Almost every Trezor owner who contacts us opens the same way: “My seed doesn’t work.” In the large majority of cases the words are fine. What has failed is the transcription, the order, the word count, or a passphrase nobody remembers enabling. Those are different problems with different odds — and most of them are solvable.
What does “Invalid recovery seed” actually mean?
It means your words failed a checksum test, not that your coins are gone. A Trezor backup is a BIP39 mnemonic: each word maps to an 11-bit number from a fixed 2,048-word list. A 24-word phrase encodes 264 bits — 256 bits of entropy plus an 8-bit checksum derived from that entropy. A 12-word phrase encodes 132 bits: 128 bits of entropy plus a 4-bit checksum.
When you type the words in, the device recomputes the checksum. If it doesn’t match, you get the error. So the error tells you the words you entered are internally inconsistent — one is wrong, one is missing, or two are swapped. It says nothing about whether the underlying wallet still holds funds.
Why is one wrong word recoverable?
This is the part most guides skip, and it is the whole reason professional recovery works.
Suppose you have 24 words and one is wrong, and you know which position. Naively there are 2,048 possibilities. But only the candidates that produce a valid 8-bit checksum can be real seeds — and that is 1 in 256 of them. So the search collapses to roughly 8 checksum-valid candidates. Eight. Each one derives a different wallet, and we simply check which of the eight has your transaction history on-chain.
The maths scales predictably:
- One unknown word (24-word seed): ~8 valid candidates. Minutes.
- Two unknown words: ~16,000 valid candidates. Still trivial.
- Three unknown words: tens of millions. Routine on GPU.
- Four or more: billions — feasible, but the number of unknowns starts to matter, and any hint (first letter, rough position, your handwriting habits) cuts it dramatically.
A 12-word seed has only a 4-bit checksum, so it filters less aggressively — one unknown word leaves ~128 candidates rather than 8. Still nothing.
The genuinely hard case is lost order with all words known: 24 words can be arranged 24! ways — about 6×10²³. That is not brute-forceable. But almost nobody loses order completely; people misread a column, transpose a pair, or skip a line. Partial order information makes it tractable again.
Why does my Trezor say “wrong seed” when I’m sure the words are right?
Five causes, in the order we actually see them:
- Word order. On a Trezor Model One the device screen dictates the order, which is not necessarily the order you wrote them. Backup cards are also filled in by column, not row — a very common misread.
- Wrong word count selected. Choosing 12 or 18 during recovery for a 24-word seed fails every time, and the error looks identical to a bad word.
- A near-miss word. The BIP39 list is full of neighbours: gift/giraffe, brush/crush, aware/awake, boy/box. Faded ink turns cloud into loud. A “u” written quickly reads as “v”.
- Not BIP39 at all. If your backup is 20 or 33 words, it is SLIP39 (Shamir) — a different standard used on Model T, Safe 3 and Safe 5. Entering Shamir shares as a BIP39 seed will always fail.
- Keyboard language. A non-English keyboard layout can silently produce different letters than the keycaps show.
What does “Seed phrase does not match any known wallet” mean?
This is the same class of failure as “Invalid recovery seed”, worded differently, and it means the words you entered don’t form a valid, known BIP39 combination. It is not a statement that your wallet has disappeared — the device is telling you the phrase in front of it is internally inconsistent. The usual causes are the ones above: a mistyped or near-miss word, a wrong word count, words entered in the wrong order, or a Shamir (SLIP39) backup being entered as if it were a standard BIP39 seed.
The important thing this message does not mean: it doesn’t mean the underlying wallet is empty or gone. Once the phrase is corrected to a checksum-valid one — which, for a single unknown word, is one of only about eight candidates — the “matching” wallet reappears, and its on-chain balance is intact. If every word is genuinely correct and in order and you still see this, the phrase is almost certainly SLIP39 rather than BIP39, and needs to be entered through Shamir recovery instead.
My seed works but the wallet is empty — where did my coins go?
