Ethereum presale wallet recovery
Ethereum presale wallet recovery may be possible if you still have the 2014 presale JSON backup and enough password context to narrow the search. A remembered password that fails can warrant checks of input encoding and file integrity, but it does not prove an encoding bug. There is no password-reset service.
What you need: Preserve the original JSON and any other copies. Tell us whether it contains encseed and ethaddr, and describe the original computer, keyboard language and approximate password length without sending the password or file.
Limits: An address alone cannot recreate the encrypted seed. Missing or irreparably damaged backups and strong passwords without useful hints can prevent recovery.
Fee: Free assessment; 20% of recovered value only on success, with no upfront payment. Request an assessment.
First contact: Describe the problem and which backups or devices you still have. Do not send wallet files, passwords, seed words or passphrases in your first message; our team will explain the agreed handling process if the case is suitable.
Published case: In the 1,000 ETH presale case, KeychainX reports that an encoding variant of the remembered password restored access. This is one reported outcome, not an expected result for every presale wallet.
The Ethereum presale took place in 2014, before the network launched. Buyers received an encrypted backup rather than an account with a reset button. Years later, recovery still depends on a usable backup and a practical password search. Our recovery team at KeychainX assesses the original file format, password context and available copies before work begins.
What a 2014 presale wallet is
A presale wallet is a JSON file, commonly named ethereum_wallet_backup.json. Open it in a text editor and you’ll see a handful of fields — an encseed (your encrypted seed), an ethaddr (your Ethereum address), and usually the email and BTC address you used at purchase. The encseed is the part that matters: your chosen password is stretched with PBKDF2-HMAC-SHA256 over 2,000 iterations and used to decrypt it with AES-128-CBC.
There is no server, no reset, and no support desk — by design. That is exactly why the file plus your password is the whole game, and why holding the original JSON is non-negotiable for recovery.
What you need to recover it
- The presale JSON file with the encseed field. Without it, no one can recover the wallet.
- Anything you remember about the password — length, language, words or numbers you used, whether it had special or accented characters.
- The context from 2014 — the computer, operating system and keyboard you set it up on, and whether you pasted the password from a manager like LastPass. This matters more than people expect, for reasons in the encoding section below.
How presale password recovery works
Your password is never stored; it only derives the key that decrypts the encseed. Recovery is therefore a search for that password, and the seed is never attacked directly. We extract the hash from the JSON and run a hint-driven search on GPUs using hashcat’s dedicated presale mode (16300), building candidate lists from what you remember rather than brute-forcing an astronomically large space. The moment a candidate decrypts the encseed and derives your known ethaddr, the password is confirmed — unambiguously.
The 2,000-iteration PBKDF2 is light by modern standards, so throughput is high; the real constraint is the size of the search space, which is precisely why good hints turn a hopeless case into a solvable one.
Why a remembered presale password may fail
Presale wallets are notorious for a maddening situation: you type the password you are certain is right, and the wallet stays shut. One possibility is a difference in the input bytes. An incorrect candidate or damaged file must also be considered. Because the key is derived from the exact bytes of your password, an invisible difference in how a character is encoded produces a completely different key. The common culprits:
- UTF-8 vs Latin-1. A password with an umlaut (ä, ö, ü), an accent or the £/€ sign was often stored in one byte encoding at creation and is produced in another when you type it today. The letters look identical; the bytes differ.
- Unicode normalisation (NFC vs NFKD). An accented character can be a single code point or a letter plus a combining mark — visually the same, cryptographically different.
- Keyboard layout. A password created on a German, French or other layout and re-typed on a US layout can silently swap characters like y/z or special symbols.
- Password managers and browser autofill. Pasting from LastPass or a browser in 2014 could introduce a trailing character or a different encoding than typing it by hand does now.
We test input variants that fit the evidence, alongside ordinary password candidates and file-integrity checks. The presale password-input reference links the original implementation and documented reports. Those sources do not establish which failure cause is most common.
What we can’t do — honestly
Without a usable encrypted backup or another surviving copy of the private-key material, there is nothing for a password search to decrypt. A missing JSON may first require a search of old email, drives or backups; irreparably overwritten data cannot be reconstructed by guessing a password. A long random password without useful hints can be infeasible. Password recovery also cannot reverse transfers already made from the wallet.
Presale recovery evidence and research
The reported 1,000 ETH recovery is a specific password-input case, not a general success forecast. Our presale dormancy study records a dated on-chain observation: its 19 July 2026 scan reported 621 addresses with nonce zero holding 1,421,008 ETH. Dormancy does not establish lost access or recoverability, and these are historical study figures, not a fresh scan.
The separate PRNG and IV research is an investigation into implementation behavior. It is not evidence of a universal shortcut around a missing file or strong password. For the encryption format, see the original Ethereum presale implementation.
Frequently asked questions
Can you recover a 2014 Ethereum presale wallet?
It may be possible when a usable presale JSON with an encseed survives and the password search can be narrowed sufficiently. We test candidates against the file and verify the resulting address. Possessing the file or recalling part of a password does not guarantee recovery.
My presale password is definitely correct but it will not decrypt. Why?
Possible causes include an incorrect password candidate, damaged or re-encrypted backup, keyboard/input differences or an encoding mismatch. The original computer and input language can guide testing, but a failed password does not prove an encoding bug or show that a particular cause is most common.
What file do you need for presale recovery?
A presale JSON backup, often named ethereum_wallet_backup.json, with encseed and ethaddr fields. Preserve every copy. Initially describe what survives without attaching it or sending password guesses; secure transfer is arranged if the case proceeds.
I only remember part of my presale password. Is that enough?
Often, yes. The length, any fragments, the language and the keyboard you used in 2014 let us build a targeted search instead of brute-forcing an enormous space.
How much does presale recovery cost?
Free assessment; the standard fee is 20% of recovered value, payable only on success. No upfront payment. The scope and handling arrangements are agreed in writing before recovery work.
Locked out of your presale wallet?
Start with a non-sensitive description of your problem and the backups or devices you still have. Do not attach recovery material in your first message. Contact KeychainX for an assessment.
Official KeychainX contact: mail@keychainx.io. Describe the problem first; keep recovery secrets out of the initial message.