A father and son who help clients find forgotten crypto passwords estimate billions of dollars worth of lost bitcoin is recoverable

• A father and son team of computer programmers help people find lost passwords to their crypto wallets.
• Chris and Charlie Brooks conducted an analysis that led them to estimate between 68,110 and 92,855 seemingly lost bitcoins are recoverable.
• At current prices, the high end of the recoverable bitcoin estimate amounts to $4.7 billion.

For Chris and Charlie Brooks, finding lost passwords to cryptocurrency wallets requires figuring out how their clients' minds work - and that effort can help their customers retrieve a slice of what the pair estimates is about $4.7 billion worth of recoverable bitcoin stranded in locked wallets.

"We get a really broad spectrum of clients. We have a client who is an early-stage miner in bitcoin who lost all of his information and he knows he's got some bitcoins somewhere … We get clients who were told in 2017 to buy into the hype-bubble and they bought $1,000 [worth] and they are looking for something to cover the rent," Charlie, a 20-year-old computer programmer who joined his father in running Crypto Asset Recovery based in New Hampshire, told Insider in a video interview.

"One of our most recent cracks had about $250,000," in a blockchain wallet, said Charlie, who majored in computer science in college. He's put school aside for now to work at the business. "This is something I've always liked. I would follow along with my dad ... Online treasure hunting, it seemed really cool."

Nearly 40% of 1,000 US crypto owners in a recent survey from Cryptovantage said they had lost wallet passwords and, on average, those unable to find their passwords lost $2,134.

The jumping-off point of the duo's estimate of what can be recovered was a Chainalysis estimate that up to 20% of 18.5 million existing bitcoin appear to be lost or stranded in locked wallets. The figures were cited in January by The New York Times in a story about a San Francisco-based programmer who couldn't find the password to the hard drive that stored his 7,002 bitcoin. After eight wrong guesses, he had two left to figure out the password before the virtual currency was likely lost forever.

The Chainalysis figure sparked a question for the Brookses.

"Yes, that bitcoin is lost but if the owner of that bitcoin were motivated, what percentage of those do we think is reasonable to assume could be recovered?," said Chris, a 50-year-old computer programmer who started his business in 2017 and, after some time retooling, ramped up operations late last year when his son came on board.

Nakamoto's forum

To find a sample of lost bitcoin for their analysis, Chris said they turned to a thread on BitcoinTalk, a forum whose creation is credited to bitcoin inventor Satoshi Nakamoto. A thread started in 2011 called "Let's add up the KNOWN lost bitcoins" is filled with posts by people with the amount of bitcoin they lost and how it happened. The Brookses filtered and set parameters on the information, such as excluding losses of less than half of a bitcoin, to make an estimate on the sample population of the bitcoin reported lost.

The Brookses narrowed it all down to 72 posts that described the loss of at least half of a bitcoin. They determined that 14% are potentially recoverable cases and that from their own work in recovering wallets for clients, they can decrypt about 35% of passwords. That led to their conclusion that about 2.45% of lost bitcoin is retrievable. With a range between 68,110 and 92,855 bitcoins, that would make up to $4.7 billion in bitcoin recoverable based on the asset's price of about $50,372 on Friday.

Good guesses

"We get as good a list of passwords as we can from a client and then we put our heads together and spend some time extrapolating the way that they make their passwords and try to get in their mind when they are actually creating a password," said Charlie. "That's the most helpful thing, just seeing their practice," he said. "That's the cornerstone of our business, essentially."

The duo will run "hundreds of millions or billions of variations" of password patterns and test those against the encrypted version of the wallet, said Chris.

"If you don't have a very good [password] guess, there are more possible passwords than there are atoms in the universe, and I'm not being facetious when I say that," Chris said.

The Brookses said decrypting times vary but occasionally can take as little as five seconds. That happened with a client whose list of nine potential passwords contained the correct one. Charlie said they worked for roughly a month and a half with the client who turned out to have about $250,000 in his wallet.

Security measures they take include having clients sign a contract stating they are the owner of the blockchain wallet being worked on. The two get paid on a sliding scale. Starting with wallets containing between zero and 10 bitcoins, or an equivalent value, the team will earn a 20% commission. There's no charge to clients if they can't recover any funds.

Chris said a number of their clients live in countries where people are largely unbanked.

"They may have a wallet with a couple of hundreds of dollars in it and that is their life savings. If they lose the password to it, they have no access to it anymore," said Chris. "In some sense, it can be a heartbreaking piece of the business … we do crack some of [the wallets]. It's a balancing act to be helpful without going too far down a rabbit hole."