Trezor seed phrase restored with 22 of 24 words

The backup card had been kept safe for years — and paper, left long enough, does not stay readable forever. When the client finally needed the Trezor, two of the 24 words had faded completely. Twenty-two words and positional clues remained. No device. No other backup.

What looked like a wall was a bounded problem. The reason is worth understanding, because it decides whether a case like this is worth attempting at all.

Why two missing words is not a brute-force problem

A BIP-39 phrase is not a password. It is a structured encoding of entropy, and the structure is what saves you.

A 24-word phrase encodes 256 bits of entropy plus an 8-bit checksum: 264 bits in total, split into 24 groups of 11 bits, each group selecting one word from a fixed list of exactly 2,048. The checksum is the first 8 bits of the SHA-256 hash of the entropy.

That last detail is the whole case. It means 255 out of every 256 candidate phrases are invalid and can be rejected instantly — before deriving a single key, before touching the blockchain.

With both blank positions known:

• 2,048 × 2,048 = 4,194,304 possible word pairs
• After the checksum filter: 16,384 valid phrases remain

Sixteen thousand candidates is not a search. It is a list. Even with the positions uncertain, the arithmetic stays friendly: 276 possible position pairs across 24 slots gives 1,157,627,904 raw combinations, which the checksum reduces to roughly 4.5 million valid phrases — still entirely tractable.

For contrast: reconstructing a 24-word phrase with nothing to start from means searching 2^256 possibilities. That is not a number anyone brute-forces. The difference between "hopeless" and "an afternoon" is entirely in how much of the phrase survives.

What we did

We generated the candidates for the two unknown positions, filtered them through the checksum, and derived addresses from the survivors — all offline, on a copy, with the client's device untouched.

How we knew it was the right phrase

A candidate phrase that passes the checksum is valid. That does not make it yours: each of those 16,384 phrases derives a complete wallet of its own, and the checksum cannot tell you which of them you once wrote down.

In this case, we confirmed the phrase by deriving addresses from a candidate and matching one against the owner’s known address. That is what closed this case. The rebuilt phrase produced the client's known receiving address, which is proof — not inference. Recovery was complete in approximately four hours.

What changes the feasibility of a similar case

A similar case can require a very different search. These factors affect whether the remaining information is enough:

• More missing words. Each additional blank multiplies the space by 2,048. Three or four missing words is still bounded; beyond that the derivation time, not the combinatorics, becomes the wall.
• No known address. A known receiving address or transaction record makes verification easier. Without one, an address database for a supported blockchain or other usable verification material may still identify candidates; the available evidence has to be assessed.
• A forgotten BIP-39 passphrase. This optional addition creates a different wallet from the same phrase. Useful clues about its spelling or structure can make a targeted search assessable; a long, random passphrase with no clues may be infeasible.
• Uncertainty about the words themselves. "It might have been garden or garlic" is workable. "I do not recall any of the middle section" may leave too many possibilities; feasibility depends on the number of missing words, their positions and any other clues.

What this means if you are in the same position

Do not throw the card away, and do not retype it into a website to "check" it. Count what you actually have. If you can read most of the words and know roughly where the gaps are, you are likely holding a bounded problem rather than a lost wallet — and the single most valuable extra thing you can bring is any address the wallet used.

See the seed fundamentals and seed standards references for the underlying mechanics.