A forgotten password on an old Blockchain.info wallet doesn't have to mean the funds are gone. For clients who created a wallet years ago and lost or partially forgot the password, GPU-accelerated brute-force recovery is a legitimate and often successful option, provided the search is built around a realistic model of what the person likely typed, rather than a blind attempt at every possible combination.
What Recovery Actually Looks Like
A recent case took roughly a week of continuous computation on a single consumer GPU to resolve. Across the full recovery, the process worked through well over a billion password candidates, tested in expanding batches, because a purely random search of that scale would take effectively forever. The batches that matter are built from what the client remembers, partial phrases, likely words, common substitutions and typos, not from cycling through arbitrary characters.
Why GPU Acceleration Matters
Blockchain.info and Blockchain.com wallets use PBKDF2 key derivation with a meaningful number of iterations, which is intentionally slow to compute, that's the point of the design, since it makes brute-forcing expensive. Running the search on a graphics card rather than a CPU is more than ten times faster, because the same repetitive derivation step parallelizes well across a GPU's architecture. The hardware for this costs a few thousand dollars and isn't especially exotic, but it changes a multi-year search into a multi-day one.
Where the Real Work Happens
The hardware and software tools involved, largely built on the open-source btcrecover project, are not the hard part. The actual skill is in constructing the token list, the set of words, phrases, and likely variations the search will try, narrowly enough that the process finishes in hours or days rather than centuries, while still being broad enough to cover what the client might realistically have typed.
- Interview the client for every partial memory of the password, words, numbers, a phrase, a pattern they tend to reuse.
- Build a token list from those fragments, including likely capitalization and substitution variants.
- Layer in common typo patterns, deletions, swapped characters, repeated keys, inserted characters, since real passwords are rarely typed perfectly the first time either.
- Run the search with GPU acceleration, tracking estimated completion time as the candidate set expands.
- Recompute the search using an ever-larger candidate set if the initial, narrower pass doesn't produce a match.
The success rate on this kind of recovery depends almost entirely on how much the client actually remembers about the password, not on raw computing power. A well-built token list from a handful of real memories will outperform a brute-force search across the full character space by orders of magnitude.
What This Doesn't Cover
This approach works specifically for a forgotten or partially remembered password on a wallet file the client still has legitimate access to, not for a wallet where access was lost entirely, or where a seed phrase rather than a password is the missing piece. A wallet secured with a fully random, unremembered password is not a realistic brute-force target within any practical timeframe, regardless of hardware.
Why This Matters Beyond the Technical Detail
Old Blockchain.info wallets from the 2013 to 2017 era are a common source of stuck value, accounts people set up early, forgot about, and can no longer access with confidence in the exact password used. Understanding that recovery is realistically possible, and roughly how long it takes, changes the calculus for a lot of people sitting on funds they'd otherwise have written off entirely.