<p>Missing 3 words in known positions and there will be <a href="https://www.calculatorsoup.com/calculators/discretemathematics/permutations.php" rel="nofollow noreferrer">8.577.355.766 permutations</a>.<br>
<s>Based on the speed of an average PC, approximately 10 permutations/second. This would take close to 9927 years(if unlucky and have to try every permutations)</s> Sorry, I forgot we are not dealing with wallet password encryption here.</p>

<p>Anyway, a computer will have to get the private key, calculate a public key and then check it for balance, this process will take time.<br>
Missing 4 words(17.540.692.561.920 permutations) or more, and I don't think anyone will want to try their luck. So maybe 5 words or more and even the government will let it slide.</p>

CC BY-SA 3.0
2017-12-16T23:31:19.993Z
2017-12-16T23:31:19.993Z
Chak
<p>A wallet was brute forced with 8/12 words and their order known in 2020</p>
<p><a href="https://medium.com/@johncantrell97/how-i-checked-over-1-trillion-mnemonics-in-30-hours-to-win-a-bitcoin-635fe051a752" rel="nofollow noreferrer">https://medium.com/@johncantrell97/how-i-checked-over-1-trillion-mnemonics-in-30-hours-to-win-a-bitcoin-635fe051a752</a></p>

CC BY-SA 4.0
2021-01-10T22:51:39.137Z
2021-01-10T22:51:39.137Z
Czs
<p>Given a 12 or 24 word seed with one one or more missing words what would be the difficulty of brute-forcing the missing words? E.g. for: </p>

<ul>
<li>one missing word</li>
<li>two missing words</li>
<li>three missing words</li>
</ul>

<p>By difficulty I mean the number of permutations against a dictionary wordlist. </p>

<p>And the related question: how many words would have to be missing in order to make the attack reliably unfeasible?</p>

CC BY-SA 3.0
2017-12-16T19:43:58.810Z
The answer is "very difficult" but, pending details of that answer: did you mean words missing at the end, or at unknown positions? It makes a difference because word order is significant.
brec
CC BY-SA 3.0
2017-12-16T19:49:52.627Z
I'm also unsure of what you mean by "number of combinations that would have to be checked against a dictionary." Assuming that you mean the standard words-generating protocol, called [BIP39](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki), the dictionary consists of 2048 words. Checking whether a specific word is "in the dictionary" is trivially easy. The only way to check whether a given string of words is valid for a given wallet is to enter it and see whether you get the expected coins balances.
brec
CC BY-SA 3.0
2017-12-16T19:55:29.357Z
Do I understand correctly that the seed dictionary is made of 2048 predefined words? So, in that case for one missing word in a known position (e.g. the first position) an attacker would only need to check 2048 iterations? right?
ccpizza
CC BY-SA 3.0
2017-12-16T20:04:44.047Z
Commenting requires a minimum of nine words, so: right.
brec
CC BY-SA 3.0
2017-12-16T20:07:30.027Z
got it; so hiding a single word in a known position is basically like no hiding at all; how about the related question: where the attack becomes unfeasible? (apart from the obvious answer of zero words being exposed)
ccpizza
CC BY-SA 3.0
2017-12-16T22:56:16.407Z
@Chak: That's assuming a CPU, if it is e.g. an AntMiner S9 then that can probably be reduced from thousands of years to months or weeks, no? Could you please add this as an answer so that I can accept it?
ccpizza
CC BY-SA 3.0
2017-12-16T23:10:04.727Z
@ccpizza, AntMiner S9 is great at computing SHA-256 on some input. However SHA-256 is a cryptographic hash function, not an encryption function. So no.
Chak
<wallet-recovery><seed>
Difficulty of brute-forcing a seed with missing words?
ccpizza
# Difficulty of brute-forcing a seed with missing words?

(Asked by: username_0 on 2017-12-16)

Given a 12 or 24 word seed with one one or more missing words what would be the difficulty of brute-forcing the missing words? E.g. for:

* one missing word
* two missing words
* three missing words

By difficulty I mean the number of permutations against a dictionary wordlist.

And the related question: how many words would have to be missing in order to make the attack reliably unfeasible?

**Tags:** wallet-recovery, seed

> **Comments:**
> **username_1**: The answer is "very difficult" but, pending details of that answer: did you mean words missing at the end, or at unknown positions? It makes a difference because word order is significant.  
> **username_1**: I'm also unsure of what you mean by "number of combinations that would have to be checked against a dictionary." Assuming that you mean the standard words-generating protocol, called [BIP39](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki), the dictionary consists of 2048 words. Checking whether a specific word is "in the dictionary" is trivially easy. The only way to check whether a given string of words is valid for a given wallet is to enter it and see whether you get the expected coins balances.  
> **username_0**: Do I understand correctly that the seed dictionary is made of 2048 predefined words? So, in that case for one missing word in a known position (e.g. the first position) an attacker would only need to check 2048 iterations? right?  
> **username_1**: Commenting requires a minimum of nine words, so: right.  
> **username_0**: got it; so hiding a single word in a known position is basically like no hiding at all; how about the related question: where the attack becomes unfeasible? (apart from the obvious answer of zero words being exposed)  
> **username_0**: @username_2: That's assuming a CPU, if it is e.g. an AntMiner S9 then that can probably be reduced from thousands of years to months or weeks, no? Could you please add this as an answer so that I can accept it?  
> **username_2**: @username_0, AntMiner S9 is great at computing SHA-256 on some input. However SHA-256 is a cryptographic hash function, not an encryption function. So no.  

---

## 2 answers

### Answer by username_2 on 2017-12-16. Score: 2 | Accepted answer

Missing 3 words in known positions and there will be [8.577.355.766 permutations](https://www.calculatorsoup.com/calculators/discretemathematics/permutations.php).  
~~Based on the speed of an average PC, approximately 10 permutations/second. This would take close to 9927 years(if unlucky and have to try every permutations)~~ Sorry, I forgot we are not dealing with wallet password encryption here.

Anyway, a computer will have to get the private key, calculate a public key and then check it for balance, this process will take time.  
Missing 4 words(17.540.692.561.920 permutations) or more, and I don't think anyone will want to try their luck. So maybe 5 words or more and even the government will let it slide.


---

### Answer by username_3 on 2021-01-10. Score: 2

A wallet was brute forced with 8/12 words and their order known in 2020

<https://medium.com/@johncantrell97/how-i-checked-over-1-trillion-mnemonics-in-30-hours-to-win-a-bitcoin-635fe051a752>


---