This is a different failure entirely, and it panics people more than an error message does. If the seed is accepted but the balance is zero, the seed is correct — you are simply looking at the wrong wallet. Two causes:
A passphrase. The BIP39 passphrase (the “25th word”) is not a password on your seed — it is an input to the key derivation. Every distinct passphrase generates a completely separate wallet from the same 24 words, and the device never tells you a passphrase is “wrong”, because none of them are wrong. Your 24 words alone open the empty default wallet. Your funds are in the passphrase wallet. That is not a broken seed; it is a missing 25th word.
A derivation path. The same seed produces different addresses depending on the path used. Legacy (m/44′), SegWit (m/49′), native SegWit (m/84′) and Taproot (m/86′) all derive different addresses from identical words. A wallet scanning only one path shows nothing while the coins sit on another. We sweep the full path family as standard.
What can we actually do that you can’t?
If you have a clean, complete seed and just need to restore it, you don’t need us — restore it on any BIP39-compatible device. Where professional recovery earns its fee:
- Checksum-constrained reconstruction of one to several unknown or illegible words, tested against on-chain history rather than guessed by hand.
- Order reconstruction from partial information — you know roughly where words go, or which pair you may have swapped.
- Passphrase recovery, including the encoding traps: macOS silently substitutes typographic quotes and dashes, and a passphrase typed with a curly apostrophe derives a different wallet than the same passphrase with a straight one. Unicode normalisation differences between clients do the same thing. We generate those byte-level variants systematically.
- Derivation-path forensics across path families and account indexes, and across firmware-era client behaviour.
- SLIP39 / Shamir share reconstruction where you hold some but not all shares.
All of it runs offline. Nothing is uploaded anywhere.
What you should not do
Never type your seed into a website, a “seed checker” tool, a Telegram bot, or an AI chatbot. A complete seed is your money — anyone who receives it can take everything, instantly and irreversibly. Trezor will never ask for it. Neither will we, until a signed agreement is in place, and even then the workflow is designed so you keep control. Anyone demanding payment before recovering anything is running a scam.
Also: don’t wipe the device while it still holds a working session, and stop entering PIN attempts blindly — you may be locking yourself out of the one path that still works.
A note on terminology
Trezor now officially calls the recovery seed a wallet backup. Older devices, older guides and most people still say “recovery seed” or “seed phrase”. They are the same thing. Shamir backups are the exception — those are SLIP39, not BIP39, and behave differently.
Frequently asked questions
Can you recover my Trezor if I’ve lost the seed phrase completely?
No. If there is no backup, no partial words, and no memory of any of it, the wallet is unrecoverable — by us, by Trezor, by anyone. We would rather say that immediately than take your money.
I have most of my words but one or two are unreadable. Is that recoverable?
Usually yes, and it’s the strongest case there is. The BIP39 checksum reduces one unknown word in a 24-word seed to roughly 8 valid candidates, which we test against the blockchain in minutes.
My Trezor says “Invalid recovery seed” but I’m certain the words are correct. What now?
Check the word count you selected and the order the device asked for first — those two account for most cases. If the words are right and ordered correctly, the phrase may be SLIP39 rather than BIP39, or a word is a near-miss you can’t see.
My seed restored but the wallet is empty. Is the seed wrong?
Almost certainly not. An empty restore usually means a passphrase (25th word) was set, or the wallet is scanning a different derivation path than the one holding your coins.
Do you need my full seed phrase to start?
No. To assess a case we need to know what you have, roughly how much is missing, and the device model — not the words themselves.
How much does Trezor seed recovery cost?
Success-based: a percentage of the recovered value, agreed before we start, and only if we open the wallet. No upfront payment.
KeychainX has recovered wallets professionally since 2017 from Baar, Zug, Switzerland. Trezor is the hardware wallet we see most and know best. Contact us — we reply within 24 hours. We never contact people first on social media and never ask for upfront payment.