the benchmarks PBKDF2-HMAC-SHA512 hashes at a 4.800 kh/s under a usual 8 x 1080´s rig so it should be possible to recover in several days the 5 missing words.
tldr; Implement GPU in btcrecover or brainflayer or understand how to make it work under Hashcat. Up to 3 words + checksum word doable in CPU, more need GPU.

user1652: With 4 unknown words there is around 1.76 trillion possible mnemonics and John Cantrell was able to write and setup network of CPU and GPU solvers which successfully checked 1 trillion mnemonics in 30 hours (as part of a challenge to win a bitcoin) by renting bunch of GPUs (it cost him less than $500).
The last 5th word you can just pre-calculate to reduce the number of calculations as it contains a checksum.
So if you are able to reproduce similar setup, you can brute-force and recover your wallet in just few days.
Read more at: How I checked over 1 trillion mnemonics in 30 hours to win a bitcoin.
Project repositories:

https://github.com/johncantrell97/bip39-solver-server
https://github.com/johncantrell97/bip39-solver-gpu
https://github.com/johncantrell97/bip39-solver-cpu


95042: <p>I have managed to lose 5 words of my 24 word Ledger Nano S recovery phrase. I have words 1-19 but I am missing words 20-24.
I have significant holdings on the wallet so would very much like to recover it if possible.
The passphrase is a BIP39 mnemonic (see <a href="https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki" rel="noreferrer">https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki</a>).
I have the bitcoin and ethereum public addresses for this mnemonic. I am wondering if it's feasible to brute force the passphrase.</p>

<p>Each word is 11 bits (2^11 = 2048 possible words).
The last (24th) word of the passphrase is of the following form [3 random bits][8 bit checksum].
Therefore I only have to check 2^(55 - 8) = 2^47 = 1.4x10^14 combinations.
I would have to compute SHA-512-HMAC with an iteration count of 2048.
As far as I understand, that means I'd have to compute 1.4*10^14 * 2048 = 2.87*10^17 hashes in total.</p>

<p>Is there any hardware out there designed for this? I am aware of ASICs that compute sha-256 hashes but not sha-512 hashes.
Perhaps I could tweak one to work with sha-512 since they are very similar.</p>

<p>Assuming a fairly typical ASIC hashrate of 1TH/s (10^12 hashes per second), I could exhaust the search space in 2.87*10^5 = 287000 seconds = 3.3 days. I'd probably get there sooner, of course (expected 1.65 days). Time is not something I am worried about. Even if I have to wait months, I don't mind - so if I can get 10GH/s at a reasonable price, that would be great.</p>

<p>I would really appreciate any help/information you could provide to help me out and make sure I haven't missed anything.
I could also use GPUs for this (I calculate I can run them at roughly $1/10TH - so it would cost me $28.7k to exhaust the search space, which I will do if there are no cheaper options).</p>

<p>Many thanks,
James</p>
 84072: <p>You can try btcrecover on github, look here: <a href="https://github.com/gurnec/btcrecover" rel="nofollow noreferrer">https://github.com/gurnec/btcrecover</a></p>

<p>it has a special feature to find missing mnemonic.</p>

<p>I also have a GPU version of it, if you need help</p>

<p>/KX</p>
 99471: <p>You have three options here:</p>

<ol>
<li>Using a GPU implementation of the Gurnec´s <a href="https://github.com/gurnec/btcrecover/blob/master/seedrecover.py" rel="nofollow noreferrer">Seed Recovery script</a></li>
<li>Use Hashcat / JTR, where PBKDF2-HMAC-SHA512  is already implemented.</li>
<li>Use <a href="https://github.com/ryancdotorg/brainflayer" rel="nofollow noreferrer">brainflayer</a>, similar to Gurnecs software, no multithread, no GPU.</li>
</ol>

<p>Gurnec´s script runs at aproximately 40kh/s under my i7-8700k without OC. So if you only had lost the last 4 words of your seed, it will be 2^36 hashes.</p>

<p>2^36 h / 40.000 h/s = ~ 20 days</p>

<p>So it will take roughtly 3 weeks to test every combination.</p>

<p>But to crack the last 5 words of your seed it would take 2048 * 20 days.</p>

<p>On the other side according to the <a href="https://hashcat.net/forum/thread-6391.html" rel="nofollow noreferrer">benchmarks</a> PBKDF2-HMAC-SHA512 hashes at a 4.800 kh/s under a usual 8 x 1080´s rig so it should be possible to recover in several days the 5 missing words.</p>

<p>tldr; Implement GPU in btcrecover or brainflayer or understand how to make it work under Hashcat. Up to 3 words + checksum word doable in CPU, more need GPU.</p>
 1652: <p>With 4 unknown words there is around 1.76 trillion possible mnemonics and <a href="https://github.com/johncantrell97" rel="nofollow noreferrer">John Cantrell</a> was able to write and setup network of CPU and GPU solvers which successfully checked 1 trillion mnemonics in 30 hours (as part of a <a href="https://twitter.com/alistairmilne/status/1266037520715915267" rel="nofollow noreferrer">challenge to win a bitcoin</a>) by renting bunch of GPUs (it cost him less than $500).</p>
<p>The last 5th word you can just pre-calculate to reduce the number of calculations as it contains a checksum.</p>
<p>So if you are able to reproduce similar setup, you can brute-force and recover your wallet in just few days.</p>
<p>Read more at: <a href="https://medium.com/@johncantrell97/how-i-checked-over-1-trillion-mnemonics-in-30-hours-to-win-a-bitcoin-635fe051a752" rel="nofollow noreferrer">How I checked over 1 trillion mnemonics in 30 hours to win a bitcoin</a>.</p>
<p>Project repositories:</p>
<ul>
<li><a href="https://github.com/johncantrell97/bip39-solver-server" rel="nofollow noreferrer">https://github.com/johncantrell97/bip39-solver-server</a></li>
<li><a href="https://github.com/johncantrell97/bip39-solver-gpu" rel="nofollow noreferrer">https://github.com/johncantrell97/bip39-solver-gpu</a></li>
<li><a href="https://github.com/johncantrell97/bip39-solver-cpu" rel="nofollow noreferrer">https://github.com/johncantrell97/bip39-solver-cpu</a></li>
</ul>
