Blockchain.com Wallet Recovery Service

Blockchain.com (formerly Blockchain.info) is two different products under one name: a custodial Trading Account where the company holds the keys, and a non-custodial DeFi Wallet where only you hold them. Recovery rules for one do not apply to the other.

What you are actually dealing with

• Custodial Trading Account: reset the password through the normal login flow with email and identity verification. This page is not about that flow.
• DeFi Wallet (non-custodial): the wallet is encrypted with your own password on your side, so Blockchain.com never holds a version it could reset. What gets you back in is your 12-word Recovery Phrase or an encrypted wallet backup (wallet.aes.json) with its password.
• Older Blockchain.info wallet (pre-2016): a different, legacy recovery mechanism applies.
• A wallet generated in the browser between 2011 and 2015: this is the Randstorm window. Unciphered's 2023 disclosure attributed the weakness to the SecureRandom() function in the JSBN library that early BitcoinJS relied on, and named Blockchain.info among the affected services. It does not cover every wallet of that era, and the later the wallet the harder the work - the disclosure notes that impacted 2014 wallets are substantially more difficult than impacted 2012 ones. Where it does apply, the private key can sometimes be reconstructed without the password or the phrase: see Randstorm.

When professional recovery is genuinely useful

• A forgotten password with no phrase, but with the wallet.aes.json backup: a structured search against the encrypted file.
• A legacy phrase with missing or uncertain words: reconstruction, not brute force.
• Imported Bitcoin addresses that are not restored by the phrase: they were stored separately and need the original encrypted wallet data.

What is impossible

• No phrase, no backup file, and no access to the original wallet data. The email address is a contact channel, not a key: it never held the phrase or the password.
• Funds already sent to a scammer or an attacker.

Practical notes

• Never enter your phrase into any page that did not come from the official Blockchain.com domain; phrase-capture phishing is the most common way DeFi Wallet funds are lost.
• The Wallet ID reminder: enter your registered email address on the login page and Blockchain.com emails you every Wallet ID linked to that email, with the date each was last accessed. There is no lookup from a bitcoin address to a Wallet ID.
• Don't keep retrying passwords in the Blockchain.com login form — lockouts only slow things down. The real search runs offline against your backup file or phrase material.