Recovering a BTC Wallet from Illegible Handwriting?

BIP38 is a standard for encrypting Bitcoin private keys with a passphrase. Instead of storing a raw private key (which anyone who sees it can use), you store an encrypted version that requires a password to unlock.

The encrypted key is a 58-character Base58 string starting with "6P". Without the password, the underlying private key is cryptographically inaccessible.

But, this is the interesting part, not everything in a BIP38 key is encrypted.

A decoded BIP38 key has this structure:

Bytes 0-1:   Prefix (identifies the key type)
Byte 2:      Flag byte (compression settings)
Bytes 3-6:   Address Hash (4 bytes, NOT encrypted)
Bytes 7-42:  Encrypted data

That Address Hash is crucial. It's the first 4 bytes of SHA256(SHA256(bitcoin_address)), stored in plaintext within the encrypted key.

Its original purpose is verification during decryption. Ff you enter the wrong password, the derived address won't match this hash. But for my purposes, it allowed me to verify that a recovered key matched a known Bitcoin address without ever knowing the password.

Bitcoin uses Base58Check encoding, which appends a 4-byte checksum to encoded data. Any transcription error—a single wrong character—produces an invalid checksum. The probability of a random error still passing? About 1 in 4.3 billion.

The Base58 alphabet is worth noting:

123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz

Missing: 0 (zero), O (capital O), l (lowercase L), I (capital I). These were deliberately excluded to reduce visual ambiguity. A thoughtful design choice that nonetheless failed to account for my friend's handwriting.

I had a candidate key with a valid checksum. But did it belong to the expected Bitcoin address?

This is where the unencrypted Address Hash becomes useful:

def key_matches_address(bip38_key, bitcoin_address):
    # Extract hash from key (bytes 3-6)
    key_hash = base58_decode(bip38_key)[3:7]
    
    # Calculate expected hash from address
    addr_bytes = bitcoin_address.encode('utf-8')
    addr_hash = sha256(sha256(addr_bytes))[:4]
    
    return key_hash == addr_hash

The hashes matched. Mathematical confirmation that my recovered key corresponded to the known address, without any password or blockchain access required.

The handwritten notes contained a second BIP38 key. I applied the same process—this time, two characters were completely illegible, requiring a search through 58 × 58 = 3,364 combinations.

One candidate emerged with a valid checksum. But the Address Hash check revealed something unexpected: this key belonged to a different Bitcoin address entirely.

The writer had apparently documented two separate wallets. The second address remains unknown until decryption.

For anyone facing a similar problem, here's the core code.

import hashlib

BASE58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"

def base58_decode(s):
    num = 0
    for c in s:
        num = num * 58 + BASE58.index(c)
    result = []
    while num > 0:
        result.append(num % 256)
        num //= 256
    result.reverse()
    return bytes([0] * (len(s) - len(s.lstrip('1'))) + result)

def double_sha256(data):
    return hashlib.sha256(hashlib.sha256(data).digest()).digest()

def verify_checksum(key):
    decoded = base58_decode(key)
    payload, checksum = decoded[:-4], decoded[-4:]
    return checksum == double_sha256(payload)[:4]

def get_address_hash(bip38_key):
    """Extract address hash from BIP38 key (bytes 3-6)."""
    return base58_decode(bip38_key)[3:7]

def calculate_address_hash(bitcoin_address):
    """Compute expected hash from a Bitcoin address string."""
    return double_sha256(bitcoin_address.encode('utf-8'))[:4]

def key_matches_address(bip38_key, bitcoin_address):
    """Check if key belongs to address, without needing the password."""
    return get_address_hash(bip38_key) == calculate_address_hash(bitcoin_address)

def search_with_insertion_and_replacement(key_57):
    """Search for valid 58-char key by inserting one char and replacing one."""
    for fix_pos in range(len(key_57)):
        original = key_57[fix_pos]
        for fix_char in BASE58:
            if fix_char == original:
                continue
            modified = key_57[:fix_pos] + fix_char + key_57[fix_pos+1:]
            
            for ins_pos in range(len(modified) + 1):
                for ins_char in BASE58:
                    candidate = modified[:ins_pos] + ins_char + modified[ins_pos:]
                    if verify_checksum(candidate):
                        return candidate, fix_pos, fix_char, ins_pos, ins_char
    return None

• BIP-0038 Specification - The encrypted private key standard
• Base58Check Encoding - Bitcoin Wiki
• Learn Me a Bitcoin: Base58 - Visual explanation of the encoding
• bitaddress.org - Open source tool for offline key operations

The keys were recovered. The funds were moved to more robust storage.

A few observations from the experience:

The Base58Check checksum made this recovery possible. Without it, I would have needed to test each candidate against the blockchain, dramatically slowing the process and requiring network access.

The unencrypted Address Hash in BIP38 is an underappreciated feature. It enables verification without secrets. Useful not just for password checking, but for confirming key-address relationships during recovery.

And finally: if you're storing cryptographic keys on paper, consider using a typewriter. Or at least print them. The human hand, whatever its other merits, was not optimised for producing unambiguous alphanumeric strings. Also it's in your own interest into not oversharing your wallet keys. So it was fun!