Disclaimer: This guide is for legitimate recovery of a wallet you own. Attempting to recover someone else's mnemonic is illegal and unethical.
What an offline dictionary attack means in this context
A Coldcard hardware wallet uses a BIP39 mnemonic to represent the wallet seed. If you remember part of the phrase, the position of some words, or a likely pattern, an offline dictionary attack can test candidate combinations without exposing the seed to the internet. The goal is recovery, not bypassing ownership. The device and recovery machine should remain air-gapped.
When this approach is reasonable
- You own the wallet and can prove it.
- You have partial mnemonic information, such as several known words or known positions.
- You remember the BIP39 passphrase, if one was used.
- You have a secure, offline environment.
If you have no information beyond a forgotten PIN, Coldcard's security model is designed to resist brute force. Do not expect an easy bypass.
Prerequisites
- A trusted, open-source recovery tool that supports BIP39. Research its code and community reputation.
- An air-gapped computer that will never connect to the internet during recovery.
- A copy of the official BIP39 English word list, if your mnemonic is in English.
- A written record of every known word, position, checksum clue, and passphrase detail.
- A spare hardware wallet or a temporary software wallet for verification.
High-level recovery workflow
1. Document what you know
Write down known words and their positions. For example, if you know words 1, 4, 9, and 12, mark them. Do not guess in a way that risks overwriting the only copy of your backup.
2. Build a focused candidate list
Use only words that fit your memory and the BIP39 list. A focused list is faster and safer than a massive generic wordlist. Include common transcription errors if you suspect them.
3. Run the search offline
On the air-gapped machine, use the recovery tool to test candidates against BIP39 checksum rules. The checksum filters out most invalid guesses. Keep notes on parameters, derivation paths, and passphrase options.
4. Verify the result carefully
Once a candidate mnemonic passes the checksum, restore it on a spare device or a watch-only wallet. Check that the derived addresses match your known wallet history. Do not move funds until you are certain.
5. Secure the recovered wallet
If the mnemonic was ever exposed to an online device, consider it compromised. Create a new seed on a trusted hardware wallet, write it down offline, and move funds to the new wallet. Never store the mnemonic in a photo, cloud note, or password manager.
Common mistakes
- Running recovery software on an internet-connected computer.
- Using closed-source tools from unknown sources.
- Forgetting the BIP39 passphrase, which creates a different wallet.
- Testing with real funds before confirming the correct derivation path.
- Sharing partial seed words with strangers or online recovery services.
Final thoughts
An offline dictionary attack can be a valid last resort for recovering your own Coldcard mnemonic when you have partial information. The process should be slow, private, and verifiable. If you are unsure at any step, consult a reputable security professional who understands hardware wallets and BIP39. Protect your seed phrase like cash: if it is lost or leaked, your funds are at risk.